Merge pull request #390 from NHSDigital/feature/hotfix-merge-to-main

Feature/hotfix merge to main

Author: eddalmond1

.github/workflows/base-deploy.yml

@@ -109,6 +109,25 @@ jobs:
           ref: ${{ needs.metadata.outputs.ref }}
           fetch-depth: 0
 
+      - name: "Setup Terraform"
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ needs.metadata.outputs.terraform_version }}
+
+      - name: "Install Poetry"
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: "Set up Python"
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: 'poetry'
+
+      - name: "Install dependencies"
+        run: poetry install
+
       - name: "Build lambda artefact"
         shell: bash
         run: |

.github/workflows/cicd-2-publish.yaml

@@ -30,6 +30,8 @@ jobs:
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref_name }}
 
       - name: "Set CI/CD variables"
         id: variables
@@ -70,6 +72,8 @@ jobs:
 
       - name: "Checkout Repository"
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref_name }}
 
       - name: "Build lambda artefact"
         run: |

.github/workflows/cicd-3-test-deploy.yaml

@@ -14,11 +14,7 @@ jobs:
   metadata:
     name: "Resolve metadata from triggering run"
     runs-on: ubuntu-latest
-    if: >
-      ${{
-        github.event.workflow_run.conclusion == 'success' &&
-        github.event.workflow_run.head_branch == 'main'
-      }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     outputs:
       terraform_version: ${{ steps.vars.outputs.terraform_version }}
       tag: ${{ steps.tag.outputs.name }}

infrastructure/stacks/api-layer/iam_policies.tf

@@ -352,7 +352,6 @@ data "aws_iam_policy_document" "s3_audit_kms_key_policy" {
     actions = ["kms:*"]
     resources = ["*"]
   }
-
   # Allow Lambda, Firehose, and external write roles to use the KMS key
   statement {
     sid    = "AllowAuditKeyAccess"

infrastructure/stacks/api-layer/locals.tf

@@ -2,7 +2,7 @@ locals {
   stack_name = "api-layer"
 
   api_subdomain   = var.environment
-  api_domain_name = "eligibility-signposting-api.nhs.uk"
+  api_domain_name = var.environment == "prod" ? "eligibility-signposting-api.national.nhs.uk" : "eligibility-signposting-api.nhs.uk"
 
   # PEM file for certificate
   pem_file_content = join("\n", [