Skip to content

Commit 4ed0a36

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
CCM-11345 manual repo sync (#583)
1 parent c346543 commit 4ed0a36

File tree

17 files changed

+418
-50
lines changed

17 files changed

+418
-50
lines changed

‎.github/SECURITY.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ If you wish to notify us of a vulnerability via email, please include detailed i
2121

2222
You can reach us at:
2323

24-
- _[ A product team email address ]_
25-
- [[email protected]]([email protected])
24+
- [[email protected]](mailto:[email protected])
25+
- [[email protected]](mailto:[email protected])
2626

2727
### NCSC
2828

‎.github/actions/check-todo-usage/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Check Todo usage"
2+
description: "Check Todo usage"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Check Todo usage"
7+
shell: bash
8+
run: |
9+
export BRANCH_NAME=origin/${{ github.event.repository.default_branch }}
10+
check=branch ./scripts/githooks/check-todos.sh

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
3333
- name: Create Pull Request
3434
if: ${{ !env.ACT }}
35-
uses: peter-evans/[email protected].7
35+
uses: peter-evans/[email protected].8
3636
with:
3737
token: ${{ secrets.GITHUB_TOKEN }}
3838
commit-message: Drift from template

‎.github/workflows/scorecard.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '15 22 * * 5'
14+
push:
15+
branches: [ "main" ]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
# Uncomment the permissions below if installing in a private repository.
30+
contents: read
31+
actions: read
32+
33+
steps:
34+
- name: "Checkout code"
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
with:
37+
persist-credentials: false
38+
39+
- name: "Run analysis"
40+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
41+
with:
42+
results_file: results.sarif
43+
results_format: sarif
44+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
45+
# - you want to enable the Branch-Protection check on a *public* repository, or
46+
# - you are installing Scorecard on a *private* repository
47+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
48+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
49+
50+
# Public repositories:
51+
# - Publish results to OpenSSF REST API for easy access by consumers
52+
# - Allows the repository to include the Scorecard badge.
53+
# - See https://github.com/ossf/scorecard-action#publishing-results.
54+
# For private repositories:
55+
# - `publish_results` will always be set to `false`, regardless
56+
# of the value entered here.
57+
publish_results: false
58+
59+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
60+
# format to the repository Actions tab.
61+
- name: "Upload artifact"
62+
uses: actions/upload-artifact@v4
63+
with:
64+
name: SARIF file
65+
path: results.sarif
66+
retention-days: 5
67+
68+
# Upload the results to GitHub's code scanning dashboard (optional).
69+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
70+
- name: "Upload to code-scanning"
71+
uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
72+
with:
73+
sarif_file: results.sarif

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
scan-secrets:
3737
name: "Scan secrets"
3838
runs-on: ubuntu-latest
39-
timeout-minutes: 2
39+
timeout-minutes: 5
4040
steps:
4141
- name: "Checkout code"
4242
uses: actions/checkout@v4
@@ -47,7 +47,7 @@ jobs:
4747
check-file-format:
4848
name: "Check file format"
4949
runs-on: ubuntu-latest
50-
timeout-minutes: 2
50+
timeout-minutes: 5
5151
steps:
5252
- name: "Checkout code"
5353
uses: actions/checkout@v4
@@ -58,7 +58,7 @@ jobs:
5858
check-markdown-format:
5959
name: "Check Markdown format"
6060
runs-on: ubuntu-latest
61-
timeout-minutes: 2
61+
timeout-minutes: 5
6262
steps:
6363
- name: "Checkout code"
6464
uses: actions/checkout@v4
@@ -93,14 +93,25 @@ jobs:
9393
check-english-usage:
9494
name: "Check English usage"
9595
runs-on: ubuntu-latest
96-
timeout-minutes: 2
96+
timeout-minutes: 5
9797
steps:
9898
- name: "Checkout code"
9999
uses: actions/checkout@v4
100100
with:
101101
fetch-depth: 0 # Full history is needed to compare branches
102102
- name: "Check English usage"
103103
uses: ./.github/actions/check-english-usage
104+
check-todo-usage:
105+
name: "Check TODO usage"
106+
runs-on: ubuntu-latest
107+
timeout-minutes: 5
108+
steps:
109+
- name: "Checkout code"
110+
uses: actions/checkout@v4
111+
with:
112+
fetch-depth: 0 # Full history is needed to compare branches
113+
- name: "Check TODO usage"
114+
uses: ./.github/actions/check-todo-usage
104115
detect-terraform-changes:
105116
name: "Detect Terraform Changes"
106117
runs-on: ubuntu-latest
@@ -127,7 +138,7 @@ jobs:
127138
lint-terraform:
128139
name: "Lint Terraform"
129140
runs-on: ubuntu-latest
130-
timeout-minutes: 2
141+
timeout-minutes: 5
131142
needs: detect-terraform-changes
132143
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
133144
steps:
@@ -145,7 +156,7 @@ jobs:
145156
- name: "Checkout code"
146157
uses: actions/checkout@v4
147158
- name: "Setup ASDF"
148-
uses: asdf-vm/actions/setup@v3
159+
uses: asdf-vm/actions/setup@v4
149160
- name: "Perform Setup"
150161
uses: ./.github/actions/setup
151162
- name: "Trivy Scan"
@@ -156,7 +167,7 @@ jobs:
156167
permissions:
157168
id-token: write
158169
contents: read
159-
timeout-minutes: 2
170+
timeout-minutes: 5
160171
steps:
161172
- name: "Checkout code"
162173
uses: actions/checkout@v4
@@ -175,7 +186,7 @@ jobs:
175186
permissions:
176187
id-token: write
177188
contents: read
178-
timeout-minutes: 2
189+
timeout-minutes: 5
179190
steps:
180191
- name: "Checkout code"
181192
uses: actions/checkout@v4

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ terraform 1.9.2
77
terraform-docs 0.19.0
88
trivy 0.61.0
99
vale 3.6.0
10+
# python 3.13.2
1011

1112
# ==============================================================================
1213
# The section below is reserved for Docker image versions.

‎LICENCE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# MIT Licence
22

3-
Copyright (c) 2024 Crown Copyright NHS England.
3+
Copyright (c) 2025 Crown Copyright NHS England.
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎infrastructure/terraform/bin/terraform.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -793,8 +793,8 @@ case "${action}" in
793793
;;
794794
*)
795795
echo -e "Generic action case invoked. Only the additional arguments will be passed to terraform, you break it you fix it:";
796-
echo -e "\tterraform ${action} ${extra_args}";
797-
terraform "${action}" ${extra_args} \
796+
echo -e "\tterraform ${action} ${extra_args} | tee terraform_output";
797+
terraform "${action}" ${extra_args} | tee terraform_output \
798798
|| error_and_die "Terraform ${action} failed.";
799799
;;
800800
esac;

‎scripts/config/.repository-template-sync-ignore‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,33 @@
11
# Files and folders to ignore when syncing nhs-notify-repository-template back in to this repository
2-
.github/workflows/
32
nhs-notify-repository-template/
4-
.github/CODEOWNERS
53

64
# Files and Folders in this repository to ignore
5+
.editorconfig
6+
.github/CODEOWNERS
7+
.github/ISSUE_TEMPLATE
8+
.github/workflows/cicd-*.yaml
9+
.github/workflows/stage-*.yaml
10+
.gitleaksignore
711
.vscode/
12+
Makefile
813
CHANGELOG.md
914
project.code-workspace
1015
README.md
11-
VERSION
12-
.editorconfig
13-
.gitleaksignore
14-
scripts/tests/
15-
Makefile
1616
scripts/config/sonar-scanner.properties
17+
scripts/tests/
18+
VERSION
1719

1820
# Files and Folders in the template repository to disregard
1921
.devcontainer/
20-
.github/workflows/cicd-*.yaml
22+
.github/actions/build-docs
23+
.github/workflows/*.disabled
2124
*/examples/
2225
docs/
26+
eslint.config.mjs
2327
infrastructure/terraform/components/
24-
docker/examples/
28+
lambdas/example-lambda/
29+
package-lock.json
30+
package.json
31+
scripts/**/examples/
32+
scripts/terraform/terraform.mk
33+
src/.vscode/

‎scripts/config/.repository-template-sync-merge‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Files and folders to merge when syncing nhs-notify-repository-template back in to this repository
2+
.github/workflows/cicd-*.yaml
23
scripts/config/.repository-template-sync-ignore
34
scripts/config/.repository-template-sync-merge
5+
scripts/config/vale/vale.ini
46
.tool-versions
57
.gitignore
68
scripts/config/vale/styles/config/vocabularies/words/accept.txt

0 commit comments

Comments
 (0)