Merge branch 'main' into PRMP-627

Author: MohammadIqbalAD-NHS

.github/workflows/automated-deploy-dev.yml

@@ -222,15 +222,19 @@ jobs:
       AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
 
   notify-slack:
+    name: Notify Slack on Failure
     runs-on: ubuntu-latest
+    environment: development
     needs: [terraform_plan_apply, deploy_lambdas, deploy_ui]
     if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+          role-skip-session-tagging: true
           aws-region: ${{ vars.AWS_REGION }}
+          mask-aws-account-id: true
 
       - name: Get slack bot token from SSM parameter store
         run: |

…b/workflows/automated-sbom-repo-scan.yml …hub/workflows/automated-pr-validator.yml.github/workflows/automated-sbom-repo-scan.yml renamed to .github/workflows/automated-pr-validator.yml .github/workflows/automated-sbom-repo-scan.yml renamed to .github/workflows/automated-pr-validator.yml

@@ -1,23 +1,23 @@
-name: 'Z-AUTOMATED: SBOM Repo Scan'
+name: "Z-AUTOMATED: PR Validator"
 
 on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-permissions:
-  actions: read   # Required for anchore/sbom-action
-  contents: write # Required for anchore/sbom-action
-  id-token: write # Required for requesting the JWT
-  pull-requests: write
-
 jobs:
   sbom_scan:
     name: SBOM Repo Scan
     runs-on: ubuntu-latest
+    permissions:
+      actions: read # Required for anchore/sbom-action
+      contents: write # Required for anchore/sbom-action
+      id-token: write # Required for requesting the JWT
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - name: Checkout
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+          fetch-depth: 0
 
       - uses: anchore/sbom-action@v0
         with:
@@ -51,14 +51,14 @@ jobs:
               repo: context.repo.repo,
               issue_number: context.issue.number,
             })
-            
+
             const botComment = comments.find(comment => {
               return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
             })
 
             // 2. Prepare format of the comment
             const output = `### Code security issues found
-            
+
             View full details [here](https://github.com/${{ github.repository }}/security/code-scanning?query=is%3Aopen+pr%3A${{ github.event.pull_request.number }}).`;
 
             // 3. If we have a comment, update it, otherwise create a new one
@@ -70,7 +70,7 @@ jobs:
                 body: output
               })
             }
-            
+
             github.rest.issues.createComment({
               issue_number: context.issue.number,
               owner: context.repo.owner,
@@ -89,7 +89,7 @@ jobs:
               repo: context.repo.repo,
               issue_number: context.issue.number,
             })
-            
+
             const botComment = comments.find(comment => {
               return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
             })
@@ -102,3 +102,21 @@ jobs:
                 comment_id: botComment.id
               })
             }
+
+  markdown-validation:
+    name: Markdown Validation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Run Markdown Validation Script
+        id: validate
+        run: |
+          BRANCH_NAME=${{ github.event.repository.default_branch }}
+          chmod +x scripts/markdown-validator.sh
+          scripts/markdown-validator.sh

.github/workflows/automated-sonarqube-cloud-analysis.yml

@@ -28,15 +28,19 @@ jobs:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   notify-slack:
+    name: Notify Slack on Failure
     runs-on: ubuntu-latest
+    environment: development
     needs: [sonarqube_cloud]
     if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+          role-skip-session-tagging: true
           aws-region: ${{ vars.AWS_REGION }}
+          mask-aws-account-id: true
 
       - name: Get slack bot token from SSM parameter store
         run: |

.github/workflows/cron-daily-health-check.yml

@@ -198,15 +198,19 @@ jobs:
     secrets: inherit
 
   notify-slack:
+    name: Notify Slack on Failure
     runs-on: ubuntu-latest
+    environment: development
     needs: [terraform_plan_apply, run_lambda_unit_tests, run_ui_unit_tests, run_cypress_tests, publish_lambda_layers, deploy_lambdas, deploy_ui]
     if: failure()
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+          role-skip-session-tagging: true
           aws-region: ${{ vars.AWS_REGION }}
+          mask-aws-account-id: true
 
       - name: Get slack bot token from SSM parameter store
         run: |

.markdownlint.jsonc

@@ -0,0 +1,4 @@
+{
+    "MD013": false,
+    "MD033": false
+}

.terraform-docs.yml

@@ -14,8 +14,11 @@ sections:
 
 content: |-
   {{ .Requirements }}
+
   {{ .Resources }}
+
   {{ .Inputs }}
+
   {{ .Outputs }}
 
 output:

README.md

@@ -8,7 +8,8 @@ This repository is used to build the infrastructure the NDR. That is it's sole p
 - [Terraform docs](https://github.com/terraform-docs/terraform-docs)
 
 To install terraform-docs on WSL use the following commands (e.g. for v0.20.0):
-```
+
+```shell
 curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.20.0/terraform-docs-v0.20.0-$(uname)-amd64.tar.gz
 tar -xzf terraform-docs.tar.gz
 chmod +x terraform-docs
@@ -24,7 +25,7 @@ As this repository is a standalone infrastructure there is no python/node based
 
 - Set this repository to get it's pre-commit hooks from .githooks
 
-```
+```shell
 git config core.hooksPath .githooks
 ```
 

bootstrap/README.md

@@ -1,3 +1,5 @@
+# Terraform Bootstrap
+
 ## Requirements
 
 | Name | Version |

infrastructure/README.md

@@ -1,3 +1,5 @@
+# National Document Repository - Infrastructure as Code
+
 ## Requirements
 
 | Name                                                         | Version |

infrastructure/api.tf

@@ -76,12 +76,15 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
     module.send-feedback-gateway,
     module.send-feedback-lambda,
     module.review_document_version_gateway,
+    module.review_document_status_gateway,
+    module.review-document-status-check-lambda,
     module.update-doc-ref-lambda,
     module.update-upload-state-gateway,
     module.update-upload-state-lambda,
     module.document-status-check-gateway,
     module.document-status-check-lambda,
     module.post-document-references-fhir-lambda,
+    module.post_document_review_lambda,
     module.patch_document_review_lambda,
     module.virus_scan_result_gateway,
     module.virus_scan_result_lambda