Drift from template

aidenvaines-cgi · github-actions[bot] · commit 94744aaf4eb0 · 2025-04-01T00:29:55.000Z
diff --git a/.github/actions/build-docs/action.yml b/.github/actions/build-docs/action.yml
@@ -0,0 +1,42 @@
+name: "Build Docs"
+description: "build jekyll docs"
+inputs:
+  version:
+    description: "Version number"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+    - name: Npm cli install
+      working-directory: ./docs
+      run: npm ci
+      shell: bash
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@v1.180.1
+      with:
+        ruby-version: "3.2" # Not needed with a .ruby-version file
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+        cache-version: 0 # Increment this number if you need to re-download cached gems
+        working-directory: "./docs"
+    - name: Setup Pages
+      id: pages
+      uses: actions/configure-pages@v5
+    - name: Build with Jekyll
+      working-directory: ./docs
+      # Outputs to the './_site' directory by default
+      shell: bash
+      run: make build BASE_URL="${{ steps.pages.outputs.base_path }}" VERSION="${{ inputs.version }}"
+      #run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+      env:
+        JEKYLL_ENV: production
+    - name: Upload artifact
+      # Automatically uploads an artifact from the './_site' directory by default
+      uses: actions/upload-pages-artifact@v3
+      with:
+        path: "docs/_site/"
+        name: jekyll-docs-${{ inputs.version }}
diff --git a/.tool-versions b/.tool-versions
@@ -4,6 +4,7 @@ pre-commit 3.6.0
 terraform 1.9.2
 terraform-docs 0.19.0
 vale 3.6.0
+python 3.13.2
 tfsec 1.28.10
 nodejs 20.18.2
 jq 1.6
diff --git a/infrastructure/terraform/bin/terraform.sh b/infrastructure/terraform/bin/terraform.sh
@@ -793,8 +793,8 @@ case "${action}" in
     ;;
   *)
     echo -e "Generic action case invoked. Only the additional arguments will be passed to terraform, you break it you fix it:";
-    echo -e "\tterraform ${action} ${extra_args}";
-    terraform "${action}" ${extra_args} \
+    echo -e "\tterraform ${action} ${extra_args} | tee terraform_output";
+    terraform "${action}" ${extra_args} | tee terraform_output \
       || error_and_die "Terraform ${action} failed.";
     ;;
 esac;
diff --git a/scripts/config/.repository-template-sync-ignore b/scripts/config/.repository-template-sync-ignore
@@ -1,4 +1,6 @@
 # Files and folders to ignore when syncing nhs-notify-repository-template back in to this repository
+/Makefile
+scripts/**/examples/
 .github/workflows/
 nhs-notify-repository-template/
 .github/CODEOWNERS
diff --git a/scripts/config/.repository-template-sync-merge b/scripts/config/.repository-template-sync-merge
@@ -3,5 +3,6 @@ scripts/config/.repository-template-sync-ignore
 scripts/config/.repository-template-sync-merge
 .tool-versions
 .gitignore
+scripts/config/vale/vale.ini
 scripts/config/vale/styles/config/vocabularies/words/accept.txt
 scripts/config/vale/styles/config/vocabularies/words/reject.txt
diff --git a/scripts/config/pre-commit.yaml b/scripts/config/pre-commit.yaml
@@ -9,7 +9,6 @@ repos:
       - id: check-symlinks
       - id: detect-private-key
       - id: end-of-file-fixer
-        exclude: .+\.cs
       - id: forbid-new-submodules
       - id: mixed-line-ending
       - id: pretty-format-json
diff --git a/scripts/config/vale/styles/config/vocabularies/words/accept.txt b/scripts/config/vale/styles/config/vocabularies/words/accept.txt
@@ -9,6 +9,7 @@ drawio
 endcapture
 endfor
 endraw
+Git[Hh]ub
 GitHub
 Gitleaks
 Grype
diff --git a/scripts/devcontainer/postcreatecommand.sh b/scripts/devcontainer/postcreatecommand.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+rm -Rf ~/.asdf
+git clone https://github.com/asdf-vm/asdf.git ~/.asdf;
+chmod +x ~/.asdf/asdf.sh;
+echo '. $HOME/.asdf/asdf.sh' >> ~/.zshrc
+echo '. $HOME/.asdf/completions/asdf.bash' >> ~/.zshrc
+
+source ~/.zshrc
+
+echo 'asdf setup complete'
+
+make config
+
+jekyll --version && cd docs && bundle install
+
+echo 'jekyll setup complete'
diff --git a/scripts/devcontainer/poststartcommand.sh b/scripts/devcontainer/poststartcommand.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+source ~/.zshrc
+make config
diff --git a/scripts/docker/examples/python/.tool-versions.example b/scripts/docker/examples/python/.tool-versions.example
@@ -0,0 +1,2 @@
+# python, SEE: https://hub.docker.com/_/python/tags
+# docker/python 3.11.4-alpine3.18@sha256:0135ae6442d1269379860b361760ad2cf6ab7c403d21935a8015b48d5bf78a86
diff --git a/scripts/docker/examples/python/Dockerfile b/scripts/docker/examples/python/Dockerfile
@@ -0,0 +1,33 @@
+# `*:latest` will be replaced with a corresponding version stored in the '.tool-versions' file
+# hadolint ignore=DL3007
+FROM python:latest as base
+
+# === Builder ==================================================================
+
+FROM base AS builder
+COPY ./assets/hello_world/requirements.txt /requirements.txt
+WORKDIR /packages
+RUN set -eux; \
+    \
+    # Install dependencies
+    pip install \
+        --requirement /requirements.txt \
+        --prefix=/packages \
+        --no-warn-script-location \
+        --no-cache-dir
+
+# === Runtime ==================================================================
+
+FROM base
+ENV \
+    LANG="C.UTF-8" \
+    LC_ALL="C.UTF-8" \
+    PYTHONDONTWRITEBYTECODE="1" \
+    PYTHONUNBUFFERED="1" \
+    TZ="UTC"
+COPY --from=builder /packages /usr/local
+COPY ./assets/hello_world /hello_world
+WORKDIR /hello_world
+USER nobody
+CMD [ "python", "app.py" ]
+EXPOSE 8000
diff --git a/scripts/docker/examples/python/Dockerfile.effective b/scripts/docker/examples/python/Dockerfile.effective
@@ -0,0 +1,54 @@
+# `*:latest` will be replaced with a corresponding version stored in the '.tool-versions' file
+FROM python:3.11.4-alpine3.18@sha256:0135ae6442d1269379860b361760ad2cf6ab7c403d21935a8015b48d5bf78a86 as base
+
+# === Builder ==================================================================
+
+FROM base AS builder
+COPY ./assets/hello_world/requirements.txt /requirements.txt
+WORKDIR /packages
+RUN set -eux; \
+    \
+    # Install dependencies
+    pip install \
+        --requirement /requirements.txt \
+        --prefix=/packages \
+        --no-warn-script-location \
+        --no-cache-dir
+
+# === Runtime ==================================================================
+
+FROM base
+ENV \
+    LANG="C.UTF-8" \
+    LC_ALL="C.UTF-8" \
+    PYTHONDONTWRITEBYTECODE="1" \
+    PYTHONUNBUFFERED="1" \
+    TZ="UTC"
+COPY --from=builder /packages /usr/local
+COPY ./assets/hello_world /hello_world
+WORKDIR /hello_world
+USER nobody
+CMD [ "python", "app.py" ]
+EXPOSE 8000
+
+# === Metadata =================================================================
+
+ARG IMAGE
+ARG TITLE
+ARG DESCRIPTION
+ARG LICENCE
+ARG GIT_URL
+ARG GIT_BRANCH
+ARG GIT_COMMIT_HASH
+ARG BUILD_DATE
+ARG BUILD_VERSION
+LABEL \
+    org.opencontainers.image.base.name=$IMAGE \
+    org.opencontainers.image.title="$TITLE" \
+    org.opencontainers.image.description="$DESCRIPTION" \
+    org.opencontainers.image.licenses="$LICENCE" \
+    org.opencontainers.image.url=$GIT_URL \
+    org.opencontainers.image.ref.name=$GIT_BRANCH \
+    org.opencontainers.image.revision=$GIT_COMMIT_HASH \
+    org.opencontainers.image.created=$BUILD_DATE \
+    org.opencontainers.image.version=$BUILD_VERSION
diff --git a/scripts/docker/examples/python/assets/hello_world/app.py b/scripts/docker/examples/python/assets/hello_world/app.py
@@ -0,0 +1,12 @@
+from flask import Flask
+from flask_wtf.csrf import CSRFProtect
+
+app = Flask(__name__)
+csrf = CSRFProtect()
+csrf.init_app(app)
+
+@app.route("/")
+def index():
+    return "Hello World!"
+
+app.run(host='0.0.0.0', port=8000)
diff --git a/scripts/docker/examples/python/assets/hello_world/requirements.txt b/scripts/docker/examples/python/assets/hello_world/requirements.txt
@@ -0,0 +1,12 @@
+blinker==1.6.2
+click==8.1.7
+Flask-WTF==1.2.0
+Flask==2.3.3
+itsdangerous==2.1.2
+Jinja2==3.1.5
+MarkupSafe==2.1.3
+pip==23.3
+setuptools==78.1.0
+Werkzeug==3.0.6
+wheel==0.41.1
+WTForms==3.0.1
diff --git a/scripts/docker/examples/python/tests/goss.yaml b/scripts/docker/examples/python/tests/goss.yaml
@@ -0,0 +1,8 @@
+package:
+  python:
+    installed: true
+
+command:
+  pip list | grep -i flask:
+    exit-status: 0
+    timeout: 60000
diff --git a/scripts/githooks/sort-dictionary.sh b/scripts/githooks/sort-dictionary.sh
@@ -25,7 +25,8 @@ function main() {
   mv $root/accept.sorted.txt $root/accept.txt
   mv $root/reject.sorted.txt $root/reject.txt
 
-  git add -uv $root/*
+  # Update the sorted files in the staged git index
+  git add --update --verbose $root/*
 }
 
 # ==============================================================================
diff --git a/scripts/githooks/sync-template-repo.sh b/scripts/githooks/sync-template-repo.sh
@@ -42,15 +42,13 @@ if [ ! -f "${MERGE_FILE}" ]; then
   echo "# Files and folders to merge when syncing ${TEMPLATE_REPO_DIR} back in to this repository" > ${MERGE_FILE}
 fi
 
-# Read the .template-ignore file into an array
-while IFS= read -r line || [ -n "$line" ]; do
-  IGNORED_PATHS+=("$line")
-done < "$IGNORE_FILE"
+TMP_SYNC_IGNORE=${PWD}/tmp-sync-ignore
+mkdir -p "${TMP_SYNC_IGNORE}"
+cp "${IGNORE_FILE}" "${TMP_SYNC_IGNORE}/.gitignore"
 
-# Read the .template-merge file into an array
-while IFS= read -r line || [ -n "$line" ]; do
-  MERGED_PATHS+=("$line")
-done < "$MERGE_FILE"
+TMP_SYNC_MERGE=${PWD}/tmp-sync-merge
+mkdir -p "${TMP_SYNC_MERGE}"
+cp "${MERGE_FILE}" "${TMP_SYNC_MERGE}/.gitignore"
 
 # Check if a file is ignored.
 is_ignored() {
@@ -61,27 +59,25 @@ is_ignored() {
     return 0
   fi
 
-  for ignored in "${IGNORED_PATHS[@]}"; do
-    if [[ -n "$ignored" && "$file" =~ $ignored ]]; then
-      return 0
-    fi
-  done
-  return 1
+  pushd "${TMP_SYNC_IGNORE}" > /dev/null
+  git check-ignore -q "${file}"
+  R=$?
+  popd > /dev/null
+  return $R
 }
 
 is_merge() {
   local file=${1}
 
-  for merged in "${MERGED_PATHS[@]}"; do
-    if [[ -n "$merged" && "$file" =~ $merged ]]; then
-      return 0
-    fi
-  done
-  return 1
+  pushd "${TMP_SYNC_MERGE}" > /dev/null
+  git check-ignore -q "${file}"
+  R=$?
+  popd > /dev/null
+  return $R
 }
 
 # Navigate to the template directory
-cd "${TEMPLATE_REPO_DIR}" || exit
+pushd "${TEMPLATE_REPO_DIR}" || exit
 FILES_ADDED=()
 FILES_WITH_CHANGES=()
 
@@ -127,6 +123,9 @@ while IFS= read -r -d '' file || [[ -n $file ]]; do
   fi
 done < <(find . -type f -print0)
 
+popd
+rm -rf "${TMP_SYNC_IGNORE}" "${TMP_SYNC_MERGE}"
+
 echo ------------------------------------------
 echo "${#FILES_ADDED[@]} files added, ${#FILES_WITH_CHANGES[@]} files with changes detected."
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+#!/bin/bash`
	`2`	`+source ~/.zshrc`
	`3`	`+make config`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# python, SEE: https://hub.docker.com/_/python/tags`
	`2`	`+# docker/python 3.11.4-alpine3.18@sha256:0135ae6442d1269379860b361760ad2cf6ab7c403d21935a8015b48d5bf78a86`