update: update js-yaml version for jest

.github/workflows/nodejs.yml

@@ -1,30 +1,38 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
 name: Node.js CI
 
 on:
   push:
-    branches: [ master ]
   pull_request:
-    branches: [ master ]
+
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [10.x, 12.x]
-
     steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+    - uses: actions/checkout@v7.0.0
+
+    - name: Use Node.js 24
+      uses: actions/setup-node@v6.4.0
+      with:
+        node-version: '24'
+
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        node-version: ${{ matrix.node-version }}
+        role-to-assume: arn:aws:iam::${{ secrets.AWS_DEV_ACCOUNT_NUMBER }}:role/smart-ui-github-actions-role
+        aws-region: eu-west-2
+
     - run: npm install grunt -g
+
+    - run: npm run ca:setup
+      env:
+        AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
+
     - run: npm install
     - run: npm test
       env:

.gitignore

@@ -42,3 +42,4 @@ test/keycloak/local_user.json
 test/keycloak/h2/keycloakdb.mv.db
 test/keycloak/h2/keycloakdb.trace.db
 
+PLAN.md

.tool-versions

@@ -1,4 +1,4 @@
 aws-vault 7.2.0
 direnv 2.37.0
-nodejs 24.14.1
+nodejs 24.14.1 22.22.2
 terraform 1.6.6

docker-compose.yaml

@@ -47,7 +47,7 @@ services:
     memswap_limit: 4g
 
   smart-api:
-    image: ${AWS_DEV_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/smart-api:1.0.63
+    image: ${AWS_DEV_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/smart-api:1.0.67
     ports:
       - '8080:8080'
       - '8082:8082'
@@ -300,7 +300,7 @@ services:
     memswap_limit: 1g
 
   smart-ui:
-    image: ${AWS_DEV_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/smart-ui:0.2.138
+    image: ${AWS_DEV_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/smart-ui:0.2.145
     hostname: smart-ui
     build:
       context: .

terraform/iam_smarts_ui.tf

@@ -9,6 +9,98 @@ data "aws_iam_policy_document" "smart_ui_policy_doc" {
   }
 }
 
+locals{
+  is_dev = terraform.workspace == "dev" ? 1 : 0
+}
+
+resource "aws_iam_openid_connect_provider" "github" {
+  count = local.is_dev
+
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+
+  thumbprint_list = []
+}
+
+data "aws_iam_policy_document" "github_actions_assume_role" {
+  count = local.is_dev
+
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type        = "Federated"
+      identifiers = [aws_iam_openid_connect_provider.github[0].arn]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values   = ["sts.amazonaws.com"]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "token.actions.githubusercontent.com:sub"
+      values   = ["repo:${var.github_org}/${var.github_repo}:*"]
+    }
+  }
+}
+
+resource "aws_iam_role" "github_actions_codeartifact" {
+  count = local.is_dev
+
+  name               = "${var.github_repo}-github-actions-role"
+  description        = "Role assumed by GitHub Actions for CodeArtifact authentication on ${var.github_repo}"
+  assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role[0].json
+}
+
+data "aws_iam_policy_document" "codeartifact_read_only" {
+  count = local.is_dev
+
+  statement {
+    sid    = "CodeArtifactTokenPermission"
+    effect = "Allow"
+    actions = [
+      "codeartifact:GetAuthorizationToken",
+      "codeartifact:GetRepositoryEndpoint",
+      "codeartifact:ReadFromRepository"
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "BearerTokenPermission"
+    effect = "Allow"
+    actions = [
+      "sts:GetServiceBearerToken"
+    ]
+    resources = ["*"]
+
+    condition {
+      test     = "StringEquals"
+      variable = "sts:AWSServiceName"
+      values   = ["codeartifact.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_policy" "codeartifact_policy" {
+  count = local.is_dev
+
+  name        = "${var.github_repo}-codeartifact-read-policy"
+  description = "Provides read access to CodeArtifact for GitHub Actions"
+  policy      = data.aws_iam_policy_document.codeartifact_read_only[0].json
+}
+
+resource "aws_iam_role_policy_attachment" "attach_codeartifact" {
+  count = local.is_dev
+
+  role       = aws_iam_role.github_actions_codeartifact[0].name
+  policy_arn = aws_iam_policy.codeartifact_policy[0].arn
+}
+
 //module "smarts_ui_role" {
 //  source               = "github.com/mcga-gov-uk/module-iam-service-role.git"
 //  name_prefix          = "${local.name_prefix}-sa"

terraform/variables.tf

@@ -92,3 +92,15 @@ variable "ECR_ACCOUNT_ID" {
   type        = string
   description = "The AWS Account ID where the centralized ECR images reside (Dev Account)"
 }
+
+variable "github_org" {
+  type        = string
+  description = "The owner of the smart repository."
+  default     = "mcagov"
+}
+
+variable "github_repo" {
+  type        = string
+  description = "The name of the public GitHub repository."
+  default     = "smart-ui"
+}