Merge branch 'main' into feature/CCM-12937

Author: stevebux

.github/CODEOWNERS

@@ -7,6 +7,9 @@
 /docs/                      @NHSDigital/nhs-notify-supplier-api
 /infrastructure/terraform/  @NHSDigital/nhs-notify-platform @NHSDigital/nhs-notify-supplier-api-admins
 
+# Root level AGENTS.md owned by platform.
+AGENTS.md                   @NHSDigital/nhs-notify-platform
+
 # Codeowners must be final check
 /.github/CODEOWNERS         @NHSDigital/nhs-notify-code-owners
 /CODEOWNERS                 @NHSDigital/nhs-notify-code-owners

.gitignore

@@ -27,4 +27,8 @@ dist
 /sandbox/*.log
 /sandbox-staging
 /specification/api/components/examples
+/specification/api/components/x-nhsd-apim/x-nhsd-apim.yml
+/specification/api/components/security-schemes/security-schemes.yml
+/specification/api/components/security/security.yml
+/specification/api/components/parameters/authorization/authorization.yml
 /scripts/JWT/*.pem

AGENTS.md

@@ -46,32 +46,26 @@ publish-oas:
 	npm run publish-oas
 
 set-authorization: guard-APIM_ENV
-	@ AUTHORIZATION=authorization-$$APIM_ENV.yml \
-	envsubst '$${AUTHORIZATION}' \
-	< specification/api/components/parameters/authorization/authorization-template.yml > specification/api/components/parameters/authorization/authorization.yml
+	SPEC_DIR=./specification/api/components/environments
+	COMPONENT_DIR=./specification/api/components/parameters/authorization
+	./scripts/build/substitute_build_env.sh $$COMPONENT_DIR/authorization-template.yml $$SPEC_DIR/$$APIM_ENV.env $$COMPONENT_DIR/authorization.yml
 
-set-target: guard-APIM_ENV
-	@ TARGET=target-$$APIM_ENV.yml \
-	envsubst '$${TARGET}' \
-	< specification/api/components/x-nhsd-apim/target-template.yml > specification/api/components/x-nhsd-apim/target.yml
-
-set-access: guard-APIM_ENV
-	@ ACCESS=access-$$APIM_ENV.yml \
-	envsubst '$${ACCESS}' \
-	< specification/api/components/x-nhsd-apim/access-template.yml > specification/api/components/x-nhsd-apim/access.yml
+set-nhsd-apim: guard-APIM_ENV
+	SPEC_DIR=./specification/api/components/environments
+	COMPONENT_DIR=./specification/api/components/x-nhsd-apim
+	./scripts/build/substitute_build_env.sh $$COMPONENT_DIR/x-nhsd-apim-template.yml $$SPEC_DIR/$$APIM_ENV.env $$COMPONENT_DIR/x-nhsd-apim.yml
 
 set-security: guard-APIM_ENV
-	@ SECURITY=security-$$APIM_ENV.yml \
-	envsubst '$${SECURITY}' \
-	< specification/api/components/security/security-template.yml > specification/api/components/security/security.yml
-	@ SECURITY_SCHEMES=security-schemes-$$APIM_ENV.yml \
-	envsubst '$${SECURITY_SCHEMES}' \
-	< specification/api/components/security-schemes/security-schemes-template.yml > specification/api/components/security-schemes/security-schemes.yml
+	SPEC_DIR=./specification/api/components/environments
+	COMPONENT_DIR=./specification/api/components/security
+	./scripts/build/substitute_build_env.sh $$COMPONENT_DIR/security-template.yml $$SPEC_DIR/$$APIM_ENV.env $$COMPONENT_DIR/security.yml
+	COMPONENT_DIR=./specification/api/components/security-schemes
+	./scripts/build/substitute_build_env.sh $$COMPONENT_DIR/security-schemes-template.yml $$SPEC_DIR/$$APIM_ENV.env $$COMPONENT_DIR/security-schemes.yml
+
 
 construct-spec: guard-APIM_ENV
+	$(MAKE) set-nhsd-apim APIM_ENV=$$APIM_ENV
 	$(MAKE) set-authorization APIM_ENV=$$APIM_ENV
-	$(MAKE) set-target APIM_ENV=$$APIM_ENV
-	$(MAKE) set-access APIM_ENV=$$APIM_ENV
 	$(MAKE) set-security APIM_ENV=$$APIM_ENV
 
 build-json-oas-spec: guard-APIM_ENV

Makefile

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TEMPLATE="$1"
+ENV_FILE="$2"
+OUT="$3"
+
+# Extract variable names from the env file (left side of KEY=VALUE)
+VARS=$(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$ENV_FILE" | cut -d= -f1)
+
+# Build envsubst variable list ($VAR1 $VAR2 ...)
+VARLIST=""
+for v in $VARS; do
+  VARLIST="$VARLIST \$$v"
+done
+VARLIST="${VARLIST# }"   # remove leading space
+
+# Export values from the env file
+set -a
+source "$ENV_FILE"
+set +a
+
+# Run envsubst only on the selected variables
+envsubst "$VARLIST" < "$TEMPLATE" > "$OUT"
+
+echo "Generated: $OUT"

scripts/build/substitute_build_env.sh

@@ -0,0 +1,3 @@
+MONITORING_FLAG=true
+TEMPORARY_FLAG=false
+ENV_DIR=../environments/int