Chore: [AEA-6424] - use new common workflows

[anthony-nhs]

Summary

• Routine Change

Details

• move to latest qc
• remove all trivy files
• add CODEOWNERS to restrict updates to workflows
• use least permissions on all workflows
• add --ignore-scripts true to npm install

[github-actions]

This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:

AEA-0000

[Copilot]

Pull request overview

Updates repository automation to align with newer shared EPS workflows and security tooling configuration, mainly by adjusting GitHub Actions workflow permissions/checkout behavior and swapping vulnerability scanning configuration files.

Changes:

• Add Zizmor and Grype configuration and update pre-commit hooks (including a new local Grype scan hook).
• Update multiple GitHub Actions workflows to use explicit permissions: {} defaults and persist-credentials: false on checkouts, plus some token/env handling tweaks.
• Remove legacy Trivy and CodeQL configuration/workflows and an older release_ref workflow.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
zizmor.yml	Adds Zizmor rule config/ignores for workflow linting.
trivy.yaml	Removes Trivy config indirection to .trivyignore.
.trivyignore.yaml	Removes Trivy vulnerability ignore list.
.pre-commit-config.yaml	Updates pre-commit hooks version and adds a new local “grype-scan-local” hook.
.grype.yaml	Adds Grype vulnerability ignore list.
.gitignore	Ignores .sbom/.
.github/workflows/update_validator_version.yml	Updates permissions/checkout and adds a GitHub App token generation step.
.github/workflows/update_dev_container_version.yml	Minor workflow formatting change.
.github/workflows/sync_copilot.yml	Adds explicit workflow-level permissions block.
.github/workflows/run_regression_tests.yml	Adds explicit workflow permissions and refines token/env passing.
.github/workflows/run_pact_tests.yml	Adds explicit workflow permissions and updates checkout credential persistence.
.github/workflows/run_epsat_tests.yml	Adds explicit workflow permissions and updates checkout credential persistence.
.github/workflows/release.yml	Adds workflow/job permissions blocks and removes a local get_version job dependency.
.github/workflows/release_ref.yml	Removes the dedicated REF release workflow.
.github/workflows/pull_request.yml	Switches to common workflows (currently via a branch ref) and adds explicit permissions blocks.
.github/workflows/delete_old_cloudformation_stacks.yml	Adds explicit workflow permissions, checkout changes, and pins AWS credentials action.
.github/workflows/codeql-analysis.yml	Removes CodeQL analysis workflow.
.github/workflows/ci.yml	Adds workflow/job permissions blocks and removes a local get_version job dependency.
.github/workflows/cdk_release_code.yml	Adds explicit workflow permissions and adjusts account-id propagation + checkout credential persistence.
.github/workflows/cdk_package_code.yml	Adjusts checkout credential persistence and switches some env propagation to step outputs.
.gitallowed	Allows a new ${GITHUB_TOKEN} token pattern.
.devcontainer/devcontainer.json	Bumps devcontainer image version.

Comments suppressed due to low confidence (2)

.github/workflows/pull_request.yml:60

• With workflow-level permissions: {}, this job currently has no token permissions. actions/github-script calls repos.listPullRequestsAssociatedWithCommit, which will fail without at least pull-requests: read (and typically contents: read). Add explicit job-level permissions here (or relax the workflow-level restriction) so this step can query the API.

  get_issue_number:
    runs-on: ubuntu-22.04
    needs: quality_checks
    outputs:
      issue_number: ${{ steps.get_issue_number.outputs.result }}
      version: ${{ steps.get_issue_number.outputs.version_number }}

    steps:
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        name: get issue number

.github/workflows/update_validator_version.yml:52

• The Create GitHub App Token step is currently unused, while create-pull-request uses a long-lived PAT (secrets.VALIDATOR_UPGRADE_PAT). Prefer using the generated GitHub App token output for the PR creation and remove the PAT usage. Also, commit-message references env.BRANCH_NAME, but this workflow no longer defines it, so the message will be blank/incorrect; use a defined value (e.g., master or env.NEW_BRANCH_NAME).

      - name: Create GitHub App Token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
        id: generate-token
        with:
          app-id: "${{ secrets.CREATE_PULL_REQUEST_APP_ID }}"
          private-key: "${{ secrets.CREATE_PULL_REQUEST_PEM }}"

      - name: Create pull request
        if: env.HAS_VALIDATOR_CHANGED == 'true'
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          base: master
          branch: ${{ env.NEW_BRANCH_NAME }}
          title: "Upgrade: [dependabot] - bump fhir validator from ${{ env.CURRENT_VALIDATOR_VERSION }} to ${{ env.NEW_VALIDATOR_VERSION }}"
          body: "This PR was automatically created by GitHub Actions to update validator versions."
          commit-message: "Update validator versions on ${{ env.BRANCH_NAME }}"
          sign-commits: true
          token: ${{ secrets.VALIDATOR_UPGRADE_PAT }}
          labels: dependencies

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

.github/workflows/update_validator_version.yml:30

• NEW_BRANCH_NAME is being set, but it is no longer used anywhere in this workflow (the create-pull-request step no longer sets branch:). Either re-add branch: ${{ env.NEW_BRANCH_NAME }} (or similar) to avoid branch collisions, or remove the unused branch-name step to prevent confusion.

      - name: Set up date-time branch name
        id: datetime
        run: |
          # shellcheck disable=SC2086
          echo "NEW_BRANCH_NAME=update-validator-$(date +'%Y%m%d-%H%M%S')" >> $GITHUB_ENV

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud