Skip to content

Commit 245a4cd

Browse files
jamesthompson26-nhsjamesthompson26-nhs
authored
Feature/CCM-10921 Add Lambda Boilerplate (#42)
* CCM-10921: Add Lambda Boilerplate * CCM-10921: Add Lambda Boilerplate * CCM-10921: Add Lambda Boilerplate * CCM-10921: Add Lambda Boilerplate * CCM-10921: Add Lambda Boilerplate
1 parent 28aa8bc commit 245a4cd

40 files changed

+11582
-347
lines changed

.github/actions/tfsec/action.yaml renamed to .github/actions/trivy/action.yaml

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,17 @@
1-
name: "TFSec Scan"
2-
description: "Scan HCL using TFSec"
1+
name: "Trivy Scan"
32
runs:
43
using: "composite"
54
steps:
6-
- name: "TFSec Scan - Components"
5+
- name: "Trivy Terraform IAC Scan"
76
shell: bash
87
run: |
98
components_exit_code=0
109
modules_exit_code=0
1110
12-
./scripts/terraform/tfsec.sh ./infrastructure/terraform/components || components_exit_code=$?
13-
./scripts/terraform/tfsec.sh ./infrastructure/terraform/modules || modules_exit_code=$?
11+
./scripts/terraform/trivy.sh ./infrastructure/terraform/components || components_exit_code=$?
12+
./scripts/terraform/trivy.sh ./infrastructure/terraform/modules || modules_exit_code=$?
1413
1514
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
16-
echo "One or more TFSec scans failed."
15+
echo "Trivy misconfigurations detected."
1716
exit 1
1817
fi

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,8 +135,8 @@ jobs:
135135
uses: actions/checkout@v4
136136
- name: "Lint Terraform"
137137
uses: ./.github/actions/lint-terraform
138-
tfsec:
139-
name: "TFSec Scan"
138+
trivy:
139+
name: "Trivy Scan"
140140
runs-on: ubuntu-latest
141141
timeout-minutes: 5
142142
needs: detect-terraform-changes
@@ -148,8 +148,8 @@ jobs:
148148
uses: asdf-vm/actions/setup@v3
149149
- name: "Perform Setup"
150150
uses: ./.github/actions/setup
151-
- name: "TFSec Scan"
152-
uses: ./.github/actions/tfsec
151+
- name: "Trivy Scan"
152+
uses: ./.github/actions/trivy
153153
count-lines-of-code:
154154
name: "Count lines of code"
155155
runs-on: ubuntu-latest

‎.github/workflows/stage-2-test.yaml‎

Lines changed: 64 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,33 +32,89 @@ on:
3232
required: true
3333
type: string
3434

35+
env:
36+
AWS_REGION: eu-west-2
37+
TERM: xterm-256color
38+
39+
permissions:
40+
id-token: write # This is required for requesting the JWT
41+
contents: read # This is required for actions/checkout
42+
3543
jobs:
44+
check-generated-dependencies:
45+
name: "Check generated dependencies"
46+
runs-on: ubuntu-latest
47+
timeout-minutes: 5
48+
steps:
49+
- name: "Checkout code"
50+
uses: actions/checkout@v4
51+
- name: "Repo setup"
52+
run: |
53+
npm ci
54+
- name: "Generate dependencies"
55+
run: |
56+
npm run generate-dependencies --workspaces --if-present
57+
git diff --exit-code
3658
test-unit:
3759
name: "Unit tests"
3860
runs-on: ubuntu-latest
3961
timeout-minutes: 5
4062
steps:
4163
- name: "Checkout code"
4264
uses: actions/checkout@v4
65+
- name: "Repo setup"
66+
run: |
67+
npm ci
68+
- name: "Generate dependencies"
69+
run: |
70+
npm run generate-dependencies --workspaces --if-present
4371
- name: "Run unit test suite"
4472
run: |
4573
make test-unit
4674
- name: "Save the result of fast test suite"
47-
run: |
48-
echo "Nothing to save"
75+
uses: actions/upload-artifact@v4
76+
with:
77+
name: unit-tests
78+
path: "**/.reports/unit"
79+
include-hidden-files: true
80+
if: always()
81+
- name: "Save the result of code coverage"
82+
uses: actions/upload-artifact@v4
83+
with:
84+
name: code-coverage-report
85+
path: ".reports/lcov.info"
4986
test-lint:
5087
name: "Linting"
5188
runs-on: ubuntu-latest
5289
timeout-minutes: 5
5390
steps:
5491
- name: "Checkout code"
5592
uses: actions/checkout@v4
93+
- name: "Repo setup"
94+
run: |
95+
npm ci
96+
- name: "Generate dependencies"
97+
run: |
98+
npm run generate-dependencies --workspaces --if-present
5699
- name: "Run linting"
57100
run: |
58101
make test-lint
59-
- name: "Save the linting result"
102+
test-typecheck:
103+
name: "Typecheck"
104+
runs-on: ubuntu-latest
105+
timeout-minutes: 5
106+
steps:
107+
- name: "Checkout code"
108+
uses: actions/checkout@v4
109+
- name: "Repo setup"
60110
run: |
61-
echo "Nothing to save"
111+
npm ci
112+
- name: "Generate dependencies"
113+
run: |
114+
npm run generate-dependencies --workspaces --if-present
115+
- name: "Run typecheck"
116+
run: |
117+
make test-typecheck
62118
test-coverage:
63119
name: "Test coverage"
64120
needs: [test-unit]
@@ -86,6 +142,10 @@ jobs:
86142
uses: actions/checkout@v4
87143
with:
88144
fetch-depth: 0 # Full history is needed to improving relevancy of reporting
145+
- name: "Download coverage report for SONAR"
146+
uses: actions/download-artifact@v4
147+
with:
148+
name: code-coverage-report
89149
- name: "Perform static analysis"
90150
uses: ./.github/actions/perform-static-analysis
91151
with:

‎.gitignore‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,15 @@ version.json
1111
!project.code-workspace
1212

1313
# Please, add your custom content below!
14-
node_modules
1514
.idea
15+
16+
# dependencies
17+
node_modules
18+
.node-version
19+
*/node_modules
20+
/.pnp
21+
.pnp.js
22+
/build
23+
dist
24+
.DS_Store
25+
.reports

‎.gitleaksignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ b1f85a7faf54eaf66074d7a6daa093aefe6b3ebe:sdk/python/pyproject.toml:ipv4:25
1010
# Example ECDA key in OAPI spec
1111
4118582e5009685c1ac31fc664371649602a8a0e:specification/api/notify-supplier.yml:generic-api-key:115
1212
4118582e5009685c1ac31fc664371649602a8a0e:specification/api/notify-supplier-next.yml:generic-api-key:119
13+
28aa8bcf42e1af50ab2541a345be851b53dd0f00:specification/api/notify-supplier-next.yml:generic-api-key:119
14+
28aa8bcf42e1af50ab2541a345be851b53dd0f00:specification/api/notify-supplier.yml:generic-api-key:115

‎.tool-versions‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
act 0.2.64
2-
gitleaks 8.18.4
2+
gitleaks 8.24.0
3+
jq 1.6
4+
nodejs 22.11.0
5+
pnpm 10.4.1
36
pre-commit 3.6.0
7+
python 3.13.2
48
terraform 1.9.2
59
terraform-docs 0.19.0
6-
tfsec 1.28.10
10+
trivy 0.61.0
711
vale 3.6.0
8-
python 3.13.2
9-
pnpm 10.4.1
10-
nodejs 20.18.2
1112

1213
# ==============================================================================
1314
# The section below is reserved for Docker image versions.

‎docs/Gemfile.lock‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ GEM
2929
ffi (1.16.3)
3030
forwardable-extended (2.6.0)
3131
gemoji (4.1.0)
32+
google-protobuf (4.29.2-arm64-darwin)
33+
bigdecimal
34+
rake (>= 13)
3235
google-protobuf (4.29.2-x86_64-linux)
3336
bigdecimal
3437
rake (>= 13)
@@ -92,6 +95,8 @@ GEM
9295
jekyll-seo-tag (~> 2.1)
9396
minitest (5.24.1)
9497
mutex_m (0.2.0)
98+
nokogiri (1.18.4-arm64-darwin)
99+
racc (~> 1.4)
95100
nokogiri (1.18.4-x86_64-linux-gnu)
96101
racc (~> 1.4)
97102
pathutil (0.16.2)
@@ -105,6 +110,8 @@ GEM
105110
rexml (3.3.9)
106111
rouge (4.2.1)
107112
safe_yaml (1.0.5)
113+
sass-embedded (1.83.0-arm64-darwin)
114+
google-protobuf (~> 4.28)
108115
sass-embedded (1.83.0-x86_64-linux-gnu)
109116
google-protobuf (~> 4.28)
110117
terminal-table (3.0.2)
@@ -115,6 +122,7 @@ GEM
115122
webrick (1.8.2)
116123

117124
PLATFORMS
125+
arm64-darwin-23
118126
x86_64-linux
119127

120128
DEPENDENCIES

0 commit comments

Comments
 (0)