Merge branch 'PRMP-892' of https://github.com/nhsconnect/national-document-repository-infrastructure into PRMP-892

Author: steph-torres-nhs

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+<!-- markdownlint-disable-next-line first-line-heading -->
+## Overview
+
+**Jira ticket**: [TBC](https://nhsd-jira.digital.nhs.uk/browse/XXX)
+
+### Description
+
+<!-- Describe your changes in detail. -->
+
+### Context
+
+<!-- Why is this change required? What problem does it solve? -->
+
+## Checklist
+
+<!--
+
+  Put an `x` in the completed tasks.
+
+  If a task is not relevant, `x` it, then strike through the text e.g.:
+  - [x] ~~This task is not relevant.~~
+
+-->
+
+Tasks for all changes:
+
+- [ ] 1. I have linked this PR to its Jira ticket.
+- [ ] 2. I have run git pre-commits.
+- [ ] 3. I have updated relevant documentation.
+- [ ] 4. I have considered the cross-team impact (and have PR approval from both Core & Demographics if necessary).
+- [ ] 5. I have successfully [deployed this change to a sandbox](https://github.com/NHSDigital/national-document-repository-infrastructure/actions/workflows/deploy-sandbox.yml) and witnessed it build: [Workflow run: TBC](https://github.com/NHSDigital/national-document-repository-infrastructure/actions/runs/XXX)
+- [ ] 6. I have checked the Terraform Plan from this PR against `ndr-dev`.

.github/workflows/automated-pr-validator.yml

@@ -2,7 +2,9 @@ name: "Z-AUTOMATED: PR Validator"
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, edited]
+
+permissions: {}
 
 jobs:
   sbom_scan:
@@ -120,3 +122,23 @@ jobs:
           BRANCH_NAME=${{ github.event.repository.default_branch }}
           chmod +x scripts/markdown-validator.sh
           scripts/markdown-validator.sh
+
+  checklist_validator:
+    name: Checklist Validation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v6
+      with:
+        python-version: 3.11
+
+    - name: Run checklist validator
+      run: |
+        python3 scripts/github/checklist_validator/main.py
+      env:
+        PR_BODY: ${{ github.event.pull_request.body }}

.github/workflows/cron-daily-health-check.yml

@@ -119,6 +119,10 @@ jobs:
           runTests: false
           build: npm run build
           working-directory: ./app
+
+      - name: Copy main.html to index.html for serve compatibility
+        run: cp ./dist/main.html ./dist/index.html
+        working-directory: ./app
 
       - name: npm install serve -g
         run: npm install serve -g

.gitignore

@@ -36,3 +36,7 @@ tfplan
 .idea/
 .vscode/
 venv/
+
+#Ignore certificates
+scripts/csrs
+scripts/keys

infrastructure/cloudfront.tf

@@ -154,16 +154,3 @@ resource "aws_cloudfront_cache_policy" "nocache" {
     }
   }
 }
-# module "cloudfront-distribution-lg" {
-#   source                        = "./modules/cloudfront"
-#   bucket_domain_name            = module.ndr-lloyd-george-store.bucket_regional_domain_name
-#   bucket_id                     = module.ndr-lloyd-george-store.bucket_id
-#   qualifed_arn                  = module.edge-presign-lambda.qualified_arn
-#   depends_on                    = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name, module.ndr-document-pending-review-store.bucket_id, module.ndr-document-pending-review-store.bucket_domain_name]
-#   web_acl_id                    = try(module.cloudfront_firewall_waf_v2[0].arn, "")
-#   has_secondary_bucket          = local.is_production ? false : true
-#   secondary_bucket_domain_name  = module.ndr-document-pending-review-store.bucket_regional_domain_name
-#   secondary_bucket_id           = module.ndr-document-pending-review-store.bucket_id
-#   secondary_bucket_path_pattern = "review/*"
-#   log_bucket_id                 = local.access_logs_bucket_id
-# }

infrastructure/lambda-edge-presign.tf

@@ -79,12 +79,14 @@ module "edge-presign-lambda" {
   providers = {
     aws = aws.us_east_1
   }
-  bucket_names = [module.ndr-lloyd-george-store.bucket_id, module.ndr-document-pending-review-store.bucket_id, module.ndr-bulk-staging-store.bucket_id]
-  table_name   = module.cloudfront_edge_dynamodb_table.table_name
+  bucket_names = [
+    module.ndr-lloyd-george-store.bucket_id,
+    module.ndr-document-pending-review-store.bucket_id,
+    module.ndr-bulk-staging-store.bucket_id
+  ]
+  table_name = module.cloudfront_edge_dynamodb_table.table_name
 }
 
-
-
 resource "aws_iam_policy" "staging_bucket_put" {
   name = "${terraform.workspace}_staging_bucket_put"
   policy = jsonencode({