[jamesthompson26-nhs]

Description

CCM-24467: Replace asdf with mise and pre-commit with prek.

• Added mise.toml pinning the CLI tools previously in .tool-versions; pre-commit is replaced by prek.
• Added mise.lock with checksums for 73 platform entries. Installs run with MISE_LOCKED=1 so they are verified against it.
• Supply-chain hardening in mise.toml: asdf and vfox plugins are disabled, and minimum_release_age = "7d" ignores newly published releases.
• Moved the Docker image pins to .docker-versions; docker.lib.sh reads this file instead of .tool-versions. .tool-versions is deleted.
• CI: replaced asdf-vm/actions/setup with jdx/mise-action v4.3.0 (pinned to a SHA). Version outputs in cicd-1-pull-request.yaml and cicd-3-deploy.yaml are read from mise.toml, and stage-2-test.yaml passes node-version explicitly.
• make githooks-config now runs prek install --force, so existing clones replace the old pre-commit git hook.
• Updated init.mk, terraform.mk, terraform.sh, style.sh, postcreatecommand.sh, the README, AGENTS.md, the sync/ignore configs and the Vale accept list to use mise and prek.
• Validated locally: MISE_LOCKED=1 mise install and mise exec -- prek run --config scripts/config/pre-commit.yaml pass. CI workflow changes have not been run.

Local setup for developers

Install mise using the instructions for your operating system. On macOS with Homebrew:

brew install mise

Keep asdf installed while you work in repositories that have not migrated. For zsh, add mise activation to ~/.zshrc:

eval "$(mise activate zsh)"

Restart the terminal, change to this repository, then configure the pinned tools and git hooks:

make config

The repository’s mise.toml defines tool versions, and mise.lock records download URLs and checksums. The make config install uses locked mode to verify tools against that lockfile.

To switch between version managers in a zsh session, you can add this optional function to ~/.zshrc:

function activate() {
  case "$1" in
    mise)
      path=("${path[@]:#$HOME/.asdf/shims}")
      eval "$(mise activate zsh)"
      ;;
    asdf)
      eval "$(mise deactivate)"
      path=("${path[@]:#$HOME/.asdf/shims}")
      export PATH="$HOME/.asdf/shims:$PATH"
      ;;
    *)
      print -u2 "Usage: activate mise|asdf"
      return 2
      ;;
  esac
  rehash
}

Run the configured hooks manually at any time with:

make githooks-run

After changing to a repository, run activate mise for a migrated repo or activate asdf for a legacy repo. Confirm which tool is selected with which node or node --version. The function only affects the current terminal and is not installed by this repository.

The devcontainer setup installs a pinned mise release and runs make config automatically.

6. Optional: remove asdf once nothing else depends on it (brew uninstall asdf or rm -rf ~/.asdf), and uninstall the Python pre-commit package if you installed it separately.

If a tool is not found outside the repo, run it through mise with mise exec -- <command>.

When updating a tool version, change it in mise.toml and run mise lock to refresh mise.lock; commit both files.

Context

asdf plugins run arbitrary code and do not verify what they download, which exposes us to transitive dependency supply-chain attacks. mise provides lockfile checksums, a release age cooldown and no plugin execution.

• The lint-terraform pin stays at 6.0.5 and must be bumped to 7.0.0 once the nhs-notify-shared-modules PR is released. Until then that job will not work correctly, as the old action still runs asdf.
• postcreatecommand.sh "installs a pinned mise release verified by SHA-256 checksum".
• The python pin is kept for the shared python_version workflow input, although the template has no Python code.
• Downstream repos will need to take mise.toml, mise.lock and the workflows together on sync, and developers will need to follow the local setup steps above.

Dependency on nhs-notify-shared-modules

This PR depends on NHSDigital/nhs-notify-shared-modules#342, which migrates the shared-modules lint-terraform action, hooks and scripts from asdf to mise. Until it is released, the lint-terraform job in this PR will not work correctly, as lint-terraform@6.0.5 still runs asdf.

Steps required before this PR can merge:

1. Merge nhs-notify-shared-modules#342.
2. Release nhs-notify-shared-modules as a major version (7.0.0), because the action now requires mise on the runner and Terraform pinned in mise.toml and mise.lock.
3. In this PR, bump every NHSDigital/nhs-notify-shared-modules/...@6.0.5 pin in .github to 7.0.0.
4. In this PR, bump the hook rev in scripts/config/pre-commit.yaml from 6.0.0 to 7.0.0. The 7.0.0 hooks read Docker image versions from .docker-versions; the older hooks look for the deleted .tool-versions.
5. Re-run CI on this PR and confirm the Lint Terraform and hook checks pass.

To test before the release exists, temporarily pin lint-terraform to the commit SHA of the shared-modules PR branch, then revert it to 7.0.0 before merging.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming
• If I have used the 'skip-dependencies-check' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud