Merge branch 'main' into feature/CCM-11580-oas-spec-v1

masl2 · masl2 · commit e1ddd450e968 · 2025-09-09T15:40:05.000+01:00
diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml
@@ -46,7 +46,6 @@ jobs:
           echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
           echo "version=$(echo $version)" >> $GITHUB_OUTPUT
           echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
-
       - name: "Check if pull request exists for this branch"
         id: pr_exists
         env:
diff --git a/.github/workflows/pr_closed.yaml b/.github/workflows/pr_closed.yaml
@@ -56,10 +56,8 @@ jobs:
         run: |
           bash .github/scripts/dispatch_internal_repo_workflow.sh \
             --releaseVersion "main" \
-            --targetWorkflow "dispatch-deploy-static-notify-supplier-api-env.yaml " \
+            --targetWorkflow "dispatch-deploy-static-notify-supplier-api-env.yaml" \
             --targetEnvironment "main" \
             --targetAccountGroup "nhs-notify-supplier-api-dev" \
             --targetComponent "${{ matrix.component }}" \
-            --terraformAction "apply" \
-            --overrideProjectName "nhs" \
-            --overrideRoleName "nhs-main-acct-supplier-api-github-deploy"
+            --terraformAction "apply"
diff --git a/.github/workflows/release_created.yaml b/.github/workflows/release_created.yaml
@@ -36,6 +36,4 @@ jobs:
             --targetEnvironment "main" \
             --targetAccountGroup "nhs-notify-supplier-api-nonprod" \
             --targetComponent "${{ matrix.component }}" \
-            --terraformAction "apply" \
-            --overrideProjectName "nhs" \
-            --overrideRoleName "nhs-main-acct-supplier-api-github-deploy"
+            --terraformAction "apply"
diff --git a/.github/workflows/stage-4-acceptance.yaml b/.github/workflows/stage-4-acceptance.yaml
@@ -31,6 +31,9 @@ on:
         description: "Version of the software, set by the CI/CD pipeline workflow"
         required: true
         type: string
+      pr_number:
+        required: true
+        type: string
 
 jobs:
   environment-set-up:
diff --git a/infrastructure/terraform/components/api/README.md b/infrastructure/terraform/components/api/README.md
@@ -29,12 +29,12 @@ No requirements.
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
+| <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip | n/a |
 | <a name="module_domain_truststore"></a> [domain\_truststore](#module\_domain\_truststore) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.17 |
-| <a name="module_get_letters"></a> [get\_letters](#module\_get\_letters) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.10 |
-| <a name="module_kms"></a> [kms](#module\_kms) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v2.0.10 |
+| <a name="module_get_letters"></a> [get\_letters](#module\_get\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip | n/a |
+| <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip | n/a |
 | <a name="module_logging_bucket"></a> [logging\_bucket](#module\_logging\_bucket) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.17 |
-| <a name="module_patch_letters"></a> [patch\_letters](#module\_patch\_letters) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.10 |
+| <a name="module_patch_letters"></a> [patch\_letters](#module\_patch\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip | n/a |
 | <a name="module_supplier_ssl"></a> [supplier\_ssl](#module\_supplier\_ssl) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/ssl | v2.0.17 |
 ## Outputs
 
diff --git a/infrastructure/terraform/components/api/acm_certificate.tf b/infrastructure/terraform/components/api/acm_certificate.tf
@@ -8,6 +8,6 @@ resource "aws_acm_certificate" "main" {
 }
 
 resource "aws_acm_certificate_validation" "main" {
-  certificate_arn = aws_acm_certificate.main.arn
+  certificate_arn         = aws_acm_certificate.main.arn
   validation_record_fqdns = [for record in aws_route53_record.acm_validation : record.fqdn]
 }
diff --git a/infrastructure/terraform/components/api/api_gateway_domain.tf b/infrastructure/terraform/components/api/api_gateway_domain.tf
@@ -8,14 +8,14 @@ resource "aws_api_gateway_domain_name" "main" {
   }
 
   mutual_tls_authentication {
-      truststore_uri     = var.manually_configure_mtls_truststore ? "s3://${local.acct.s3_buckets["truststore"]["id"]}/${var.ca_pem_filename}" : "s3://${local.acct.s3_buckets["truststore"]["id"]}/${aws_s3_object.placeholder_truststore[0].key}"
-      truststore_version = var.manually_configure_mtls_truststore ? data.aws_s3_object.external_ca_cert[0].version_id : aws_s3_object.placeholder_truststore[0].version_id
+    truststore_uri     = var.manually_configure_mtls_truststore ? "s3://${local.acct.s3_buckets["truststore"]["id"]}/${var.ca_pem_filename}" : "s3://${local.acct.s3_buckets["truststore"]["id"]}/${aws_s3_object.placeholder_truststore[0].key}"
+    truststore_version = var.manually_configure_mtls_truststore ? data.aws_s3_object.external_ca_cert[0].version_id : aws_s3_object.placeholder_truststore[0].version_id
   }
 }
 
 data "aws_s3_object" "external_ca_cert" {
   count = var.manually_configure_mtls_truststore ? 1 : 0
 
   bucket = local.acct.s3_buckets["truststore"]["id"]
-  key = "${local.csi}/${var.ca_pem_filename}"
+  key    = "${local.csi}/${var.ca_pem_filename}"
 }
diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf
@@ -1,6 +1,6 @@
 resource "aws_api_gateway_rest_api" "main" {
-  name        = local.csi
-  body        = local.openapi_spec
-  description = "Suppliers API"
+  name                         = local.csi
+  body                         = local.openapi_spec
+  description                  = "Suppliers API"
   disable_execute_api_endpoint = true
 }
diff --git a/infrastructure/terraform/components/api/module_authorizer_lambda.tf b/infrastructure/terraform/components/api/module_authorizer_lambda.tf
@@ -1,5 +1,5 @@
 module "authorizer_lambda" {
-  source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.4"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip"
 
   aws_account_id = var.aws_account_id
   component      = var.component
diff --git a/infrastructure/terraform/components/api/module_domain_truststore.tf b/infrastructure/terraform/components/api/module_domain_truststore.tf
@@ -8,8 +8,8 @@ module "domain_truststore" {
   project        = var.project
   region         = var.region
 
-  default_tags   = local.default_tags
-  kms_key_arn = module.kms.key_id
+  default_tags = local.default_tags
+  kms_key_arn  = module.kms.key_id
 
   bucket_logging_target = {
     bucket = module.logging_bucket.bucket
diff --git a/infrastructure/terraform/components/api/module_kms.tf b/infrastructure/terraform/components/api/module_kms.tf
@@ -1,5 +1,5 @@
 module "kms" {
-  source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v2.0.10"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip"
 
   providers = {
     aws           = aws
diff --git a/infrastructure/terraform/components/api/module_lambda_get_letters.tf b/infrastructure/terraform/components/api/module_lambda_get_letters.tf
@@ -1,5 +1,5 @@
 module "get_letters" {
-  source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.10"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip"
 
   function_name = "get_letters"
   description   = "Get paginated letter ids"
@@ -37,7 +37,7 @@ module "get_letters" {
 
   lambda_env_vars = {
     LETTERS_TABLE_NAME = aws_dynamodb_table.letters.name,
-    LETTER_TTL_HOURS = 24
+    LETTER_TTL_HOURS   = 24
   }
 }
 
diff --git a/infrastructure/terraform/components/api/module_lambda_patch_letters.tf b/infrastructure/terraform/components/api/module_lambda_patch_letters.tf
@@ -1,5 +1,5 @@
 module "patch_letters" {
-  source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.10"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip"
 
   function_name = "patch_letters"
   description   = "Update the status of a letter"
@@ -37,7 +37,7 @@ module "patch_letters" {
 
   lambda_env_vars = {
     LETTERS_TABLE_NAME = aws_dynamodb_table.letters.name,
-    LETTER_TTL_HOURS = 24
+    LETTER_TTL_HOURS   = 24
   }
 }
 
@@ -56,7 +56,7 @@ data "aws_iam_policy_document" "patch_letters_lambda" {
     ]
   }
 
-    statement {
+  statement {
     sid    = "AllowDynamoDBAccess"
     effect = "Allow"
 
diff --git a/infrastructure/terraform/components/api/module_logging_bucket.tf b/infrastructure/terraform/components/api/module_logging_bucket.tf
@@ -8,8 +8,8 @@ module "logging_bucket" {
   project        = var.project
   region         = var.region
 
-  default_tags   = local.default_tags
-  kms_key_arn = module.kms.key_id
+  default_tags = local.default_tags
+  kms_key_arn  = module.kms.key_id
 
   policy_documents = [
     data.aws_iam_policy_document.logging.json
@@ -18,18 +18,18 @@ module "logging_bucket" {
 
 data "aws_iam_policy_document" "logging" {
   statement {
-      sid    = "s3-log-delivery"
-      effect = "Allow"
+    sid    = "s3-log-delivery"
+    effect = "Allow"
 
-      principals {
-        type        = "Service"
-        identifiers = ["logging.s3.amazonaws.com"]
-      }
+    principals {
+      type        = "Service"
+      identifiers = ["logging.s3.amazonaws.com"]
+    }
 
-      actions = ["s3:PutObject"]
+    actions = ["s3:PutObject"]
 
-      resources = [
-        "${module.logging_bucket.arn}/*",
-      ]
-    }
+    resources = [
+      "${module.logging_bucket.arn}/*",
+    ]
+  }
 }
diff --git a/infrastructure/terraform/components/api/module_supplier_ssl.tf b/infrastructure/terraform/components/api/module_supplier_ssl.tf
@@ -3,12 +3,12 @@ module "supplier_ssl" {
 
   source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/ssl?ref=v2.0.17"
 
-  name           = "sapi_trust"
-  aws_account_id = var.aws_account_id
-  default_tags   = local.default_tags
-  component      = var.component
-  environment    = var.environment
-  project        = var.project
-  region         = var.region
+  name                = "sapi_trust"
+  aws_account_id      = var.aws_account_id
+  default_tags        = local.default_tags
+  component           = var.component
+  environment         = var.environment
+  project             = var.project
+  region              = var.region
   subject_common_name = local.root_domain_name
 }
diff --git a/infrastructure/terraform/components/api/s3_object_placeholder_truststore.tf b/infrastructure/terraform/components/api/s3_object_placeholder_truststore.tf
@@ -1,6 +1,6 @@
 # In manually configured (e.g. dev main, nonprod main, prod main) add lifecycle policy to permit manual management of cert
 resource "aws_s3_object" "placeholder_truststore" {
-  count   = var.manually_configure_mtls_truststore ? 0 : 1
+  count = var.manually_configure_mtls_truststore ? 0 : 1
 
   bucket  = local.acct.s3_buckets["truststore"]["id"]
   key     = "${local.csi}/truststore.pem"

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,6 @@ resource "aws_acm_certificate" "main" {`
`8`	`8`	`}`
`9`	`9`
`10`	`10`	`resource "aws_acm_certificate_validation" "main" {`
`11`		`- certificate_arn = aws_acm_certificate.main.arn`
	`11`	`+ certificate_arn = aws_acm_certificate.main.arn`
`12`	`12`	`validation_record_fqdns = [for record in aws_route53_record.acm_validation : record.fqdn]`
`13`	`13`	`}`
Original file line number	Diff line number	Diff line change
`@@ -8,14 +8,14 @@ resource "aws_api_gateway_domain_name" "main" {`
`8`	`8`	`}`
`9`	`9`
`10`	`10`	`mutual_tls_authentication {`
`11`		`- truststore_uri = var.manually_configure_mtls_truststore ? "s3://${local.acct.s3_buckets["truststore"]["id"]}/${var.ca_pem_filename}" : "s3://${local.acct.s3_buckets["truststore"]["id"]}/${aws_s3_object.placeholder_truststore[0].key}"`
`12`		`- truststore_version = var.manually_configure_mtls_truststore ? data.aws_s3_object.external_ca_cert[0].version_id : aws_s3_object.placeholder_truststore[0].version_id`
	`11`	`+ truststore_uri = var.manually_configure_mtls_truststore ? "s3://${local.acct.s3_buckets["truststore"]["id"]}/${var.ca_pem_filename}" : "s3://${local.acct.s3_buckets["truststore"]["id"]}/${aws_s3_object.placeholder_truststore[0].key}"`
	`12`	`+ truststore_version = var.manually_configure_mtls_truststore ? data.aws_s3_object.external_ca_cert[0].version_id : aws_s3_object.placeholder_truststore[0].version_id`
`13`	`13`	`}`
`14`	`14`	`}`
`15`	`15`
`16`	`16`	`data "aws_s3_object" "external_ca_cert" {`
`17`	`17`	`count = var.manually_configure_mtls_truststore ? 1 : 0`
`18`	`18`
`19`	`19`	`bucket = local.acct.s3_buckets["truststore"]["id"]`
`20`		`- key = "${local.csi}/${var.ca_pem_filename}"`
	`20`	`+ key = "${local.csi}/${var.ca_pem_filename}"`
`21`	`21`	`}`