refactor: FTRS-313 Refactor GitHub workflows to enhance SonarQube security

Author: mmg-nhse

.github/workflows/deploy-application-infrastructure.yaml

@@ -1,8 +1,6 @@
 name: Deploy application infrastructure workflow
 
-permissions:
-  id-token: write
-  contents: read
+permissions: {}
 on:
   workflow_call:
     inputs:
@@ -57,27 +55,30 @@ on:
         required: false
         default: "dev,test,int"
         type: string
+    secrets:
+      ACCOUNT_ID:
+        description: "AWS account ID for credentials"
+        required: true
+      MGMT_ACCOUNT_ID:
+        description: "Management AWS account ID for credentials"
+        required: true
     outputs:
       plan_result:
         description: "The Terraform plan output"
         value: ${{ jobs.plan-application-infrastructure.outputs.plan_result }}
       deploy_status:
         description: "The status of the deployment"
         value: ${{ jobs.deploy_summary.outputs.deploy_status }}
-secrets:
-      ACCOUNT_ID:
-        description: "AWS account ID for credentials"
-        required: true
-      MGMT_ACCOUNT_ID:
-        description: "Management AWS account ID for credentials"
-        required: true
 
 jobs:
   plan-application-infrastructure:
     name: "Plan application infrastructure deployment to ${{ inputs.environment }} "
     concurrency:
       group: "${{ inputs.environment }}-${{ inputs.ref || inputs.workspace}}"
       cancel-in-progress: false
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/deploy-infrastructure.yaml
     with:
       environment: ${{ inputs.environment }}
@@ -119,6 +120,9 @@ jobs:
     needs:
       - plan-application-infrastructure
       - manual-approval-application-infra
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/deploy-infrastructure.yaml
     with:
       environment: ${{ inputs.environment }}