chore: rebase cicd-staging onto upstream/main

.ci/Dockerfile

@@ -1,5 +1,5 @@
 #syntax=docker/dockerfile:1.2
-FROM node:20 as build
+FROM node@sha256:1501d5fd51032aa10701a7dcc9e6c72ab1e611a033ffcf08b6d5882e9165f63e as build
 WORKDIR /lambdas
 RUN apt-get update \
         && apt-get install -y zip \

.ci/terraform-init-all.sh

@@ -4,9 +4,9 @@
 # required to run tflint via pre-commit
 
 # only run the script if a uniique pid file exits if not creat it or --force flag is passed
-pid="/tmp/philips-labs-terraform-aws-github-runner.pid"
+pid="/tmp/github-aws-runners-terraform-aws-github-runner.pid"
 if [ "$1" == "--force" ]; then
-  rm -f /tmp/philips-labs-terraform-aws-github-runner.pid
+  rm -f /tmp/github-aws-runners-terraform-aws-github-runner.pid
 fi
 
 if [ ! -f $pid ]; then

.devcontainer/Dockerfile

@@ -1,2 +1 @@
-ARG VARIANT="20-bullseye"
-FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node@sha256:d09eac5cd85fb4bd70770fa3f88ee9dfdd0b09f8b85455a0e039048677276749

.devcontainer/devcontainer.json

@@ -16,11 +16,10 @@
         "dbaeumer.vscode-eslint",
         "editorconfig.editorconfig",
         "esbenp.prettier-vscode",
-        "firsttris.vscode-jest-runner",
         "hashicorp.hcl",
         "hashicorp.terraform",
         "hashicorp.terraform",
-        "orta.vscode-jest",
+        "vitest.explorer",
         "yzhang.markdown-all-in-one"
       ]
     }

.github/dependabot.yml

@@ -15,11 +15,20 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      github:
+        patterns:
+          - "actions/*"
+          - "github/"
 
   - package-ecosystem: "npm"
     directory: "/lambdas"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       aws:
         patterns:
@@ -30,14 +39,71 @@ updates:
       aws-powertools:
         patterns:
           - "@aws-lambda-powertools/*"
+      nx:
+        patterns:
+          - "@nx/*"
+          - "nx/*"
+      eslint:
+        patterns:
+          - "eslint*"
+          - "@typescript-eslint-*"
+      vite:
+        patterns:
+          - "vite*"
+          - "@vite/*"
 
+    commit-message:
+      prefix: "fix(lambda)"
+      prefix-development: "chore(lambda)"
+    # Ignore major version updates for Node.js related packages to keep aligned with Lambda runtime as configured via Terraform
     ignore:
-      - dependency-name: "@middy/core"
+      - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
-      - dependency-name: "@octokit/*"
+
+  - package-ecosystem: "docker"
+    directory: "/.ci/Dockerfile"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore(docker)"
+    # Ignore major version updates for Node.js Docker images to keep aligned with Lambda runtime as configured via Terraform
+    ignore:
+      - dependency-name: "node"
         update-types: ["version-update:semver-major"]
-      - dependency-name: "eslint"
+
+  - package-ecosystem: "docker"
+    directory: "/.devcontainer/Dockerfile"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore(devcontainer)"
+    # Ignore major version updates for Node.js Docker images to keep aligned with Lambda runtime as configured via Terraform
+    ignore:
+      - dependency-name: "mcr.microsoft.com/vscode/devcontainers/typescript-node"
         update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: "pip"
+    directory: "/.github/workflows/mkdocs"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      python-deps:
+        patterns:
+          - "*"
+    labels:
+      - "dependencies"
+      - "python"
     commit-message:
-      prefix: "fix(lambda)"
-      prefix-development: "chore(lambda)"
+      prefix: "chore(docs)"

.github/pull_request_template.md

@@ -0,0 +1,19 @@
+## Description
+
+<!-- Briefly describe the changes in this PR. -->
+
+## Test Plan
+
+<!--
+  Please describe how you tested these changes. This helps reviewers understand
+  the scope and confidence level of the change. Examples:
+
+  - Ran `terraform plan` against an existing deployment
+  - Added/updated unit tests (link to test file or describe coverage)
+  - Deployed to a test environment and triggered a workflow run
+  - Validated with `terraform validate` and `tflint`
+-->
+
+## Related Issues
+
+<!-- Link any related issues, e.g. Fixes #123, Closes #456 -->

.github/workflows/codeql.yml

@@ -10,32 +10,44 @@ on:
   schedule:
     - cron: '25 19 * * 2'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      # required for all workflows
-      security-events: write
+      security-events: write # required for CodeQL to upload security scan results
 
     strategy:
       fail-fast: false
       matrix:
-        include:
-        - language: javascript-typescript
-          build-mode: none
+        language: ['javascript-typescript', 'actions']
+
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
       with:
         languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
+        build-mode: none
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -0,0 +1,38 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    name: Dependency vulnerability scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # for actions/checkout
+      pull-requests: write # for actions/dependency-review-action to comment on PRs
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+        with:
+          comment-summary-in-pr: always

.github/workflows/lambda.yml

@@ -8,20 +8,32 @@ on:
       - 'lambdas/**'
       - '.github/workflows/lambda.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
+    name: Build and test lambda functions
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node: [22]
     container:
-      image: node:${{ matrix.node }}
+      image: node:24@sha256:aa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9
     defaults:
       run:
         working-directory: ./lambdas
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: yarn install --frozen-lockfile
       - name: Run prettier
@@ -34,7 +46,7 @@ jobs:
       - name: Build distribution
         run: yarn build
       - name: Upload coverage report
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ failure() }}
         with:
           name: coverage-reports

.github/workflows/mkdocs/requirements.in

@@ -0,0 +1 @@
+mkdocs-material==9.7.3