From 42197eb38db344c2b04c308ddd91a44c67f15336 Mon Sep 17 00:00:00 2001 From: aidenvaines-cgi Date: Wed, 26 Aug 2026 16:03:29 +0100 Subject: [PATCH 1/2] CCM-23214: Adding a GHA Validator Action --- .github/workflows/cicd-4-pr-title-check.yaml | 2 +- .github/workflows/stage-1-commit.yaml | 25 +++++++++++++------- .github/workflows/stage-2-test.yaml | 2 +- 3 files changed, 19 insertions(+), 10 deletions(-) diff --git a/.github/workflows/cicd-4-pr-title-check.yaml b/.github/workflows/cicd-4-pr-title-check.yaml index 2e012703..b96580af 100644 --- a/.github/workflows/cicd-4-pr-title-check.yaml +++ b/.github/workflows/cicd-4-pr-title-check.yaml @@ -15,6 +15,6 @@ jobs: runs-on: ubuntu-latest steps: - name: "Check PR title format" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-pr-title-format@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-pr-title-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag with: title: ${{ github.event.pull_request.title }} diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml index 230a4929..e2d2f47c 100644 --- a/.github/workflows/stage-1-commit.yaml +++ b/.github/workflows/stage-1-commit.yaml @@ -47,7 +47,16 @@ jobs: with: fetch-depth: 0 # Full history is needed to scan all commits - name: "Scan secrets" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + validate-action-pins: + name: "Validate action SHA pins" + runs-on: ubuntu-latest + timeout-minutes: 2 + steps: + - name: "Checkout code" + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Validate action SHA pins" + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/validate-action-pins@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-file-format: name: "Check file format" runs-on: ubuntu-latest @@ -58,7 +67,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check file format" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-markdown-format: name: "Check Markdown format" runs-on: ubuntu-latest @@ -69,7 +78,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check Markdown format" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag terraform-docs: name: "Run terraform-docs" runs-on: ubuntu-latest @@ -104,7 +113,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check English usage" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-todo-usage: name: "Check TODO usage" runs-on: ubuntu-latest @@ -115,7 +124,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check TODO usage" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-todo-usage@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-todo-usage@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag detect-terraform-changes: name: "Detect Terraform Changes" runs-on: ubuntu-latest @@ -151,7 +160,7 @@ jobs: - name: "Setup ASDF" uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1 - name: "Lint Terraform" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/lint-terraform@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/lint-terraform@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag count-lines-of-code: name: "Count lines of code" runs-on: ubuntu-latest @@ -163,7 +172,7 @@ jobs: - name: "Checkout code" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Count lines of code" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag with: build_datetime: "${{ inputs.build_datetime }}" build_timestamp: "${{ inputs.build_timestamp }}" @@ -182,7 +191,7 @@ jobs: - name: "Checkout code" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Scan dependencies" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-dependencies@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-dependencies@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag with: build_datetime: "${{ inputs.build_datetime }}" build_timestamp: "${{ inputs.build_timestamp }}" diff --git a/.github/workflows/stage-2-test.yaml b/.github/workflows/stage-2-test.yaml index 5eaa56bb..4fb30443 100644 --- a/.github/workflows/stage-2-test.yaml +++ b/.github/workflows/stage-2-test.yaml @@ -145,7 +145,7 @@ jobs: with: name: code-coverage-report - name: "Perform static analysis" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/perform-static-analysis@5.0.7 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/perform-static-analysis@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag with: sonar_organisation_key: "${{ vars.SONAR_ORGANISATION_KEY }}" sonar_project_key: "${{ vars.SONAR_PROJECT_KEY }}" From ba19022b05393bb38b7c57893fc9264613f28cbf Mon Sep 17 00:00:00 2001 From: aidenvaines-cgi Date: Thu, 27 Aug 2026 08:49:38 +0100 Subject: [PATCH 2/2] Triggering build post GHA outage