Differences between upstream (red) and UKHSA's fork (green)

.eslintrc.json

@@ -48,7 +48,12 @@
     {
       "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
       "rules": {
-        "prettier/prettier": ["error"],
+        "prettier/prettier": [
+          "error",
+          {
+            "endOfLine": "auto"
+          }
+        ],
         "tsdoc/syntax": "warn"
       }
     }

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Each line is a file pattern followed by one or more owners.
+
+# L3 Engineering are the default owners for everything excluding team specific forms (unless it's for a product supported by L3, in which
+# case they are owners for those specific forms too)
+
+* @ukhsa-collaboration/L3-Engineering
+/runner/src/server/forms/ReportAnOutbreak @ukhsa-collaboration/L3-Engineering
+
+/runner/src/server/forms

.github/copilot-instructions.md

@@ -0,0 +1,40 @@
+# Copilot Instructions
+
+## 🚫 Sensitive Files — Do Not Use for Context
+
+The following files contain sensitive or secret information and must NEVER be used
+as context for suggestions, completions, or prompts:
+
+- .env
+- \*.env
+- .env.\*
+- secrets.\*
+- credentials.\*
+- private.key
+- \*.pem
+
+These files may contain:
+
+- API keys
+- Tokens
+- Passwords
+- Private credentials
+
+Copilot must ignore these files entirely.
+
+---
+
+## ✅ Safe Alternatives
+
+When generating code or examples:
+
+- Use placeholder values instead of real secrets
+- Refer to `.env.example` for variable names and structure
+- Never infer or suggest real-looking secrets
+
+Example:
+
+```env
+API_KEY=your-api-key-here
+DATABASE_URL=your-database-url-here
+```

.github/workflows/auto-forms-deployment-caller.yml

@@ -0,0 +1,97 @@
+# This workflow automatically calls to deploy if a change is made to only the forms folder
+
+name: Automated Form Deployment
+
+# Workflow runs automatically when the form folder is updated
+on:
+  push:
+    branches:
+      - v2
+    paths:
+      - "runner/src/server/forms/**"
+  workflow_dispatch:
+    inputs:
+      success:
+        description: "Did the deployment succeed"
+        type: boolean
+        required: true
+        default: false
+      auto_deploy_status:
+        description: "Failure status message"
+        type: string
+        required: false
+      commit_message:
+        description: "Triggering commit message"
+        type: string
+        required: true
+      caller_run_id:
+        description: "Workflow Caller ID"
+        type: string
+        required: true
+
+jobs:
+  Trigger-Deployment:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+    outputs:
+      should_deploy: ${{ steps.check_file_path.outputs.should_deploy }}
+    env:
+      FORMS_FOLDER: "runner/src/server/forms/"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Check file paths
+        id: check_file_path
+        run: |
+          NON_FORM_FILES=$(git diff --name-only ${{ github.event.before }} ${{ github.event.after }} -- ":(exclude)${{ env.FORMS_FOLDER }}" | wc -l)
+          if [ "$NON_FORM_FILES" -eq 0 ]; then
+            echo "Only form changes found, able to deploy"
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          else
+            echo "Non-form changes found, do not deploy"
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Generate token
+        if: steps.check_file_path.outputs.should_deploy == 'true'
+        uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ secrets.DEPLOYMENT_APP_ID }}
+          private-key: ${{ secrets.DEPLOYMENT_APP_KEY }}
+          owner: ${{ secrets.DEPLOYMENT_OWNER }}
+          repositories: ${{ secrets.DEPLOYMENT_REPO }}
+
+      - name: Call deployment repo
+        if: steps.check_file_path.outputs.should_deploy == 'true'
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: '${{ secrets.DEPLOYMENT_OWNER }}',
+              repo: '${{ secrets.DEPLOYMENT_REPO }}',
+              workflow_id: 'form-only-deployment.yml',
+              ref: 'trunk',
+              inputs: {
+                branch: 'v2',
+                commit_message: '${{ github.event.head_commit.message }}',
+                caller_run_id: '${{ github.run_id }}'
+              }
+            });
+
+  Print-Status:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print Deployment Status
+        run: |
+          echo "Deployment Success: ${{ github.event.inputs.success }}"
+          echo "Deployment Status Message: ${{ github.event.inputs.auto_deploy_status }}"
+          echo "Triggering Commit Message: ${{ github.event.inputs.commit_message }}"
+          echo "Caller Run ID: ${{ github.event.inputs.caller_run_id }}"

.github/workflows/beta--lint-unit-build-and-publish-images.yml

@@ -10,21 +10,21 @@ jobs:
     outputs:
       semVer: ${{ steps.gitversion.outputs.semVer }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          branches: main
+          ref: main
 
       - name: Install GitVersion
-        uses: gittools/actions/gitversion/setup@v0.9.7
+        uses: gittools/actions/gitversion/setup@v4
         with:
           versionSpec: "5.x"
 
       - name: Determine Version
         id: gitversion
-        uses: gittools/actions/gitversion/execute@v0.9.7
+        uses: gittools/actions/gitversion/execute@v4
         with:
-          useConfigFile: true
+          configFilePath: "GitVersion.yml"
 
   assign-semver:
     runs-on: ubuntu-latest
@@ -72,7 +72,7 @@ jobs:
       SEMVER: ${{ needs.assign-semver.outputs.SEMVER }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Tag branch with run number

.github/workflows/build.yml

@@ -32,17 +32,17 @@ jobs:
       tag: ${{ steps.hashFile.outputs.tag }}
       hash: ${{ steps.hashFile.outputs.hash }}
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@v5
       - name: Use Node.js
-        uses: actions/setup-node@v3.6.0
+        uses: actions/setup-node@v5
         with:
           node-version: "16.x"
 
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
         run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -52,13 +52,13 @@ jobs:
           fail-on-cache-miss: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
         with:
-          config-inline: |
+          buildkitd-config-inline: |
             [registry."ghcr.io"]
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -75,7 +75,7 @@ jobs:
 
       - name: Build ${{inputs.app}}
         if: ${{inputs.publish != true }}
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           file: ${{inputs.app}}/Dockerfile
           push: false
@@ -84,7 +84,7 @@ jobs:
 
       - name: Build ${{inputs.app}} and push
         if: ${{inputs.semver && inputs.publish == true }}
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           file: ${{inputs.app}}/Dockerfile
           push: true

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v5
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -47,7 +47,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,4 +56,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v4

.github/workflows/create-ukhsa-release.yaml

@@ -0,0 +1,90 @@
+name: Create UKHSA Release
+
+on:
+  push:
+    branches:
+      - v2
+    paths:
+      - "**/*docker-compose*.yml"
+      - "**/*docker-compose*.yaml"
+      - "**/docker-compose/**"
+      - "runner/**"
+      - "designer/**"
+      - "submitter/**"
+      - "model/**"
+      - "queue-model/**"
+      - "package.json"
+      - "yarn.lock"
+
+jobs:
+  create-extended-tags:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Git
+        run: |
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+
+      - name: Find merge base with main and create extended tags
+        run: |
+          # Ensure we have all tags and branches
+          git fetch --tags origin
+          git fetch origin main:main
+
+          # Find the merge base between v2 and main
+          MERGE_BASE=$(git merge-base v2 main)
+          echo "Merge base commit: $MERGE_BASE"
+
+          # Get the tags that point to the merge base commit
+          BASE_TAGS=$(git tag --points-at $MERGE_BASE)
+
+          if [ -z "$BASE_TAGS" ]; then
+            echo "No tags found at merge base. Exiting."
+            exit 0
+          fi
+
+          echo "Found tags at merge base: $BASE_TAGS"
+
+          # Process each found tag
+          for BASE_TAG in $BASE_TAGS; do
+            echo "Processing base tag: $BASE_TAG"
+
+            # Find highest existing extended tag version
+            HIGHEST_EXT_VERSION=0
+
+            # Get all extended tags for this base tag
+            EXISTING_EXT_TAGS=$(git tag -l "${BASE_TAG}-ext*")
+
+            for EXT_TAG in $EXISTING_EXT_TAGS; do
+              # Extract version number after "ext"
+              VERSION_NUM=$(echo $EXT_TAG | sed -E "s|${BASE_TAG}-ext([0-9]+)|\1|")
+
+              if [[ $VERSION_NUM =~ ^[0-9]+$ ]]; then
+                if [ $VERSION_NUM -gt $HIGHEST_EXT_VERSION ]; then
+                  HIGHEST_EXT_VERSION=$VERSION_NUM
+                fi
+              fi
+            done
+
+            # Calculate new version
+            NEW_VERSION=$((HIGHEST_EXT_VERSION + 1))
+            NEW_TAG="${BASE_TAG}-ext${NEW_VERSION}"
+
+            echo "Creating new extended tag: $NEW_TAG"
+
+            # Get current v2 branch HEAD
+            V2_HEAD=$(git rev-parse v2)
+
+            # Create annotated tag
+            git tag -a "$NEW_TAG" -m "Extended tag from $BASE_TAG for v2 branch (version $NEW_VERSION)" $V2_HEAD
+
+            # Push the new tag
+            git push origin "$NEW_TAG"
+            echo "Successfully created and pushed tag $NEW_TAG"
+          done