LCS-867 Review sonarqube vulnerabilities in github pipelines part2

[mrlockstar]

What is the change?

This PR implements several improvements based on SonarQube recommendations, including security fixes, code reliability enhancements, and general refactoring for better reusability.

Although the original scope was focused on security, it made sense to address related quality improvements at the same time.

Please note that this will not resolve all the issues; its more a second pass at fixing them. More PRs will follow.

I have also included the 500 error alert into this PR as it was previously broken.

Why are we making this change?

To ensure the repository can remain public while adhering to SonarQube best practices, particularly around security, maintainability, and code quality.

[github-actions]

The review app is available at this URL:
https://pr-461.non-live.digital-lung-cancer-screening.nhs.uk/
You must authenticate with HTTP basic authentication. Ask the team for credentials.

[Copilot]

Pull request overview

This PR is a second pass at addressing SonarQube findings by reducing secret exposure in reusable GitHub Actions workflows, refactoring a composite action’s environment handling, and re-enabling a previously broken “500 error” alert in Terraform.

Changes:

• Replaced secrets: inherit with explicit secret mappings / declared required secrets for reusable workflows.
• Re-enabled and updated the scheduled query alert Terraform resource for error detection.
• Refactored the CLOC report composite action to pass values via env: instead of inline exports.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
infrastructure/modules/container-apps/alerts.tf	Re-enabled the scheduled query alert resource and updated scopes/query.
.github/workflows/stage-5-deploy.yaml	Declared required Azure secrets for the reusable deploy workflow.
.github/workflows/stage-2-test.yaml	Declared required SONAR_TOKEN secret for the reusable test workflow.
.github/workflows/stage-1-commit.yaml	Declared required AWS report-upload secrets for the reusable commit workflow.
.github/workflows/cicd-2-main-branch.yaml	Replaced inherited secrets with explicit secret mapping (currently mismatched for commit stage).
.github/workflows/cicd-1-pull-request.yaml	Replaced inherited secrets with explicit secret mapping.
.github/actions/create-lines-of-code-report/action.yaml	Refactored env handling and adjusted S3 upload destination construction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud