Merge pull request #796 from alan-turing-institute/staging

Release: dependency upgrades, migration fixes, and curriculum bug fix

Author: chrisdburr

.github/workflows/build.yaml

@@ -70,13 +70,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
       - name: Setup Node.js with cache
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -85,11 +85,11 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Cache Prisma Client
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: prisma-cache-validate
         with:
-          path: node_modules/.prisma/client
-          key: prisma-${{ runner.os }}-${{ hashFiles('prisma/schema.prisma') }}
+          path: src/generated/prisma
+          key: prisma-${{ runner.os }}-${{ hashFiles('prisma/schema.prisma', 'pnpm-lock.yaml') }}
 
       - name: Generate Prisma client
         if: steps.prisma-cache-validate.outputs.cache-hit != 'true'
@@ -140,13 +140,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
       - name: Setup Node.js with cache
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -155,11 +155,11 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Cache Prisma Client
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: prisma-cache-test
         with:
-          path: node_modules/.prisma/client
-          key: prisma-${{ runner.os }}-${{ hashFiles('prisma/schema.prisma') }}
+          path: src/generated/prisma
+          key: prisma-${{ runner.os }}-${{ hashFiles('prisma/schema.prisma', 'pnpm-lock.yaml') }}
 
       - name: Generate Prisma client
         if: steps.prisma-cache-test.outputs.cache-hit != 'true'
@@ -207,7 +207,7 @@ jobs:
           cp -r .next/static .next/standalone/.next/static
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright
@@ -225,15 +225,15 @@ jobs:
         run: pnpm exec playwright test
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: playwright-report
           path: playwright-report/
           retention-days: 14
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: test-results
@@ -251,21 +251,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -288,7 +288,7 @@ jobs:
 
       - name: Build and push Docker image (Production - main branch)
         if: github.ref == 'refs/heads/main'
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
@@ -309,7 +309,7 @@ jobs:
 
       - name: Build and push Docker image (Staging branch)
         if: github.ref == 'refs/heads/staging'
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
@@ -330,7 +330,7 @@ jobs:
 
       - name: Build and push Docker image (PR/other branches)
         if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/staging'
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile

.github/workflows/cleanup-images.yaml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Delete PR images older than 14 days
-        uses: snok/container-retention-policy@v3
+        uses: snok/container-retention-policy@v3.0.1
         with:
           account: alan-turing-institute
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_TOKEN }}
@@ -28,7 +28,7 @@ jobs:
         uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "pnpm"

.github/workflows/seed-staging.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 

.pre-commit-config.yaml

@@ -34,15 +34,15 @@ repos:
     hooks:
       - id: ultracite-lint
         name: ultracite lint (staged files)
-        entry: bash -c 'FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E "\.(jsx?|tsx?|json)$" || true); [ -z "$FILES" ] && exit 0; echo "$FILES" | xargs npx ultracite lint'
+        entry: bash -c 'FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E "\.(jsx?|tsx?|json)$" || true); [ -z "$FILES" ] && exit 0; echo "$FILES" | xargs npx ultracite check'
         language: system
         pass_filenames: false
         files: '\.(jsx?|tsx?|json)$'
         exclude: '(node_modules|\.next|public/documentation|logs)/'
 
       - id: ultracite-format
         name: ultracite format (staged files, safe fixes only)
-        entry: bash -c 'FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E "\.(jsx?|tsx?|json)$" || true); [ -z "$FILES" ] && exit 0; echo "$FILES" | xargs npx ultracite format || true'
+        entry: bash -c 'FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E "\.(jsx?|tsx?|json)$" || true); [ -z "$FILES" ] && exit 0; echo "$FILES" | xargs npx ultracite fix || true'
         language: system
         pass_filenames: false
         files: '\.(jsx?|tsx?|json)$'

.secrets.baseline

@@ -315,7 +315,7 @@
         "filename": "lib/services/user-management-service.ts",
         "hashed_secret": "8911a1ef22f1dfd8cd71925c676afa4fb2959a12",
         "is_verified": false,
-        "line_number": 248
+        "line_number": 254
       }
     ],
     "lib/services/user-service.ts": [
@@ -13103,7 +13103,7 @@
         "filename": "prisma/seed/dev-seed.ts",
         "hashed_secret": "8911a1ef22f1dfd8cd71925c676afa4fb2959a12",
         "is_verified": false,
-        "line_number": 129
+        "line_number": 130
       }
     ],
     "public/documentation/docs/technical-guide/setup-installation/cloud-deployment/index.html": [
@@ -13130,7 +13130,7 @@
         "filename": "scripts/create-test-users.ts",
         "hashed_secret": "8911a1ef22f1dfd8cd71925c676afa4fb2959a12",
         "is_verified": false,
-        "line_number": 31
+        "line_number": 32
       }
     ],
     "scripts/seed-test-user.ts": [
@@ -13572,5 +13572,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-09T18:01:04Z"
+  "generated_at": "2026-03-13T14:56:39Z"
 }

actions/assurance-cases.ts

@@ -8,15 +8,15 @@ import {
 } from "@/lib/schemas/assurance-case";
 import { validateInput } from "@/lib/validation/input-validation";
 
-type AssuranceCase = {
+interface AssuranceCase {
+	createdDate?: string;
+	description?: string;
 	id: number | string;
+	isDemo?: boolean;
 	name: string;
-	description?: string;
-	createdDate?: string;
-	updatedDate?: string;
 	owner?: number | string;
-	isDemo?: boolean;
-};
+	updatedDate?: string;
+}
 
 export const fetchAssuranceCases = async (): Promise<
 	AssuranceCase[] | null
@@ -89,15 +89,15 @@ export const fetchPublishedAssuranceCases = async (): Promise<
 	return await Promise.resolve([]);
 };
 
-type PublishedCaseForStudy = {
+interface PublishedCaseForStudy {
+	description: string;
 	id: string;
+	markedReadyAt: string | null;
 	name: string;
-	description: string;
-	publishStatus: string;
 	publishedAt: string | null;
-	markedReadyAt: string | null;
 	publishedVersionId: string | null;
-};
+	publishStatus: string;
+}
 
 /**
  * Fetches the current user's cases that are available for linking to case studies

actions/case-data.ts

@@ -11,7 +11,7 @@ export async function loadStaticCaseData(
 	caseFile: string
 ): Promise<{ data: unknown } | { error: string }> {
 	// Validate filename to prevent path traversal
-	if (caseFile.includes("..") || caseFile.includes("/")) {
+	if (caseFile.includes("..") || caseFile.startsWith("/")) {
 		return { error: "Invalid case file name" };
 	}
 

actions/export-case.ts

@@ -4,9 +4,9 @@ import { validateSession } from "@/lib/auth/validate-session";
 import { uuidSchema } from "@/lib/schemas/base";
 import type { CaseExportNested } from "@/lib/schemas/case-export";
 
-type ExportOptions = {
+interface ExportOptions {
 	includeComments: boolean;
-};
+}
 
 type ExportResult = { data: CaseExportNested } | { error: string };
 

actions/export-document.ts

@@ -4,9 +4,9 @@ import { validateSession } from "@/lib/auth/validate-session";
 import { uuidSchema } from "@/lib/schemas/base";
 import type { CaseExportNested } from "@/lib/schemas/case-export";
 
-type DocumentExportOptions = {
+interface DocumentExportOptions {
 	includeComments: boolean;
-};
+}
 
 type DocumentExportResult = { data: CaseExportNested } | { error: string };