Skip to content

Commit 63f1dbe

Browse files
committed
Merge remote-tracking branch 'origin/main' into dev_container_build
2 parents 7d1908d + ba86b0c commit 63f1dbe

23 files changed

+8129
-55
lines changed

.devcontainer/Dockerfile

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,7 @@ RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf)
6262
tar -xvzf /tmp/asdf.tar.gz && \
6363
mv asdf /usr/bin
6464

65-
USER vscode
66-
67-
ENV PATH="$PATH:/home/vscode/.asdf/shims/:/workspaces/eps-prescription-tracker-ui/node_modules/.bin:/workspaces/eps-workflow-quality-checks/.venv/bin"
65+
ENV PATH="$PATH:/home/vscode/.asdf/bin/:/workspaces/eps-prescription-tracker-ui/node_modules/.bin:/workspaces/eps-common-workflows/.venv/bin"
6866

6967
# Install ASDF plugins#
7068
RUN asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git && \
@@ -73,9 +71,9 @@ RUN asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git && \
7371
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git && \
7472
asdf plugin add python
7573

76-
WORKDIR /workspaces/eps-workflow-quality-checks
74+
WORKDIR /workspaces/eps-common-workflows
7775

78-
ADD .tool-versions /workspaces/eps-workflow-quality-checks/.tool-versions
76+
ADD .tool-versions /workspaces/eps-common-workflows/.tool-versions
7977
ADD .tool-versions /home/vscode/.tool-versions
8078

8179
RUN asdf install python && \

.devcontainer/devcontainer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
],
1919
"containerUser": "vscode",
2020
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
21-
"postAttachCommand": "docker build -f /workspaces/eps-workflow-quality-checks/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && pre-commit install --install-hooks -f",
21+
"postAttachCommand": "docker build -f /workspaces/eps-common-workflows/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && pre-commit install --install-hooks -f",
2222
"features": {
2323
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
2424
"version": "latest",

.github/dependabot.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,31 @@ updates:
1212
open-pull-requests-limit: 20
1313
commit-message:
1414
prefix: "Upgrade: [dependabot] - "
15+
16+
###################################
17+
# NPM workspace ##################
18+
###################################
19+
- package-ecosystem: "npm"
20+
directory: "/"
21+
schedule:
22+
interval: "weekly"
23+
day: "friday"
24+
time: "18:00" # UTC
25+
open-pull-requests-limit: 20
26+
versioning-strategy: increase
27+
commit-message:
28+
prefix: "Upgrade: [dependabot] - "
29+
30+
###################################
31+
# Poetry #########################
32+
###################################
33+
- package-ecosystem: "pip"
34+
directory: "/"
35+
schedule:
36+
interval: "weekly"
37+
day: "friday"
38+
time: "18:00" # UTC
39+
open-pull-requests-limit: 20
40+
versioning-strategy: increase
41+
commit-message:
42+
prefix: "Upgrade: [dependabot] - "
Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: "Combine PRs"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
branchPrefix:
7+
description: "Branch prefix to find combinable PRs based on"
8+
default: "dependabot"
9+
type: string
10+
mustBeGreen:
11+
description: "Only combine PRs that are green (status is success)"
12+
default: true
13+
type: boolean
14+
combineBranchName:
15+
description: "Name of the branch to combine PRs into"
16+
default: "combine-dependabot-PRs"
17+
type: string
18+
ignoreLabel:
19+
description: "Exclude PRs with this label"
20+
default: "nocombine"
21+
type: string
22+
23+
# Allow manual triggering of the workflow for this repo
24+
workflow_dispatch:
25+
inputs:
26+
branchPrefix:
27+
description: "Branch prefix to find combinable PRs based on"
28+
default: "dependabot"
29+
type: string
30+
mustBeGreen:
31+
description: "Only combine PRs that are green (status is success)"
32+
default: true
33+
type: boolean
34+
combineBranchName:
35+
description: "Name of the branch to combine PRs into"
36+
default: "combine-dependabot-PRs"
37+
type: string
38+
ignoreLabel:
39+
description: "Exclude PRs with this label"
40+
default: "nocombine"
41+
type: string
42+
43+
jobs:
44+
combine-prs:
45+
runs-on: ubuntu-22.04
46+
steps:
47+
- name: Checkout repository
48+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
49+
with:
50+
repository: NHSDigital/eps-common-workflows
51+
sparse-checkout-cone-mode: false
52+
sparse-checkout: |
53+
combine-prs.js
54+
55+
- name: Create Combined PR
56+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
57+
id: create-combined-pr
58+
env:
59+
branchPrefix: ${{ inputs.branchPrefix }}
60+
mustBeGreen: ${{ inputs.mustBeGreen }}
61+
combineBranchName: ${{ inputs.combineBranchName }}
62+
ignoreLabel: ${{ inputs.ignoreLabel }}
63+
with:
64+
github-token: ${{secrets.GITHUB_TOKEN}}
65+
script: |
66+
const combinePRs = require('./combine-prs.js');
67+
await combinePRs({ github, context, core });
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Dependabot auto-approve
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
AUTOMERGE_APP_ID:
7+
required: true
8+
AUTOMERGE_PEM:
9+
required: true
10+
11+
permissions:
12+
pull-requests: write
13+
contents: write
14+
15+
jobs:
16+
dependabot:
17+
runs-on: ubuntu-22.04
18+
if: ${{ github.actor == 'dependabot[bot]' }}
19+
steps:
20+
- name: Get token from Github App
21+
id: get_app_token
22+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42
23+
with:
24+
app-id: ${{ secrets.AUTOMERGE_APP_ID }}
25+
private-key: ${{ secrets.AUTOMERGE_PEM }}
26+
27+
- name: Dependabot metadata
28+
id: dependabot-metadata
29+
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b
30+
with:
31+
github-token: "${{ secrets.GITHUB_TOKEN }}"
32+
33+
- name: Approve patch and minor updates
34+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
35+
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
36+
env:
37+
PR_URL: ${{github.event.pull_request.html_url}}
38+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
39+
40+
- name: Approve major updates of development dependencies
41+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:development'}}
42+
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a major update of a dependency used only in development**"
43+
env:
44+
PR_URL: ${{github.event.pull_request.html_url}}
45+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
46+
47+
- name: Comment on major updates of non-development dependencies
48+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:production'}}
49+
run: |
50+
gh pr comment "$PR_URL" --body "I'm **not approving** this PR because **it includes a major update of a dependency used in production**"
51+
gh pr edit "$PR_URL" --add-label "requires-manual-qa"
52+
env:
53+
PR_URL: ${{github.event.pull_request.html_url}}
54+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
55+
56+
# enable auto merge on all dependabot prs
57+
- name: Enable auto-merge for Dependabot PRs
58+
run: gh pr merge --auto --squash "$PR_URL"
59+
env:
60+
PR_URL: ${{github.event.pull_request.html_url}}
61+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: PR Title Check
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
pr_title_format_check:
8+
runs-on: ubuntu-22.04
9+
permissions:
10+
pull-requests: write
11+
steps:
12+
- name: Check PR Title is Prefixed with Change Type
13+
id: check_prefix
14+
continue-on-error: true
15+
env:
16+
PR_TITLE: ${{ github.event.pull_request.title }}
17+
run: |
18+
if [[ "$PR_TITLE" =~ ^(Fix|Update|New|Breaking|Docs|Build|Upgrade|Chore):.*$ ]]; then
19+
echo "PR title is prefixed with change type."
20+
else
21+
echo "PR title is not prefixed with change type."
22+
exit 1
23+
fi
24+
25+
- name: Check PR Title contains Ticket/Dependabot Reference
26+
id: check_ticket_reference
27+
continue-on-error: true
28+
env:
29+
PR_TITLE: ${{ github.event.pull_request.title }}
30+
run: |
31+
if [[ "$PR_TITLE" =~ ^.*:.*\[([A-Z]+-[0-9]+|dependabot)\].*-.*$ ]]; then
32+
echo "PR title contains ticket or dependabot reference."
33+
else
34+
echo "PR title does not contain ticket or dependabot reference."
35+
exit 1
36+
fi
37+
38+
- name: Extract Ticket Reference
39+
id: extract_ticket_reference
40+
if: steps.check_ticket_reference.outcome == 'success'
41+
env:
42+
PR_TITLE: ${{ github.event.pull_request.title }}
43+
run: |
44+
if [[ "$PR_TITLE" =~ ^.*:.*\[([A-Z]+-[0-9]+|dependabot)\].*-.*$ ]]; then
45+
TICKET_REF="${BASH_REMATCH[1]}"
46+
echo "Extracted ticket reference: $TICKET_REF"
47+
echo "TICKET_REF=$TICKET_REF" > "$GITHUB_OUTPUT"
48+
else
49+
echo "No ticket reference found."
50+
exit 1
51+
fi
52+
53+
- name: Comment on PR with Jira Link
54+
if: steps.extract_ticket_reference.outcome == 'success' && steps.extract_ticket_reference.outputs.TICKET_REF != 'dependabot'
55+
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
TICKET_REF: ${{ steps.extract_ticket_reference.outputs.TICKET_REF }}
59+
with:
60+
message: |
61+
This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:
62+
# [${{ env.TICKET_REF }}](https://nhsd-jira.digital.nhs.uk/browse/${{ env.TICKET_REF }})
63+
comment-tag: pr-link
64+
65+
- name: Comment on PR for dependabot
66+
if: steps.extract_ticket_reference.outcome == 'success' && steps.extract_ticket_reference.outputs.TICKET_REF == 'dependabot'
67+
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
68+
env:
69+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
70+
with:
71+
message: |
72+
This PR is raised by Dependabot to update a dependency.
73+
comment-tag: pr-link
74+
75+
- name: Comment on PR for bad format
76+
if: steps.check_prefix.outcome != 'success' || steps.check_ticket_reference.outcome != 'success'
77+
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
78+
env:
79+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
with:
81+
message: |
82+
The PR title does not conform to the required format.
83+
Please ensure your PR title is prefixed with a change type (Fix, Update, New, Breaking, Docs, Build, Upgrade, Chore)
84+
and contains a ticket reference (eg. 'Fix: [AEA-####] - ...', or 'Chore: [dependabot] - ...'),
85+
then push an empty commit or recreate your PR.
86+
See the contributing guide for more details:
87+
https://github.com/NHSDigital/eps-common-workflows/blob/main/CONTRIBUTING.md
88+
comment-tag: pr-link

.github/workflows/pull_request.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@ jobs:
4949
echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
5050
dependabot-auto-approve-and-merge:
5151
needs: quality_checks
52-
uses: NHSDigital/eps-workflow-dependabot/.github/workflows/dependabot-auto-approve-and-merge.yml@4b56ed8edd7c5357fd0123a2bd84b3429d3a6b20
52+
uses: ./.github/workflows/dependabot-auto-approve-and-merge.yml
5353
secrets:
5454
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
5555
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
5656
pr_title_format_check:
57-
uses: NHSDigital/eps-workflow-semantic-release/.github/workflows/pr_title_check.yml@f3d071da30cd01dc0e4472ac0e2d7452db78d1c7
57+
uses: ./.github/workflows/pr_title_check.yml
5858
get_asdf_version:
5959
runs-on: ubuntu-22.04
6060
outputs:
@@ -94,7 +94,7 @@ jobs:
9494

9595
tag_release:
9696
needs: [quality_checks, get_asdf_version]
97-
uses: NHSDigital/eps-workflow-semantic-release/.github/workflows/tag-release.yml@f3d071da30cd01dc0e4472ac0e2d7452db78d1c7
97+
uses: ./.github/workflows/tag-release.yml
9898
with:
9999
dry_run: true
100100
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}

.github/workflows/quality-checks.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -361,7 +361,7 @@ jobs:
361361
path: cfn_guard_output
362362

363363
- name: Generate and check SBOMs
364-
uses: NHSDigital/eps-action-sbom@ae6916d542c092ec1636f9a0ba14464ba25a97d1
364+
uses: NHSDigital/eps-action-sbom@7684ce6314e515df7b7929fac08b4464f8a03d06
365365

366366
- name: "check is SONAR_TOKEN exists"
367367
env:

.github/workflows/release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ jobs:
6363
PUSH_IMAGE_ROLE: ${{ secrets.DEV_CONTAINER_PUSH_IMAGE_ROLE }}
6464
tag_release:
6565
needs: [quality_checks, get_asdf_version]
66-
uses: NHSDigital/eps-workflow-semantic-release/.github/workflows/tag-release.yml@f3d071da30cd01dc0e4472ac0e2d7452db78d1c7
66+
uses: ./.github/workflows/tag-release.yml
6767
with:
6868
dry_run: false
6969
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}

0 commit comments

Comments
 (0)