From 5babc640ce733619898b99a19f47bda515a4e050 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:49:12 +0000 Subject: [PATCH 1/3] build(deps): bump actions/checkout Bumps the github-actions-minor-patch group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/cicd-1-pull-request.yaml | 8 ++++---- .github/workflows/cicd-2-publish.yaml | 4 ++-- .../workflows/dependency-tools-mise-upgrade.yml | 2 +- .github/workflows/stage-1-coding-standards.yaml | 14 +++++++------- .github/workflows/stage-1-commit.yaml | 14 +++++++------- .github/workflows/stage-1-pre-commit.yml | 2 +- .github/workflows/stage-2-test.yaml | 8 ++++---- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml index 8a17367d..30e5260e 100644 --- a/.github/workflows/cicd-1-pull-request.yaml +++ b/.github/workflows/cicd-1-pull-request.yaml @@ -44,7 +44,7 @@ jobs: image_tag: ${{ steps.set-metadata.outputs.image_tag }} steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Set CI/CD metadata" id: set-metadata @@ -75,7 +75,7 @@ jobs: changed: ${{ steps.detect.outputs.changed }} steps: - name: "Checkout PR branch" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} fetch-depth: 0 @@ -300,7 +300,7 @@ jobs: timeout-minutes: 5 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Set up mise" uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 @@ -322,7 +322,7 @@ jobs: # contents: read # steps: # - name: Checkout code - # uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + # uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - name: Generate a token # id: generate-token diff --git a/.github/workflows/cicd-2-publish.yaml b/.github/workflows/cicd-2-publish.yaml index c1def78f..6734fd6f 100644 --- a/.github/workflows/cicd-2-publish.yaml +++ b/.github/workflows/cicd-2-publish.yaml @@ -34,7 +34,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -56,7 +56,7 @@ jobs: timeout-minutes: 10 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 diff --git a/.github/workflows/dependency-tools-mise-upgrade.yml b/.github/workflows/dependency-tools-mise-upgrade.yml index faa7f49b..802384dc 100644 --- a/.github/workflows/dependency-tools-mise-upgrade.yml +++ b/.github/workflows/dependency-tools-mise-upgrade.yml @@ -31,7 +31,7 @@ jobs: timeout-minutes: 20 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Set up mise" uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 diff --git a/.github/workflows/stage-1-coding-standards.yaml b/.github/workflows/stage-1-coding-standards.yaml index 4675e232..013f144a 100644 --- a/.github/workflows/stage-1-coding-standards.yaml +++ b/.github/workflows/stage-1-coding-standards.yaml @@ -49,7 +49,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to scan all commits - name: "Scan secrets" @@ -62,7 +62,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check file format" @@ -75,7 +75,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check Markdown format" @@ -88,7 +88,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check English usage" @@ -101,7 +101,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Lint Terraform" uses: ./.github/actions/lint-terraform @@ -116,7 +116,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Count lines of code" uses: ./.github/actions/create-lines-of-code-report with: @@ -138,7 +138,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Scan dependencies" uses: ./.github/actions/scan-dependencies with: diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml index e96aa997..3734d98b 100644 --- a/.github/workflows/stage-1-commit.yaml +++ b/.github/workflows/stage-1-commit.yaml @@ -49,7 +49,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to scan all commits - name: "Scan secrets" @@ -61,7 +61,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check file format" @@ -73,7 +73,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check Markdown format" @@ -85,7 +85,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check English usage" @@ -97,7 +97,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Lint Terraform" uses: ./.github/actions/lint-terraform count-lines-of-code: @@ -109,7 +109,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Count lines of code" uses: ./.github/actions/create-lines-of-code-report with: @@ -128,7 +128,7 @@ jobs: timeout-minutes: 2 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Scan dependencies" uses: ./.github/actions/scan-dependencies with: diff --git a/.github/workflows/stage-1-pre-commit.yml b/.github/workflows/stage-1-pre-commit.yml index e34b4f05..267d4bb6 100644 --- a/.github/workflows/stage-1-pre-commit.yml +++ b/.github/workflows/stage-1-pre-commit.yml @@ -47,7 +47,7 @@ jobs: regenerate-dependabot-config check-available-modules steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/stage-2-test.yaml b/.github/workflows/stage-2-test.yaml index 0f30982c..a55f0db2 100644 --- a/.github/workflows/stage-2-test.yaml +++ b/.github/workflows/stage-2-test.yaml @@ -39,7 +39,7 @@ jobs: timeout-minutes: 5 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run unit test suite" run: | make test-unit @@ -52,7 +52,7 @@ jobs: timeout-minutes: 5 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run linting" run: | make test-lint @@ -66,7 +66,7 @@ jobs: timeout-minutes: 5 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run test coverage check" run: | make test-coverage @@ -83,7 +83,7 @@ jobs: timeout-minutes: 5 steps: - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Full history is needed to improving relevancy of reporting - name: "Perform static analysis" From 2dfcf1f25dccf0f91bcf84bb59f79d6719d62570 Mon Sep 17 00:00:00 2001 From: Oliver Slater Date: Mon, 5 Oct 2026 18:29:39 +0100 Subject: [PATCH 2/3] fix: update echo command in extract-branch-name action and improve variable handling in cicd-1-pull-request workflow --- .github/actions/extract-branch-name/action.yaml | 4 +++- .github/workflows/cicd-1-pull-request.yaml | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/actions/extract-branch-name/action.yaml b/.github/actions/extract-branch-name/action.yaml index 863e2bf6..eabcc8be 100644 --- a/.github/actions/extract-branch-name/action.yaml +++ b/.github/actions/extract-branch-name/action.yaml @@ -47,5 +47,7 @@ runs: - name: Echo branch name shell: bash + env: + BRANCH_NAME: ${{ steps.extract.outputs.branch_name }} run: | - echo "branch_name = '${{ steps.extract.outputs.branch_name }}'" + echo "branch_name = '${BRANCH_NAME}'" diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml index 30e5260e..20d42d6a 100644 --- a/.github/workflows/cicd-1-pull-request.yaml +++ b/.github/workflows/cicd-1-pull-request.yaml @@ -93,10 +93,10 @@ jobs: # Compare PR head against base to find modules with provider constraint changes. base_sha="${{ github.event.pull_request.base.sha }}" + # xargs -r avoids calling dirname with empty stdin when grep finds no matches. mapfile -t modules_to_upgrade < <( git diff --name-only "$base_sha...HEAD" \ | grep '^infrastructure/modules/.*/versions\.tf$' \ - # -r avoids calling dirname with empty stdin when grep finds no matches. | xargs -r -n1 dirname \ | sort -u ) @@ -139,12 +139,14 @@ jobs: # Push an auto-fix commit so the next PR workflow run validates the refreshed content. if: steps.detect.outputs.changed == 'true' shell: bash + env: + HEAD_REF: ${{ github.event.pull_request.head.ref }} run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add -A git commit -m "chore(dependabot): regenerate terraform docs and lockfiles" - git push origin "HEAD:${{ github.event.pull_request.head.ref }}" + git push origin "HEAD:${HEAD_REF}" - name: "Comment on PR with auto-fix summary" if: steps.detect.outputs.changed == 'true' From 58f25a6fa6bef3118e13779c31272fa04120f45d Mon Sep 17 00:00:00 2001 From: Oliver Slater Date: Mon, 5 Oct 2026 18:58:43 +0100 Subject: [PATCH 3/3] fix(docs): correct indentation in Docker build instructions for consistency --- docs/developer-guides/Scripting_Docker.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/developer-guides/Scripting_Docker.md b/docs/developer-guides/Scripting_Docker.md index 08b6a4ff..3c619cef 100644 --- a/docs/developer-guides/Scripting_Docker.md +++ b/docs/developer-guides/Scripting_Docker.md @@ -154,8 +154,8 @@ It is usually the case that there is a specific image that you will most often w ```make build: # Build the project artefact @Pipeline - DOCKER_IMAGE=my-shiny-app - make docker-build + DOCKER_IMAGE=my-shiny-app + make docker-build ``` Now when you run `make build`, it will do the right thing. Keeping this convention consistent across projects means that new starters can be on-boarded quickly, without needing to learn a new set of conventions each time.