Merge remote-tracking branch 'origin/main' into dev_container_build

Author: anthony-nhs

.github/workflows/quality-checks.yml

@@ -122,6 +122,14 @@ jobs:
           echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
           echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc
 
+      - name: Cache npm dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: ./node_modules
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
       - name: make install
         run: |
           make install
@@ -156,6 +164,58 @@ jobs:
             echo "uses_java=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Check licenses (Makefile)
+        run: |
+          make check-licenses
+
+      - name: Run code lint
+        run: make lint
+
+      - name: actionlint
+        uses: raven-actions/actionlint@3a24062651993d40fed1019b58ac6fbdfbf276cc
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
+        with:
+          ignore_paths: >-
+            *test*
+            .venv
+            node_modules
+            .git
+
+      - name: Run unit tests
+        run: make test
+
+      - name: Generate and check SBOMs
+        uses: NHSDigital/eps-action-sbom@7684ce6314e515df7b7929fac08b4464f8a03d06
+
+      - name: "check is SONAR_TOKEN exists"
+        env:
+          super_secret: ${{ secrets.SONAR_TOKEN }}
+        if: ${{ env.super_secret != '' && inputs.run_sonar == true }}
+        run: echo "SONAR_TOKEN_EXISTS=true" >> "$GITHUB_ENV"
+
+      - name: Run SonarQube analysis
+        if: ${{ steps.check_java.outputs.uses_java == 'true' && env.SONAR_TOKEN_EXISTS == 'true' }}
+        run: mvn sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }}
+
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602
+        if: ${{ steps.check_java.outputs.uses_java == 'false' && env.SONAR_TOKEN_EXISTS == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+  # CloudFormation validation (runs only if templates exist, ~3-5 minutes)
+  cloudformation-validation:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        with:
+          ref: ${{ env.BRANCH_NAME }}
+          fetch-depth: 0
+
       - name: Check for SAM templates
         id: check_sam_templates
         run: |
@@ -201,34 +261,34 @@ jobs:
             echo "cdk_exists=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check licenses (Makefile)
-        run: |
-          make check-licenses
-
-      - name: Run code lint
-        run: make lint
-
-      - name: actionlint
-        uses: raven-actions/actionlint@3a24062651993d40fed1019b58ac6fbdfbf276cc
-
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
-        with:
-          ignore_paths: >-
-            *test*
-            .venv
-            node_modules
-            .git
-
       - name: Run cfn-lint
         if: steps.check_sam_templates.outputs.sam_exists == 'true' || steps.check_cf_templates.outputs.cf_exists == 'true'
         run: |
           pip install cfn-lint
           cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
           cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
 
-      - name: Run unit tests
-        run: make test
+      - name: Cache npm dependencies
+        if: steps.check_cdk.outputs.cdk_exists == 'true'
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Setting up .npmrc
+        if: steps.check_cdk.outputs.cdk_exists == 'true'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
+          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc
+
+      - name: make install NodeJS
+        if: steps.check_cdk.outputs.cdk_exists == 'true'
+        run: |
+          make install-node && make compile
 
       - name: Run cdk-synth
         if: steps.check_cdk.outputs.cdk_exists == 'true'
@@ -359,184 +419,3 @@ jobs:
         with:
           name: cfn_guard_output
           path: cfn_guard_output
-
-      - name: Generate and check SBOMs
-        uses: NHSDigital/eps-action-sbom@7684ce6314e515df7b7929fac08b4464f8a03d06
-
-      - name: "check is SONAR_TOKEN exists"
-        env:
-          super_secret: ${{ secrets.SONAR_TOKEN }}
-        if: ${{ env.super_secret != '' && inputs.run_sonar == true }}
-        run: echo "SONAR_TOKEN_EXISTS=true" >> "$GITHUB_ENV"
-
-      - name: Run SonarQube analysis
-        if: ${{ steps.check_java.outputs.uses_java == 'true' && env.SONAR_TOKEN_EXISTS == 'true' }}
-        run: mvn sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }}
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602
-        if: ${{ steps.check_java.outputs.uses_java == 'false' && env.SONAR_TOKEN_EXISTS == 'true' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-  build_dev_container_x64:
-    permissions:
-      id-token: write
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Download check_ecr_image_scan_results.sh script
-        env:
-          SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
-        run: |
-          curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
-          chmod +x check_ecr_image_scan_results.sh
-      - name: Build dev container
-        run: |
-          docker build -f .devcontainer/Dockerfile -t dev-container-image .
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
-        id: connect-aws-deploy
-        with:
-          aws-region: eu-west-2
-          role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
-          role-session-name: dev-container-build-x64
-          output-credentials: true
-
-      - name: Retrieve AWS Account ID
-        id: retrieve-deploy-account-id
-        run: |
-          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
-          echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
-
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
-
-      - name: Push x64 image to Amazon ECR
-        env:
-          ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          docker tag "dev-container-image" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
-          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
-      - name: Check dev container scan results
-        env:
-          REPOSITORY_NAME: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}-amd64
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          sleep 30
-          ./check_ecr_image_scan_results.sh
-
-  build_dev_container_arm64:
-    permissions:
-      id-token: write
-    runs-on: ubuntu-22.04-arm
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Download check_ecr_image_scan_results.sh script
-        env:
-          SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
-        run: |
-          curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
-          chmod +x check_ecr_image_scan_results.sh
-
-      - name: Build dev container
-        run: |
-          docker build -f .devcontainer/Dockerfile -t dev-container-image-arm .
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
-        id: connect-aws-deploy
-        with:
-          aws-region: eu-west-2
-          role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
-          role-session-name: dev-container-build-arm64
-          output-credentials: true
-
-      - name: Retrieve AWS Account ID
-        id: retrieve-deploy-account-id
-        run: |
-          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
-          echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
-
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
-
-      - name: Push ARM64 image to Amazon ECR
-        env:
-          ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          docker tag "dev-container-image-arm" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
-          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
-      - name: Check dev container scan results
-        env:
-          REPOSITORY_NAME: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}-arm64
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          # Wait a moment for ECR to process the new manifest
-          sleep 30
-          ./check_ecr_image_scan_results.sh
-
-  create_multi_arch_manifest:
-    permissions:
-      id-token: write
-    runs-on: ubuntu-22.04
-    needs: [build_dev_container_x64, build_dev_container_arm64]
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
-        with:
-          aws-region: eu-west-2
-          role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
-          role-session-name: multi-arch-manifest
-          output-credentials: true
-
-      - name: Retrieve AWS Account ID
-        id: retrieve-deploy-account-id
-        run: |
-          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
-          echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
-
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
-
-      - name: Create and push multi-architecture manifest for tag
-        env:
-          ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          # Create manifest list combining both architectures
-          docker buildx imagetools create -t "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}" \
-            "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64" \
-            "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
-
-      - name: Verify multi-architecture manifest
-        env:
-          ECR_REPOSITORY: ${{ inputs.dev_container_ecr }}
-          IMAGE_TAG: ${{ inputs.dev_container_image_tag }}
-          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
-        run: |
-          echo "=== Verifying multi-architecture manifest ==="
-          docker buildx imagetools inspect "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}"