From 4cd4eed0315c23a60cdb4e69b428aad7b8bdd37b Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:16:17 +0100
Subject: [PATCH 01/23] init concourse

---
 concourse/ci.yml                     | 86 ++++++++++++++++++++++++++++
 concourse/scripts/assume_role.sh     | 14 +++++
 concourse/scripts/build_image.sh     | 14 +++++
 concourse/scripts/set_pipeline.sh    | 27 +++++++++
 concourse/scripts/terraform_infra.sh | 52 +++++++++++++++++
 5 files changed, 193 insertions(+)
 create mode 100644 concourse/ci.yml
 create mode 100644 concourse/scripts/assume_role.sh
 create mode 100755 concourse/scripts/build_image.sh
 create mode 100755 concourse/scripts/set_pipeline.sh
 create mode 100644 concourse/scripts/terraform_infra.sh

diff --git a/concourse/ci.yml b/concourse/ci.yml
new file mode 100644
index 0000000..6065e3c
--- /dev/null
+++ b/concourse/ci.yml
@@ -0,0 +1,86 @@
+resources:
+- name: resource-repo
+  type: git
+  icon: github
+  source:
+    uri: https://github.com/ONS-Innovation/github-copilot-usage-dashboard
+    username: ((github_access_token))
+    password: x-oauth-basic
+    branch: ((branch))
+
+- name: release
+  type: github-release
+  icon: github
+  source:
+    owner: ONS-Innovation
+    username: ((github_access_token))
+    password: x-oauth-basic
+    repository: github-copilot-usage-dashboard
+
+jobs:
+- name:  build-and-push
+  public: true
+  plan:
+  - get: resource-repo
+    timeout: 5m
+  - get: release
+    trigger: true
+    timeout: 5m
+  - task: build-image
+    privileged: true
+    config:
+      platform: linux
+      image_resource:
+        type: docker-image
+        source:
+          repository: hashicorp/terraform
+      inputs:
+      - name: resource-repo
+      - name: release
+      params:
+        aws_account_id: ((aws_account_sdp_((env))))
+        aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
+        github_repo_archive_secrets: ((sdp_((env))_github_repo_archive_secrets))
+      run: # binary used to build the image
+        path: sh
+        args:
+        - -cx
+        - |
+          if [[ "((env))" == "prod" ]]; then
+            export tag=v$(cat release/version)
+          else
+            export tag=((tag))
+          fi
+          git rev-parse --abbrev-ref HEAD
+          chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
+          chmod u+x ./resource-repo/concourse/scripts/build_image.sh
+          source ./resource-repo/concourse/scripts/assume_role.sh
+          ./resource-repo/concourse/scripts/build_image.sh
+    timeout: 10m
+  - task: terraform
+    privileged: true
+    config:
+      platform: linux
+      image_resource:
+        type: docker-image
+        source: {repository: hashicorp/terraform}
+      inputs:
+      - name: resource-repo
+      - name: release
+      params:
+        github_repo_archive_secrets: ((sdp_((env))_github_repo_archive_secrets))
+        github_access_token: ((github_access_token))
+      run:
+        path: sh
+        args:
+        - -cx
+        - |
+          if [[ "((env))" == "prod" ]]; then
+            export tag=v$(cat release/version)
+          else 
+            export tag=((tag))
+          fi
+          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+          export env=((env))
+          ./resource-repo/concourse/scripts/terraform_infra.sh
+    timeout: 30m
\ No newline at end of file
diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
new file mode 100644
index 0000000..9abc9f4
--- /dev/null
+++ b/concourse/scripts/assume_role.sh
@@ -0,0 +1,14 @@
+set -euo pipefail
+
+apk add --no-cache aws-cli podman jq iptables
+
+aws sts assume-role --output text \
+    --role-arn "${aws_role_arn}" \
+    --role-session-name concourse-pipeline-run \
+    --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+    | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
+
+
+export AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
+export AWS_SECRET_ACCESS_KEY="$(cat SecretAccessKey)"
+export AWS_SESSION_TOKEN="$(cat SessionToken)"
\ No newline at end of file
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
new file mode 100755
index 0000000..ce2b375
--- /dev/null
+++ b/concourse/scripts/build_image.sh
@@ -0,0 +1,14 @@
+set -euo pipefail
+
+export STORAGE_DRIVER=vfs
+export PODMAN_SYSTEMD_UNIT=concourse-task
+
+container_image=$(echo "$github_repo_archive_secrets" | jq -r .container_image)
+
+aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com
+
+podman build -t ${container_image}:${tag} resource-repo
+
+podman tag ${container_image}:${tag} ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com/${container_image}:${tag}
+
+podman push ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com/${container_image}:${tag}
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
new file mode 100755
index 0000000..9a96271
--- /dev/null
+++ b/concourse/scripts/set_pipeline.sh
@@ -0,0 +1,27 @@
+repo_name=${1}
+
+if [[ $# -gt 1 ]]; then
+    branch=${2}
+    git rev-parse --verify ${branch}
+    if [[ $? -ne 0 ]]; then
+        echo "Branch \"${branch}\" does not exist"
+        exit 1
+    fi
+else
+    branch=$(git rev-parse --abbrev-ref HEAD)
+fi
+
+if [[ ${branch} == "main" || ${branch} == "master" || ${branch} == "concourse" ]]; then
+    env="prod"
+else
+    env="dev"
+fi
+
+if [[ ${env} == "dev" ]]; then
+    tag=$(git rev-parse HEAD)
+else
+    tag=$(git tag | tail -n 1)
+fi
+
+fly -t aws-sdp set-pipeline -c concourse/ci.yml -p ${repo_name}-${branch} -v branch=${branch} -v tag=${tag} -v env=${env}
+
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
new file mode 100644
index 0000000..144e4d4
--- /dev/null
+++ b/concourse/scripts/terraform_infra.sh
@@ -0,0 +1,52 @@
+set -euo pipefail
+
+apk add --no-cache jq
+
+aws_account_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_account_id)
+aws_access_key_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_access_key_id)
+
+aws_secret_access_key=$(echo "$github_repo_archive_secrets" | jq -r .aws_secret_access_key)
+aws_secret_name=$(echo "$github_repo_archive_secrets" | jq -r .aws_secret_name)
+
+env_name=$(echo "$github_repo_archive_secrets" | jq -r .env_name)
+lambda_name=$(echo "$github_repo_archive_secrets" | jq -r .lambda_name)
+
+github_app_client_id=$(echo "$github_repo_archive_secrets" | jq -r .github_app_client_id)
+lambda_arch=$(echo "$github_repo_archive_secrets" | jq -r .lambda_arch)
+
+github_org=$(echo "$github_repo_archive_secrets" | jq -r .github_org)
+container_image=$(echo "$github_repo_archive_secrets" | jq -r .container_image)
+
+schedule=$(echo "$github_repo_archive_secrets" | jq -r .schedule)
+lambda_timeout=$(echo "$github_repo_archive_secrets" | jq -r .lambda_timeout)
+
+lambda_memory=$(echo "$github_repo_archive_secrets" | jq -r .lambda_memory)
+
+export AWS_ACCESS_KEY_ID=$aws_access_key_id
+export AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
+
+git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
+
+if [[ ${env} != "prod" ]]; then
+    env="dev"
+fi
+
+cd resource-repo/terraform/data_logger/
+
+terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
+
+terraform apply \
+-var "aws_account_id=$aws_account_id" \
+-var "aws_access_key_id=$aws_access_key_id" \
+-var "aws_secret_access_key=$aws_secret_access_key" \
+-var "aws_secret_name=$aws_secret_name" \
+-var "env_name=$env_name" \
+-var "lambda_version=${tag}" \
+-var "lambda_name=$lambda_name" \
+-var "lambda_arch=$lambda_arch" \
+-var "lambda_timeout=$lambda_timeout" \
+-var "github_app_client_id=$github_app_client_id" \
+-var "github_org=$github_org" \
+-var lambda_memory=$lambda_memory \
+-var "schedule=$schedule" \
+-auto-approve
\ No newline at end of file

From 36bf626b4cabe4d398a3b66bb166a1ce4913a048 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:18:13 +0100
Subject: [PATCH 02/23] put quotes around variable declaration

---
 concourse/scripts/terraform_infra.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 144e4d4..8bc4e8d 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -47,6 +47,6 @@ terraform apply \
 -var "lambda_timeout=$lambda_timeout" \
 -var "github_app_client_id=$github_app_client_id" \
 -var "github_org=$github_org" \
--var lambda_memory=$lambda_memory \
+-var "lambda_memory=$lambda_memory" \
 -var "schedule=$schedule" \
 -auto-approve
\ No newline at end of file

From e5e9ed8a56ab78c5ca997c13d61d4539258d5a24 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:22:32 +0100
Subject: [PATCH 03/23] remove concourse from branch check

---
 concourse/scripts/set_pipeline.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 9a96271..a5ebaee 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -11,7 +11,7 @@ else
     branch=$(git rev-parse --abbrev-ref HEAD)
 fi
 
-if [[ ${branch} == "main" || ${branch} == "master" || ${branch} == "concourse" ]]; then
+if [[ ${branch} == "main" || ${branch} == "master" ]]; then
     env="prod"
 else
     env="dev"

From 3a5d29f3cb8d2a5c5ecb4878748d7f2070dac11e Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:24:47 +0100
Subject: [PATCH 04/23] use correct repo name

---
 concourse/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/ci.yml b/concourse/ci.yml
index 6065e3c..a6f8e8e 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -3,7 +3,7 @@ resources:
   type: git
   icon: github
   source:
-    uri: https://github.com/ONS-Innovation/github-copilot-usage-dashboard
+    uri: https://github.com/ONS-Innovation/github-repository-archive-script
     username: ((github_access_token))
     password: x-oauth-basic
     branch: ((branch))

From aabbe1814a500bc37e0cf82d4b7745d07a259650 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:30:12 +0100
Subject: [PATCH 05/23] use correct directory

---
 concourse/scripts/terraform_infra.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 8bc4e8d..5b68e93 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -31,7 +31,7 @@ if [[ ${env} != "prod" ]]; then
     env="dev"
 fi
 
-cd resource-repo/terraform/data_logger/
+cd cd resource-repo/terraform/service
 
 terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
 

From 839c87fc34e9ff71bbe9c5a8c044030992bdf5b9 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 20 Jun 2025 17:35:42 +0100
Subject: [PATCH 06/23] remove stray cd

---
 concourse/scripts/terraform_infra.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 5b68e93..eaf8c66 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -31,7 +31,7 @@ if [[ ${env} != "prod" ]]; then
     env="dev"
 fi
 
-cd cd resource-repo/terraform/service
+cd resource-repo/terraform/service
 
 terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
 

From 077fbf8965953fe5f68213fbcc55921d6134b6d5 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Thu, 10 Jul 2025 17:31:21 +0100
Subject: [PATCH 07/23] refactor to use API for tagging

---
 concourse/ci.yml                     | 26 ++++++++++----------------
 concourse/scripts/assume_role.sh     |  2 --
 concourse/scripts/build_image.sh     |  2 +-
 concourse/scripts/set_pipeline.sh    |  2 +-
 concourse/scripts/terraform_infra.sh |  2 --
 5 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/concourse/ci.yml b/concourse/ci.yml
index a6f8e8e..e61d9d4 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -8,22 +8,12 @@ resources:
     password: x-oauth-basic
     branch: ((branch))
 
-- name: release
-  type: github-release
-  icon: github
-  source:
-    owner: ONS-Innovation
-    username: ((github_access_token))
-    password: x-oauth-basic
-    repository: github-copilot-usage-dashboard
-
 jobs:
 - name:  build-and-push
   public: true
   plan:
   - get: resource-repo
     timeout: 5m
-  - get: release
     trigger: true
     timeout: 5m
   - task: build-image
@@ -36,18 +26,20 @@ jobs:
           repository: hashicorp/terraform
       inputs:
       - name: resource-repo
-      - name: release
       params:
         aws_account_id: ((aws_account_sdp_((env))))
         aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
-        github_repo_archive_secrets: ((sdp_((env))_github_repo_archive_secrets))
+        secrets: ((sdp_((env))_github_repo_archive_secrets))
       run: # binary used to build the image
         path: sh
         args:
         - -cx
         - |
+          apk add --no-cache aws-cli podman jq iptables curl
+
           if [[ "((env))" == "prod" ]]; then
-            export tag=v$(cat release/version)
+            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+            export tag
           else
             export tag=((tag))
           fi
@@ -66,17 +58,19 @@ jobs:
         source: {repository: hashicorp/terraform}
       inputs:
       - name: resource-repo
-      - name: release
       params:
-        github_repo_archive_secrets: ((sdp_((env))_github_repo_archive_secrets))
+        secrets: ((sdp_((env))_github_repo_archive_secrets))
         github_access_token: ((github_access_token))
       run:
         path: sh
         args:
         - -cx
         - |
+          apk add --no-cache jq curl
+
           if [[ "((env))" == "prod" ]]; then
-            export tag=v$(cat release/version)
+            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+            export tag
           else 
             export tag=((tag))
           fi
diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index 9abc9f4..5531536 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,7 +1,5 @@
 set -euo pipefail
 
-apk add --no-cache aws-cli podman jq iptables
-
 aws sts assume-role --output text \
     --role-arn "${aws_role_arn}" \
     --role-session-name concourse-pipeline-run \
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index ce2b375..522f5b4 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 export STORAGE_DRIVER=vfs
 export PODMAN_SYSTEMD_UNIT=concourse-task
 
-container_image=$(echo "$github_repo_archive_secrets" | jq -r .container_image)
+container_image=$(echo "$secrets" | jq -r .container_image)
 
 aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com
 
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index a5ebaee..9a96271 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -11,7 +11,7 @@ else
     branch=$(git rev-parse --abbrev-ref HEAD)
 fi
 
-if [[ ${branch} == "main" || ${branch} == "master" ]]; then
+if [[ ${branch} == "main" || ${branch} == "master" || ${branch} == "concourse" ]]; then
     env="prod"
 else
     env="dev"
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index eaf8c66..408f10c 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,7 +1,5 @@
 set -euo pipefail
 
-apk add --no-cache jq
-
 aws_account_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_account_id)
 aws_access_key_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_access_key_id)
 

From 7aa33658a9cf00c0ecf5b7ff3cc461634e9342fb Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Thu, 10 Jul 2025 17:37:41 +0100
Subject: [PATCH 08/23] github_repo_archive_secrets -> repo_archive secrets

---
 concourse/ci.yml                     |  2 --
 concourse/scripts/terraform_infra.sh | 26 +++++++++++++-------------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/concourse/ci.yml b/concourse/ci.yml
index e61d9d4..7ffe936 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -14,8 +14,6 @@ jobs:
   plan:
   - get: resource-repo
     timeout: 5m
-    trigger: true
-    timeout: 5m
   - task: build-image
     privileged: true
     config:
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 408f10c..366f61a 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,24 +1,24 @@
 set -euo pipefail
 
-aws_account_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_account_id)
-aws_access_key_id=$(echo "$github_repo_archive_secrets" | jq -r .aws_access_key_id)
+aws_account_id=$(echo "$secrets" | jq -r .aws_account_id)
+aws_access_key_id=$(echo "$secrets" | jq -r .aws_access_key_id)
 
-aws_secret_access_key=$(echo "$github_repo_archive_secrets" | jq -r .aws_secret_access_key)
-aws_secret_name=$(echo "$github_repo_archive_secrets" | jq -r .aws_secret_name)
+aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
+aws_secret_name=$(echo "$secrets" | jq -r .aws_secret_name)
 
-env_name=$(echo "$github_repo_archive_secrets" | jq -r .env_name)
-lambda_name=$(echo "$github_repo_archive_secrets" | jq -r .lambda_name)
+env_name=$(echo "$secrets" | jq -r .env_name)
+lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 
-github_app_client_id=$(echo "$github_repo_archive_secrets" | jq -r .github_app_client_id)
-lambda_arch=$(echo "$github_repo_archive_secrets" | jq -r .lambda_arch)
+github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
+lambda_arch=$(echo "$secrets" | jq -r .lambda_arch)
 
-github_org=$(echo "$github_repo_archive_secrets" | jq -r .github_org)
-container_image=$(echo "$github_repo_archive_secrets" | jq -r .container_image)
+github_org=$(echo "$secrets" | jq -r .github_org)
+container_image=$(echo "$secrets" | jq -r .container_image)
 
-schedule=$(echo "$github_repo_archive_secrets" | jq -r .schedule)
-lambda_timeout=$(echo "$github_repo_archive_secrets" | jq -r .lambda_timeout)
+schedule=$(echo "$secrets" | jq -r .schedule)
+lambda_timeout=$(echo "$secrets" | jq -r .lambda_timeout)
 
-lambda_memory=$(echo "$github_repo_archive_secrets" | jq -r .lambda_memory)
+lambda_memory=$(echo "$secrets" | jq -r .lambda_memory)
 
 export AWS_ACCESS_KEY_ID=$aws_access_key_id
 export AWS_SECRET_ACCESS_KEY=$aws_secret_access_key

From 4f53d30b6ed3ec745ee51ada1a925cc1fc1cf2ce Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Thu, 10 Jul 2025 17:44:23 +0100
Subject: [PATCH 09/23] bump provider version to 6.2.0

---
 terraform/service/providers.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/service/providers.tf b/terraform/service/providers.tf
index 9fa6158..1852e48 100644
--- a/terraform/service/providers.tf
+++ b/terraform/service/providers.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.2.0"
     }
   }
 }

From 95f094c767e517a4446bd46195649f729ef49938 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 11 Jul 2025 10:05:32 +0100
Subject: [PATCH 10/23] remove concourse conditional

---
 concourse/scripts/set_pipeline.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 9a96271..a5ebaee 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -11,7 +11,7 @@ else
     branch=$(git rev-parse --abbrev-ref HEAD)
 fi
 
-if [[ ${branch} == "main" || ${branch} == "master" || ${branch} == "concourse" ]]; then
+if [[ ${branch} == "main" || ${branch} == "master" ]]; then
     env="prod"
 else
     env="dev"

From a73179095090486436aeb0ff1171a222750d75ee Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Fri, 11 Jul 2025 10:08:18 +0100
Subject: [PATCH 11/23] update README

---
 README.md | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/README.md b/README.md
index 3e330b8..28e0b6f 100644
--- a/README.md
+++ b/README.md
@@ -325,6 +325,41 @@ terraform destroy -var-file=env/dev/dev.tfvars
 
 **Please Note:** Make sure to use the correct `.tfbackend` and `.tfvars` files for your environment.
 
+### Deployments with Concourse
+
+#### Allowlisting your IP
+To setup the deployment pipeline with concourse, you must first allowlist your IP address on the Concourse
+server. IP addresses are flushed everyday at 00:00 so this must be done at the beginning of every working day
+whenever the deployment pipeline needs to be used. Follow the instructions on the Confluence page (SDP Homepage > SDP Concourse > Concourse Login) to
+login. All our pipelines run on sdp-pipeline-prod, whereas sdp-pipeline-dev is the account used for
+changes to Concourse instance itself. Make sure to export all necessary environment variables from sdp-pipeline-prod (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN).
+
+#### Setting up a pipeline
+When setting up our pipelines, we use ecs-infra-user on sdp-dev to be able to interact with our infrastructure on AWS. The credentials for this are stored on
+AWS Secrets Manager so you do not need to set up anything yourself.
+
+To set the pipeline, run the following script:
+```bash
+chmod u+x ./concourse/scripts/set_pipeline.sh
+./concourse/scripts/set_pipeline.sh github-repo-archive-script
+```
+Note that you only have to run chmod the first time running the script in order to give permissions.
+This script will set the branch and pipeline name to whatever branch you are currently on. It will also set the image tag on ECR to the current commit hash at the time of setting the pipeline.
+
+The pipeline name itself will usually follow a pattern as follows: `<repo-name>-<branch-name>`
+If you wish to set a pipeline for another branch without checking out, you can run the following:
+```bash
+./concourse/scripts/set_pipeline.sh github-repo-archive-script <branch_name>
+```
+
+If the branch you are deploying is "main" or "master", it will trigger a deployment to the sdp-prod environment. To set the ECR image tag, you must draft a Github release pointing to the latest release of the main/master branch that has a tag in the form of vX.Y.Z. Drafting up a release will automatically deploy the latest version of the main/master branch with the associated release tag, but you can also manually trigger a build through the Concourse UI or the terminal prompt.
+
+#### Triggering a pipeline
+Once the pipeline has been set, you can manually trigger a build on the Concourse UI, or run the following command:
+```bash
+fly -t aws-sdp trigger-job -j github-repo-archive-script-<branch-name>/build-and-push
+```
+
 ## Linting and Testing
 
 ### GitHub Actions

From c1f86d838fc9dc067b44631d267c9d48740ab09d Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 09:48:37 +0100
Subject: [PATCH 12/23] lint bash scripts

---
 concourse/scripts/assume_role.sh     | 12 +++++++++---
 concourse/scripts/build_image.sh     |  2 ++
 concourse/scripts/set_pipeline.sh    |  2 ++
 concourse/scripts/terraform_infra.sh |  2 ++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index 5531536..4c6f922 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 aws sts assume-role --output text \
@@ -7,6 +9,10 @@ aws sts assume-role --output text \
     | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
 
 
-export AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
-export AWS_SECRET_ACCESS_KEY="$(cat SecretAccessKey)"
-export AWS_SESSION_TOKEN="$(cat SessionToken)"
\ No newline at end of file
+AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
+AWS_SECRET_ACCESS_KEY="$(cat SecretAccessKey)"
+AWS_SESSION_TOKEN="$(cat SessionToken)"
+
+export AWS_ACCESS_KEY_ID
+export AWS_SECRET_ACCESS_KEY
+export AWS_SESSION_TOKEN
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 522f5b4..63f36a7 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 export STORAGE_DRIVER=vfs
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index a5ebaee..c3e8ddb 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 repo_name=${1}
 
 if [[ $# -gt 1 ]]; then
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 366f61a..2ff481f 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 aws_account_id=$(echo "$secrets" | jq -r .aws_account_id)

From d42d56d48abf351605a3829f0f3b149365e30cab Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 12:44:16 +0100
Subject: [PATCH 13/23] lint some more

---
 concourse/scripts/assume_role.sh     |  4 +++-
 concourse/scripts/build_image.sh     | 13 +++++++------
 concourse/scripts/set_pipeline.sh    |  8 ++++----
 concourse/scripts/terraform_infra.sh | 17 +++++++++++------
 4 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index 4c6f922..fe2bbdb 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,12 +1,14 @@
-#!/bin/sh
+#!/bin/bash
 
 set -euo pipefail
 
+# shellcheck disable=SC3040, SC2154
 aws sts assume-role --output text \
     --role-arn "${aws_role_arn}" \
     --role-session-name concourse-pipeline-run \
     --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
     | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
+# shellcheck disable=SC3040, SC2154
 
 
 AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 63f36a7..1ec760b 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 set -euo pipefail
 
@@ -7,10 +7,11 @@ export PODMAN_SYSTEMD_UNIT=concourse-task
 
 container_image=$(echo "$secrets" | jq -r .container_image)
 
-aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com
+# shellcheck disable=SC2154
+aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com
 
-podman build -t ${container_image}:${tag} resource-repo
+podman build -t "${container_image}":"${tag}" resource-repo
 
-podman tag ${container_image}:${tag} ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com/${container_image}:${tag}
-
-podman push ${aws_account_id}.dkr.ecr.eu-west-2.amazonaws.com/${container_image}:${tag}
+podman tag "${container_image}":"${tag}" "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
+podman push "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
+# shellcheck disable=SC2154
\ No newline at end of file
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index c3e8ddb..9816f27 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,11 +1,11 @@
-#!/bin/sh
+#!/bin/bash
 
 repo_name=${1}
 
 if [[ $# -gt 1 ]]; then
     branch=${2}
-    git rev-parse --verify ${branch}
-    if [[ $? -ne 0 ]]; then
+    git rev-parse --verify "${branch}"
+    if [[ $? -ne 0 ]]; then # shellcheck disable=SC2181
         echo "Branch \"${branch}\" does not exist"
         exit 1
     fi
@@ -25,5 +25,5 @@ else
     tag=$(git tag | tail -n 1)
 fi
 
-fly -t aws-sdp set-pipeline -c concourse/ci.yml -p ${repo_name}-${branch} -v branch=${branch} -v tag=${tag} -v env=${env}
+fly -t aws-sdp set-pipeline -c concourse/ci.yml -p "${repo_name}"-"${branch}" -v branch="${branch}" -v tag="${tag}" -v env="${env}"
 
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 2ff481f..5a6c16d 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,7 +1,8 @@
-#!/bin/sh
+#!/bin/bash
 
 set -euo pipefail
 
+# shellcheck disable=SC2154
 aws_account_id=$(echo "$secrets" | jq -r .aws_account_id)
 aws_access_key_id=$(echo "$secrets" | jq -r .aws_access_key_id)
 
@@ -22,10 +23,13 @@ lambda_timeout=$(echo "$secrets" | jq -r .lambda_timeout)
 
 lambda_memory=$(echo "$secrets" | jq -r .lambda_memory)
 
-export AWS_ACCESS_KEY_ID=$aws_access_key_id
-export AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
+AWS_ACCESS_KEY_ID=$aws_access_key_id
+AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
 
-git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
+export AWS_ACCESS_KEY_ID
+export AWS_SECRET_ACCESS_KEY
+
+git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/" # shellcheck disable=
 
 if [[ ${env} != "prod" ]]; then
     env="dev"
@@ -33,7 +37,7 @@ fi
 
 cd resource-repo/terraform/service
 
-terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
+terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfigure
 
 terraform apply \
 -var "aws_account_id=$aws_account_id" \
@@ -49,4 +53,5 @@ terraform apply \
 -var "github_org=$github_org" \
 -var "lambda_memory=$lambda_memory" \
 -var "schedule=$schedule" \
--auto-approve
\ No newline at end of file
+-auto-approve
+# shellcheck disable=SC2154
\ No newline at end of file

From 0611b65cc8f5915a09b4ac08055e1518e840c932 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 12:49:19 +0100
Subject: [PATCH 14/23] remove shellcheck space

---
 concourse/scripts/assume_role.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index fe2bbdb..729ff09 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -2,13 +2,13 @@
 
 set -euo pipefail
 
-# shellcheck disable=SC3040, SC2154
+# shellcheck disable=SC3040,SC2154
 aws sts assume-role --output text \
     --role-arn "${aws_role_arn}" \
     --role-session-name concourse-pipeline-run \
     --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
     | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
-# shellcheck disable=SC3040, SC2154
+# shellcheck disable=SC3040,SC2154
 
 
 AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"

From 873b10e7c3596a0a3eebc23d5d1f7e56f27d5326 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 13:49:12 +0100
Subject: [PATCH 15/23] run prettier

---
 .github/pull_request_template.md     |   4 +-
 README.md                            |  52 ++++++----
 concourse/ci.yml                     | 146 +++++++++++++--------------
 concourse/scripts/build_image.sh     |   5 +-
 concourse/scripts/set_pipeline.sh    |   4 +-
 concourse/scripts/terraform_infra.sh |   5 +-
 6 files changed, 114 insertions(+), 102 deletions(-)

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index c014f8a..4296043 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -16,7 +16,7 @@ Have any new tests been added as part of this issue? If not, try to explain why
 
 - [ ] Yes
 - [ ] No
-Please write a brief description of why test coverage is not necessary here.
+      Please write a brief description of why test coverage is not necessary here.
 - [ ] Not as part of this ticket. (Could be done at a later point)
 
 ### Documentation
@@ -26,7 +26,7 @@ as new code is added, rather than leaving it for the future.
 
 - [ ] Yes
 - [ ] No
-Please write a brief description of why documentation is not necessary here.
+      Please write a brief description of why documentation is not necessary here.
 - [ ] Not as part of this ticket. (Could be done at a later point)
 
 ### Related issues
diff --git a/README.md b/README.md
index 28e0b6f..f8726a7 100644
--- a/README.md
+++ b/README.md
@@ -5,33 +5,33 @@ A Python utility used to archive old, unused GitHub repositories from an organis
 ## Table of Contents
 
 - [GitHub Repository Archive Script](#github-repository-archive-script)
-  - [Table of Contents](#table-of-contents)
-  - [Prerequisites](#prerequisites)
-  - [Makefile](#makefile)
-  - [Development](#development)
-  - [Running the Project](#running-the-project)
-    - [Containerised (Recommended)](#containerised-recommended)
-    - [Outside of a Container (Development only)](#outside-of-a-container-development-only)
-  - [Deployment](#deployment)
-    - [Overview](#overview)
-    - [Deployment Prerequisites](#deployment-prerequisites)
-    - [Storing the Container on AWS Elastic Container Registry (ECR)](#storing-the-container-on-aws-elastic-container-registry-ecr)
-    - [Deploying the Lambda](#deploying-the-lambda)
-    - [Destroying / Removing the Lambda](#destroying--removing-the-lambda)
-  - [Linting and Testing](#linting-and-testing)
-    - [GitHub Actions](#github-actions)
-    - [Running Tests Locally](#running-tests-locally)
+    - [Table of Contents](#table-of-contents)
+    - [Prerequisites](#prerequisites)
+    - [Makefile](#makefile)
+    - [Development](#development)
+    - [Running the Project](#running-the-project)
+        - [Containerised (Recommended)](#containerised-recommended)
+        - [Outside of a Container (Development only)](#outside-of-a-container-development-only)
+    - [Deployment](#deployment)
+        - [Overview](#overview)
+        - [Deployment Prerequisites](#deployment-prerequisites)
+        - [Storing the Container on AWS Elastic Container Registry (ECR)](#storing-the-container-on-aws-elastic-container-registry-ecr)
+        - [Deploying the Lambda](#deploying-the-lambda)
+        - [Destroying / Removing the Lambda](#destroying--removing-the-lambda)
+    - [Linting and Testing](#linting-and-testing)
+        - [GitHub Actions](#github-actions)
+        - [Running Tests Locally](#running-tests-locally)
 
 ## Prerequisites
 
 - A Docker Daemon (Colima is recommended)
-  - [Colima](https://github.com/abiosoft/colima)
+    - [Colima](https://github.com/abiosoft/colima)
 - Terraform (For deployment)
-  - [Terraform](https://www.terraform.io/)
+    - [Terraform](https://www.terraform.io/)
 - Python >3.12
-  - [Python](https://www.python.org/)
+    - [Python](https://www.python.org/)
 - Make
-  - [GNU make](https://www.gnu.org/software/make/manual/make.html#Overview)
+    - [GNU make](https://www.gnu.org/software/make/manual/make.html#Overview)
 
 ## Makefile
 
@@ -119,7 +119,7 @@ Before the doing the following, make sure your Daemon is running. If using Colim
     When running the container, you are required to pass some environment variable.
 
     | Variable                    | Description                                                                               |
-    |-----------------------------|-------------------------------------------------------------------------------------------|
+    | --------------------------- | ----------------------------------------------------------------------------------------- |
     | GITHUB_ORG                  | The organisation you would like to run the tool in.                                       |
     | GITHUB_APP_CLIENT_ID        | The Client ID for the GitHub App which the tool uses to authenticate with the GitHub API. |
     | AWS_DEFAULT_REGION          | The AWS Region which the Secret Manager Secret is in.                                     |
@@ -168,7 +168,7 @@ To run the Lambda function outside of a container, we need to execute the `handl
     ...
     ```
 
-    **Please Note:** If uncommenting the above in `main.py`, make sure you re-comment the code *before* pushing back to GitHub.
+    **Please Note:** If uncommenting the above in `main.py`, make sure you re-comment the code _before_ pushing back to GitHub.
 
 2. Export the required environment variables:
 
@@ -268,6 +268,7 @@ Within the terraform directory, there is a [service](./terraform/service/) subdi
     ```
 
 2. Fill out the appropriate environment variables file
+
     - `env/dev/dev.tfvars` for sdp-dev.
     - `env/prod/prod.tfvars` for sdp-prod.
 
@@ -328,6 +329,7 @@ terraform destroy -var-file=env/dev/dev.tfvars
 ### Deployments with Concourse
 
 #### Allowlisting your IP
+
 To setup the deployment pipeline with concourse, you must first allowlist your IP address on the Concourse
 server. IP addresses are flushed everyday at 00:00 so this must be done at the beginning of every working day
 whenever the deployment pipeline needs to be used. Follow the instructions on the Confluence page (SDP Homepage > SDP Concourse > Concourse Login) to
@@ -335,19 +337,23 @@ login. All our pipelines run on sdp-pipeline-prod, whereas sdp-pipeline-dev is t
 changes to Concourse instance itself. Make sure to export all necessary environment variables from sdp-pipeline-prod (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN).
 
 #### Setting up a pipeline
+
 When setting up our pipelines, we use ecs-infra-user on sdp-dev to be able to interact with our infrastructure on AWS. The credentials for this are stored on
 AWS Secrets Manager so you do not need to set up anything yourself.
 
 To set the pipeline, run the following script:
+
 ```bash
 chmod u+x ./concourse/scripts/set_pipeline.sh
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script
 ```
+
 Note that you only have to run chmod the first time running the script in order to give permissions.
 This script will set the branch and pipeline name to whatever branch you are currently on. It will also set the image tag on ECR to the current commit hash at the time of setting the pipeline.
 
 The pipeline name itself will usually follow a pattern as follows: `<repo-name>-<branch-name>`
 If you wish to set a pipeline for another branch without checking out, you can run the following:
+
 ```bash
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script <branch_name>
 ```
@@ -355,7 +361,9 @@ If you wish to set a pipeline for another branch without checking out, you can r
 If the branch you are deploying is "main" or "master", it will trigger a deployment to the sdp-prod environment. To set the ECR image tag, you must draft a Github release pointing to the latest release of the main/master branch that has a tag in the form of vX.Y.Z. Drafting up a release will automatically deploy the latest version of the main/master branch with the associated release tag, but you can also manually trigger a build through the Concourse UI or the terminal prompt.
 
 #### Triggering a pipeline
+
 Once the pipeline has been set, you can manually trigger a build on the Concourse UI, or run the following command:
+
 ```bash
 fly -t aws-sdp trigger-job -j github-repo-archive-script-<branch-name>/build-and-push
 ```
diff --git a/concourse/ci.yml b/concourse/ci.yml
index 7ffe936..ad88a19 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -1,78 +1,78 @@
 resources:
-- name: resource-repo
-  type: git
-  icon: github
-  source:
-    uri: https://github.com/ONS-Innovation/github-repository-archive-script
-    username: ((github_access_token))
-    password: x-oauth-basic
-    branch: ((branch))
+  - name: resource-repo
+    type: git
+    icon: github
+    source:
+      uri: https://github.com/ONS-Innovation/github-repository-archive-script
+      username: ((github_access_token))
+      password: x-oauth-basic
+      branch: ((branch))
 
 jobs:
-- name:  build-and-push
-  public: true
-  plan:
-  - get: resource-repo
-    timeout: 5m
-  - task: build-image
-    privileged: true
-    config:
-      platform: linux
-      image_resource:
-        type: docker-image
-        source:
-          repository: hashicorp/terraform
-      inputs:
-      - name: resource-repo
-      params:
-        aws_account_id: ((aws_account_sdp_((env))))
-        aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
-        secrets: ((sdp_((env))_github_repo_archive_secrets))
-      run: # binary used to build the image
-        path: sh
-        args:
-        - -cx
-        - |
-          apk add --no-cache aws-cli podman jq iptables curl
+  - name: build-and-push
+    public: true
+    plan:
+      - get: resource-repo
+        timeout: 5m
+      - task: build-image
+        privileged: true
+        config:
+          platform: linux
+          image_resource:
+            type: docker-image
+            source:
+              repository: hashicorp/terraform
+          inputs:
+            - name: resource-repo
+          params:
+            aws_account_id: ((aws_account_sdp_((env))))
+            aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
+            secrets: ((sdp_((env))_github_repo_archive_secrets))
+          run: # binary used to build the image
+            path: sh
+            args:
+              - -cx
+              - |
+                apk add --no-cache aws-cli podman jq iptables curl
 
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-            export tag
-          else
-            export tag=((tag))
-          fi
-          git rev-parse --abbrev-ref HEAD
-          chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
-          chmod u+x ./resource-repo/concourse/scripts/build_image.sh
-          source ./resource-repo/concourse/scripts/assume_role.sh
-          ./resource-repo/concourse/scripts/build_image.sh
-    timeout: 10m
-  - task: terraform
-    privileged: true
-    config:
-      platform: linux
-      image_resource:
-        type: docker-image
-        source: {repository: hashicorp/terraform}
-      inputs:
-      - name: resource-repo
-      params:
-        secrets: ((sdp_((env))_github_repo_archive_secrets))
-        github_access_token: ((github_access_token))
-      run:
-        path: sh
-        args:
-        - -cx
-        - |
-          apk add --no-cache jq curl
+                if [[ "((env))" == "prod" ]]; then
+                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+                  export tag
+                else
+                  export tag=((tag))
+                fi
+                git rev-parse --abbrev-ref HEAD
+                chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
+                chmod u+x ./resource-repo/concourse/scripts/build_image.sh
+                source ./resource-repo/concourse/scripts/assume_role.sh
+                ./resource-repo/concourse/scripts/build_image.sh
+        timeout: 10m
+      - task: terraform
+        privileged: true
+        config:
+          platform: linux
+          image_resource:
+            type: docker-image
+            source: { repository: hashicorp/terraform }
+          inputs:
+            - name: resource-repo
+          params:
+            secrets: ((sdp_((env))_github_repo_archive_secrets))
+            github_access_token: ((github_access_token))
+          run:
+            path: sh
+            args:
+              - -cx
+              - |
+                apk add --no-cache jq curl
 
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-            export tag
-          else 
-            export tag=((tag))
-          fi
-          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
-          export env=((env))
-          ./resource-repo/concourse/scripts/terraform_infra.sh
-    timeout: 30m
\ No newline at end of file
+                if [[ "((env))" == "prod" ]]; then
+                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+                  export tag
+                else 
+                  export tag=((tag))
+                fi
+                chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+                export env=((env))
+                ./resource-repo/concourse/scripts/terraform_infra.sh
+        timeout: 30m
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 1ec760b..dfac7a8 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -10,8 +10,11 @@ container_image=$(echo "$secrets" | jq -r .container_image)
 # shellcheck disable=SC2154
 aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com
 
+# shellcheck disable=SC2154
 podman build -t "${container_image}":"${tag}" resource-repo
 
+# shellcheck disable=SC2154
 podman tag "${container_image}":"${tag}" "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
+
+# shellcheck disable=SC2154
 podman push "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
-# shellcheck disable=SC2154
\ No newline at end of file
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 9816f27..7295550 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -5,7 +5,8 @@ repo_name=${1}
 if [[ $# -gt 1 ]]; then
     branch=${2}
     git rev-parse --verify "${branch}"
-    if [[ $? -ne 0 ]]; then # shellcheck disable=SC2181
+    # shellcheck disable=SC2181
+    if [[ $? -ne 0 ]]; then
         echo "Branch \"${branch}\" does not exist"
         exit 1
     fi
@@ -26,4 +27,3 @@ else
 fi
 
 fly -t aws-sdp set-pipeline -c concourse/ci.yml -p "${repo_name}"-"${branch}" -v branch="${branch}" -v tag="${tag}" -v env="${env}"
-
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 5a6c16d..9f3e8a6 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -29,7 +29,8 @@ AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
 export AWS_ACCESS_KEY_ID
 export AWS_SECRET_ACCESS_KEY
 
-git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/" # shellcheck disable=
+# shellcheck disable=SC2086
+git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
 
 if [[ ${env} != "prod" ]]; then
     env="dev"
@@ -39,6 +40,7 @@ cd resource-repo/terraform/service
 
 terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfigure
 
+# shellcheck disable=SC2154
 terraform apply \
 -var "aws_account_id=$aws_account_id" \
 -var "aws_access_key_id=$aws_access_key_id" \
@@ -54,4 +56,3 @@ terraform apply \
 -var "lambda_memory=$lambda_memory" \
 -var "schedule=$schedule" \
 -auto-approve
-# shellcheck disable=SC2154
\ No newline at end of file

From 8aa996babbe2b945ca6113907ce200dc7dea21c8 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 15:15:09 +0100
Subject: [PATCH 16/23] Revert "run prettier"

This reverts commit 873b10e7c3596a0a3eebc23d5d1f7e56f27d5326.
---
 .github/pull_request_template.md     |   4 +-
 README.md                            |  52 ++++------
 concourse/ci.yml                     | 146 +++++++++++++--------------
 concourse/scripts/build_image.sh     |   5 +-
 concourse/scripts/set_pipeline.sh    |   4 +-
 concourse/scripts/terraform_infra.sh |   5 +-
 6 files changed, 102 insertions(+), 114 deletions(-)

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 4296043..c014f8a 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -16,7 +16,7 @@ Have any new tests been added as part of this issue? If not, try to explain why
 
 - [ ] Yes
 - [ ] No
-      Please write a brief description of why test coverage is not necessary here.
+Please write a brief description of why test coverage is not necessary here.
 - [ ] Not as part of this ticket. (Could be done at a later point)
 
 ### Documentation
@@ -26,7 +26,7 @@ as new code is added, rather than leaving it for the future.
 
 - [ ] Yes
 - [ ] No
-      Please write a brief description of why documentation is not necessary here.
+Please write a brief description of why documentation is not necessary here.
 - [ ] Not as part of this ticket. (Could be done at a later point)
 
 ### Related issues
diff --git a/README.md b/README.md
index f8726a7..28e0b6f 100644
--- a/README.md
+++ b/README.md
@@ -5,33 +5,33 @@ A Python utility used to archive old, unused GitHub repositories from an organis
 ## Table of Contents
 
 - [GitHub Repository Archive Script](#github-repository-archive-script)
-    - [Table of Contents](#table-of-contents)
-    - [Prerequisites](#prerequisites)
-    - [Makefile](#makefile)
-    - [Development](#development)
-    - [Running the Project](#running-the-project)
-        - [Containerised (Recommended)](#containerised-recommended)
-        - [Outside of a Container (Development only)](#outside-of-a-container-development-only)
-    - [Deployment](#deployment)
-        - [Overview](#overview)
-        - [Deployment Prerequisites](#deployment-prerequisites)
-        - [Storing the Container on AWS Elastic Container Registry (ECR)](#storing-the-container-on-aws-elastic-container-registry-ecr)
-        - [Deploying the Lambda](#deploying-the-lambda)
-        - [Destroying / Removing the Lambda](#destroying--removing-the-lambda)
-    - [Linting and Testing](#linting-and-testing)
-        - [GitHub Actions](#github-actions)
-        - [Running Tests Locally](#running-tests-locally)
+  - [Table of Contents](#table-of-contents)
+  - [Prerequisites](#prerequisites)
+  - [Makefile](#makefile)
+  - [Development](#development)
+  - [Running the Project](#running-the-project)
+    - [Containerised (Recommended)](#containerised-recommended)
+    - [Outside of a Container (Development only)](#outside-of-a-container-development-only)
+  - [Deployment](#deployment)
+    - [Overview](#overview)
+    - [Deployment Prerequisites](#deployment-prerequisites)
+    - [Storing the Container on AWS Elastic Container Registry (ECR)](#storing-the-container-on-aws-elastic-container-registry-ecr)
+    - [Deploying the Lambda](#deploying-the-lambda)
+    - [Destroying / Removing the Lambda](#destroying--removing-the-lambda)
+  - [Linting and Testing](#linting-and-testing)
+    - [GitHub Actions](#github-actions)
+    - [Running Tests Locally](#running-tests-locally)
 
 ## Prerequisites
 
 - A Docker Daemon (Colima is recommended)
-    - [Colima](https://github.com/abiosoft/colima)
+  - [Colima](https://github.com/abiosoft/colima)
 - Terraform (For deployment)
-    - [Terraform](https://www.terraform.io/)
+  - [Terraform](https://www.terraform.io/)
 - Python >3.12
-    - [Python](https://www.python.org/)
+  - [Python](https://www.python.org/)
 - Make
-    - [GNU make](https://www.gnu.org/software/make/manual/make.html#Overview)
+  - [GNU make](https://www.gnu.org/software/make/manual/make.html#Overview)
 
 ## Makefile
 
@@ -119,7 +119,7 @@ Before the doing the following, make sure your Daemon is running. If using Colim
     When running the container, you are required to pass some environment variable.
 
     | Variable                    | Description                                                                               |
-    | --------------------------- | ----------------------------------------------------------------------------------------- |
+    |-----------------------------|-------------------------------------------------------------------------------------------|
     | GITHUB_ORG                  | The organisation you would like to run the tool in.                                       |
     | GITHUB_APP_CLIENT_ID        | The Client ID for the GitHub App which the tool uses to authenticate with the GitHub API. |
     | AWS_DEFAULT_REGION          | The AWS Region which the Secret Manager Secret is in.                                     |
@@ -168,7 +168,7 @@ To run the Lambda function outside of a container, we need to execute the `handl
     ...
     ```
 
-    **Please Note:** If uncommenting the above in `main.py`, make sure you re-comment the code _before_ pushing back to GitHub.
+    **Please Note:** If uncommenting the above in `main.py`, make sure you re-comment the code *before* pushing back to GitHub.
 
 2. Export the required environment variables:
 
@@ -268,7 +268,6 @@ Within the terraform directory, there is a [service](./terraform/service/) subdi
     ```
 
 2. Fill out the appropriate environment variables file
-
     - `env/dev/dev.tfvars` for sdp-dev.
     - `env/prod/prod.tfvars` for sdp-prod.
 
@@ -329,7 +328,6 @@ terraform destroy -var-file=env/dev/dev.tfvars
 ### Deployments with Concourse
 
 #### Allowlisting your IP
-
 To setup the deployment pipeline with concourse, you must first allowlist your IP address on the Concourse
 server. IP addresses are flushed everyday at 00:00 so this must be done at the beginning of every working day
 whenever the deployment pipeline needs to be used. Follow the instructions on the Confluence page (SDP Homepage > SDP Concourse > Concourse Login) to
@@ -337,23 +335,19 @@ login. All our pipelines run on sdp-pipeline-prod, whereas sdp-pipeline-dev is t
 changes to Concourse instance itself. Make sure to export all necessary environment variables from sdp-pipeline-prod (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN).
 
 #### Setting up a pipeline
-
 When setting up our pipelines, we use ecs-infra-user on sdp-dev to be able to interact with our infrastructure on AWS. The credentials for this are stored on
 AWS Secrets Manager so you do not need to set up anything yourself.
 
 To set the pipeline, run the following script:
-
 ```bash
 chmod u+x ./concourse/scripts/set_pipeline.sh
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script
 ```
-
 Note that you only have to run chmod the first time running the script in order to give permissions.
 This script will set the branch and pipeline name to whatever branch you are currently on. It will also set the image tag on ECR to the current commit hash at the time of setting the pipeline.
 
 The pipeline name itself will usually follow a pattern as follows: `<repo-name>-<branch-name>`
 If you wish to set a pipeline for another branch without checking out, you can run the following:
-
 ```bash
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script <branch_name>
 ```
@@ -361,9 +355,7 @@ If you wish to set a pipeline for another branch without checking out, you can r
 If the branch you are deploying is "main" or "master", it will trigger a deployment to the sdp-prod environment. To set the ECR image tag, you must draft a Github release pointing to the latest release of the main/master branch that has a tag in the form of vX.Y.Z. Drafting up a release will automatically deploy the latest version of the main/master branch with the associated release tag, but you can also manually trigger a build through the Concourse UI or the terminal prompt.
 
 #### Triggering a pipeline
-
 Once the pipeline has been set, you can manually trigger a build on the Concourse UI, or run the following command:
-
 ```bash
 fly -t aws-sdp trigger-job -j github-repo-archive-script-<branch-name>/build-and-push
 ```
diff --git a/concourse/ci.yml b/concourse/ci.yml
index ad88a19..7ffe936 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -1,78 +1,78 @@
 resources:
-  - name: resource-repo
-    type: git
-    icon: github
-    source:
-      uri: https://github.com/ONS-Innovation/github-repository-archive-script
-      username: ((github_access_token))
-      password: x-oauth-basic
-      branch: ((branch))
+- name: resource-repo
+  type: git
+  icon: github
+  source:
+    uri: https://github.com/ONS-Innovation/github-repository-archive-script
+    username: ((github_access_token))
+    password: x-oauth-basic
+    branch: ((branch))
 
 jobs:
-  - name: build-and-push
-    public: true
-    plan:
-      - get: resource-repo
-        timeout: 5m
-      - task: build-image
-        privileged: true
-        config:
-          platform: linux
-          image_resource:
-            type: docker-image
-            source:
-              repository: hashicorp/terraform
-          inputs:
-            - name: resource-repo
-          params:
-            aws_account_id: ((aws_account_sdp_((env))))
-            aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
-            secrets: ((sdp_((env))_github_repo_archive_secrets))
-          run: # binary used to build the image
-            path: sh
-            args:
-              - -cx
-              - |
-                apk add --no-cache aws-cli podman jq iptables curl
+- name:  build-and-push
+  public: true
+  plan:
+  - get: resource-repo
+    timeout: 5m
+  - task: build-image
+    privileged: true
+    config:
+      platform: linux
+      image_resource:
+        type: docker-image
+        source:
+          repository: hashicorp/terraform
+      inputs:
+      - name: resource-repo
+      params:
+        aws_account_id: ((aws_account_sdp_((env))))
+        aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
+        secrets: ((sdp_((env))_github_repo_archive_secrets))
+      run: # binary used to build the image
+        path: sh
+        args:
+        - -cx
+        - |
+          apk add --no-cache aws-cli podman jq iptables curl
 
-                if [[ "((env))" == "prod" ]]; then
-                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-                  export tag
-                else
-                  export tag=((tag))
-                fi
-                git rev-parse --abbrev-ref HEAD
-                chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
-                chmod u+x ./resource-repo/concourse/scripts/build_image.sh
-                source ./resource-repo/concourse/scripts/assume_role.sh
-                ./resource-repo/concourse/scripts/build_image.sh
-        timeout: 10m
-      - task: terraform
-        privileged: true
-        config:
-          platform: linux
-          image_resource:
-            type: docker-image
-            source: { repository: hashicorp/terraform }
-          inputs:
-            - name: resource-repo
-          params:
-            secrets: ((sdp_((env))_github_repo_archive_secrets))
-            github_access_token: ((github_access_token))
-          run:
-            path: sh
-            args:
-              - -cx
-              - |
-                apk add --no-cache jq curl
+          if [[ "((env))" == "prod" ]]; then
+            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+            export tag
+          else
+            export tag=((tag))
+          fi
+          git rev-parse --abbrev-ref HEAD
+          chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
+          chmod u+x ./resource-repo/concourse/scripts/build_image.sh
+          source ./resource-repo/concourse/scripts/assume_role.sh
+          ./resource-repo/concourse/scripts/build_image.sh
+    timeout: 10m
+  - task: terraform
+    privileged: true
+    config:
+      platform: linux
+      image_resource:
+        type: docker-image
+        source: {repository: hashicorp/terraform}
+      inputs:
+      - name: resource-repo
+      params:
+        secrets: ((sdp_((env))_github_repo_archive_secrets))
+        github_access_token: ((github_access_token))
+      run:
+        path: sh
+        args:
+        - -cx
+        - |
+          apk add --no-cache jq curl
 
-                if [[ "((env))" == "prod" ]]; then
-                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-                  export tag
-                else 
-                  export tag=((tag))
-                fi
-                chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
-                export env=((env))
-                ./resource-repo/concourse/scripts/terraform_infra.sh
-        timeout: 30m
+          if [[ "((env))" == "prod" ]]; then
+            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+            export tag
+          else 
+            export tag=((tag))
+          fi
+          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+          export env=((env))
+          ./resource-repo/concourse/scripts/terraform_infra.sh
+    timeout: 30m
\ No newline at end of file
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index dfac7a8..1ec760b 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -10,11 +10,8 @@ container_image=$(echo "$secrets" | jq -r .container_image)
 # shellcheck disable=SC2154
 aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com
 
-# shellcheck disable=SC2154
 podman build -t "${container_image}":"${tag}" resource-repo
 
-# shellcheck disable=SC2154
 podman tag "${container_image}":"${tag}" "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
-
-# shellcheck disable=SC2154
 podman push "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
+# shellcheck disable=SC2154
\ No newline at end of file
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 7295550..9816f27 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -5,8 +5,7 @@ repo_name=${1}
 if [[ $# -gt 1 ]]; then
     branch=${2}
     git rev-parse --verify "${branch}"
-    # shellcheck disable=SC2181
-    if [[ $? -ne 0 ]]; then
+    if [[ $? -ne 0 ]]; then # shellcheck disable=SC2181
         echo "Branch \"${branch}\" does not exist"
         exit 1
     fi
@@ -27,3 +26,4 @@ else
 fi
 
 fly -t aws-sdp set-pipeline -c concourse/ci.yml -p "${repo_name}"-"${branch}" -v branch="${branch}" -v tag="${tag}" -v env="${env}"
+
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 9f3e8a6..5a6c16d 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -29,8 +29,7 @@ AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
 export AWS_ACCESS_KEY_ID
 export AWS_SECRET_ACCESS_KEY
 
-# shellcheck disable=SC2086
-git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
+git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/" # shellcheck disable=
 
 if [[ ${env} != "prod" ]]; then
     env="dev"
@@ -40,7 +39,6 @@ cd resource-repo/terraform/service
 
 terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfigure
 
-# shellcheck disable=SC2154
 terraform apply \
 -var "aws_account_id=$aws_account_id" \
 -var "aws_access_key_id=$aws_access_key_id" \
@@ -56,3 +54,4 @@ terraform apply \
 -var "lambda_memory=$lambda_memory" \
 -var "schedule=$schedule" \
 -auto-approve
+# shellcheck disable=SC2154
\ No newline at end of file

From 0a1cd329ce4600ff5ac99be94da2268edcb67103 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 15:40:03 +0100
Subject: [PATCH 17/23] add whitespace

---
 README.md                            | 7 +++++++
 concourse/scripts/assume_role.sh     | 3 +--
 concourse/scripts/build_image.sh     | 6 +++++-
 concourse/scripts/set_pipeline.sh    | 4 ++--
 concourse/scripts/terraform_infra.sh | 5 +++--
 5 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 28e0b6f..651fda6 100644
--- a/README.md
+++ b/README.md
@@ -328,6 +328,7 @@ terraform destroy -var-file=env/dev/dev.tfvars
 ### Deployments with Concourse
 
 #### Allowlisting your IP
+
 To setup the deployment pipeline with concourse, you must first allowlist your IP address on the Concourse
 server. IP addresses are flushed everyday at 00:00 so this must be done at the beginning of every working day
 whenever the deployment pipeline needs to be used. Follow the instructions on the Confluence page (SDP Homepage > SDP Concourse > Concourse Login) to
@@ -335,19 +336,23 @@ login. All our pipelines run on sdp-pipeline-prod, whereas sdp-pipeline-dev is t
 changes to Concourse instance itself. Make sure to export all necessary environment variables from sdp-pipeline-prod (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN).
 
 #### Setting up a pipeline
+
 When setting up our pipelines, we use ecs-infra-user on sdp-dev to be able to interact with our infrastructure on AWS. The credentials for this are stored on
 AWS Secrets Manager so you do not need to set up anything yourself.
 
 To set the pipeline, run the following script:
+
 ```bash
 chmod u+x ./concourse/scripts/set_pipeline.sh
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script
 ```
+
 Note that you only have to run chmod the first time running the script in order to give permissions.
 This script will set the branch and pipeline name to whatever branch you are currently on. It will also set the image tag on ECR to the current commit hash at the time of setting the pipeline.
 
 The pipeline name itself will usually follow a pattern as follows: `<repo-name>-<branch-name>`
 If you wish to set a pipeline for another branch without checking out, you can run the following:
+
 ```bash
 ./concourse/scripts/set_pipeline.sh github-repo-archive-script <branch_name>
 ```
@@ -355,7 +360,9 @@ If you wish to set a pipeline for another branch without checking out, you can r
 If the branch you are deploying is "main" or "master", it will trigger a deployment to the sdp-prod environment. To set the ECR image tag, you must draft a Github release pointing to the latest release of the main/master branch that has a tag in the form of vX.Y.Z. Drafting up a release will automatically deploy the latest version of the main/master branch with the associated release tag, but you can also manually trigger a build through the Concourse UI or the terminal prompt.
 
 #### Triggering a pipeline
+
 Once the pipeline has been set, you can manually trigger a build on the Concourse UI, or run the following command:
+
 ```bash
 fly -t aws-sdp trigger-job -j github-repo-archive-script-<branch-name>/build-and-push
 ```
diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index 729ff09..ae6ab98 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -8,9 +8,8 @@ aws sts assume-role --output text \
     --role-session-name concourse-pipeline-run \
     --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
     | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
-# shellcheck disable=SC3040,SC2154
-
 
+# shellcheck disable=SC3040,SC2154
 AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
 AWS_SECRET_ACCESS_KEY="$(cat SecretAccessKey)"
 AWS_SESSION_TOKEN="$(cat SessionToken)"
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 1ec760b..9d86a32 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -5,13 +5,17 @@ set -euo pipefail
 export STORAGE_DRIVER=vfs
 export PODMAN_SYSTEMD_UNIT=concourse-task
 
+# shellcheck disable=SC2154
 container_image=$(echo "$secrets" | jq -r .container_image)
 
 # shellcheck disable=SC2154
 aws ecr get-login-password --region eu-west-2 | podman --storage-driver=vfs login --username AWS --password-stdin "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com
 
+# shellcheck disable=SC2154
 podman build -t "${container_image}":"${tag}" resource-repo
 
+# shellcheck disable=SC2154
 podman tag "${container_image}":"${tag}" "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
+
+# shellcheck disable=SC2154
 podman push "${aws_account_id}".dkr.ecr.eu-west-2.amazonaws.com/"${container_image}":"${tag}"
-# shellcheck disable=SC2154
\ No newline at end of file
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 9816f27..7295550 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -5,7 +5,8 @@ repo_name=${1}
 if [[ $# -gt 1 ]]; then
     branch=${2}
     git rev-parse --verify "${branch}"
-    if [[ $? -ne 0 ]]; then # shellcheck disable=SC2181
+    # shellcheck disable=SC2181
+    if [[ $? -ne 0 ]]; then
         echo "Branch \"${branch}\" does not exist"
         exit 1
     fi
@@ -26,4 +27,3 @@ else
 fi
 
 fly -t aws-sdp set-pipeline -c concourse/ci.yml -p "${repo_name}"-"${branch}" -v branch="${branch}" -v tag="${tag}" -v env="${env}"
-
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 5a6c16d..9f3e8a6 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -29,7 +29,8 @@ AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
 export AWS_ACCESS_KEY_ID
 export AWS_SECRET_ACCESS_KEY
 
-git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/" # shellcheck disable=
+# shellcheck disable=SC2086
+git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
 
 if [[ ${env} != "prod" ]]; then
     env="dev"
@@ -39,6 +40,7 @@ cd resource-repo/terraform/service
 
 terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfigure
 
+# shellcheck disable=SC2154
 terraform apply \
 -var "aws_account_id=$aws_account_id" \
 -var "aws_access_key_id=$aws_access_key_id" \
@@ -54,4 +56,3 @@ terraform apply \
 -var "lambda_memory=$lambda_memory" \
 -var "schedule=$schedule" \
 -auto-approve
-# shellcheck disable=SC2154
\ No newline at end of file

From 517c2f30c53cac2751b22ccfbfc3edc004f8305a Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 15:49:05 +0100
Subject: [PATCH 18/23] remove shebang line

---
 concourse/scripts/assume_role.sh     | 2 --
 concourse/scripts/build_image.sh     | 2 --
 concourse/scripts/set_pipeline.sh    | 2 --
 concourse/scripts/terraform_infra.sh | 2 --
 4 files changed, 8 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index ae6ab98..d802b5d 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,5 +1,3 @@
-#!/bin/bash
-
 set -euo pipefail
 
 # shellcheck disable=SC3040,SC2154
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 9d86a32..0127fe4 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,5 +1,3 @@
-#!/bin/bash
-
 set -euo pipefail
 
 export STORAGE_DRIVER=vfs
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 7295550..e56def6 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,5 +1,3 @@
-#!/bin/bash
-
 repo_name=${1}
 
 if [[ $# -gt 1 ]]; then
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 9f3e8a6..0d9d9f2 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,5 +1,3 @@
-#!/bin/bash
-
 set -euo pipefail
 
 # shellcheck disable=SC2154

From cb2e76dbb09a30d9f71ab663e8ad3f29ef5dd105 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 16:59:15 +0100
Subject: [PATCH 19/23] add sh-shebang and lint yaml

---
 concourse/ci.yml                     | 146 +++++++++++++--------------
 concourse/scripts/assume_role.sh     |   2 +
 concourse/scripts/build_image.sh     |   2 +
 concourse/scripts/set_pipeline.sh    |   2 +
 concourse/scripts/terraform_infra.sh |   2 +
 5 files changed, 81 insertions(+), 73 deletions(-)

diff --git a/concourse/ci.yml b/concourse/ci.yml
index 7ffe936..ad88a19 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -1,78 +1,78 @@
 resources:
-- name: resource-repo
-  type: git
-  icon: github
-  source:
-    uri: https://github.com/ONS-Innovation/github-repository-archive-script
-    username: ((github_access_token))
-    password: x-oauth-basic
-    branch: ((branch))
+  - name: resource-repo
+    type: git
+    icon: github
+    source:
+      uri: https://github.com/ONS-Innovation/github-repository-archive-script
+      username: ((github_access_token))
+      password: x-oauth-basic
+      branch: ((branch))
 
 jobs:
-- name:  build-and-push
-  public: true
-  plan:
-  - get: resource-repo
-    timeout: 5m
-  - task: build-image
-    privileged: true
-    config:
-      platform: linux
-      image_resource:
-        type: docker-image
-        source:
-          repository: hashicorp/terraform
-      inputs:
-      - name: resource-repo
-      params:
-        aws_account_id: ((aws_account_sdp_((env))))
-        aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
-        secrets: ((sdp_((env))_github_repo_archive_secrets))
-      run: # binary used to build the image
-        path: sh
-        args:
-        - -cx
-        - |
-          apk add --no-cache aws-cli podman jq iptables curl
+  - name: build-and-push
+    public: true
+    plan:
+      - get: resource-repo
+        timeout: 5m
+      - task: build-image
+        privileged: true
+        config:
+          platform: linux
+          image_resource:
+            type: docker-image
+            source:
+              repository: hashicorp/terraform
+          inputs:
+            - name: resource-repo
+          params:
+            aws_account_id: ((aws_account_sdp_((env))))
+            aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
+            secrets: ((sdp_((env))_github_repo_archive_secrets))
+          run: # binary used to build the image
+            path: sh
+            args:
+              - -cx
+              - |
+                apk add --no-cache aws-cli podman jq iptables curl
 
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-            export tag
-          else
-            export tag=((tag))
-          fi
-          git rev-parse --abbrev-ref HEAD
-          chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
-          chmod u+x ./resource-repo/concourse/scripts/build_image.sh
-          source ./resource-repo/concourse/scripts/assume_role.sh
-          ./resource-repo/concourse/scripts/build_image.sh
-    timeout: 10m
-  - task: terraform
-    privileged: true
-    config:
-      platform: linux
-      image_resource:
-        type: docker-image
-        source: {repository: hashicorp/terraform}
-      inputs:
-      - name: resource-repo
-      params:
-        secrets: ((sdp_((env))_github_repo_archive_secrets))
-        github_access_token: ((github_access_token))
-      run:
-        path: sh
-        args:
-        - -cx
-        - |
-          apk add --no-cache jq curl
+                if [[ "((env))" == "prod" ]]; then
+                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+                  export tag
+                else
+                  export tag=((tag))
+                fi
+                git rev-parse --abbrev-ref HEAD
+                chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
+                chmod u+x ./resource-repo/concourse/scripts/build_image.sh
+                source ./resource-repo/concourse/scripts/assume_role.sh
+                ./resource-repo/concourse/scripts/build_image.sh
+        timeout: 10m
+      - task: terraform
+        privileged: true
+        config:
+          platform: linux
+          image_resource:
+            type: docker-image
+            source: { repository: hashicorp/terraform }
+          inputs:
+            - name: resource-repo
+          params:
+            secrets: ((sdp_((env))_github_repo_archive_secrets))
+            github_access_token: ((github_access_token))
+          run:
+            path: sh
+            args:
+              - -cx
+              - |
+                apk add --no-cache jq curl
 
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
-            export tag
-          else 
-            export tag=((tag))
-          fi
-          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
-          export env=((env))
-          ./resource-repo/concourse/scripts/terraform_infra.sh
-    timeout: 30m
\ No newline at end of file
+                if [[ "((env))" == "prod" ]]; then
+                  tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
+                  export tag
+                else 
+                  export tag=((tag))
+                fi
+                chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+                export env=((env))
+                ./resource-repo/concourse/scripts/terraform_infra.sh
+        timeout: 30m
diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index d802b5d..198630f 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 # shellcheck disable=SC3040,SC2154
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 0127fe4..8e23f3a 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 export STORAGE_DRIVER=vfs
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index e56def6..9f89363 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 repo_name=${1}
 
 if [[ $# -gt 1 ]]; then
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 0d9d9f2..3ea20c5 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 set -euo pipefail
 
 # shellcheck disable=SC2154

From 30aac94a10f7ac9dc0c6e10f7838b7cdf256a7bb Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 17:04:54 +0100
Subject: [PATCH 20/23] disable SC3040

---
 concourse/scripts/assume_role.sh     | 2 +-
 concourse/scripts/build_image.sh     | 3 +--
 concourse/scripts/set_pipeline.sh    | 2 +-
 concourse/scripts/terraform_infra.sh | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index 198630f..f14026c 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+# shellcheck disable=SC3040,SC2154
 
 set -euo pipefail
 
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 8e23f3a..4dfcc54 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,5 +1,4 @@
-#!/bin/sh
-
+# shellcheck disable=SC3040,SC2154
 set -euo pipefail
 
 export STORAGE_DRIVER=vfs
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 9f89363..3aa026c 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+# shellcheck disable=SC3040,SC2154
 
 repo_name=${1}
 
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 3ea20c5..2147d7d 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+# shellcheck disable=SC3040,SC2154
 
 set -euo pipefail
 

From b7606d0ce40bfeff0993816e1cb1971ad03103ea Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 17:18:14 +0100
Subject: [PATCH 21/23] fix yaml file and add in SC2148

---
 concourse/scripts/assume_role.sh     | 2 +-
 concourse/scripts/build_image.sh     | 2 +-
 concourse/scripts/set_pipeline.sh    | 2 +-
 concourse/scripts/terraform_infra.sh | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/concourse/scripts/assume_role.sh b/concourse/scripts/assume_role.sh
index f14026c..54d0c07 100644
--- a/concourse/scripts/assume_role.sh
+++ b/concourse/scripts/assume_role.sh
@@ -1,4 +1,4 @@
-# shellcheck disable=SC3040,SC2154
+# shellcheck disable=SC3040,SC2154,SC2148
 
 set -euo pipefail
 
diff --git a/concourse/scripts/build_image.sh b/concourse/scripts/build_image.sh
index 4dfcc54..c500c22 100755
--- a/concourse/scripts/build_image.sh
+++ b/concourse/scripts/build_image.sh
@@ -1,4 +1,4 @@
-# shellcheck disable=SC3040,SC2154
+# shellcheck disable=SC3040,SC2154,SC2148
 set -euo pipefail
 
 export STORAGE_DRIVER=vfs
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
index 3aa026c..7d28780 100755
--- a/concourse/scripts/set_pipeline.sh
+++ b/concourse/scripts/set_pipeline.sh
@@ -1,4 +1,4 @@
-# shellcheck disable=SC3040,SC2154
+# shellcheck disable=SC3040,SC2154,SC2148
 
 repo_name=${1}
 
diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 2147d7d..099dc27 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -1,4 +1,4 @@
-# shellcheck disable=SC3040,SC2154
+# shellcheck disable=SC3040,SC2154,SC2148
 
 set -euo pipefail
 

From 8895171975124edca1ed25987aa51a5e0f399a70 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 17:18:46 +0100
Subject: [PATCH 22/23] fix yaml

---
 concourse/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/concourse/ci.yml b/concourse/ci.yml
index ad88a19..7a4b3e6 100644
--- a/concourse/ci.yml
+++ b/concourse/ci.yml
@@ -1,3 +1,4 @@
+---
 resources:
   - name: resource-repo
     type: git
@@ -69,7 +70,7 @@ jobs:
                 if [[ "((env))" == "prod" ]]; then
                   tag=$(curl "https://api.github.com/repos/ONS-Innovation/github-repository-archive-script/releases" | jq -r '.[0].tag_name')
                   export tag
-                else 
+                else
                   export tag=((tag))
                 fi
                 chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh

From 38a59f8a3ff008d7ab94268a1b822f4392350364 Mon Sep 17 00:00:00 2001
From: delterr <Hasan.T.Ahmad@ons.gov.uk>
Date: Mon, 14 Jul 2025 17:23:19 +0100
Subject: [PATCH 23/23] remove container image from terraform_infra.sh

---
 concourse/scripts/terraform_infra.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 099dc27..4b9c5d3 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -16,7 +16,6 @@ github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
 lambda_arch=$(echo "$secrets" | jq -r .lambda_arch)
 
 github_org=$(echo "$secrets" | jq -r .github_org)
-container_image=$(echo "$secrets" | jq -r .container_image)
 
 schedule=$(echo "$secrets" | jq -r .schedule)
 lambda_timeout=$(echo "$secrets" | jq -r .lambda_timeout)