CCM-18685: Deployed proxies should be deleted on PR close

.devcontainer/devcontainer.json

@@ -74,7 +74,7 @@
       "dockerDashComposeVersion": "v2",
       "installDockerBuildx": true,
       "installDockerComposeSwitch": true,
-      "moby": true,
+      "moby": false,
       "version": "latest"
     },
     "ghcr.io/devcontainers/features/dotnet:2.4.0": {

.github/actions/build-oas-spec/action.yml

@@ -6,7 +6,11 @@ inputs:
     description: "Version number"
     required: true
   apimEnv:
-    description: "APIM environment"
+    description: |
+      OAS build configuration name. Selects environment-specific templates from
+      specification/api/components/environments/<apimEnv>/ (e.g. auth level, target secrets,
+      monitoring flags). Valid values: internal-dev, internal-dev-pr, int, ref, prod.
+      Note: 'internal-dev-pr' is a build config only - there is no corresponding APIM environment.
     required: true
   buildSandbox:
     description: "Whether to build the sandbox OAS spec"

.github/actions/build-proxies/action.yml

@@ -16,7 +16,11 @@ inputs:
     description: "Deployment environment"
     required: true
   apimEnv:
-    description: "APIM environment"
+    description: |
+      OAS build configuration name (e.g. internal-dev-pr, internal-dev, int, prod).
+      Must match the apimEnv used to build the OAS artifact this action downloads.
+      The '-pr' suffix is stripped before dispatching to proxygen, which only knows
+      real APIM environments (internal-dev, internal-dev-sandbox, int, ref, prod).
     required: true
   runId:
     description: "GitHub Actions run ID to fetch the OAS artifact from"
@@ -60,19 +64,26 @@ runs:
     - name: Setup Proxy Name and target
       shell: bash
       run: |
+        set -euo pipefail
 
         ENV="${{ inputs.apimEnv }}"
-        if [[ "$ENV" == "internal-dev" || "$ENV" == *pr ]]; then
+        if [[ "$ENV" == "internal-dev" || "$ENV" == "internal-dev-pr" || "$ENV" == "internal-dev-sandbox" ]]; then
           echo "TARGET_DOMAIN=suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
-        elif [[ "$ENV" == "int" ]]; then
+        elif [[ "$ENV" == "int" || "$ENV" == "ref" ]]; then
           echo "TARGET_DOMAIN=suppliers.nonprod.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
         elif [[ "$ENV" == "prod" ]]; then
           echo "TARGET_DOMAIN=suppliers.prod.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
         else
-          echo "TARGET_DOMAIN=suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
+          echo "[ERROR] Unsupported apimEnv '$ENV'."
+          exit 1
         fi
 
     - name: Set APIM_ENV
+      # apimEnv carries the OAS build configuration name (e.g. "internal-dev-pr")
+      # which determines auth level, target secrets, and artifact naming.
+      # Proxygen and the internal proxy-deploy/proxy-destroy workflows only know
+      # real APIM environments, so we strip the "-pr" suffix here - this is the
+      # single translation boundary between OAS build config and APIM deployment.
       shell: bash
       run: |
         APIM_ENV="${{ inputs.apimEnv }}"

.github/workflows/pr_destroy_dynamic_env.yaml

@@ -4,7 +4,7 @@ on:
   pull_request:
     types: [closed]
     branches:
-      - '*'
+      - "*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -46,7 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Trigger dynamic proxy destruction
+      - name: Trigger PR sandbox proxy destruction
         env:
           APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
           APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
@@ -60,3 +60,18 @@ jobs:
           --targetEnvironment "pr${{ github.event.number }}" \
           --apimEnvironment "internal-dev-sandbox" \
           --boundedContext "notify-supplier"
+
+      - name: Trigger PR proxy destruction
+        env:
+          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
+          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+        shell: bash
+        run: |
+          .github/scripts/dispatch_internal_repo_workflow.sh \
+          --infraRepoName "nhs-notify-supplier-api" \
+          --releaseVersion "main" \
+          --targetComponent "api" \
+          --targetWorkflow "proxy-destroy.yaml" \
+          --targetEnvironment "pr${{ github.event.number }}" \
+          --apimEnvironment "internal-dev" \
+          --boundedContext "notify-supplier"

.github/workflows/stage-3-build.yaml

@@ -67,7 +67,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        apimEnv: [internal-dev-pr, internal-dev, int, ref, prod]
+        apimEnv: [internal-dev, int, ref, prod]
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -161,7 +161,7 @@ jobs:
   #       uses: ./.github/actions/build-libraries
   #       with:
   #         version: "${{ inputs.version }}"
-  pr-create-dynamic-environment:
+  create-dynamic-environment:
     name: Create Dynamic Environment
     runs-on: ubuntu-latest
     outputs:
@@ -192,7 +192,7 @@ jobs:
   populate-config:
     name: "Populate Supplier Config"
     runs-on: ubuntu-latest
-    needs: [pr-create-dynamic-environment]
+    needs: [create-dynamic-environment]
     timeout-minutes: 10
 
     steps:
@@ -221,7 +221,7 @@ jobs:
     name: "Build proxies"
     runs-on: ubuntu-latest
     if: always() && !failure() && inputs.deploy_proxy == 'true'
-    needs: [artefact-oas-spec, pr-create-dynamic-environment]
+    needs: [artefact-oas-spec, create-dynamic-environment]
     timeout-minutes: 10
     env:
       PROXYGEN_API_NAME: nhs-notify-supplier
@@ -234,7 +234,7 @@ jobs:
         uses: ./.github/actions/build-proxies
         with:
           version: "${{ inputs.version }}"
-          environment: ${{ needs.pr-create-dynamic-environment.outputs.environment_name }}
+          environment: ${{ needs.create-dynamic-environment.outputs.environment_name }}
           apimEnv: "${{ inputs.pr_number == '' && 'internal-dev' || 'internal-dev-pr' }}"
           runId: "${{ github.run_id }}"
           buildSandbox: true

scripts/config/pre-commit.yaml

@@ -28,7 +28,7 @@ repos:
             )$
 
   - repo: https://github.com/NHSDigital/nhs-notify-shared-modules
-    rev: 5.0.1
+    rev: 5.0.3
     hooks:
       - id: sort-dictionary
       - id: scan-secrets