CCM-18143: Deprecated GitHub Actions Updated

.devcontainer/devcontainer.json

@@ -0,0 +1,70 @@
+{
+  "customizations": {
+    "codespaces": {
+      "openFiles": [
+        "README.md",
+        ".github/SECURITY.md",
+        "docs/index.md"
+      ]
+    },
+    "vscode": {
+      "extensions": [
+        "alefragnani.bookmarks",
+        "AmazonWebServices.aws-toolkit-vscode",
+        "chdsbd.github-code-owners",
+        "davidanson.vscode-markdownlint",
+        "dbaeumer.vscode-eslint",
+        "donjayamanne.githistory",
+        "editorconfig.editorconfig",
+        "esbenp.prettier-vscode",
+        "fvclaus.sort-json-array",
+        "github.codespaces",
+        "github.github-vscode-theme",
+        "github.remotehub",
+        "github.vscode-github-actions",
+        "github.vscode-pull-request-github",
+        "hediet.vscode-drawio",
+        "johnpapa.vscode-peacock",
+        "joshx.workspace-terminals",
+        "maattdd.gitless",
+        "mhutchie.git-graph",
+        "ms-azuretools.vscode-docker",
+        "ms-vscode-remote.remote-containers",
+        "ms-vscode-remote.remote-wsl",
+        "ms-vscode.hexeditor",
+        "ms-vscode.live-server",
+        "ms-vsliveshare.vsliveshare",
+        "redhat.vscode-xml",
+        "streetsidesoftware.code-spell-checker-british-english",
+        "takumii.markdowntable",
+        "tamasfe.even-better-toml",
+        "tomoki1207.pdf",
+        "vscode-icons-team.vscode-icons",
+        "vstirbu.vscode-mermaid-preview",
+        "wayou.vscode-todo-highlight",
+        "yzane.markdown-pdf",
+        "yzhang.dictionary-completion",
+        "yzhang.markdown-all-in-one",
+        "zoma.vscode-auto-open-workspace"
+      ],
+      "settings": {
+        "[makefile]": {
+          "editor.detectIndentation": false,
+          "editor.insertSpaces": false
+        },
+        "autoOpenWorkspace.enableAutoOpenIfSingleWorkspace": true,
+        "editor.formatOnSave": true,
+        "extensions.ignoreRecommendations": true,
+        "files.insertFinalNewline": true
+      }
+    }
+  },
+  "forwardPorts": [
+    4000
+  ],
+  "image": "ghcr.io/nhsdigital/nhs-notify-template-repository:latest",
+  "name": "Jekyll",
+  "runArgs": [
+    "--platform=linux/amd64"
+  ]
+}

.editorconfig

@@ -19,3 +19,13 @@ indent_size = 4
 
 [{Makefile,*.mk,go.mod,go.sum,*.go,.gitmodules}]
 indent_style = tab
+
+# Ignore paths
+[Gemfile.lock]
+charset = unset
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+indent_style = unset
+indent_size = unset
+generated_code = true

.gitattributes

@@ -1,5 +1,4 @@
 scripts/docker/** linguist-vendored
-scripts/githooks/** linguist-vendored
 scripts/reports/** linguist-vendored
 scripts/terraform/** linguist-vendored
 scripts/tests/test.mk linguist-vendored

.github/CODEOWNERS

@@ -0,0 +1,86 @@
+# NHS Notify Code Owners
+
+# Notify default owners
+*                           @NHSDigital/nhs-notify-repository-template
+
+/.github/                   @NHSDigital/nhs-notify-repository-template-admins
+*.code-workspace            @NHSDigital/nhs-notify-repository-template-admins
+/infrastructure/terraform/  @NHSDigital/nhs-notify-platform
+
+# Root level AGENTS.md owned by platform.
+AGENTS.md
+
+# Codeowners must be final check
+/.github/CODEOWNERS         @NHSDigital/nhs-notify-code-owners
+/CODEOWNERS                 @NHSDigital/nhs-notify-code-owners
+
+
+# Each NHS Notify repository should have clear code owners set.
+# Do not use GitHub team names, instead use the GitHub usernames
+# of the people who are responsible for the code maintenance.
+
+# This is a comment.
+# Each line is a file pattern followed by one or more owners.
+
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# @global-owner1 and @global-owner2 will be requested for
+# review when someone opens a pull request.
+# *       @global-owner1 @global-owner2
+
+# Order is important; the last matching pattern takes the most
+# precedence. When someone opens a pull request that only
+# modifies JS files, only @js-owner and not the global
+# owner(s) will be requested for a review.
+# *.js    @js-owner #This is an inline comment.
+
+# You can also use email addresses if you prefer. They'll be
+# used to look up users just like we do for commit author
+# emails.
+# *.go docs@example.com
+
+# Teams can be specified as code owners as well. Teams should
+# be identified in the format @org/team-name. Teams must have
+# explicit write access to the repository. In this example,
+# the octocats team in the octo-org organization owns all .txt files.
+# *.txt @octo-org/octocats
+
+# In this example, @doctocat owns any files in the build/logs
+# directory at the root of the repository and any of its
+# subdirectories.
+# /build/logs/ @doctocat
+
+# The `docs/*` pattern will match files like
+# `docs/getting-started.md` but not further nested files like
+# `docs/build-app/troubleshooting.md`.
+# docs/*  docs@example.com
+
+# In this example, @octocat owns any file in an apps directory
+# anywhere in your repository.
+# apps/ @octocat
+
+# In this example, @doctocat owns any file in the `/docs`
+# directory in the root of your repository and any of its
+# subdirectories.
+# /docs/ @doctocat
+
+# In this example, any change inside the `/scripts` directory
+# will require approval from @doctocat or @octocat.
+# /scripts/ @doctocat @octocat
+
+# In this example, @octocat owns any file in a `/logs` directory such as
+# `/build/logs`, `/scripts/logs`, and `/deeply/nested/logs`. Any changes
+# in a `/logs` directory will require approval from @octocat.
+# **/logs @octocat
+
+# In this example, @octocat owns any file in the `/apps`
+# directory in the root of your repository except for the `/apps/github`
+# subdirectory, as its owners are left empty.
+# /apps/ @octocat
+# /apps/github
+
+# In this example, @octocat owns any file in the `/apps`
+# directory in the root of your repository except for the `/apps/github`
+# subdirectory, as this subdirectory has its own owner @doctocat
+# /apps/ @octocat
+# /apps/github @doctocat

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,6 +25,7 @@
 - [ ] I have added tests to cover my changes
 - [ ] I have updated the documentation accordingly
 - [ ] This PR is a result of pair or mob programming
+<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
 
 ---
 

.github/SECURITY.md

@@ -21,8 +21,8 @@ If you wish to notify us of a vulnerability via email, please include detailed i
 
 You can reach us at:
 
-- _[ A product team email address ]_
-- [cybersecurity@nhs.net](cybersecurity@nhs.net)
+- [england.nhsnotify@nhs.net](mailto:england.nhsnotify@nhs.net)
+- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
 
 ### NCSC
 

.github/actions/build-docs/action.yml

@@ -0,0 +1,44 @@
+name: "Build Docs"
+description: "build jekyll docs"
+inputs:
+  version:
+    description: "Version number"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 18
+    - name: Install docs node dependencies
+      working-directory: ./docs
+      run: pnpm --ignore-workspace install --frozen-lockfile
+      shell: bash
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@7372622e62b60b3cb750dcd2b9e32c247ffec26a # v1.302.0
+      with:
+        ruby-version: "3.2" # Not needed with a .ruby-version file
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+        cache-version: 0 # Increment this number if you need to re-download cached gems
+        working-directory: "./docs"
+    - name: Setup Pages
+      id: pages
+      uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+    - name: Build with Jekyll
+      working-directory: ./docs
+      # Outputs to the './_site' directory by default
+      shell: bash
+      run: make build BASE_URL="$BASE_URL" VERSION="$VERSION"
+      #run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+      env:
+        JEKYLL_ENV: production
+        BASE_URL: ${{ steps.pages.outputs.base_path }}
+        VERSION: ${{ inputs.version }}
+    - name: Upload artifact
+      # Automatically uploads an artifact from the './_site' directory by default
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+      with:
+        path: "docs/_site/"
+        name: jekyll-docs-${{ inputs.version }}