From d294ba125061115119f04006712b03a55e1ce6af Mon Sep 17 00:00:00 2001 From: Francisco Videira Date: Wed, 8 Jul 2026 16:35:44 +0000 Subject: [PATCH 1/5] destroy pr proxy --- .github/workflows/pr_destroy_dynamic_env.yaml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr_destroy_dynamic_env.yaml b/.github/workflows/pr_destroy_dynamic_env.yaml index b6354eeab..61e74a21d 100644 --- a/.github/workflows/pr_destroy_dynamic_env.yaml +++ b/.github/workflows/pr_destroy_dynamic_env.yaml @@ -4,7 +4,7 @@ on: pull_request: types: [closed] branches: - - '*' + - "*" concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -46,7 +46,7 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Trigger dynamic proxy destruction + - name: Trigger PR sandbox proxy destruction env: APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }} @@ -60,3 +60,18 @@ jobs: --targetEnvironment "pr${{ github.event.number }}" \ --apimEnvironment "internal-dev-sandbox" \ --boundedContext "notify-supplier" + + - name: Trigger PR proxy destruction + env: + APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} + APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }} + shell: bash + run: | + .github/scripts/dispatch_internal_repo_workflow.sh \ + --infraRepoName "nhs-notify-supplier-api" \ + --releaseVersion "main" \ + --targetComponent "api" \ + --targetWorkflow "proxy-destroy.yaml" \ + --targetEnvironment "pr${{ github.event.number }}" \ + --apimEnvironment "internal-dev" \ + --boundedContext "notify-supplier" From 18a5f90b2263a1b86ca2b7e972f68a294dcece77 Mon Sep 17 00:00:00 2001 From: Francisco Videira Date: Wed, 8 Jul 2026 16:38:42 +0000 Subject: [PATCH 2/5] small refactor, and documentation for apimEnv --- .github/actions/build-oas-spec/action.yml | 6 +++++- .github/actions/build-proxies/action.yml | 19 +++++++++++++++---- .github/workflows/stage-3-build.yaml | 10 +++++----- 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/.github/actions/build-oas-spec/action.yml b/.github/actions/build-oas-spec/action.yml index 242adffd3..b2d51e7ff 100644 --- a/.github/actions/build-oas-spec/action.yml +++ b/.github/actions/build-oas-spec/action.yml @@ -6,7 +6,11 @@ inputs: description: "Version number" required: true apimEnv: - description: "APIM environment" + description: | + OAS build configuration name. Selects environment-specific templates from + specification/api/components/environments// (e.g. auth level, target secrets, + monitoring flags). Valid values: internal-dev, internal-dev-pr, int, ref, prod. + Note: 'internal-dev-pr' is a build config only - there is no corresponding APIM environment. required: true buildSandbox: description: "Whether to build the sandbox OAS spec" diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml index d00f1a30d..5563a3332 100644 --- a/.github/actions/build-proxies/action.yml +++ b/.github/actions/build-proxies/action.yml @@ -16,7 +16,11 @@ inputs: description: "Deployment environment" required: true apimEnv: - description: "APIM environment" + description: | + OAS build configuration name (e.g. internal-dev-pr, internal-dev, int, prod). + Must match the apimEnv used to build the OAS artifact this action downloads. + The '-pr' suffix is stripped before dispatching to proxygen, which only knows + real APIM environments (internal-dev, internal-dev-sandbox, int, ref, prod). required: true runId: description: "GitHub Actions run ID to fetch the OAS artifact from" @@ -60,19 +64,26 @@ runs: - name: Setup Proxy Name and target shell: bash run: | + set -euo pipefail ENV="${{ inputs.apimEnv }}" - if [[ "$ENV" == "internal-dev" || "$ENV" == *pr ]]; then + if [[ "$ENV" == "internal-dev" || "$ENV" == "internal-dev-pr" || "$ENV" == "internal-dev-sandbox" ]]; then echo "TARGET_DOMAIN=suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV - elif [[ "$ENV" == "int" ]]; then + elif [[ "$ENV" == "int" || "$ENV" == "ref" ]]; then echo "TARGET_DOMAIN=suppliers.nonprod.nhsnotify.national.nhs.uk" >> $GITHUB_ENV elif [[ "$ENV" == "prod" ]]; then echo "TARGET_DOMAIN=suppliers.prod.nhsnotify.national.nhs.uk" >> $GITHUB_ENV else - echo "TARGET_DOMAIN=suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV + echo "[ERROR] Unsupported apimEnv '$ENV'." + exit 1 fi - name: Set APIM_ENV + # apimEnv carries the OAS build configuration name (e.g. "internal-dev-pr") + # which determines auth level, target secrets, and artifact naming. + # Proxygen and the internal proxy-deploy/proxy-destroy workflows only know + # real APIM environments, so we strip the "-pr" suffix here - this is the + # single translation boundary between OAS build config and APIM deployment. shell: bash run: | APIM_ENV="${{ inputs.apimEnv }}" diff --git a/.github/workflows/stage-3-build.yaml b/.github/workflows/stage-3-build.yaml index d29ce39fe..5b8811413 100644 --- a/.github/workflows/stage-3-build.yaml +++ b/.github/workflows/stage-3-build.yaml @@ -67,7 +67,7 @@ jobs: timeout-minutes: 10 strategy: matrix: - apimEnv: [internal-dev-pr, internal-dev, int, ref, prod] + apimEnv: [internal-dev, int, ref, prod] steps: - name: "Checkout code" uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -161,7 +161,7 @@ jobs: # uses: ./.github/actions/build-libraries # with: # version: "${{ inputs.version }}" - pr-create-dynamic-environment: + create-dynamic-environment: name: Create Dynamic Environment runs-on: ubuntu-latest outputs: @@ -192,7 +192,7 @@ jobs: populate-config: name: "Populate Supplier Config" runs-on: ubuntu-latest - needs: [pr-create-dynamic-environment] + needs: [create-dynamic-environment] timeout-minutes: 10 steps: @@ -221,7 +221,7 @@ jobs: name: "Build proxies" runs-on: ubuntu-latest if: always() && !failure() && inputs.deploy_proxy == 'true' - needs: [artefact-oas-spec, pr-create-dynamic-environment] + needs: [artefact-oas-spec, create-dynamic-environment] timeout-minutes: 10 env: PROXYGEN_API_NAME: nhs-notify-supplier @@ -234,7 +234,7 @@ jobs: uses: ./.github/actions/build-proxies with: version: "${{ inputs.version }}" - environment: ${{ needs.pr-create-dynamic-environment.outputs.environment_name }} + environment: ${{ needs.create-dynamic-environment.outputs.environment_name }} apimEnv: "${{ inputs.pr_number == '' && 'internal-dev' || 'internal-dev-pr' }}" runId: "${{ github.run_id }}" buildSandbox: true From 9160dd7cb0de93742d0c5ba3c62cbca6a93de525 Mon Sep 17 00:00:00 2001 From: Francisco Videira Date: Mon, 13 Jul 2026 13:59:00 +0000 Subject: [PATCH 3/5] bump scan secrets --- scripts/config/pre-commit.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/config/pre-commit.yaml b/scripts/config/pre-commit.yaml index 072be970c..948baeb16 100644 --- a/scripts/config/pre-commit.yaml +++ b/scripts/config/pre-commit.yaml @@ -28,7 +28,7 @@ repos: )$ - repo: https://github.com/NHSDigital/nhs-notify-shared-modules - rev: 5.0.1 + rev: 5.0.3 hooks: - id: sort-dictionary - id: scan-secrets From 9057177fb5a4d4361d7ff3589e9eec9d8f1e0179 Mon Sep 17 00:00:00 2001 From: Francisco Videira Date: Mon, 13 Jul 2026 13:59:35 +0000 Subject: [PATCH 4/5] TODO REMOVE use internal ref for testing --- .github/actions/build-proxies/action.yml | 3 ++- .github/workflows/pr_destroy_dynamic_env.yaml | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml index 5563a3332..ca8b8bc2b 100644 --- a/.github/actions/build-proxies/action.yml +++ b/.github/actions/build-proxies/action.yml @@ -116,4 +116,5 @@ runs: --apimEnvironment "${{ env.APIM_ENV }}" \ --boundedContext "notify-supplier" \ --targetDomain "$TARGET_DOMAIN" \ - --version "${{ inputs.version }}" + --version "${{ inputs.version }}" \ + --internalRef "feature/CCM-18685" diff --git a/.github/workflows/pr_destroy_dynamic_env.yaml b/.github/workflows/pr_destroy_dynamic_env.yaml index 61e74a21d..6c186cf72 100644 --- a/.github/workflows/pr_destroy_dynamic_env.yaml +++ b/.github/workflows/pr_destroy_dynamic_env.yaml @@ -59,7 +59,8 @@ jobs: --targetWorkflow "proxy-destroy.yaml" \ --targetEnvironment "pr${{ github.event.number }}" \ --apimEnvironment "internal-dev-sandbox" \ - --boundedContext "notify-supplier" + --boundedContext "notify-supplier" \ + --internalRef "feature/CCM-18685" - name: Trigger PR proxy destruction env: @@ -74,4 +75,5 @@ jobs: --targetWorkflow "proxy-destroy.yaml" \ --targetEnvironment "pr${{ github.event.number }}" \ --apimEnvironment "internal-dev" \ - --boundedContext "notify-supplier" + --boundedContext "notify-supplier" \ + --internalRef "feature/CCM-18685" From 8c4aaecd71945f70fc98a5706a02f80baa47d760 Mon Sep 17 00:00:00 2001 From: Francisco Videira Date: Mon, 13 Jul 2026 15:04:28 +0000 Subject: [PATCH 5/5] Temp: CI unblock fix (squashed) from origin/feature/CCM-21851-Missing-Pack-Specification --- .../notify-admail-colour-whitemail.json | 55 +++++++++++++++++++ ...plier1-notify-admail-colour-whitemail.json | 7 +++ .../components/api/api_gateway_deployment.tf | 4 ++ .../components/api/api_gateway_rest_api.tf | 7 +-- .../api/api_gateway_rest_api_tls.tf | 11 ---- .../terraform/components/api/locals.tf | 2 - .../components/api/resources/spec.tmpl.json | 4 +- 7 files changed, 70 insertions(+), 20 deletions(-) create mode 100644 config/suppliers/pack-specification/notify-admail-colour-whitemail.json create mode 100644 config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json delete mode 100644 infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf diff --git a/config/suppliers/pack-specification/notify-admail-colour-whitemail.json b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json new file mode 100644 index 000000000..dd735faec --- /dev/null +++ b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json @@ -0,0 +1,55 @@ +{ + "assembly": { + "duplex": true, + "envelopeId": "economy-c5", + "features": [ + "ADMAIL" + ], + "paper": { + "colour": "WHITE", + "id": "paper-std-white-80", + "name": "Standard White 80gsm", + "recycled": true, + "size": "A4", + "weightGSM": 80 + }, + "printColour": "COLOUR" + }, + "billingId": "insert-admail-colour", + "constraints": { + "blackCoveragePercentage": { + "operator": "LESS_THAN", + "value": 20 + }, + "colourCoveragePercentage": { + "operator": "LESS_THAN", + "value": 10 + }, + "deliveryDays": { + "operator": "LESS_THAN", + "value": 2 + }, + "sheets": { + "operator": "LESS_THAN", + "value": 5 + }, + "sides": { + "operator": "LESS_THAN", + "value": 10 + } + }, + "createdAt": "2026-01-12T00:00:00.000Z", + "description": "Admail economy tariff with whitemail envelope and colour printing", + "id": "notify-admail-colour-whitemail", + "name": "Admail (colour whitemail)", + "postage": { + "deliveryDays": 4, + "id": "admail-economy", + "maxThicknessMm": 5, + "maxWeightGrams": 100, + "size": "STANDARD" + }, + "status": "PROD", + "updatedAt": "2026-01-12T00:00:00.000Z", + "version": 1 +} diff --git a/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json new file mode 100644 index 000000000..859848c3a --- /dev/null +++ b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json @@ -0,0 +1,7 @@ +{ + "approval": "APPROVED", + "id": "supplier1-notify-admail-colour-whitemail", + "packSpecificationId": "notify-admail-colour-whitemail", + "status": "PROD", + "supplierId": "supplier1" +} diff --git a/infrastructure/terraform/components/api/api_gateway_deployment.tf b/infrastructure/terraform/components/api/api_gateway_deployment.tf index 458752390..bbbaf25b5 100644 --- a/infrastructure/terraform/components/api/api_gateway_deployment.tf +++ b/infrastructure/terraform/components/api/api_gateway_deployment.tf @@ -10,6 +10,10 @@ resource "aws_api_gateway_deployment" "main" { deployed_at = timestamp() } + depends_on = [ + aws_api_gateway_rest_api.main + ] + lifecycle { create_before_destroy = true } diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf index 1b259235e..b905c7865 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf @@ -1,10 +1,9 @@ + resource "aws_api_gateway_rest_api" "main" { name = local.csi body = local.openapi_spec description = "Suppliers API" disable_execute_api_endpoint = var.disable_gateway_execute_endpoint - - lifecycle { - replace_triggered_by = [terraform_data.rest_api_security_policy] - } + security_policy = "SecurityPolicy_TLS13_1_2_2021_06" + endpoint_access_mode = "BASIC" } diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf deleted file mode 100644 index efef825f1..000000000 --- a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf +++ /dev/null @@ -1,11 +0,0 @@ -locals { - rest_api_security_policy = "SecurityPolicy_TLS12_PFS_2025_EDGE" - rest_api_endpoint_access_mode = "STRICT" -} - -resource "terraform_data" "rest_api_security_policy" { - input = { - security_policy = local.rest_api_security_policy - endpoint_access_mode = local.rest_api_endpoint_access_mode - } -} diff --git a/infrastructure/terraform/components/api/locals.tf b/infrastructure/terraform/components/api/locals.tf index 517590fa8..da1e61630 100644 --- a/infrastructure/terraform/components/api/locals.tf +++ b/infrastructure/terraform/components/api/locals.tf @@ -7,8 +7,6 @@ locals { openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", { APIG_EXECUTION_ROLE_ARN = aws_iam_role.api_gateway_execution_role.arn AWS_REGION = var.region - SECURITY_POLICY = local.rest_api_security_policy - ENDPOINT_ACCESS_MODE = local.rest_api_endpoint_access_mode AUTHORIZER_LAMBDA_ARN = module.authorizer_lambda.function_arn GET_LETTER_LAMBDA_ARN = module.get_letter.function_arn GET_LETTERS_LAMBDA_ARN = module.get_letters.function_arn diff --git a/infrastructure/terraform/components/api/resources/spec.tmpl.json b/infrastructure/terraform/components/api/resources/spec.tmpl.json index 8d6430127..51ad83dfb 100644 --- a/infrastructure/terraform/components/api/resources/spec.tmpl.json +++ b/infrastructure/terraform/components/api/resources/spec.tmpl.json @@ -357,7 +357,5 @@ } ] } - }, - "x-amazon-apigateway-endpoint-access-mode": "${ENDPOINT_ACCESS_MODE}", - "x-amazon-apigateway-security-policy": "${SECURITY_POLICY}" + } }