From dc1f1d09e2120156c00af1e375bda93d5592a45c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 28 Nov 2024 11:41:16 +0000 Subject: [PATCH] Upgrade: [dependabot] - bump NHSDigital/eps-workflow-quality-checks from 3.0.0 to 4.0.4 (#275) Bumps [NHSDigital/eps-workflow-quality-checks](https://github.com/nhsdigital/eps-workflow-quality-checks) from 3.0.0 to 4.0.4.
Release notes

Sourced from NHSDigital/eps-workflow-quality-checks's releases.

v4.0.4

4.0.4 (2024-11-19)

Fix

Info

See code diff Release workflow run

It was initialized by wildjames

v4.0.3

4.0.3 (2024-11-12)

Docs

Info

See code diff Release workflow run

It was initialized by wildjames

v4.0.2

4.0.2 (2024-11-06)

Fix

Info

See code diff Release workflow run

It was initialized by wildjames

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=NHSDigital/eps-workflow-quality-checks&package-manager=github_actions&previous-version=3.0.0&new-version=4.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anthony Brown <121869075+anthony-nhs@users.noreply.github.com> --- .devcontainer/devcontainer.json | 8 ++++++++ .gitallowed | 18 ++++++++++++++++++ .github/workflows/ci.yml | 2 +- .github/workflows/pull_request.yml | 2 +- .github/workflows/release.yml | 2 +- .pre-commit-config.yaml | 10 ++++++++++ 6 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 .gitallowed diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 58ff30b..76c5cc8 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -8,6 +8,13 @@ "context": "..", "args": {} }, + "features": { + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { + "version": "latest", + "moby": "true", + "installDockerBuildx": "true" + } + }, "mounts": [ "source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind", "source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind" @@ -52,5 +59,6 @@ } } }, + "remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" }, "postCreateCommand": "rm -f ~/.docker/config.json; git config --global --add safe.directory /workspaces/nhs-eps-spine-client; make install; direnv allow ." } diff --git a/.gitallowed b/.gitallowed new file mode 100644 index 0000000..9f2ecd3 --- /dev/null +++ b/.gitallowed @@ -0,0 +1,18 @@ +token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"? +github-token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"? +token: ?"?\$\{\{\s*secrets\.DEPENDABOT_TOKEN\s*\}\}"? +id-token: write +--token=\$\{\{\s*steps\.generate-token\.outputs\.token\s*\}\} +--token=\$GITHUB-TOKEN +--token="\$GITHUB-TOKEN" +.*Gemfile\.lock.* +.*\.gitallowed.* +.*nhsd-rules-deny.txt.* +.*\.venv.* +.*node_modules.* +.:src/resources/clinical_content_view.*root=* +.:src/resources/clinical_content_view.*codeSystem=* +.:src/resources/prescription_search.*root=* +.:src/live-spine-client.*root=* +0ba20a521167058a74f3b6e65c42d732054e5753:docs.* +0ba20a521167058a74f3b6e65c42d732054e5753:scripts/.* diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1357286..b03080c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ on: jobs: quality_checks: - uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0 + uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4 secrets: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index b9021dd..2a30293 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -6,7 +6,7 @@ on: jobs: quality_checks: - uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0 + uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4 secrets: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3a5883f..5982f63 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,7 @@ on: jobs: quality_checks: - uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0 + uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4 secrets: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 31ecaab..17aefc8 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -40,5 +40,15 @@ repos: types_or: [yaml] pass_filenames: false + - repo: local + hooks: + - id: git-secrets + name: Git Secrets + description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories. + entry: bash + args: + - -c + - 'docker run -v "$LOCAL_WORKSPACE_FOLDER:/src" git-secrets --pre_commit_hook' + language: system fail_fast: true default_stages: [commit]