Merge branch 'main' into PRM-691

Author: oliverbeumkes-nhs

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @NHSDigital/patient-record-management

.github/workflows/automated-sbom-repo-scan.yml

@@ -15,7 +15,7 @@ jobs:
     name: SBOM Repo Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
 
@@ -35,7 +35,7 @@ jobs:
           output-format: sarif
 
       - name: Upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: ${{ steps.sbom-scan.outputs.sarif }}

.github/workflows/base-java-service-jobs.yml

@@ -44,10 +44,10 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ inputs.java_version }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "${{ inputs.java_version }}"
@@ -73,17 +73,17 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ inputs.java_version }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "${{ inputs.java_version }}"
           cache: gradle
 
       - name: Configure AWS Credentials (Read/Write)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -137,11 +137,11 @@ jobs:
   deploy_infra:
     name: Deploy Infrastructure
     needs: [build_and_publish]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
-
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/base-node-service-jobs.yml

@@ -44,19 +44,19 @@ jobs:
         id: extract_branch
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install dependencies
         working-directory: ./services/${{ inputs.service }}
         run: npm install
 
       - name: Start LocalStack
-        uses: LocalStack/setup-localstack@v0.2.4
+        uses: LocalStack/setup-localstack@v0.2.5
         with:
           install-awslocal: "true"
 
@@ -106,16 +106,18 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
+
       - name: Install dependencies
         run: npm install
+
       - name: Configure AWS Credentials (Read/Write)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -169,10 +171,11 @@ jobs:
   deploy_infra:
     name: Deploy Infrastructure
     needs: [build_and_publish]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/base-python-service-jobs.yml

@@ -36,10 +36,10 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.9
       - name: Run Unit tests
@@ -54,16 +54,16 @@ jobs:
       run:
         working-directory: ./services/${{ inputs.service }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.9
 
       - name: Configure AWS credentials
         id: auth
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           mask-aws-account-id: true
           role-to-assume: ${{ secrets.IAM_ROLE }}
@@ -120,10 +120,11 @@ jobs:
     if: ${{ inputs.deploy_infra && inputs.is_deployment }}
     name: Deploy Infrastructure
     needs: [build-and-publish-service]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/build.yml

@@ -1,31 +1,34 @@
 name: Build
+
 on:
   push:
     branches:
       - main
+
   pull_request:
     types: [opened, synchronize, reopened]
+
 jobs:
   sonarcloud:
     name: SonarCloud
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
 
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v3
+      - name: Use Node.js 24.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Run test coverage
         run: |
           cd ./services/ehr-repo
           ./tasks test_coverage-github-action
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v4
+        uses: SonarSource/sonarqube-scan-action@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/e2e.yml

@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout End to End
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           repository: "nhsconnect/prm-repo-e2e-tests"
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "adopt"
           java-version: "21"

.github/workflows/service-ci.yml

@@ -40,15 +40,15 @@ jobs:
       changed: ${{ steps.get_changes.outputs.changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Get Changes
         id: get_changes
         run: |
-          git fetch origin ${{ github.event.pull_request.base.ref }}
-          changed=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD | tr '\n' ' ')
+          git fetch origin main
+          changed=$(git diff --name-only origin/main... | tr '\n' ' ')
           echo "changed=$changed" >> $GITHUB_OUTPUT
 
   ehr-repo:

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Welcome to the Orphaned Record Continuity contributors guide
+
+Thank you for your interest in improving the codebase.
+
+In this guide you will get an overview of the contribution workflow from creating a PR, reviewing, and merging the PR.
+
+The codebase covers:
+
+- The [Orphaned Record Continuity service](https://digital.nhs.uk/services/orphaned-record-continuity).
+
+To raise an issue, please contact one of the [CODEOWNERS](.github/CODEOWNERS) directly, or raise a PR.
+
+If you're new to GitHub and/or Markdown, GitHub's own [contributor's guide](https://github.com/github/docs/blob/main/.github/CONTRIBUTING.md) provides good signposting on these topics.
+
+## Pull requests and merging
+
+You can't push to the main branch. Therefore, for all changes you will need to create a new branch, and then a pull request to merge said branch into `main`. The [CODEOWNERS](.github/CODEOWNERS) will be nominated as reviewers of your PR by default, but feel free to add other people as well if you think they will have valuable input.
+
+## Contributing guidelines and etiquette
+
+- Preview your Markdown code to make sure the format is not broken.
+- Check grammar, spelling and punctuation - no-one wants to look pedantic by requesting changes due to typos or inconsistent grammar/syntax, but it's only fair to keep this tidy.
+- The codebase is open to the world. This has a few implications:
+  - Nothing in it should be confidential, private to NHSE or include any personal data.
+  - All links should be public.
+  - Consider comments and README.md text: comments in open source repos such as this are not official communications and don't go through the normal approval process for public communication. They can however still be interpreted as official communication, even if not intended as such.
+- Use [inclusive language](https://github.com/NHSDigital/software-engineering-quality-framework/blob/main/inclusive-language.md): avoid terms which cause hurt and offence, including if they have historically been considered industry-standard terms.