Feature/ccm 12180 test on pipeline re sign

.editorconfig

@@ -67,3 +67,9 @@ trim_trailing_whitespace = unset
 indent_style = unset
 indent_size = unset
 generated_code = true
+
+[/internal/events/**/*.schema.json]
+insert_final_newline = unset
+
+[/pact-contracts/pacts/**/*.json]
+insert_final_newline = unset

.env.template

@@ -0,0 +1,5 @@
+ENVIRONMENT=$ENV_NAME
+API_KEY=
+HEADERAUTH=
+PR_NUMBER=prxx # remove if needs to run against main
+NHSD_APIM_TOKEN=

.github/CODEOWNERS

@@ -5,7 +5,10 @@
 /.github/                   @NHSDigital/nhs-notify-supplier-api-admins
 *.code-workspace            @NHSDigital/nhs-notify-supplier-api-admins
 /docs/                      @NHSDigital/nhs-notify-supplier-api
-/infrastructure/terraform/  @NHSDigital/nhs-notify-platform
+/infrastructure/terraform/  @NHSDigital/nhs-notify-platform @NHSDigital/nhs-notify-supplier-api-admins
+
+# Root level AGENTS.md owned by platform.
+AGENTS.md                   @NHSDigital/nhs-notify-platform
 
 # Codeowners must be final check
 /.github/CODEOWNERS         @NHSDigital/nhs-notify-code-owners

.github/actions/acceptance-tests/action.yaml

@@ -0,0 +1,51 @@
+name: Acceptance tests
+description: "Run acceptance tests for this repo"
+
+inputs:
+  testType:
+    description: Type of test to run
+    required: true
+
+  targetEnvironment:
+    description: Name of the environment under test
+    required: true
+
+  targetAccountGroup:
+    description: Name of the account group under test
+    default: nhs-notify-template-management-dev
+    required: true
+
+  targetComponent:
+    description: Name of the component under test
+    required: true
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: Fetch terraform output
+      uses: actions/download-artifact@v5
+      with:
+        name: terraform-output-${{ inputs.targetComponent }}
+
+    - name: Get Node version
+      id: nodejs_version
+      shell: bash
+      run: |
+        echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+
+    - name: "Repo setup"
+      uses: ./.github/actions/node-install
+      with:
+        node-version: ${{ steps.nodejs_version.outputs.nodejs_version }}
+        GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
+
+    - name: "Set PR NUMBER"
+      shell: bash
+      run: |
+          echo "PR_NUMBER=${{ inputs.targetEnvironment }}" >> $GITHUB_ENV
+
+    - name: Run test - ${{ inputs.testType }}
+      shell: bash
+      run: |
+        make test-${{ inputs.testType }}

.github/actions/build-docs/action.yml

@@ -4,16 +4,22 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
     - name: Checkout
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
     - name: Npm cli install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
     - name: Setup Ruby

.github/actions/build-libraries/action.yml

@@ -4,17 +4,23 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
     - name: Checkout
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 

.github/actions/build-proxies/action.yml

@@ -25,6 +25,12 @@ inputs:
     description: "Name of the Component to deploy"
     required: true
     default: 'api'
+  nodejs_version:
+    description: "Node.js version, set by the CI/CD pipeline workflow"
+    required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 
 runs:
   using: composite
@@ -34,10 +40,22 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: ${{ inputs.nodejs_version }}
+        registry-url: 'https://npm.pkg.github.com'
+
+    - name: "Cache node_modules"
+      uses: actions/cache@v4
+      with:
+        path: |
+          **/node_modules
+        key: ${{ runner.os }}-node-${{ inputs.nodejs_version }}-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-${{ inputs.nodejs_version }}-
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 

.github/actions/build-sandbox/action.yml

@@ -4,6 +4,10 @@ inputs:
   version:
     description: "Version number"
     required: true
+
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: composite
 
@@ -12,10 +16,13 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 

.github/actions/build-sdk/action.yml

@@ -4,17 +4,23 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
     - name: Checkout
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 

.github/actions/build-server/action.yml

@@ -4,17 +4,23 @@ inputs:
   version:
     description: "Version number"
     required: true
+  NODE_AUTH_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
 runs:
   using: "composite"
   steps:
     - name: Checkout
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
+        registry-url: 'https://npm.pkg.github.com'
 
     - name: Npm install
       working-directory: .
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.NODE_AUTH_TOKEN }}
       run: npm ci
       shell: bash
 

.github/actions/node-install/action.yaml

@@ -0,0 +1,27 @@
+name: 'npm install and setup'
+description: 'Setup node, authenticate github package repository and perform clean npm install'
+
+inputs:
+  node-version:
+    description: 'Node.js version'
+    required: true
+  GITHUB_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Use Node.js'
+      uses: actions/setup-node@v6
+      with:
+        node-version: '${{ inputs.node-version }}'
+        registry-url: 'https://npm.pkg.github.com'
+        scope: '@nhsdigital'
+
+    - name: 'Install dependencies'
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.GITHUB_TOKEN }}
+      run: |
+        npm ci

.github/actions/test-types.json

@@ -0,0 +1,3 @@
+[
+  "component"
+]

.github/workflows/manual-proxy-environment-deploy.yaml

@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   deploy-environment:
@@ -32,10 +33,12 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 22
 
       - name: Npm install
         working-directory: .
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm ci
         shell: bash
 
@@ -87,3 +90,4 @@ jobs:
           runId: "${{ github.run_id }}"
           buildSandbox: ${{ inputs.build_sandbox }}
           releaseVersion: ${{ github.ref_name }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr_closed.yaml

@@ -62,3 +62,98 @@ jobs:
             --targetAccountGroup "nhs-notify-supplier-api-dev" \
             --targetComponent "${{ matrix.component }}" \
             --terraformAction "apply"
+
+  check-event-schemas-version-change:
+    name: Check for event schemas package version change
+    needs: check-merge-or-workflow-dispatch
+    if: needs.check-merge-or-workflow-dispatch.outputs.deploy == 'true'
+    outputs:
+      version_changed: ${{ steps.check-version.outputs.version_changed }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: check if local version differs from latest published version
+        id: check-version
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          published_version=$(npm view @nhsdigital/nhs-notify-event-schemas-supplier-api --json 2>/dev/null | jq -r '.["dist-tags"].latest // "null"')
+          echo "Published version: $published_version"
+
+          local_version=$(jq -r '.version' internal/events/package.json)
+          echo "Local version: $local_version"
+
+          if [[ $local_version = $published_version ]]; then
+            echo "Local version is the same as the latest published version - skipping publish"
+            echo "version_changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "Local version is different to the latest published version - publishing new version"
+            echo "version_changed=true" >> $GITHUB_OUTPUT
+          fi
+
+  test-contract:
+    name: "Test contracts (provider)"
+    needs: check-event-schemas-version-change
+    if: needs.check-event-schemas-version-change.outputs.version_changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v5.0.0
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
+      - name: "Install dependencies"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm ci
+      - name: "Run provider contract tests"
+        run: make test-contract
+        env:
+          GITHUB_PACKAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-event-schemas:
+    name: Publish event schemas package to GitHub package registry
+    needs:
+      - check-event-schemas-version-change
+      - test-contract
+    if: needs.check-event-schemas-version-change.outputs.version_changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Install dependencies
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm ci
+
+      - name: Publish to GitHub Packages
+        run: npm publish --workspace internal/events
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}