Skip to content

Chore: [AEA-0000] - move to new qc #653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anthony-nhs wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Chore: [AEA-0000] - move to new qc #653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
402b458
update
anthony-nhs Apr 7, 2026
b36b474
update
anthony-nhs Apr 7, 2026
947222e
update
anthony-nhs Apr 7, 2026
a7c4ee7
no script
anthony-nhs Apr 7, 2026
a5ed87b
remove unused job
anthony-nhs Apr 7, 2026
d862429
update tag
anthony-nhs Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"args": {
"DOCKER_GID": "${env:DOCKER_GID:}",
"IMAGE_NAME": "node_24_python_3_14",
"IMAGE_VERSION": "v1.2.0",
"IMAGE_VERSION": "v1.4.4",
"USER_UID": "${localEnv:USER_ID:}",
"USER_GID": "${localEnv:GROUP_ID:}"
}
Expand Down
2 changes: 2 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# restrict access to approving workflow changes
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says this file will “restrict access” to workflow changes, but CODEOWNERS only enforces review ownership (when branch protection requires code owner review); it doesn’t restrict who can push changes. Consider rewording this to avoid implying access control is being applied.

Suggested change
# restrict access to approving workflow changes
# require review from eps-admins for workflow changes

Copilot uses AI. Check for mistakes.
.github/workflows/ @NHSDigital/eps-admins
23 changes: 16 additions & 7 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,23 @@ on:
push:
branches: [main]

env:
BRANCH_NAME: ${{ github.ref_name }}

permissions: {}
jobs:
get_config_values:
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@b0172dbdb3af4ae232873106553c316d79d784fc
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
with:
verify_published_from_main_image: true
permissions:
attestations: read
contents: read
packages: read
quality_checks:
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
needs: [get_config_values]
permissions:
contents: read
id-token: write
packages: read
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
run_docker_scan: false
Expand All @@ -23,14 +29,17 @@ jobs:

tag_release:
needs: [quality_checks, get_config_values]
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
permissions:
contents: write
id-token: write
packages: write
with:
dry_run: true
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
branch_name: main
publish_packages: packages/cdkConstructs,packages/deploymentUtils
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
secrets: inherit

package_npm_code:
needs: [quality_checks, get_config_values]
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/package_npm_code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
pinned_image:
type: string
required: true

permissions: {}
jobs:
package_npm_code:
runs-on: ubuntu-22.04
Expand All @@ -23,7 +23,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
ref: ${{ env.BRANCH_NAME }}
persist-credentials: false

- name: Install dependencies
run: |
Expand Down
60 changes: 23 additions & 37 deletions .github/workflows/pull_request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,59 +4,42 @@ on:
pull_request:
branches: [main]

env:
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}

permissions: {}
jobs:
get_config_values:
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@b0172dbdb3af4ae232873106553c316d79d784fc
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
with:
verify_published_from_main_image: false
permissions:
attestations: read
contents: read
packages: read
dependabot-auto-approve-and-merge:
needs: quality_checks
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
permissions:
contents: write
pull-requests: write
secrets:
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
pr_title_format_check:
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@b0172dbdb3af4ae232873106553c316d79d784fc
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
permissions:
pull-requests: write
quality_checks:
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
needs: [get_config_values]
permissions:
contents: read
id-token: write
packages: read
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
run_docker_scan: false

secrets:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

get_issue_number:
runs-on: ubuntu-22.04
outputs:
issue_number: ${{steps.get_issue_number.outputs.result}}

steps:
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
name: get issue number
id: get_issue_number
with:
script: |
if (context.issue.number) {
// Return issue number if present
return context.issue.number;
} else {
// Otherwise return issue number from commit
return (
await github.rest.repos.listPullRequestsAssociatedWithCommit({
commit_sha: context.sha,
owner: context.repo.owner,
repo: context.repo.repo,
})
).data[0].number;
}
result-encoding: string


package_npm_code:
needs: [quality_checks, get_config_values]
uses: ./.github/workflows/package_npm_code.yml
Comment on lines 43 to 45
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The get_issue_number job earlier in this workflow does not appear to be used by any downstream job (no needs.get_issue_number.outputs.issue_number references). If it’s no longer needed, remove it to avoid extra workflow runtime/maintenance; otherwise wire its output into the jobs that require it.

Copilot uses AI. Check for mistakes.
Expand All @@ -65,11 +48,14 @@ jobs:

tag_release:
needs: [get_config_values]
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
permissions:
contents: write
id-token: write
packages: write
with:
dry_run: true
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
branch_name: ${{ github.event.pull_request.head.ref }}
publish_packages: packages/cdkConstructs,packages/deploymentUtils
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
secrets: inherit
23 changes: 16 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,23 @@ on:
schedule:
- cron: "0 8 * * 3"

env:
BRANCH_NAME: ${{ github.ref_name }}

permissions: {}
jobs:
get_config_values:
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@b0172dbdb3af4ae232873106553c316d79d784fc
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
with:
verify_published_from_main_image: true
permissions:
attestations: read
contents: read
packages: read
quality_checks:
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
needs: [get_config_values]
permissions:
contents: read
id-token: write
packages: read
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
run_docker_scan: false
Expand All @@ -24,11 +30,14 @@ jobs:

tag_release:
needs: [quality_checks, get_config_values]
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@352f15f692c23b18f67215ad858f27b06a878717
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
permissions:
contents: write
id-token: write
packages: write
with:
dry_run: false
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
branch_name: main
publish_packages: packages/cdkConstructs,packages/deploymentUtils
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
secrets: inherit
2 changes: 1 addition & 1 deletion .github/workflows/sync_copilot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
workflow_dispatch:
schedule:
- cron: "0 6 * * 1"

permissions: {}
jobs:
sync-copilot-instructions:
runs-on: ubuntu-22.04
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,3 +28,4 @@ _site/
vendor
.trivy_out/
*.tgz
.sbom/
10 changes: 10 additions & 0 deletions .grype.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
ignore:
# picomatch
- vulnerability: GHSA-c2c7-rcm5-vvqj
# flatted
- vulnerability: GHSA-rf6f-7fwh-wjgh
# minimatch
- vulnerability: GHSA-3ppc-4f35-3m26
- vulnerability: GHSA-7r86-cg39-jmmj
- vulnerability: GHSA-23c5-xmqv-rm74
- vulnerability: GHSA-25h7-pfq9-p65f
Comment on lines +3 to +10
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.grype.yaml adds vulnerability ignores without any justification or expiry, which makes these suppressions effectively permanent. Consider adding reason and until fields per ignore entry (similar to how the removed Trivy ignore file recorded a statement/expiry) so accepted risks are time-bounded and auditable.

Suggested change
- vulnerability: GHSA-c2c7-rcm5-vvqj
# flatted
- vulnerability: GHSA-rf6f-7fwh-wjgh
# minimatch
- vulnerability: GHSA-3ppc-4f35-3m26
- vulnerability: GHSA-7r86-cg39-jmmj
- vulnerability: GHSA-23c5-xmqv-rm74
- vulnerability: GHSA-25h7-pfq9-p65f
- vulnerability: GHSA-c2c7-rcm5-vvqj
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"
# flatted
- vulnerability: GHSA-rf6f-7fwh-wjgh
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"
# minimatch
- vulnerability: GHSA-3ppc-4f35-3m26
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"
- vulnerability: GHSA-7r86-cg39-jmmj
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"
- vulnerability: GHSA-23c5-xmqv-rm74
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"
- vulnerability: GHSA-25h7-pfq9-p65f
reason: "Temporary risk acceptance for a transitive dependency; review and remove once a fixed version is available and adopted."
until: "2025-12-31"

Copilot uses AI. Check for mistakes.
8 changes: 8 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,14 @@ repos:

- repo: local
hooks:
- id: grype-scan-local
name: Grype scan local changes
entry: make
args: ["grype-scan-local"]
language: system
pass_filenames: false
always_run: true

- id: check-commit-signing
name: Check commit signing
description: Ensures that commits are GPG signed
Expand Down
82 changes: 0 additions & 82 deletions .trivyignore.yaml
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
install: install-python install-hooks install-node

install-node:
npm ci
npm ci --ignore-scripts true
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm ci --ignore-scripts true passes an extra positional argument (true) to npm ci, which can cause the command to fail or behave unexpectedly. Use the boolean flag form (npm ci --ignore-scripts) or the explicit assignment form (--ignore-scripts=true) so the install reliably runs with scripts disabled.

Suggested change
npm ci --ignore-scripts true
npm ci --ignore-scripts

Copilot uses AI. Check for mistakes.

install-python:
poetry install
Expand Down
1 change: 0 additions & 1 deletion trivy.yaml
View file
Open in desktop

This file was deleted.

5 changes: 5 additions & 0 deletions zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
rules:
unpinned-images:
# these workflows use unpinned images because they are using a full image passed in that contains the tag
ignore:
- package_npm_code.yml:14:13
Loading