[PRM-667] Outdated and Vulnerable Dependencies for JavaScript services

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @NHSDigital/patient-record-management

.github/workflows/automated-sbom-repo-scan.yml

@@ -15,7 +15,7 @@ jobs:
     name: SBOM Repo Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
 
@@ -35,7 +35,7 @@ jobs:
           output-format: sarif
 
       - name: Upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: ${{ steps.sbom-scan.outputs.sarif }}

.github/workflows/base-java-service-jobs.yml

@@ -44,10 +44,10 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ inputs.java_version }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "${{ inputs.java_version }}"
@@ -73,17 +73,17 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up JDK ${{ inputs.java_version }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "${{ inputs.java_version }}"
           cache: gradle
 
       - name: Configure AWS Credentials (Read/Write)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -137,11 +137,11 @@ jobs:
   deploy_infra:
     name: Deploy Infrastructure
     needs: [build_and_publish]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
-
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/base-node-service-jobs.yml

@@ -44,19 +44,19 @@ jobs:
         id: extract_branch
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install dependencies
         working-directory: ./services/${{ inputs.service }}
         run: npm install
 
       - name: Start LocalStack
-        uses: LocalStack/setup-localstack@v0.2.4
+        uses: LocalStack/setup-localstack@v0.2.5
         with:
           install-awslocal: "true"
 
@@ -106,16 +106,18 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
+
       - name: Install dependencies
         run: npm install
+
       - name: Configure AWS Credentials (Read/Write)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -169,10 +171,11 @@ jobs:
   deploy_infra:
     name: Deploy Infrastructure
     needs: [build_and_publish]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/base-python-service-jobs.yml

@@ -36,10 +36,10 @@ jobs:
         working-directory: "./services/${{ inputs.service }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.9
       - name: Run Unit tests
@@ -54,16 +54,16 @@ jobs:
       run:
         working-directory: ./services/${{ inputs.service }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.9
 
       - name: Configure AWS credentials
         id: auth
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           mask-aws-account-id: true
           role-to-assume: ${{ secrets.IAM_ROLE }}
@@ -120,10 +120,11 @@ jobs:
     if: ${{ inputs.deploy_infra && inputs.is_deployment }}
     name: Deploy Infrastructure
     needs: [build-and-publish-service]
-    uses: nhsconnect/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
+    uses: NHSDigital/orphaned-record-continuity-infrastructure/.github/workflows/deploy-stack.yml@v3
     with:
       stack: ${{ inputs.service }}
       environment: ${{ inputs.environment }}
       is_deployment: ${{ inputs.is_deployment }}
       ecr_alias: ${{ inputs.ecr_alias }}
+      git_ref: refs/tags/v3
     secrets: inherit

.github/workflows/build.yml

@@ -1,31 +1,34 @@
 name: Build
+
 on:
   push:
     branches:
       - main
+
   pull_request:
     types: [opened, synchronize, reopened]
+
 jobs:
   sonarcloud:
     name: SonarCloud
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
 
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v3
+      - name: Use Node.js 24.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Run test coverage
         run: |
           cd ./services/ehr-repo
           ./tasks test_coverage-github-action
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v4
+        uses: SonarSource/sonarqube-scan-action@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/e2e.yml

@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout End to End
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           repository: "nhsconnect/prm-repo-e2e-tests"
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "adopt"
           java-version: "21"

.github/workflows/service-ci.yml

@@ -40,15 +40,15 @@ jobs:
       changed: ${{ steps.get_changes.outputs.changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Get Changes
         id: get_changes
         run: |
-          git fetch origin ${{ github.event.pull_request.base.ref }}
-          changed=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD | tr '\n' ' ')
+          git fetch origin main
+          changed=$(git diff --name-only origin/main... | tr '\n' ' ')
           echo "changed=$changed" >> $GITHUB_OUTPUT
 
   ehr-repo:

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Welcome to the Orphaned Record Continuity contributors guide
+
+Thank you for your interest in improving the codebase.
+
+In this guide you will get an overview of the contribution workflow from creating a PR, reviewing, and merging the PR.
+
+The codebase covers:
+
+- The [Orphaned Record Continuity service](https://digital.nhs.uk/services/orphaned-record-continuity).
+
+To raise an issue, please contact one of the [CODEOWNERS](.github/CODEOWNERS) directly, or raise a PR.
+
+If you're new to GitHub and/or Markdown, GitHub's own [contributor's guide](https://github.com/github/docs/blob/main/.github/CONTRIBUTING.md) provides good signposting on these topics.
+
+## Pull requests and merging
+
+You can't push to the main branch. Therefore, for all changes you will need to create a new branch, and then a pull request to merge said branch into `main`. The [CODEOWNERS](.github/CODEOWNERS) will be nominated as reviewers of your PR by default, but feel free to add other people as well if you think they will have valuable input.
+
+## Contributing guidelines and etiquette
+
+- Preview your Markdown code to make sure the format is not broken.
+- Check grammar, spelling and punctuation - no-one wants to look pedantic by requesting changes due to typos or inconsistent grammar/syntax, but it's only fair to keep this tidy.
+- The codebase is open to the world. This has a few implications:
+  - Nothing in it should be confidential, private to NHSE or include any personal data.
+  - All links should be public.
+  - Consider comments and README.md text: comments in open source repos such as this are not official communications and don't go through the normal approval process for public communication. They can however still be interpreted as official communication, even if not intended as such.
+- Use [inclusive language](https://github.com/NHSDigital/software-engineering-quality-framework/blob/main/inclusive-language.md): avoid terms which cause hurt and offence, including if they have historically been considered industry-standard terms.

services/ehr-out-service/README.md

@@ -3,7 +3,6 @@
 This component is part of the Repository, responsible for creating and handling of EHR transfers out from the Repository,
 when the Orphaned/Stranded health record stored in the Repository's `ehr-repository` is requested by the next registering
 practice.
-
 When the a GP2GP EHR request on its incoming queue, the `ehr-out-service` accepts this and creates a record to track this outward transfer.
 After the successful validation of the request and retrieval of patient's health record from `ehr-repository`, it sends the 
 EHR out to the requesting practice via `gp2gp-messenger`.
@@ -16,28 +15,8 @@ Follow the links to download
 - [Node](https://nodejs.org/en/download/package-manager/#nvm) - version 14.x
 - [Docker](https://docs.docker.com/install/)
 
-### AWS helpers
-
-This repository imports shared AWS helpers from [prm-deductions-support-infra](https://github.com/nhsconnect/prm-deductions-support-infra/).
-They can be found `utils` directory after running any task from `tasks` file.
-
-## Directories
-
-| Directory         | Description                                       |
-| :---------------- |:--------------------------------------------------|
-| /test/docker      | Contains smoke test for docker                    |
-| /test/functional  | Contains tests against deployed service           |
-| /gocd             | Contains the GoCD pipeline files                  |
-| /src              | The source code                                   |
-| /terraform        | Terraform to deploy app as a Fargate task in AWS  |
-| /scripts          | Useful scripts (e.g. for sending canary messages) |
-| /utils            | Contains aws-helpers                              |
-
 ## Starting the app locally
 
-*BEWARE be sure what you're doing here as `node_modules` can contain platform-specific files e.g. mac vs linux/amd64 not
-necessarily compatible*
-
 1. Run `npm install` to install all node dependencies.
 2. Configure local environment variables:
     - run `./tasks setup_test_integration_local`
@@ -77,14 +56,6 @@ Run `./tasks test_integration` to run integration tests.
 Runs the coverage tests (unit test and integration test) and collects coverage metrics.
 Run `./tasks test_coverage` to run coverage tests.
 
-### Local Docker tests
-
-Run `./tasks test_docker_local`. Make sure you have followed the steps to start the app in production mode beforehand.
-
-### Functional tests
-
-Run `./tasks test_functional`. This will run the end to end tests within [./test/functional](./test/functional). (Note you may need to be connected to VPN).
-
 ## Pre-commit Checks
 
 Before committing, ensure you run the following tests:

services/ehr-out-service/docker-compose.localstack-local.yaml

@@ -12,3 +12,11 @@ services:
     volumes:
       - "/var/lib/localstack:/var/lib/localstack"
       - "/var/run/docker.sock:/var/run/docker.sock"
+    links:
+      - dynamodb-local:dynamodb-local
+  dynamodb-local:
+    network_mode: bridge
+    image: amazon/dynamodb-local
+    command: "-jar DynamoDBLocal.jar -sharedDb -inMemory"
+    ports:
+      - "4573:8000"

services/ehr-out-service/eslint.config.mjs

@@ -0,0 +1,37 @@
+import { defineConfig } from "eslint/config";
+import prettier from "eslint-plugin-prettier";
+import globals from "globals";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import js from "@eslint/js";
+import { FlatCompat } from "@eslint/eslintrc";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+    baseDirectory: __dirname,
+    recommendedConfig: js.configs.recommended,
+    allConfig: js.configs.all
+});
+
+export default defineConfig([{
+    extends: compat.extends("eslint:recommended", "prettier"),
+
+    plugins: {
+        prettier,
+    },
+
+    languageOptions: {
+        globals: {
+            ...globals.node,
+            ...globals.jest,
+        },
+
+        ecmaVersion: 2020,
+        sourceType: "module",
+    },
+
+    rules: {
+        "prettier/prettier": "error",
+    },
+}]);