Add environment variables for One Login

[stephencdaly]

What problem does this pull request solve?

Trello card: https://trello.com/c/tKtA1VPQ/

Things to consider when reviewing

• Ensure that you consider the wider context.
• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Has all relevant documentation been updated?

Reminders

If you've made changes to the deployer role (files in modules/deployer-access):

• Remember to run make <environment> forms/account apply on the relevant environments (dev, staging, user-research, and/or prod)
• Check the #govuk-forms-deployment-notifications Slack channel to ensure the apply-forms-terraform-<environment> pipelines have run successfully

[Copilot]

Pull request overview

This PR wires GOV.UK One Login configuration into the forms-runner Terraform deployment so each environment can pass the One Login issuer URL plus SSM-backed client credentials into the ECS task.

Changes:

• Added a new govuk_one_login_base_url input through the deployment and module variable chain.
• Injected One Login configuration into the forms-runner ECS task as one plain environment variable and two SSM-backed secrets.
• Set per-environment One Login base URLs for dev, staging, user-research, and production.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
infra/modules/forms-runner/variables.tf	Declares the new module input for the One Login base URL.
infra/modules/forms-runner/main.tf	Passes the new One Login env var and secret references into the ECS service definition.
infra/deployments/forms/tfvars/user-research.tfvars	Adds the user-research One Login base URL.
infra/deployments/forms/tfvars/staging.tfvars	Adds the staging One Login base URL.
infra/deployments/forms/tfvars/production.tfvars	Adds the production One Login base URL.
infra/deployments/forms/tfvars/dev.tfvars	Adds the dev One Login base URL.
infra/deployments/forms/inputs.tf	Extends the deployment settings object with the new field.
infra/deployments/forms/forms-runner/main.tf	Threads the new deployment setting into the forms-runner module call.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.