NHSO-0000: Security fixups.

.github/workflows/continuous-integration.yml

@@ -33,7 +33,7 @@ jobs:
         run: python -m pip install --upgrade pip setuptools wheel
 
       - name: Install poetry
-        run: pip install "poetry<2.0.0"
+        run: 'pip install --only-binary :all: "poetry==2.4.1"'
 
       - name: Cache poetry packages
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

azure/azure-pr-pipeline.yml

@@ -43,9 +43,3 @@ extends:
       - environment: internal-dev
         post_deploy:
           - template: ./templates/run-integration-tests.yml
-            parameters:
-              working_directory: $(Pipeline.Workspace)/s
-              test_folder_path: $(Pipeline.Workspace)/s/${{ variables.service_name }}/$(SERVICE_ARTIFACT_NAME)/tests
-              target_url: https://$(APIGEE_ENVIRONMENT).api.service.nhs.uk/$(SERVICE_BASE_PATH)/
-              token_url: https://$(APIGEE_ENVIRONMENT).api.service.nhs.uk/oauth2/token
-              private_key_file_path: $(Pipeline.Workspace)/secrets/$(JWT_TESTING_PRIVATE_KEY)

azure/project.yml

@@ -1,4 +1,9 @@
 variables:
   service_name: nhs-app
   short_service_name: nhsa
-  service_base_path: nhs-app
+  service_base_path: nhs-app
+  WorkingDir: $(Pipeline.Workspace)/s
+  TargetUrl: https://$(APIGEE_ENVIRONMENT).api.service.nhs.uk/$(SERVICE_BASE_PATH)/
+  TokenUrl: https://$(APIGEE_ENVIRONMENT).api.service.nhs.uk/oauth2/token
+  TestFolderPath: $(Pipeline.Workspace)/s/${{ variables.service_name }}/$(SERVICE_ARTIFACT_NAME)/tests
+  PrivateKeyFilePath: $(Pipeline.Workspace)/secrets/$(JWT_TESTING_PRIVATE_KEY)

azure/templates/run-integration-tests.yml

@@ -1,15 +1,3 @@
-parameters:
-  - name: working_directory
-    type: string
-  - name: target_url
-    type: string
-  - name: token_url
-    type: string
-  - name: test_folder_path
-    type: string
-  - name: private_key_file_path
-    type: string
-
 steps:
   - task: UseDotNet@2
     displayName: 'Use .NET Core sdk'
@@ -22,17 +10,17 @@ steps:
     displayName: dotnet restore
     inputs:
       command: restore
-      projects: '${{ parameters.test_folder_path }}/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.csproj'
+      projects: '$(TestFolderPath)/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.csproj'
       feedsToUse: 'config'
-      nugetConfigPath: '${{ parameters.test_folder_path }}/Nhs.App.Api.Integration.Tests/Nuget.config'
+      nugetConfigPath: '$(TestFolderPath)/Nhs.App.Api.Integration.Tests/Nuget.config'
       includeNuGetOrg: true
 
   - task: DotNetCoreCLI@2
     displayName: Publish Integration Tests
     inputs:
       command: 'publish'
       version: '5.0.x'
-      projects: '${{ parameters.test_folder_path }}/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.csproj'
+      projects: '$(TestFolderPath)/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.csproj'
       publishWebProjects: false
       zipAfterPublish: false
       arguments: "--configuration Release -o Publish"
@@ -43,21 +31,21 @@ steps:
       command: 'custom'
       custom: vstest
       arguments: >
-        ${{ parameters.working_directory }}/Publish/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.dll
-        --logger:"trx;LogFileName=${{ parameters.working_directory }}/IntegrationTests/Tests.trx"
-        --settings:${{ parameters.working_directory }}/Publish/Nhs.App.Api.Integration.Tests/test.runsettings
+        $(WorkingDir)/Publish/Nhs.App.Api.Integration.Tests/Nhs.App.Api.Integration.Tests.dll
+        --logger:"trx;LogFileName=$(WorkingDir)/IntegrationTests/Tests.trx"
+        --settings:$(WorkingDir)/Publish/Nhs.App.Api.Integration.Tests/test.runsettings
         -- TestRunParameters.Parameter(name="\""ApigeeApiKey"\"",value="\""$(CLIENT_ID)"\"")
-        -- TestRunParameters.Parameter(name="\""ApplicationUrl"\"",value="\""${{ parameters.target_url }}"\"")
-        -- TestRunParameters.Parameter(name="\""TokenEndpoint"\"",value="\""${{ parameters.token_url }}"\"")
+        -- TestRunParameters.Parameter(name="\""ApplicationUrl"\"",value="\""$(TargetUrl)"\"")
+        -- TestRunParameters.Parameter(name="\""TokenEndpoint"\"",value="\""$(TokenUrl)"\"")
         -- TestRunParameters.Parameter(name="\""IssuerKey"\"",value="\""$(JWT_TESTING_API_KEY)"\"")
-        -- TestRunParameters.Parameter(name="\""PrivateKeyFilePath"\"",value="\""${{ parameters.private_key_file_path }}"\"")
+        -- TestRunParameters.Parameter(name="\""PrivateKeyFilePath"\"",value="\""$(PrivateKeyFilePath)"\"")
         -- TestRunParameters.Parameter(name="\""KidValue"\"",value="\"test-1\"")
 
   - task: PublishTestResults@2
-    displayName: 'Publish Test Results ${{ parameters.working_directory }}/IntegrationTests/Tests.trx'
+    displayName: 'Publish Test Results $(WorkingDir)/IntegrationTests/Tests.trx'
     inputs:
       testResultsFormat: VSTest
-      testResultsFiles: '${{ parameters.working_directory }}/IntegrationTests/Tests.trx'
+      testResultsFiles: '$(WorkingDir)/IntegrationTests/Tests.trx'
       mergeTestResults: true
       testRunTitle: 'Integration Tests'
     continueOnError: true

sandbox/Dockerfile

@@ -1,10 +1,10 @@
-FROM node:12
+FROM node:24
 
 COPY . /sandbox
 
 WORKDIR /sandbox
 
-RUN npm install
+RUN npm install --ignore-scripts
 
 EXPOSE 9000