Merge branch 'main' into feature/CCM-12937

stevebux · web-flow · commit d2ec0dc36f88 · 2025-12-10T10:10:02.000Z
diff --git a/.github/actions/build-docs/action.yml b/.github/actions/build-docs/action.yml
@@ -4,6 +4,9 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
@@ -12,8 +15,11 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
     - name: Npm cli install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
     - name: Setup Ruby
diff --git a/.github/actions/build-libraries/action.yml b/.github/actions/build-libraries/action.yml
@@ -4,6 +4,9 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
@@ -12,9 +15,12 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 
diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml
@@ -28,6 +28,9 @@ inputs:
   nodejs_version:
     description: "Node.js version, set by the CI/CD pipeline workflow"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 
 runs:
   using: composite
@@ -38,6 +41,7 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.nodejs_version }}
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: "Cache node_modules"
       uses: actions/cache@v4
@@ -50,6 +54,8 @@ runs:
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 
diff --git a/.github/actions/build-sandbox/action.yml b/.github/actions/build-sandbox/action.yml
@@ -4,6 +4,10 @@ inputs:
   version:
     description: "Version number"
     required: true
+
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: composite
 
@@ -13,9 +17,12 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 
diff --git a/.github/actions/build-sdk/action.yml b/.github/actions/build-sdk/action.yml
@@ -4,6 +4,9 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
@@ -12,9 +15,12 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 
diff --git a/.github/actions/build-server/action.yml b/.github/actions/build-server/action.yml
@@ -4,6 +4,9 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
@@ -12,9 +15,12 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 
diff --git a/.github/workflows/manual-proxy-environment-deploy.yaml b/.github/workflows/manual-proxy-environment-deploy.yaml
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   deploy-environment:
@@ -36,6 +37,8 @@ jobs:
 
       - name: Npm install
         working-directory: .
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm ci
         shell: bash
 
@@ -87,3 +90,4 @@ jobs:
           runId: "${{ github.run_id }}"
           buildSandbox: ${{ inputs.build_sandbox }}
           releaseVersion: ${{ github.ref_name }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr_closed.yaml b/.github/workflows/pr_closed.yaml
@@ -61,9 +61,7 @@ jobs:
             --targetEnvironment "main" \
             --targetAccountGroup "nhs-notify-supplier-api-dev" \
             --targetComponent "${{ matrix.component }}" \
-            --terraformAction "apply" \
-            --overrideProjectName "nhs" \
-            --overrideRoleName "nhs-main-acct-supplier-api-github-deploy"
+            --terraformAction "apply"
 
   check-event-schemas-version-change:
     name: Check for event schemas package version change
@@ -83,9 +81,12 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
 
       - name: check if local version differs from latest published version
         id: check-version
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           published_version=$(npm view @nhsdigital/nhs-notify-event-schemas-supplier-api --json 2>/dev/null | jq -r '.["dist-tags"].latest // "null"')
           echo "Published version: $published_version"
@@ -116,7 +117,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
       - name: "Install dependencies"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm ci
       - name: "Run provider contract tests"
         run: make test-contract
@@ -145,6 +149,8 @@ jobs:
           registry-url: 'https://npm.pkg.github.com'
 
       - name: Install dependencies
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm ci
 
       - name: Publish to GitHub Packages
diff --git a/.github/workflows/release_created.yaml b/.github/workflows/release_created.yaml
@@ -37,6 +37,4 @@ jobs:
             --targetEnvironment "main" \
             --targetAccountGroup "nhs-notify-supplier-api-nonprod" \
             --targetComponent "${{ matrix.component }}" \
-            --terraformAction "apply" \
-            --overrideProjectName "nhs" \
-            --overrideRoleName "nhs-main-acct-supplier-api-github-deploy"
+            --terraformAction "apply"
diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml
@@ -237,34 +237,6 @@ jobs:
           echo "Detected package version $version in main branch"
           echo "main_version=$version" >> $GITHUB_OUTPUT
 
-#  check-schemas-generated:
-#    name: Check event schemas have been regenerated
-#    needs: detect-event-schema-package-changes
-#    if: needs.detect-event-schema-package-changes.outputs.changed == 'true'
-#    runs-on: ubuntu-latest
-#    permissions:
-#      contents: read
-#    steps:
-#      - name: "Checkout code"
-#        uses: actions/checkout@v4
-#
-#      - name: "Cache node_modules"
-#        uses: actions/cache@v4
-#        with:
-#          path: |
-#            **/node_modules
-#          key: ${{ runner.os }}-node-${{ inputs.nodejs_version }}-${{ hashFiles('**/package-lock.json') }}
-#          restore-keys: |
-#            ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
-#
-#      - name: "Re-generate schemas"
-#        run: |
-#          npm ci
-#          npm --workspace internal/events run gen:jsonschema
-#
-#      - name: Check for schema changes
-#        run: git diff --quiet internal/events/schemas
-
   check-schema-version-change:
     name: Check event schema version has been updated
     needs: detect-event-schema-package-changes
@@ -290,3 +262,43 @@ jobs:
             echo "Error: Event Schema package has changed, but new version ($local_version) is not a valid increment from latest version on main branch ($main_version)."
             exit 1
           fi
+
+  check-event-schemas-version-change:
+    name: Check for event schemas package version change
+    needs: detect-event-schema-package-changes
+    if: needs.detect-event-schema-package-changes.outputs.changed == 'true'
+    outputs:
+      version_changed: ${{ steps.check-version.outputs.version_changed }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: check if local version differs from latest published version
+        id: check-version
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          published_version=$(npm view @nhsdigital/nhs-notify-event-schemas-supplier-api --json 2>/dev/null | jq -r '.["dist-tags"].latest // "null"')
+          echo "Published version: $published_version"
+
+          local_version=$(jq -r '.version' internal/events/package.json)
+          echo "Local version: $local_version"
+
+          if [[ $local_version = $published_version ]]; then
+            echo "ERROR: Local version is the same as the latest published version, but event schemas have changed"
+            echo "version_changed=false" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "Local version is different to the latest published version - a new version will be published"
+            echo "version_changed=true" >> $GITHUB_OUTPUT
+          fi
diff --git a/.github/workflows/stage-2-test.yaml b/.github/workflows/stage-2-test.yaml
@@ -39,6 +39,7 @@ env:
 permissions:
   id-token: write # This is required for requesting the JWT
   contents: read  # This is required for actions/checkout
+  packages: read # This is required for downloading from GitHub Package Registry
 
 jobs:
   check-generated-dependencies:
@@ -57,6 +58,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
       - name: "Repo setup"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm ci
       - name: "Generate dependencies"
@@ -79,6 +82,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
       - name: "Repo setup"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm ci
       - name: "Generate dependencies"
@@ -115,6 +120,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
       - name: "Repo setup"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm ci
       - name: "Generate dependencies"
@@ -139,6 +146,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
       - name: "Repo setup"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm ci
       - name: "Generate dependencies"
diff --git a/.github/workflows/stage-3-build.yaml b/.github/workflows/stage-3-build.yaml
@@ -39,6 +39,8 @@ on:
 permissions:
   id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
+  packages: read # This is required for downloading from GitHub Package Registry
+
 jobs:
   artefact-jekyll-docs:
     name: "Build Docs"
@@ -51,6 +53,7 @@ jobs:
         uses: ./.github/actions/build-docs
         with:
           version: "${{ inputs.version }}"
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   artefact-sdks:
     name: "Build SDKs"
@@ -63,6 +66,7 @@ jobs:
         uses: ./.github/actions/build-sdk
         with:
           version: "${{ inputs.version }}"
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   # Take out for now - might add again in the future
   # artefact-servers:
@@ -133,3 +137,4 @@ jobs:
           buildSandbox: true
           releaseVersion: ${{ github.head_ref || github.ref_name }}
           nodejs_version: ${{ inputs.nodejs_version }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitleaksignore b/.gitleaksignore
@@ -17,3 +17,4 @@ b1f85a7faf54eaf66074d7a6daa093aefe6b3ebe:sdk/python/pyproject.toml:ipv4:25
 d8aaf7e033bf78fff491caa148897be266b60f67:src/src.sln:ipv4:3
 e12407e09151898bfd8d049d57eee9db9977d56b:.github/copilot-instructions.md:generic-api-key:213
 4ad86108d4e08cd410061e8842dd3a2b3bee4867:scripts/JWT/README.md:generic-api-key:38
+504844c9838740c8c5235024919f0775ad817cde:pact-contracts/pacts/letter-rendering/supplier-api-letter-request-prepared.json:generic-api-key:10
diff --git a/.npmrc b/.npmrc
@@ -0,0 +1 @@
+@nhsdigital:registry=https://npm.pkg.github.com
diff --git a/infrastructure/terraform/components/api/event_source_mapping_status_updates_to_handler.tf b/infrastructure/terraform/components/api/event_source_mapping_status_updates_to_handler.tf
@@ -6,7 +6,7 @@ resource "aws_lambda_event_source_mapping" "status_updates_sqs_to_status_update_
   scaling_config { maximum_concurrency = 10 }
 
   depends_on = [
-    module.letter_status_updates_queue,         # ensures queue exists
-    module.letter_status_update                 # ensures update handler exists
+    module.letter_status_updates_queue, # ensures queue exists
+    module.letter_status_update         # ensures update handler exists
   ]
 }
diff --git a/infrastructure/terraform/components/api/locals.tf b/infrastructure/terraform/components/api/locals.tf
diff --git a/infrastructure/terraform/components/api/module_authorizer_lambda.tf b/infrastructure/terraform/components/api/module_authorizer_lambda.tf
diff --git a/infrastructure/terraform/components/api/module_lambda_get_letter_data.tf b/infrastructure/terraform/components/api/module_lambda_get_letter_data.tf
diff --git a/infrastructure/terraform/components/api/module_sqs_letter_updates.tf b/infrastructure/terraform/components/api/module_sqs_letter_updates.tf
diff --git a/infrastructure/terraform/components/api/sqs_queue_policy_letter_updates.tf b/infrastructure/terraform/components/api/sqs_queue_policy_letter_updates.tf
diff --git a/lambdas/authorizer/src/index.ts b/lambdas/authorizer/src/index.ts
