CCM-14149: Letter Preview Placeholder

infrastructure/terraform/components/acct/ecr_repository_main.tf

@@ -11,3 +11,66 @@ resource "aws_ecr_repository" "main" {
     scan_on_push = true
   }
 }
+
+resource "aws_ecr_lifecycle_policy" "main" {
+  repository = aws_ecr_repository.main.name
+
+  policy = <<EOF
+{
+  "rules": [
+    {
+      "rulePriority": 1,
+      "description": "Archive commit images after 30 days (commit tags use suffix '-sha-')",
+      "selection": {
+        "tagStatus": "tagged",
+        "tagPatternList": ["*-sha-*"],
+        "countType": "sinceImagePushed",
+        "countNumber": 30
+      },
+      "action": {
+        "type": "transition",
+        "targetStorageClass": "archive"
+      }
+    },
+    {
+      "rulePriority": 2,
+      "description": "Expire (delete) commit images 60 days after push (only those matched as commit images)",
+      "selection": {
+        "tagStatus": "tagged",
+        "tagPatternList": ["*-sha-*"],
+        "countType": "sinceImageTransitioned",
+        "countNumber": 30
+      },
+      "action": {
+        "type": "expire"
+      }
+    },
+      "rulePriority": 3,
+      "description": "Expire (delete) untagged images 7 days after push (only those matched as commit images)",
+      "selection": {
+        "tagStatus": "untagged",
+        "countType": "sinceImageTransitioned",
+        "countNumber": 7
+      },
+      "action": {
+        "type": "expire"
+      }
+    },
+    {
+      "rulePriority": 10,
+      "description": "Archive tagged images (semantic-version tags) after 90 days — do not expire them (no delete)",
+      "selection": {
+        "tagStatus": "tagged",
+        "tagPatternList": ["*-tag-*"],
+        "countType": "sinceImagePushed",
+        "countNumber": 90
+      },
+      "action": {
+        "type": "transition",
+        "targetStorageClass": "archive"
+      }
+    }
+  ]
+}
+EOF
+}

infrastructure/terraform/components/app/README.md

@@ -22,6 +22,7 @@
 | <a name="input_cognito_user_pool_additional_callback_urls"></a> [cognito\_user\_pool\_additional\_callback\_urls](#input\_cognito\_user\_pool\_additional\_callback\_urls) | A list of additional callback\_urls for the cognito user pool | `list(string)` | `[]` | no |
 | <a name="input_commit_id"></a> [commit\_id](#input\_commit\_id) | The commit to deploy. Must be in the tree for branch\_name | `string` | `"HEAD"` | no |
 | <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"app"` | no |
+| <a name="input_container_lambda_ecr_repo"></a> [container\_lambda\_ecr\_repo](#input\_container\_lambda\_ecr\_repo) | ECR repository name for container-based lambda images | `string` | `"nhs-notify-main-acct"` | no |
 | <a name="input_control_plane_bus_arn"></a> [control\_plane\_bus\_arn](#input\_control\_plane\_bus\_arn) | Data plane event bus arn | `string` | n/a | yes |
 | <a name="input_data_plane_bus_arn"></a> [data\_plane\_bus\_arn](#input\_data\_plane\_bus\_arn) | Data plane event bus arn | `string` | n/a | yes |
 | <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
@@ -36,6 +37,7 @@
 | <a name="input_event_delivery_logging_success_sample_percentage"></a> [event\_delivery\_logging\_success\_sample\_percentage](#input\_event\_delivery\_logging\_success\_sample\_percentage) | Enable caching of events to an S3 bucket | `number` | `0` | no |
 | <a name="input_external_email_domain"></a> [external\_email\_domain](#input\_external\_email\_domain) | Externally managed domain used to create an SES identity for sending emails from. Validation DNS records will need to be manually configured in the DNS provider. | `string` | `null` | no |
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonymous with account short-name) | `string` | n/a | yes |
+| <a name="input_image_tag_suffix"></a> [image\_tag\_suffix](#input\_image\_tag\_suffix) | The short SHA or Release Tag to append to the container lambda image tag | `string` | n/a | yes |
 | <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
 | <a name="input_letter_suppliers"></a> [letter\_suppliers](#input\_letter\_suppliers) | Letter suppliers enabled in the environment | <pre>map(object({<br/>    email_addresses  = list(string)<br/>    enable_polling   = bool<br/>    default_supplier = optional(bool)<br/>  }))</pre> | `{}` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
@@ -55,6 +57,7 @@
 | <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/eventpub | v2.0.28 |
 | <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip | n/a |
 | <a name="module_kms_us_east_1"></a> [kms\_us\_east\_1](#module\_kms\_us\_east\_1) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip | n/a |
+| <a name="module_letter_preview_renderer_lambda"></a> [letter\_preview\_renderer\_lambda](#module\_letter\_preview\_renderer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | feature/CCM-14149_Support_Container_Based_Lambdas |
 | <a name="module_nhse_backup_vault"></a> [nhse\_backup\_vault](#module\_nhse\_backup\_vault) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-aws-backup-source.zip | n/a |
 | <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
 | <a name="module_ses"></a> [ses](#module\_ses) | ../../modules/ses | n/a |

infrastructure/terraform/components/app/module_letter_preview_renderer_lambda.tf

@@ -0,0 +1,27 @@
+module "letter_preview_renderer_lambda" {
+  source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=feature/CCM-14149_Support_Container_Based_Lambdas"
+
+  project        = var.project
+  environment    = var.environment
+  component      = var.component
+  aws_account_id = var.aws_account_id
+  region         = var.region
+  group          = var.group
+
+  function_name = "letter-preview-renderer"
+  description   = "Letter preview renderer Lambda"
+
+  kms_key_arn = module.kms.key_arn
+
+  package_type           = "Image"
+  image_uri              = "${var.aws_account_id}.dkr.ecr.${var.region}.amazonaws.com/${var.container_lambda_ecr_repo}:${var.project}-${var.environment}-${var.component}-letter-preview-renderer-${var.image_tag_suffix}"
+  image_repository_names = [var.container_lambda_ecr_repo]
+
+  memory  = 1024
+  timeout = 30
+
+  log_retention_in_days = var.log_retention_in_days
+
+  log_destination_arn       = local.log_destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+}

infrastructure/terraform/components/app/pre.sh

@@ -1,7 +1,19 @@
 # pre.sh runs in the same shell as terraform.sh, not in a subshell
 # any variables set or changed, any change of directory will persist once this script exits and returns control to terraform.sh
+REGION=$1
+ENVIRONMENT=$2
+ACTION=$3
 
 echo "Running app pre.sh"
+echo "ACTION=$ACTION"
+echo "component_name=$component_name"
+echo "project=$project"
+echo "aws_account_id=$aws_account_id"
+echo "environment=$environment"
+echo "region=$region"
+
+# Export values so subprocesses (e.g. npm run lambda-build -> docker.sh) can access them.
+export component_name project aws_account_id environment region
 
 # change to monorepo root
 cd $(git rev-parse --show-toplevel)
@@ -10,7 +22,42 @@ npm ci
 
 npm run generate-dependencies --workspaces --if-present
 
+## Set TF_VAR_image_tag_suffix based on git tag or short SHA for unique lambda image tagging in ECR.
+#This ensures that each build produces a uniquely identifiable image, and tagged releases are easily traceable.
+echo "Checking if current commit is a tag..."
+GIT_TAG="$(git describe --tags --exact-match 2>/dev/null || true)"
+if [ -n "$GIT_TAG" ]; then
+  TAGGED="tag-$GIT_TAG"
+  echo "On tag: $GIT_TAG, exporting TF_VAR_image_tag_suffix as tag: $TAGGED"
+  export TF_VAR_image_tag_suffix="$TAGGED"
+
+else
+  SHORT_SHA="sha-$(git rev-parse --short HEAD)"
+  echo "Not on a tag, exporting TF_VAR_image_tag_suffix as short SHA: $SHORT_SHA"
+  export TF_VAR_image_tag_suffix="$SHORT_SHA"
+fi
+
+echo "Checking if ACTION is 'apply' to set PUBLISH_LAMBDA_IMAGE..."
+if [ "$ACTION" = "apply" ]; then
+  echo "Setting PUBLISH_LAMBDA_IMAGE to true for apply action"
+  export PUBLISH_LAMBDA_IMAGE="true"
+else
+  echo "Not setting PUBLISH_LAMBDA_IMAGE for non-apply action (e.g. plan)"
+fi
+
+
+if [ "$ACTION" = "apply" ]; then
+  echo "Setting PUBLISH_LAMBDA_IMAGE to true for apply action"
+  export PUBLISH_LAMBDA_IMAGE="true"
+else
+  echo "Not setting PUBLISH_LAMBDA_IMAGE for non-apply action (e.g. plan)"
+fi
+
 npm run lambda-build --workspaces --if-present
+if [ $? -ne 0 ]; then
+  echo "npm run lambda-build failed!" >&2
+  exit 1
+fi
 
 lambdas/layers/pdfjs/build.sh
 

infrastructure/terraform/components/app/variables.tf

@@ -173,6 +173,17 @@ variable "event_delivery_logging_success_sample_percentage" {
   default     = 0
 }
 
+variable "container_lambda_ecr_repo" {
+  type        = string
+  description = "ECR repository name for container-based lambda images"
+  default     = "nhs-notify-main-acct"
+}
+
+variable "image_tag_suffix" {
+  type        = string
+  description = "The short SHA or Release Tag to append to the container lambda image tag"
+}
+
 variable "data_plane_bus_arn" {
   type        = string
   description = "Data plane event bus arn"

infrastructure/terraform/components/sandbox/pre.sh

@@ -10,11 +10,31 @@ echo "REGION=$REGION"
 echo "ENVIRONMENT=$ENVIRONMENT"
 echo "ACTION=$ACTION"
 
+# Export values so subprocesses (e.g. npm run lambda-build -> docker.sh) can access them.
+export component_name project aws_account_id environment region
+
 # change to monorepo root
 cd $(git rev-parse --show-toplevel)
 
+## Set TF_VAR_image_tag_suffix based on git tag or short SHA for unique lambda image tagging in ECR.
+## This ensures that each build produces a uniquely identifiable image, and tagged releases are easily traceable.
+echo "Checking if current commit is a tag..."
+GIT_TAG="$(git describe --tags --exact-match 2>/dev/null || true)"
+if [ -n "$GIT_TAG" ]; then
+  TAGGED="tag-$GIT_TAG"
+  echo "On tag: $GIT_TAG, exporting TF_VAR_image_tag_suffix as tag: $TAGGED"
+  export TF_VAR_image_tag_suffix="$TAGGED"
+
+else
+  SHORT_SHA="sha-$(git rev-parse --short HEAD)"
+  echo "Not on a tag, exporting TF_VAR_image_tag_suffix as short SHA: $SHORT_SHA"
+  export TF_VAR_image_tag_suffix="$SHORT_SHA"
+fi
+
 if [ "${ACTION}" == "apply" ]; then
     echo "Building lambdas for distribution"
+    echo "Setting PUBLISH_LAMBDA_IMAGE to true for apply action"
+    export PUBLISH_LAMBDA_IMAGE="true"
 
     if [[ -z $SKIP_SANDBOX_INSTALL ]]; then
       echo "Installing dependencies"
@@ -26,10 +46,15 @@ if [ "${ACTION}" == "apply" ]; then
     npm run generate-dependencies --workspaces --if-present
 
     npm run lambda-build --workspaces --if-present
+    if [ $? -ne 0 ]; then
+      echo "npm run lambda-build failed!" >&2
+      exit 1
+    fi
 
     lambdas/layers/pdfjs/build.sh
 else
     echo "Skipping lambda build for action $ACTION"
+    echo "Not setting PUBLISH_LAMBDA_IMAGE for non-apply action (e.g. plan)"
 fi
 
 # revert back to original directory

lambdas/letter-preview-renderer/.eslintignore

@@ -0,0 +1 @@
+dist

lambdas/letter-preview-renderer/.gitignore

@@ -0,0 +1,4 @@
+coverage
+node_modules
+dist
+.reports

lambdas/letter-preview-renderer/__tests__/index.test.ts

@@ -0,0 +1,17 @@
+import { handler } from '../index';
+import type { Context } from 'aws-lambda';
+import { mockDeep } from 'jest-mock-extended';
+
+describe('event-logging Lambda', () => {
+  it('logs the input event and returns 200', async () => {
+    const event = { foo: 'bar' };
+    const context = mockDeep<Context>();
+    const callback = jest.fn();
+    const result = await handler(event, context, callback);
+
+    expect(result).toEqual({
+      statusCode: 200,
+      body: 'Event logged',
+    });
+  });
+});

lambdas/letter-preview-renderer/build.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+rm -rf dist
+
+npx esbuild \
+  --bundle \
+  --minify \
+  --sourcemap \
+  --target=es2020 \
+  --platform=node \
+  --loader:.node=file \
+  --entry-names=[name] \
+  --outdir=dist \
+  src/index.ts

lambdas/letter-preview-renderer/docker.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# Fail fast on errors, unset variables, and pipeline failures.
+set -euo pipefail
+
+# Ensure build.sh is executable and build the lambda artifacts before producing the Docker image.
+chmod +x ./build.sh
+./build.sh
+
+# Set Variables required for Docker Build. TF_REGION and TF_ENVIRONMENT are set in pre.sh and exported for use here. COMPONENT is passed in the reusable workflow.
+BASE_IMAGE="$1"
+CSI="${project}-${environment}-${component_name}"
+ECR_REPO="${ECR_REPO:-nhs-notify-main-acct}"
+GHCR_LOGIN_TOKEN="${GITHUB_TOKEN}"
+GHCR_LOGIN_USER="${GITHUB_ACTOR}"
+IMAGE_TAG_SUFFIX="${TF_VAR_image_tag_suffix}"
+LAMBDA_NAME="${LAMBDA_NAME:-$(basename "$(cd "$(dirname "$0")" && pwd)")}"
+
+# Ensure required AWS/ECR configuration is present.
+echo "BASE_IMAGE: ${BASE_IMAGE:-<unset>}"
+echo "aws_account_id: ${aws_account_id:-<unset>}"
+echo "aws_region: ${region:-<unset>}"
+echo "component_name: ${component_name:-<unset>}"
+echo "CSI: ${CSI:-<unset>}"
+echo "ECR_REPO: ${ECR_REPO:-<unset>}"
+echo "environment: ${environment:-<unset>}"
+echo "GHCR_LOGIN_TOKEN: ${GHCR_LOGIN_TOKEN:-<unset>}"
+echo "GHCR_LOGIN_USER: ${GHCR_LOGIN_USER:-<unset>}"
+echo "IMAGE_TAG_SUFFIX: ${IMAGE_TAG_SUFFIX:-<unset>}"
+echo "LAMBDA_NAME: ${LAMBDA_NAME:-<unset>}"
+
+# Authenticate Docker with AWS ECR using an ephemeral login token.
+aws ecr get-login-password --region "${region}" | docker login --username AWS --password-stdin "${aws_account_id}".dkr.ecr."${region}".amazonaws.com
+
+# Optionally authenticate to GitHub Container Registry for base images.
+if [ -n "${GHCR_LOGIN_USER:-}" ] && [ -n "${GHCR_LOGIN_TOKEN:-}" ]; then
+  echo "Attempting GHCR login as ${GHCR_LOGIN_USER}..."
+  if echo "${GHCR_LOGIN_TOKEN}" | docker login ghcr.io --username "${GHCR_LOGIN_USER}" --password-stdin; then
+    echo "GHCR login successful."
+  else
+    echo "GHCR login failed!" >&2
+  fi
+fi
+
+# Namespace tag by CSI and lambda name to avoid cross-environment collisions.
+IMAGE_TAG="${CSI}-${LAMBDA_NAME}-${IMAGE_TAG_SUFFIX}"
+
+# Compose the full ECR image references.
+ECR_REPO_URI="${aws_account_id}.dkr.ecr.${region}.amazonaws.com/${ECR_REPO}"
+ECR_IMAGE="${ECR_REPO_URI}:${IMAGE_TAG}"
+# Use only the first input argument for BASE_IMAGE_ARG (no fallback)
+BASE_IMAGE_ARG="$1"
+
+# Build and tag the Docker image for the lambda.
+docker buildx build \
+  -f docker/lambda/Dockerfile \
+  --build-arg BASE_IMAGE="${BASE_IMAGE}" \
+  -t "${ECR_IMAGE}" \
+  .
+
+# Push the image tag to ECR on apply only. The Terraform configuration will reference this tag for the lambda image.
+if [ "${PUBLISH_LAMBDA_IMAGE:-false}" = "true" ]; then
+  echo "PUBLISH_LAMBDA_IMAGE is set to true. Pushing Docker image to ECR: ${ECR_IMAGE}"
+  docker push "${ECR_IMAGE}"
+else
+  echo "PUBLISH_LAMBDA_IMAGE is not set to true (we are most likely running in the context of a TF Plan). Skipping Docker push."
+  exit 0
+fi

lambdas/letter-preview-renderer/docker/lambda/Dockerfile

@@ -0,0 +1,8 @@
+ARG BASE_IMAGE=ghcr.io/nhsdigital/nhs-notify/letter-renderer-node-22:latest
+
+FROM ${BASE_IMAGE}
+
+# Copy the built output from the build context (docker.sh should have run build.sh already)
+COPY dist/index.js ${LAMBDA_TASK_ROOT}/index.js
+
+CMD [ "index.handler" ]

lambdas/letter-preview-renderer/index.ts

@@ -0,0 +1,10 @@
+// Replace me with the actual code for your Lambda function
+import { Handler } from 'aws-lambda';
+
+export const handler: Handler = async (event) => {
+  console.log('Received event:', event);
+  return {
+    statusCode: 200,
+    body: 'Event logged',
+  };
+};