Skip to content

Refactor CI workflows: integrate dependency review and remove obsolet… #718

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frasermolyneux merged 4 commits into from
Feb 7, 2026
Merged

Refactor CI workflows: integrate dependency review and remove obsolet… #718

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1040d26
Refactor CI workflows: integrate dependency review and remove obsolet…
frasermolyneux Feb 5, 2026
2e01b9d
Update workflow permissions across multiple YAML files
frasermolyneux Feb 5, 2026
53ade33
Add 'permissions: read-all' to multiple workflow YAML files
frasermolyneux Feb 5, 2026
a0e98c4
Add newline at the end of codequality.yml for consistency
frasermolyneux Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/build-and-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@ on:
- "bugfix/**"
- "hotfix/**"

permissions:
contents: read

permissions: read-all

jobs:
build-and-test:
permissions:
contents: read
Comment thread Fixed
runs-on: ubuntu-latest
steps:
- uses: frasermolyneux/actions/dotnet-ci@dotnet-ci/v1.1
Expand Down
30 changes: 26 additions & 4 deletions .github/workflows/codequality.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,15 @@ on:
- main
types: [opened, synchronize, reopened, ready_for_review]

permissions:
contents: read
actions: read
security-events: write

permissions: read-all

jobs:
quality:
permissions:
contents: read
Comment thread Fixed
actions: read
security-events: write
uses: frasermolyneux/actions/.github/workflows/codequality.yml@main
with:
sonar-project-key: frasermolyneux_portal-repository
Expand All @@ -30,3 +32,23 @@ jobs:
src-folder: src
secrets:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

devops-secure-scanning:
permissions:
contents: read
actions: read
security-events: write
uses: frasermolyneux/actions/.github/workflows/devops-secure-scanning.yml@main
Comment thread
frasermolyneux marked this conversation as resolved.
Comment thread
frasermolyneux marked this conversation as resolved.
Comment thread
frasermolyneux marked this conversation as resolved.

dependency-review:
permissions:
contents: read
pull-requests: read
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Dependency Review
uses: actions/dependency-review-action@v4

4 changes: 3 additions & 1 deletion .github/workflows/copilot-setup-steps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ on:
paths:
- .github/workflows/copilot-setup-steps.yml

permissions: read-all

jobs:
# The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
copilot-setup-steps:
Expand All @@ -33,4 +35,4 @@ jobs:
with:
dotnet-version: |
9.0.x
10.0.x-preview
10.0.x-preview
8 changes: 5 additions & 3 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,14 @@ on:
branches:
- 'dependabot/**'

permissions:
contents: write
pull-requests: write

permissions: read-all

jobs:
dependabot:
permissions:
contents: write
Comment thread Fixed
pull-requests: write
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
Expand Down
20 changes: 17 additions & 3 deletions .github/workflows/deploy-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,14 @@ name: Deploy Dev
on:
workflow_dispatch:

permissions:
contents: read
id-token: write

permissions: read-all

jobs:
build-and-test:
permissions:
contents: read
Comment thread Fixed
id-token: write
runs-on: ubuntu-latest
steps:
- uses: frasermolyneux/actions/dotnet-web-ci@main
Expand All @@ -27,6 +29,9 @@ jobs:
src-folder: "src"

terraform-plan-and-apply-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: build-and-test
runs-on: ubuntu-latest
Expand Down Expand Up @@ -68,6 +73,9 @@ jobs:
sql_database_name: ${{ steps.terraform-output.outputs.sql_database_name }}

deploy-sql-database-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: terraform-plan-and-apply-dev
runs-on: ubuntu-latest
Expand All @@ -86,6 +94,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v1-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: [build-and-test, terraform-plan-and-apply-dev, deploy-sql-database-dev]
runs-on: ubuntu-latest
Expand All @@ -102,6 +113,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v2-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: [build-and-test, terraform-plan-and-apply-dev, deploy-sql-database-dev]
runs-on: ubuntu-latest
Expand Down
32 changes: 29 additions & 3 deletions .github/workflows/deploy-prd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,17 @@ on:
schedule:
- cron: "0 3 * * 4"

permissions:
contents: read
id-token: write

permissions: read-all

concurrency:
group: ${{ github.workflow }}

jobs:
build-and-test:
permissions:
contents: read
Comment thread Fixed
id-token: write
runs-on: ubuntu-latest
steps:
- uses: frasermolyneux/actions/dotnet-web-ci@main
Expand All @@ -35,6 +37,9 @@ jobs:
src-folder: "src"

terraform-plan-and-apply-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: build-and-test
runs-on: ubuntu-latest
Expand Down Expand Up @@ -76,6 +81,9 @@ jobs:
sql_database_name: ${{ steps.terraform-output-dev.outputs.sql_database_name }}

deploy-sql-database-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: terraform-plan-and-apply-dev
runs-on: ubuntu-latest
Expand All @@ -94,6 +102,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v1-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: [build-and-test, terraform-plan-and-apply-dev, deploy-sql-database-dev]
runs-on: ubuntu-latest
Expand All @@ -110,6 +121,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v2-dev:
permissions:
contents: read
id-token: write
environment: Development
needs: [build-and-test, terraform-plan-and-apply-dev, deploy-sql-database-dev]
runs-on: ubuntu-latest
Expand All @@ -126,6 +140,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

terraform-plan-and-apply-prd:
permissions:
contents: read
id-token: write
environment: Production
needs:
- app-service-deploy-v1-dev
Expand Down Expand Up @@ -169,6 +186,9 @@ jobs:
sql_database_name: ${{ steps.terraform-output-prd.outputs.sql_database_name }}

deploy-sql-database-prd:
permissions:
contents: read
id-token: write
environment: Production
needs: terraform-plan-and-apply-prd
runs-on: ubuntu-latest
Expand All @@ -187,6 +207,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v1-prd:
permissions:
contents: read
id-token: write
environment: Production
needs: [build-and-test, terraform-plan-and-apply-prd, deploy-sql-database-prd]
runs-on: ubuntu-latest
Expand All @@ -203,6 +226,9 @@ jobs:
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

app-service-deploy-v2-prd:
permissions:
contents: read
id-token: write
environment: Production
needs: [build-and-test, terraform-plan-and-apply-prd, deploy-sql-database-prd]
runs-on: ubuntu-latest
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/destroy-development.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,14 @@ on:
#schedule:
# - cron: "50 0 * * *"

permissions:
contents: read
id-token: write # This is required for Az CLI Login

permissions: read-all

jobs:
terraform-destroy-dev:
permissions:
contents: read
Comment thread Fixed
id-token: write # This is required for Az CLI Login
environment: Development
runs-on: ubuntu-latest

Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/destroy-environment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,14 @@ on:
- dev
- prd

permissions:
contents: read
id-token: write # This is required for Az CLI Login

permissions: read-all

jobs:
terraform-destroy:
permissions:
contents: read
Comment thread Fixed
id-token: write # This is required for Az CLI Login
environment: ${{ inputs.environment == 'prd' && 'Production' || 'Development' }}
runs-on: ubuntu-latest

Expand Down
53 changes: 0 additions & 53 deletions .github/workflows/devops-secure-scanning.yml
View file
Open in desktop

This file was deleted.

11 changes: 8 additions & 3 deletions .github/workflows/integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,14 @@ on:
branches:
- 'integration/**'

permissions:
contents: read
id-token: write # This is required for Az CLI Login

permissions: read-all

jobs:
terraform-get-outputs-dev:
permissions:
contents: read
Comment thread Fixed
id-token: write # This is required for Az CLI Login
environment: Development
runs-on: ubuntu-latest

Expand Down Expand Up @@ -63,6 +65,9 @@ jobs:
api_audience: ${{ steps.terraform-output.outputs.api_audience }}

run-api-integration-tests-dev:
permissions:
contents: read
id-token: write # This is required for Az CLI Login
environment: Development
runs-on: ubuntu-latest
needs: [terraform-get-outputs-dev]
Expand Down
Loading
Loading