Merge remote-tracking branch 'origin/main' into PRMP-862

Author: PedroSoaresNHS

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+<!-- markdownlint-disable-next-line first-line-heading -->
+## Overview
+
+**Jira ticket**: [TBC](https://nhsd-jira.digital.nhs.uk/browse/XXX)
+
+### Description
+
+<!-- Describe your changes in detail. -->
+
+### Context
+
+<!-- Why is this change required? What problem does it solve? -->
+
+## Checklist
+
+<!--
+
+  Put an `x` in the completed tasks.
+
+  If a task is not relevant, `x` it, then strike through the text e.g.:
+  - [x] ~~This task is not relevant.~~
+
+-->
+
+Tasks for all changes:
+
+- [ ] 1. I have linked this PR to its Jira ticket.
+- [ ] 2. I have run git pre-commits.
+- [ ] 3. I have updated relevant documentation.
+- [ ] 4. I have considered the cross-team impact (and have PR approval from both Core & Demographics if necessary).
+- [ ] 5. I have successfully [deployed this change to a sandbox](https://github.com/NHSDigital/national-document-repository-infrastructure/actions/workflows/deploy-sandbox.yml) and witnessed it build: [Workflow run: TBC](https://github.com/NHSDigital/national-document-repository-infrastructure/actions/runs/XXX)
+- [ ] 6. I have checked the Terraform Plan from this PR against `ndr-dev`.

.github/workflows/automated-pr-validator.yml

@@ -2,7 +2,9 @@ name: "Z-AUTOMATED: PR Validator"
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, edited]
+
+permissions: {}
 
 jobs:
   sbom_scan:
@@ -120,3 +122,23 @@ jobs:
           BRANCH_NAME=${{ github.event.repository.default_branch }}
           chmod +x scripts/markdown-validator.sh
           scripts/markdown-validator.sh
+
+  checklist_validator:
+    name: Checklist Validation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.11
+
+    - name: Run checklist validator
+      run: |
+        python3 scripts/github/checklist_validator/main.py
+      env:
+        PR_BODY: ${{ github.event.pull_request.body }}

.github/workflows/cron-daily-health-check.yml

@@ -119,6 +119,10 @@ jobs:
           runTests: false
           build: npm run build
           working-directory: ./app
+
+      - name: Copy main.html to index.html for serve compatibility
+        run: cp ./dist/main.html ./dist/index.html
+        working-directory: ./app
 
       - name: npm install serve -g
         run: npm install serve -g

.gitignore

@@ -36,3 +36,7 @@ tfplan
 .idea/
 .vscode/
 venv/
+
+#Ignore certificates
+scripts/csrs
+scripts/keys

README.md

@@ -29,4 +29,4 @@ As this repository is a standalone infrastructure there is no python/node based
 git config core.hooksPath .githooks
 ```
 
-Pre-commits will run on any commit. This will build docs and format the terraform.
+Pre-commits will run on all commits. This will build docs and format the terraform.

infrastructure/backup-cross-account.tf

@@ -60,7 +60,8 @@ resource "aws_backup_selection" "cross_account_backup_selection" {
     module.bulk_upload_report_dynamodb_table.dynamodb_table_arn,
     module.statistical-reports-store.bucket_arn,
     module.pdm_dynamodb_table.dynamodb_table_arn,
-    module.pdm-document-store.bucket_arn
+    module.pdm-document-store.bucket_arn,
+    module.core_dynamodb_table.dynamodb_table_arn,
   ]
 }
 

infrastructure/buckets.tf

@@ -233,6 +233,18 @@ resource "aws_s3_bucket_lifecycle_configuration" "staging-store-lifecycle-rules"
       prefix = "user_upload/"
     }
   }
+  rule {
+    id     = "Delete objects in review folder that have existed for 24 hours"
+    status = "Enabled"
+
+    expiration {
+      days = 1
+    }
+
+    filter {
+      prefix = "review/"
+    }
+  }
   rule {
     id     = "default-to-intelligent-tiering"
     status = "Enabled"
@@ -281,6 +293,17 @@ resource "aws_s3_bucket_lifecycle_configuration" "ndr_document_pending_review_st
     }
     filter {}
   }
+  rule {
+    id     = "remove-delete-markers-after-42-days"
+    status = "Enabled"
+    expiration {
+      expired_object_delete_marker = true
+    }
+    noncurrent_version_expiration {
+      noncurrent_days = 42
+    }
+    filter {}
+  }
 }
 
 # Logging Buckets

infrastructure/dev.tfvars

@@ -12,3 +12,5 @@ cloud_security_email_param_environment = "dev"
 apim_environment = "internal-dev."
 
 kms_deletion_window = 7
+
+ssh_key_management_dry_run = true

infrastructure/dynamo_db_review.tf

@@ -1,12 +1,11 @@
-module "document_review_dynamodb_table" {
-  count                          = local.is_production ? 0 : 1
+module "document_upload_review_dynamodb_table" {
   source                         = "./modules/dynamo_db"
   table_name                     = var.document_review_table_name
   hash_key                       = "ID"
+  sort_key                       = "Version"
   deletion_protection_enabled    = local.is_production
   stream_enabled                 = false
-  ttl_enabled                    = true
-  ttl_attribute_name             = "TTL"
+  ttl_enabled                    = false
   point_in_time_recovery_enabled = !local.is_sandbox
 
   attributes = [
@@ -36,11 +35,15 @@ module "document_review_dynamodb_table" {
     },
     {
       name = "ReviewDate"
-      type = "S"
+      type = "N"
     },
     {
       name = "UploadDate"
       type = "N"
+    },
+    {
+      name = "Version"
+      type = "N"
     }
 
   ]

infrastructure/lambda-document-review-processor.tf

@@ -6,8 +6,8 @@ module "document_review_processor_lambda" {
     module.document_review_queue.sqs_read_policy_document,
     module.document_review_queue.sqs_write_policy_document,
     module.ndr-document-pending-review-store.s3_write_policy_document,
-    local.is_production ? "" : module.document_review_dynamodb_table[0].dynamodb_read_policy_document,
-    local.is_production ? "" : module.document_review_dynamodb_table[0].dynamodb_write_policy_document,
+    module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
+    module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-bulk-staging-store.s3_read_policy_document,
     module.ndr-bulk-staging-store.s3_write_policy_document,
   ]
@@ -21,7 +21,7 @@ module "document_review_processor_lambda" {
   lambda_environment_variables = {
     PENDING_REVIEW_BUCKET_NAME    = module.ndr-document-pending-review-store.bucket_id
     STAGING_STORE_BUCKET_NAME     = module.ndr-bulk-staging-store.bucket_id
-    DOCUMENT_REVIEW_DYNAMODB_NAME = local.is_production ? "" : module.document_review_dynamodb_table[0].table_name
+    DOCUMENT_REVIEW_DYNAMODB_NAME = module.document_upload_review_dynamodb_table.table_name
     WORKSPACE                     = terraform.workspace
   }
 }