feat(GAT-000): Align CRUK dummy dataset fixtures with GWDM 2.1 schema

.env.example

@@ -190,6 +190,11 @@ GOOGLE_CLOUD_LOGGING_NAME=log-name
 # GCP project path for federation
 GOOGLE_APPLICATION_PROJECT_PATH="projects/google-cloud-project-number"
 
+# GCP BigQuery
+GOOGLE_CLOUD_BIGQUERY_PROJECT_ID=google-cloud-project-id
+GOOGLE_CLOUD_BIGQUERY_DASHBOARD_DATASET=gcp_bigquery_dashboard_dataset
+GOOGLE_CLOUD_BIGQUERY_DASHBOARD_TABLE=gcp_bigquery_dashboard_table
+
 # GCP PubSub - for local
 GOOGLE_APPLICATION_CREDENTIALS="/path/to/service/credentials"
 
@@ -248,4 +253,6 @@ INDEX_ELASTIC=true
 GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials_file.json"
 GOOGLE_APPLICATION_PROJECT_PATH="projects/<project_id>"
 GATEWAY_API_USER_ID=""
-TEST_USER_PASSWORD=""
+TEST_USER_PASSWORD=""
+
+SEARCH_DEFERRED_TTL=60

.github/CODEOWNERS

@@ -0,0 +1,64 @@
+# CODEOWNERS
+# Each line is a file pattern followed by one or more owners.
+# Order matters — last matching pattern takes precedence.
+# Docs: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# ====================
+# Default — catch-all
+# ====================
+*                               @HDRUK/tech-team-backend
+
+# ====================
+# CI / DevOps
+# ====================
+.github/                        @HDRUK/tech-team-devops @HDRUK/tech-team-backend
+docker-compose*.yml             @HDRUK/tech-team-devops @HDRUK/tech-team-backend
+Dockerfile*                     @HDRUK/tech-team-devops @HDRUK/tech-team-backend
+.env.example                    @HDRUK/tech-team-devops @HDRUK/tech-team-backend
+
+# ====================
+# App Core
+# ====================
+app/Http/Controllers/           @HDRUK/tech-team-backend
+app/Http/Middleware/            @HDRUK/tech-team-backend
+app/Http/Requests/              @HDRUK/tech-team-backend
+app/Models/                     @HDRUK/tech-team-backend
+app/Services/                   @HDRUK/tech-team-backend
+app/Repositories/               @HDRUK/tech-team-backend
+app/Providers/                  @HDRUK/tech-team-backend
+
+# ====================
+# Routes
+# ====================
+routes/                         @HDRUK/tech-team-backend
+
+# ====================
+# Database
+# ====================
+database/migrations/            @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+database/seeders/               @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+database/factories/             @HDRUK/tech-team-backend
+
+# ====================
+# Configuration
+# ====================
+config/                         @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+
+# ====================
+# Tests
+# ====================
+tests/                          @HDRUK/tech-team-backend
+
+# ====================
+# Dependencies
+# ====================
+composer.json                   @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+composer.lock                   @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+package.json                    @HDRUK/tech-team-backend @HDRUK/tech-team-devops
+
+# ====================
+# Docs
+# ====================
+README.md                       @HDRUK/tech-team-backend
+docs/                           @HDRUK/tech-team-backend
+*.md                            @HDRUK/tech-team-backend

.github/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+This security policy applies to public projects under [HDRUK organisation][gh-organization] on GitHub.
+
+## Security/Bugfix Versions
+
+Security and bug fixes are generally provided only for the last minor version.
+Fixes are released either as part of the next minor version or as an on-demand patch version.
+
+Security fixes are given priority and might be enough to cause a new version to be released.
+
+## Reporting a vulnerability
+
+We encourage responsible disclosure of security vulnerabilities.
+If you find something suspicious, we encourage and appreciate your report!
+
+### Ways to report
+
+Please do not report security vulnerabilities through public GitHub issues. Instead, for the reports to reach maintainers as soon as possible, the preferred way is to use our reporting portal [here](https://hdruk.atlassian.net/servicedesk/customer/portal/7/group/82/create/78?customfield_10752=11727). This creates a private communication channel between the reporter and the maintainers.
+
+[gh-organization]: https://github.com/HDRUK

.github/workflows/actionlint.yml

@@ -1,22 +1,20 @@
 name: Lint GitHub Workflows
 
+permissions:
+  contents: read
+  actions: read
+
 on:
   pull_request:
     paths:
       - ".github/workflows/**/*.yml"
       - ".github/workflows/**/*.yaml"
+
   push:
     paths:
       - ".github/workflows/**/*.yml"
       - ".github/workflows/**/*.yaml"
 
 jobs:
   actionlint:
-    name: actionlint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Lint workflow files
-        uses: reviewdog/action-actionlint@v1
+    uses: HDRUK/github-actions-templates/.github/workflows/actionlint.yaml@main

.github/workflows/deployment.yaml

@@ -1,5 +1,5 @@
 name: Deploy Release
-run-name: ${{ github.actor }} triggered deploy to ${{ github.event.inputs.env }} pipeline
+run-name: ${{ github.actor }} triggered deploy to ${{ github.event.inputs.env }} pipeline for tag version ${{ github.event.inputs.tag_version }}
 
 on:
   workflow_dispatch:
@@ -13,99 +13,17 @@ on:
           - preprod
           - prod
       tag_version:
-        description: 'Tag version to be deployed'
+        description: 'Tag version to deploy'
         required: true
         default: ''
 
-env:
-  PROJECT_ID: "${{ secrets.PROJECT_ID }}"
-  GAR_LOCATION: "${{ secrets.GAR_LOCATION }}"
-  SLACK_WEBHOOK_URL: "${{ secrets.SLACK_WEBHOOK_URL}}"
-  SLACK_CHANNEL: "${{ secrets.GITHUBACTIONS_SLACK_CHANNEL }}"
-
 jobs:
   deploy:
-    permissions:
-      contents: write
-      id-token: write
-
-    runs-on: ubuntu-latest
-    environment:  ${{ github.event.inputs.env }}
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-
-      - name: Google Auth
-        id: auth
-        uses: "google-github-actions/auth@v2"
-        with:
-          token_format: "access_token"
-          project_id: "${{ secrets.PROJECT_ID }}"
-          workload_identity_provider: "${{ secrets.WIF_PROVIDER }}"
-          service_account: "${{ secrets.WIF_SERVICE_ACCOUNT }}"
-
-      - name: Deploy to Cloud Run
-        uses: actions-hub/gcloud@540.0.0
-        id: deploy
-        env:
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          PROD_PROJECT_ID: ${{ secrets.PROD_PROJECT_ID }}
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          GAR_NAME: ${{ secrets.GAR_NAME }}
-          SERVICE_NAME: "${{ secrets.SERVICE_NAME }}"
-          SERVICE_REGION: "${{ secrets.SERVICE_REGION }}"
-        with:
-          args: run services update '${{ env.SERVICE_NAME }}' --image='${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROD_PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ github.event.inputs.tag_version }}:latest --region='${{ env.SERVICE_REGION }}' --project='${{ env.PROJECT_ID }}'
-
-      - name: Trigger AppCheck scan
-        id: appcheck-scan
-        if: ${{ success() && github.event.inputs.env == 'preprod' }}
-        env:
-          APPCHECK_API_KEY: ${{ secrets.APPCHECK_API_KEY }}
-          APPCHECK_SCAN_ID: ${{ secrets.APPCHECK_SCAN_ID }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ -z "${APPCHECK_API_KEY:-}" || -z "${APPCHECK_SCAN_ID:-}" ]]; then
-            echo "AppCheck secrets are not set. Skipping scan trigger." >&2
-            exit 0
-          fi
-
-          BASE_URL="https://api.appcheck-ng.com/api/v1/${APPCHECK_API_KEY}/scan/${APPCHECK_SCAN_ID}"
-
-          echo "Checking AppCheck scan status..."
-
-          STATUS_JSON=$(curl -fsSL "${BASE_URL}/status" || true)
-          # Extract the 'status' field from the response
-          if command -v jq >/dev/null 2>&1; then
-            STATUS=$(echo "$STATUS_JSON" | jq -r '.status // empty' | tr '[:upper:]' '[:lower:]')
-          else
-            STATUS=$(echo "$STATUS_JSON" | sed -n 's/.*"status"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | tr '[:upper:]' '[:lower:]')
-          fi
-          echo "Current status: ${STATUS:-unknown}"
-          case "${STATUS}" in
-            running|paused|detached)
-              echo "Existing scan appears active (${STATUS}). Aborting before starting a new one..."
-              curl -fsSL -X POST "${BASE_URL}/abort" -H "Content-Length: 0" || true
-              sleep 60
-              ;;
-            *)
-              echo "No active scan detected or status unknown; proceeding to start."
-              ;;
-          esac
-          echo "Starting new AppCheck scan..."
-          curl -fsSL -X POST "${BASE_URL}/start" -H "Content-Length: 0"
-
-      - name: Run Notification
-        id: runnotificationsent
-        uses: act10ns/slack@v1
-        with:
-          status: ${{ job.status }}
-          steps: ${{ toJson(steps) }}
-          channel: ${{ env.SLACK_CHANNEL }}
-          message: Deploying tag ${{ github.event.inputs.tag_version }} to ENV ${{ github.event.inputs.env }} ${{ job.status }}
-        if: always()
+    uses: HDRUK/github-actions-templates/.github/workflows/deploy-release.yml@main
+    with:
+      env: ${{ github.event.inputs.env }}
+      tag_version: ${{ github.event.inputs.tag_version }}
+      chart_path: chart/gateway-api/Chart.yaml
+      git_ref: main
+      run_scan: true
+    secrets: inherit

.github/workflows/dev_deployment.yaml

@@ -1,116 +1,24 @@
 name: Build and deploy to DEV
-run-name: ${{ github.actor }} triggered deploy to DEV pipeline
+run-name:  ${{ github.actor }} triggered deploy to DEV pipeline
 
 on:
   push:
     branches:
-      - 'dev'
-
-env:
-  PROJECT_ID: '${{ secrets.PROJECT_ID }}'
-  GAR_LOCATION: '${{ secrets.GAR_LOCATION }}'
-  SLACK_WEBHOOK_URL: '${{ secrets.SLACK_WEBHOOK_URL}}'
-  SLACK_CHANNEL: '${{ secrets.GITHUBACTIONS_SLACK_CHANNEL }}'
+      - dev
 
 jobs:
   build:
-    name: build
-    permissions:
-      contents: write
-      id-token: write
-
-    runs-on: ubuntu-latest
-    environment: dev
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v4
-        with:
-          ref: dev
-
-      - name: Read VERSION file
-        id: getversion
-        run: |
-          sed -n 's/^appVersion:\(.*\)/\1/p' < "chart/gateway-api/Chart.yaml" > "version"
-          echo "version=$(sed 's/.*\"\(.*\)\".*/\1/g' "version")" >> "$GITHUB_OUTPUT"   
-
-      - name: Google Auth
-        id: auth
-        uses: 'google-github-actions/auth@v2'
-        with:
-          token_format: 'access_token'
-          workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' 
-          service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}'
-
-      - name: Login to GAR
-        id: garlogin
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.PROJECT_ID }}
-          username: oauth2accesstoken
-          password: ${{ steps.auth.outputs.access_token }}
-
-      - name: Build and Push Container
-        id: build
-        shell: bash
-        env: 
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          GAR_NAME: ${{ secrets.GAR_NAME_API }}
-
-        run: |-
-          docker build -t '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:${{ github.sha }} -t '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:latest ./
-          docker push --all-tags '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}
+    uses: HDRUK/github-actions-templates/.github/workflows/docker-build.yaml@main
+    with:
+      chart_path: chart/gateway-api/Chart.yaml
+      environment: dev
+    secrets: inherit
 
   deploy:
-    name: deploy
     needs: build
-    permissions:
-      contents: write
-      id-token: write
-
-    runs-on: ubuntu-latest
-    environment: dev
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v4
-        with:
-          ref: dev
-
-      - name: Google Auth
-        id: auth
-        uses: 'google-github-actions/auth@v2'
-        with:
-          token_format: 'access_token'
-          workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' 
-          service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}'
-
-      - name: Read VERSION file
-        id: getversion
-        run: |
-          sed -n 's/^appVersion:\(.*\)/\1/p' < "chart/gateway-api/Chart.yaml" > "version"
-          echo "version=$(sed 's/.*\"\(.*\)\".*/\1/g' "version")" >> "$GITHUB_OUTPUT" 
-
-      - name: Deploy to Cloud Run
-        uses: actions-hub/gcloud@540.0.0
-        id: deploy
-        env:
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          GAR_NAME: ${{ secrets.GAR_NAME_API }}
-          SERVICE_NAME: '${{ secrets.SERVICE_NAME_API }}'
-          SERVICE_REGION: '${{ secrets.SERVICE_REGION_API }}'
-
-        with:
-          args: run services update '${{ env.SERVICE_NAME }}' --image='${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:${{ github.sha }} --region='${{ env.SERVICE_REGION }}' --project='${{ env.PROJECT_ID }}' 
-
-      - name: Run Notification
-        id: runnotificationsent
-        uses: act10ns/slack@v1
-        with:
-          status: ${{ job.status }}
-          steps: ${{ toJson(steps) }}
-          channel: ${{ env.SLACK_CHANNEL }}
-          message: Deploying {{ env.GITHUB_REF_NAME }} branch to DEV ${{ job.status }}
-        if: always()
+    uses: HDRUK/github-actions-templates/.github/workflows/deploy-release.yml@main
+    with:
+      env: dev
+      chart_path: chart/gateway-api/Chart.yaml
+      git_ref: dev
+    secrets: inherit