LIME-2030: Setting up GHAs by JessWinterborne · Pull Request #21 · govuk-one-login/ipv-cri-ob-api

JessWinterborne · 2026-03-30T08:21:08Z

Proposed changes

Issue tracking

LIME-2030

What changed

PR check

Previously we deployed pre-merge stacks for PR tests, and immediately deleted them after.
- We also had the option to deploy preview stacks on workflow_dispatch or workflow_call.
Now we combine these so PR checks deploy preview stacks for testing.
- Deploying preview stacks is still also possible via workflow_dispatch.
This simplifies the actions, and reduces duplication.

Cleanup

This now consolidates the previous cleanup workflows into a single one that handles:
- stale preview stacks (pre-merge no longer required)
- stale manually deployed stacks
- stale log groups

Scan repo

We run codeql scans, as well as sonar scans with unit test coverage on PR and merges to main.
We also want to run static scans of the code base (codeql and sonar) on schedules.
- This ensures we are scanning against up-to-date vulnerability databases, and scanning on a regular basis in cases where a repo may not get regular PRs or merges to main.

Other things

Used shared one-login GHAs where-ever possible to reduce duplication, and maintenance of third-party actions.
Refined concurrency groups

Other considerations

Workflows that are manually trigger-able (workdlow_dispatch) have been tested by temporarily triggering them on PR. These need to be retested via workflow_dispatch once merged into main.

Post-merge workflow may cause the same cosign/rektor issue seen previously - will know on merge. If so, we can look into putting in the proper devplatform upload action fix (and bypass uploads to rektor entirely). May have to raise though which could take some time.

Future improvement if codeql and sonar are not required on PR check (or if both could be required): rework scan-repo to take an optional coverage artefact input, so we can call this workflow instead of the actions individually in pr-check and post-merge.

Outside of this repo, theres been a few changes to github-actions and the devplatform-deploy secure pipeline scripts/permissions, to allow for using new SAR/serverless applications.

Other than this, some work involved changes in identity-common-infra for pre-merge/preview stacks, and applying terraform for example to add test steps to the pipelines.

github-advanced-security · 2026-03-31T21:45:19Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

nlsteers · 2026-04-01T11:09:16Z

-          [[ "${{ needs.type-check.result }}" != "success" ]] && failed+=("type-check")
          [[ "${{ needs.unit-tests.result }}" != "success" ]] && failed+=("unit-tests")
-
+          [[ "${{ needs.sonar.result }}" != "success" ]] && failed+=("sonar")


sonar is skipped for dependabot so this job will fail for PRs raised by it if you require a sonar success result here

What was the reasoning behind skipping sonar? I think it would be fine to run / be required

the main reason is bots don't have access to the sonar secret so the job always fails

I see it running in other dependabot PRs as a required check - so not sure how that is working - e.g. here.
Or is it that we don't want to give access?
Sorry - I think potentially while its required and appears to have run/passed - since the coverage step was skipped it actually didn't.

Although... I think it just runs without unit test coverage - there's an example of a dependabot report here.
I'll do some more experiments but not sure what approach we'd prefer if this is the case.

nlsteers · 2026-04-01T11:11:56Z

+        # runs for ts and js by default.
+
+  sonar:
+    name: Sonar scan


worth checking that running the sonar scan without the coverage report on a cron won't mess with our coverage metrics on sonarcloud

Think we will have to wait and see on this as there's not enough lines of code yet to generate a proper report. I don't expect it would since there's scenarios across the programme where unit test coverage isn't reported, but can come back to if there's any issues.

nlsteers · 2026-04-01T11:17:31Z

-    needs: type-check
+      # actions: read
+    steps:
+      - name: Run Sonar scan


suggest moving this into a composite action (similar to the frontend) so that when we update the sonar action in the future it only needs to be done in one place

I've been playing around with doing something like that, but more similar to how other repos do it (e.g. check-hmrc).
It adds complexity in different ways though so not sure its worth it...
Also splitting that action out seems pretty repetitive / similar to the github-actions version. I don't see much difference other than updating the SHA and would compare it to putting a wrapper on something like checkout or assume aws creds, just so we don't have to update the version in a few places.

Will look into the other point about the metrics report above though - its a good point.

nlsteers

looking really nice, couple of qs from me

nlsteers · 2026-04-10T11:41:07Z

+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sonar-token: ${{ secrets.SONAR_TOKEN }}
+          coverage-artifact: null


can this just be omitted rather than passing null here?

Unfortunately not without changing the shared action - annoyingly it checks if its null, but it has a default value so omitting != null.
https://github.com/govuk-one-login/github-actions/blob/main/code-quality/sonarcloud/action.yml#L51

nlsteers · 2026-04-10T11:46:49Z

+        run: echo "sha-short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: Build app
+        uses: govuk-one-login/github-actions/sam/build-application@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged


is this still waiting on a merge?

This is because I want to merge this github-actions PR so we can ref the new commit sha from main.

I worry if we merge here before, it might ref a non-existant sha once the other PR is merged and the branch deleted.

nlsteers · 2026-04-10T11:58:53Z

-          [[ "${{ needs.type-check.result }}" != "success" ]] && failed+=("type-check")
          [[ "${{ needs.unit-tests.result }}" != "success" ]] && failed+=("unit-tests")
-
+          [[ "${{ needs.codeql.result }}" != "success" ]] && failed+=("codeql")


are you just checking that the codeql job ran here? it doesn't report a result directly so this is currently just a check to see if the job ran at all

Hm yea I didn't think much about what this was doing - I think yes just checking it ran. I think it could be removed - this would then open up the possibility to rework scan-repo to be re-useable in pr-check and post-merge if they're both not required.
But I think I will leave that as a future improvement since this has taken long enough 😆

nlsteers · 2026-04-10T11:59:59Z

-        uses: ./.github/actions/node-setup
-      - name: Type check
-        run: npm run type-check
+        uses: govuk-one-login/github-actions/node/install-dependencies@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged


useful, we should backport this into the frontend actions when your branch is merged

nlsteers · 2026-04-10T12:02:25Z

      - id: eslint
        name: ESLint
-        entry: npm run lint
+        entry: npm run lint:pre-commit


what's the point of adding this over the existing 'lint' script?

On pre-commit un-staged files were being ran against, which is not really the intended functionality for pre-commit hooks.

nlsteers · 2026-04-10T12:03:40Z

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+echo hello test word


is this supposed to be 'world'? nbd as these are temp

sonarqubecloud · 2026-04-14T16:16:50Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

JessWinterborne force-pushed the LIME-2030 branch 5 times, most recently from a6f04d9 to 6489316 Compare March 31, 2026 21:44

JessWinterborne force-pushed the LIME-2030 branch 6 times, most recently from 42dbd5c to 5755291 Compare March 31, 2026 23:26

nlsteers reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/pr-check.yml

nlsteers reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/deploy-dev.yml

nlsteers reviewed Apr 1, 2026

View reviewed changes

JessWinterborne temporarily deployed to development April 1, 2026 16:22 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch from 8a7924a to 46c4163 Compare April 1, 2026 16:56

JessWinterborne temporarily deployed to development April 1, 2026 16:56 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch from 46c4163 to 3fee638 Compare April 2, 2026 08:20

JessWinterborne temporarily deployed to development April 2, 2026 08:20 — with GitHub Actions Inactive

JessWinterborne temporarily deployed to development April 2, 2026 14:18 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch from befcfc7 to 04b0966 Compare April 2, 2026 14:22

JessWinterborne temporarily deployed to development April 2, 2026 14:23 — with GitHub Actions Inactive

JessWinterborne had a problem deploying to development April 7, 2026 11:40 — with GitHub Actions Failure

JessWinterborne force-pushed the LIME-2030 branch from 5aefa91 to 3e735fb Compare April 7, 2026 11:54

JessWinterborne had a problem deploying to development April 7, 2026 11:54 — with GitHub Actions Failure

JessWinterborne had a problem deploying to development April 7, 2026 12:01 — with GitHub Actions Failure

JessWinterborne temporarily deployed to development April 7, 2026 12:15 — with GitHub Actions Inactive

JessWinterborne temporarily deployed to development April 9, 2026 16:07 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch from 7bb8372 to 9f1ab61 Compare April 9, 2026 16:24

JessWinterborne temporarily deployed to development April 9, 2026 16:25 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch from 9f1ab61 to 39ed489 Compare April 10, 2026 07:13

JessWinterborne had a problem deploying to development April 10, 2026 07:14 — with GitHub Actions Failure

JessWinterborne force-pushed the LIME-2030 branch from 39ed489 to b5c7b37 Compare April 10, 2026 07:30

JessWinterborne temporarily deployed to development April 10, 2026 07:32 — with GitHub Actions Inactive

JessWinterborne force-pushed the LIME-2030 branch 4 times, most recently from 5a6d977 to 96db2d0 Compare April 10, 2026 10:34

JessWinterborne marked this pull request as ready for review April 10, 2026 10:47

JessWinterborne requested a review from a team as a code owner April 10, 2026 10:47

nlsteers reviewed Apr 10, 2026

View reviewed changes

JessWinterborne force-pushed the LIME-2030 branch from 96db2d0 to 296cf61 Compare April 10, 2026 13:11

nlsteers previously approved these changes Apr 10, 2026

View reviewed changes

SarahHillGDS reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/workflows/_secure-pipeline-deploy.yml Outdated

JessWinterborne dismissed nlsteers’s stale review via 9185b30 April 10, 2026 14:51

JessWinterborne force-pushed the LIME-2030 branch 2 times, most recently from 2b30c72 to 500c672 Compare April 10, 2026 15:21

JessWinterborne changed the title ~~Initial tests adding GHAs~~ [LIME-2030]: Setting up GHAs Apr 10, 2026

JessWinterborne changed the title ~~[LIME-2030]: Setting up GHAs~~ LIME-2030: Setting up GHAs Apr 10, 2026

SarahHillGDS previously approved these changes Apr 10, 2026

View reviewed changes

LIME-2030: Setting up GHAs

ef0c3c4

JessWinterborne dismissed SarahHillGDS’s stale review via ef0c3c4 April 14, 2026 16:15

JessWinterborne force-pushed the LIME-2030 branch from 500c672 to ef0c3c4 Compare April 14, 2026 16:15

nlsteers approved these changes Apr 14, 2026

View reviewed changes

JessWinterborne merged commit 00ba9ac into main Apr 14, 2026
10 checks passed

JessWinterborne deleted the LIME-2030 branch April 14, 2026 16:48

Conversation

JessWinterborne commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Issue tracking

What changed

Other considerations

Uh oh!

github-advanced-security AI commented Mar 31, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

nlsteers Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JessWinterborne Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JessWinterborne Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nlsteers left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JessWinterborne Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JessWinterborne commented Mar 30, 2026 •

edited

Loading

nlsteers Apr 1, 2026 •

edited

Loading

JessWinterborne Apr 2, 2026 •

edited

Loading

JessWinterborne Apr 1, 2026 •

edited

Loading

JessWinterborne Apr 10, 2026 •

edited

Loading