[PRM-495] Added dispatch to workflows by oliverbeumkes-nhs · Pull Request #256 · NHSDigital/orphaned-record-continuity

oliverbeumkes-nhs · 2025-09-19T13:56:11Z

No description provided.

.github/workflows/e2e.yml

+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Hello World
+        run: echo "Hello, world!"


To fix the problem, explicitly specify the minimal necessary workflow permissions using the permissions key. Since the workflow appears only to echo "Hello, world!" and does not interact with the repository or GitHub resources, it is safe to restrict all permissions (permissions: {};), or as GitHub recommends, set contents: read at the top level. The best practice is to add the permissions block at the workflow root (directly under the name field, before on:), which applies it to all jobs in the workflow unless overridden.

Edit .github/workflows/e2e.yml

Add the following block after name: e2e and before on::
permissions: contents: read
(alternatively, permissions: {} is an even stricter minimal baseline, but contents: read is more typically recommended)

No additional imports or definitions are necessary.

.github/workflows/ehr-repo-build-and-publish.yml

+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Hello World
+        run: echo "Hello, world!"


The best approach is to explicitly define a permissions block that grants only the minimal rights required by this workflow. Since the current workflow only prints a message and does not use the GITHUB_TOKEN for any operations (read or write), the most restrictive and therefore safest configuration is permissions: {} at either the workflow or job level.

Recommended: Add the following at the top level (just after the name: and before or after on:):

permissions: {}

Alternatively, for jobs that do require some permissions (e.g., pushing to the repository), you would set only those specific permissions. But in this case, since no permission is required, {} suffices.

What to change:

Add a permissions: {} block after the name: line (line 1), or before the jobs: block (after line 25), or (less optimal) under each job. The most common and clear place is immediately after name: ... so it acts as a workflow-global default.

No extra imports or methods are necessary.

.github/workflows/test-ehr-repo.yml

+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Hello World
+        run: echo "Hello, world!"


To fix this issue, you should add a permissions block to the workflow. The preferred location is at the root level, just below the workflow name and triggers, which sets the permissions for all jobs unless overridden. Since this workflow does not perform any sensitive repository actions, you should specify the most restrictive permissible setting: contents: read (which allows reading repository content, not writing), or even none if nothing at all is needed. However, for many simple jobs, contents: read is recommended as a safe default. The change should be made at the top of .github/workflows/test-ehr-repo.yml, just below the workflow name (name: test-ehr-repo and before the on: block).

github-actions · 2025-09-19T13:58:35Z

Report for environment: pre-prod

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (0 to add, 1 to change, 0 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_alb.alb-internal will be updated in-place
  ~ resource "aws_alb" "alb-internal" {
        id                                          = "arn:aws:elasticloadbalancing:eu-west-2:108148468272:loadbalancer/app/pre-prod-ehr-repo-alb-int/bd71a8cf0838769b"
        name                                        = "pre-prod-ehr-repo-alb-int"
        tags                                        = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "pre-prod"
        }
        # (23 unchanged attributes hidden)

      ~ access_logs {
          ~ bucket  = (sensitive value)
          - prefix  = "ehr-repository" -> null
            # (1 unchanged attribute hidden)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

github-actions · 2025-09-19T13:58:36Z

Report for environment: prod

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (1 to add, 8 to change, 1 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_alb.alb-internal will be updated in-place
  ~ resource "aws_alb" "alb-internal" {
        id                                          = "arn:aws:elasticloadbalancing:eu-west-2:535760944720:loadbalancer/app/prod-ehr-repo-alb-int/b96ab86d7636d0e4"
        name                                        = "prod-ehr-repo-alb-int"
        tags                                        = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
        }
        # (23 unchanged attributes hidden)

      ~ access_logs {
          - prefix  = "ehr-repository" -> null
            # (2 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:535760944720:service/prod-ehr-repo-ecs-cluster/prod-ehr-repo-service"
        name                               = "prod-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:21" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:21" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 21 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_developer_to_see_access_logs_policy[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "ehr_repo_permit_developer_to_see_access_logs_policy" {
        id     = "prod-ehr-repo-access-logs"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (1 unchanged element hidden)
                    {
                        Action    = [
                            "s3:Get*",
                            "s3:ListBucket",
                        ]
                        Condition = {
                            Bool = {
                                "aws:SecureTransport" = "false"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::535760944720:role/RepoDeveloper"
                        }
                        Resource  = [
                            "arn:aws:s3:::prod-ehr-repo-access-logs",
                            "arn:aws:s3:::prod-ehr-repo-access-logs/*",
                        ]
                        Sid       = "S3PermitDeveloperAccessLogsPolicy"
                    },
                  + {
                      + Action    = "s3:*"
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = "*"
                      + Resource  = [
                          + "arn:aws:s3:::prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3EnforceHTTPSPolicy"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_security_group.alb_to_ehr_repo_ecs will be updated in-place
  ~ resource "aws_security_group" "alb_to_ehr_repo_ecs" {
        id                     = "sg-091d2c37cedc98276"
        name                   = "prod-alb-to-ehr-repo-ecr"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-to-ehr-repo-ecs"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.ehr_repo_alb will be updated in-place
  ~ resource "aws_security_group" "ehr_repo_alb" {
        id                     = "sg-07e5606b3bcd4649d"
        name                   = "prod-alb-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-ehr-repo"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.gocd_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "gocd_to_ehr_repo" {
        id                     = "sg-03ac6aa886cc858a1"
      ~ ingress                = (sensitive value)
        name                   = "prod-gocd-to-ehr-repo"
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-gocd-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.service_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "service_to_ehr_repo" {
        id                     = "sg-0843b1d0b553c2023"
        name                   = "prod-service-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-service-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.vpn_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "vpn_to_ehr_repo" {
        id                     = "sg-0b1fbb458ed13a742"
        name                   = "prod-vpn-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-vpn-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

Plan: 1 to add, 8 to change, 1 to destroy.

github-actions · 2025-09-19T13:58:38Z

Report for environment: test

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (0 to add, 1 to change, 0 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_alb.alb-internal will be updated in-place
  ~ resource "aws_alb" "alb-internal" {
        id                                          = "arn:aws:elasticloadbalancing:eu-west-2:005235525306:loadbalancer/app/test-ehr-repo-alb-int/44d32f86b879ef3f"
        name                                        = "test-ehr-repo-alb-int"
        tags                                        = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "test"
        }
        # (23 unchanged attributes hidden)

      ~ access_logs {
          ~ bucket  = (sensitive value)
          - prefix  = "ehr-repository" -> null
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

github-actions · 2025-09-19T13:58:40Z

Report for environment: dev

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (no changes)



No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Added dispatch to workflows

2ef0e7f

oliverbeumkes-nhs temporarily deployed to test September 19, 2025 13:56 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to pre-prod September 19, 2025 13:56 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to dev September 19, 2025 13:56 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to prod September 19, 2025 13:56 — with GitHub Actions Inactive

github-advanced-security bot found potential problems Sep 19, 2025

View reviewed changes

Correct names

831572b

oliverbeumkes-nhs temporarily deployed to dev September 19, 2025 13:58 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to pre-prod September 19, 2025 13:58 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to test September 19, 2025 13:58 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to prod September 19, 2025 13:58 — with GitHub Actions Inactive

steph-torres-nhs approved these changes Sep 19, 2025

View reviewed changes

oliverbeumkes-nhs merged commit e212795 into main Sep 19, 2025
9 checks passed

oliverbeumkes-nhs deleted the PRM-495-PHFIX branch September 19, 2025 13:59

@@ -1,4 +1,5 @@
             name: ehr-repo-build-and-publish
+            permissions: {}
             on:
               workflow_dispatch:
                 inputs:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PRM-495] Added dispatch to workflows#256

[PRM-495] Added dispatch to workflows#256
oliverbeumkes-nhs merged 2 commits intomainfrom
PRM-495-PHFIX

oliverbeumkes-nhs commented Sep 19, 2025

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Sep 19, 2025

Uh oh!

github-actions bot commented Sep 19, 2025

Uh oh!

github-actions bot commented Sep 19, 2025

Uh oh!

github-actions bot commented Sep 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

@@ -1,4 +1,6 @@
             name: e2e
+            permissions:
+              contents: read
             on:
               workflow_dispatch:
                 inputs:

Conversation

oliverbeumkes-nhs commented Sep 19, 2025

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Sep 19, 2025

Report for environment: pre-prod

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Sep 19, 2025

Report for environment: prod

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Sep 19, 2025

Report for environment: test

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Sep 19, 2025

Report for environment: dev

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`