Merge branch 'main' into one-login

.env.example

@@ -90,4 +90,7 @@ GOV_ONE_BASE_URI=https://oidc.integration.account.gov.uk
 # Redirect URIs for Gov One Login redirects
 # Replace localhost:3000 with the correct application root path
 GOV_ONE_REDIRECT_URI=http://localhost:3000/users/auth/openid_connect/callback
-GOV_ONE_LOGOUT_REDIRECT_URI=http://localhost:3000/users/sign_out
+GOV_ONE_LOGOUT_REDIRECT_URI=http://localhost:3000/users/sign_out
+
+# DISPLAY SERVICE_UNAVAILABLE PAGE
+MAINTENANCE = true

.github/workflows/content.yml

@@ -9,25 +9,25 @@
 #   https://ey-recovery-pr-123.london.cloudapps.digital
 #
 name: Deploy Content App
-on:
-  pull_request:
-    # branches:
-    #   - main
-    types:
-      - labeled
-      - synchronize
-    paths-ignore:
-      - '**/*.md'
-      - .docker*
-      - .env.example
-      - .gitignore
-      - .pa11yci
-      - .tool-versions
-      - .yardopts
-      - bin/*
-      - docker-compose.*
-      - Dockerfile
-      - terraform
+# on:
+#   pull_request:
+#     # branches:
+#     #   - main
+#     types:
+#       - labeled
+#       - synchronize
+#     paths-ignore:
+#       - '**/*.md'
+#       - .docker*
+#       - .env.example
+#       - .gitignore
+#       - .pa11yci
+#       - .tool-versions
+#       - .yardopts
+#       - bin/*
+#       - docker-compose.*
+#       - Dockerfile
+#       - terraform
 
 jobs:
   deploy:
@@ -48,7 +48,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
       -
         name: Pin Terraform version
-        uses: hashicorp/setup-terraform@v2.0.3
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.1.7
       -

.github/workflows/development.yml

@@ -7,22 +7,22 @@
 #   https://ey-recovery-dev.london.cloudapps.digital
 #
 name: Deploy Development App
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - '**/*.md'
-      - .docker*
-      - .env.example
-      - .gitignore
-      - .pa11yci
-      - .tool-versions
-      - .yardopts
-      - bin/*
-      - docker-compose.*
-      - uml/*
+# on:
+#   workflow_dispatch:
+#   push:
+#     branches:
+#       - main
+#     paths-ignore:
+#       - '**/*.md'
+#       - .docker*
+#       - .env.example
+#       - .gitignore
+#       - .pa11yci
+#       - .tool-versions
+#       - .yardopts
+#       - bin/*
+#       - docker-compose.*
+#       - uml/*
 
 jobs:
   deploy:
@@ -39,7 +39,7 @@ jobs:
         #   ref: ${{ github.sha }}
       -
         name: Pin Terraform version
-        uses: hashicorp/setup-terraform@v2.0.3
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.1.7
       -

.github/workflows/production.yml

@@ -47,7 +47,7 @@ jobs:
           echo "HEAD=$(git rev-parse ${{ inputs.version }})" >> $GITHUB_ENV
       -
         name: Pin Terraform version
-        uses: hashicorp/setup-terraform@v2.0.3
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.1.7
       -

.github/workflows/staging.yml

@@ -10,21 +10,21 @@
 #   https://ey-recovery-staging.london.cloudapps.digital
 #
 name: Deploy Staging App
-on:
-  workflow_dispatch:
-    inputs:
-      candidate:
-        description: Create release candidate version ("rcx.x.x")
-        type: string
-        required: true
-      ref:
-        description: Git ref or branch to deploy
-        type: string
-        required: true
-        default: main
-  push:
-    tags:
-      - rc*
+# on:
+#   workflow_dispatch:
+#     inputs:
+#       candidate:
+#         description: Create release candidate version ("rcx.x.x")
+#         type: string
+#         required: true
+#       ref:
+#         description: Git ref or branch to deploy
+#         type: string
+#         required: true
+#         default: main
+#   push:
+#     tags:
+#       - rc*
 
 jobs:
   deploy:
@@ -48,7 +48,7 @@ jobs:
           echo "HEAD=$(git rev-parse ${{ inputs.candidate }})" >> $GITHUB_ENV
       -
         name: Pin Terraform version
-        uses: hashicorp/setup-terraform@v2.0.3
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.1.7
       -

.github/workflows/teardown.yml

@@ -22,7 +22,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
       -
         name: Pin Terraform version
-        uses: hashicorp/setup-terraform@v2.0.3
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.1.7
       -

.github/workflows/tf-azure-deploy.yml

@@ -45,7 +45,7 @@ jobs:
 
       # Install the latest version of the Terraform CLI
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.5.6
           terraform_wrapper: false
@@ -148,7 +148,7 @@ jobs:
 
       # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.5.6
 

.github/workflows/tf-azure-unit-tests.yml

@@ -24,7 +24,7 @@ jobs:
 
     # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v2
+      uses: hashicorp/setup-terraform@v3
 
     # Initialise a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
     - name: Terraform Init

.github/workflows/trivy.yml

@@ -66,7 +66,7 @@ jobs:
             ${{ env.REGISTRY }}:${{ github.sha }}
       -
         name: Run Trivy vulnerability scanner
-        uses: aquasecurity/[email protected].0
+        uses: aquasecurity/[email protected].1
         with:
           image-ref: ${{ env.REGISTRY }}:${{ github.sha }}
           format: table

Dockerfile

@@ -53,8 +53,6 @@ ENV PUPPETEER_EXECUTABLE_PATH /usr/bin/chromium-browser
 ENV APP_HOME /srv
 ENV RAILS_ENV ${RAILS_ENV:-production}
 
-COPY .docker-profile /root/.profile
-
 RUN mkdir -p ${APP_HOME}/tmp/pids ${APP_HOME}/log
 
 WORKDIR ${APP_HOME}

Gemfile

@@ -135,3 +135,6 @@ group :ui do
   gem 'selenium-webdriver'
   gem 'site_prism'
 end
+
+gem 'devise-pwned_password', '~> 0.1.10'
+gem 'devise-security', '~> 0.18.0'

Gemfile.lock

@@ -138,6 +138,11 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
+    devise-pwned_password (0.1.10)
+      devise (~> 4)
+      pwned (~> 2.0.0)
+    devise-security (0.18.0)
+      devise (>= 4.3.0)
     dibber (0.7.0)
     diff-lcs (1.5.0)
     digest-crc (0.6.5)
@@ -373,6 +378,7 @@ GEM
     public_suffix (5.0.3)
     puma (6.4.0)
       nio4r (~> 2.0)
+    pwned (2.0.2)
     que (2.2.1)
     que-scheduler (4.4.0)
       activesupport (>= 5.0)
@@ -504,7 +510,7 @@ GEM
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
     safely_block (0.4.0)
-    selenium-webdriver (4.13.1)
+    selenium-webdriver (4.15.0)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
@@ -629,6 +635,8 @@ DEPENDENCIES
   cssbundling-rails
   debug
   devise
+  devise-pwned_password (~> 0.1.10)
+  devise-security (~> 0.18.0)
   dibber
   dotenv-rails
   dry-core
@@ -683,4 +691,4 @@ RUBY VERSION
    ruby 3.2.2p53
 
 BUNDLED WITH
-   2.3.26
+   2.4.13

app/assets/stylesheets/application.scss

@@ -1,6 +1,7 @@
 /*
 https://frontend.design-system.service.gov.uk/sass-api-reference
 https://design.education.gov.uk/design-system/dfe-frontend
+https://design-system.service.gov.uk/styles/colour/
 
 $color_dfe-blue             #003a69 Primary brand colour
 $color_dfe-secondary-blue   #347ca9
@@ -15,8 +16,10 @@ $govuk-page-width: 1200px;
 
 @import 'govuk-frontend/govuk/all';
 @import 'dfe-frontend-alpha/packages/dfefrontend';
-@import 'dfe-header';
 
+$light-blue: tint($color_dfe-secondary-blue, 90%);
+
+@import 'dfe-header';
 @import 'card';
 @import 'prompt';
 @import 'video';
@@ -77,6 +80,14 @@ Hero layout
     margin-top: govuk-spacing(6);
     margin-bottom: govuk-spacing(-4);
   }
+
+  @include govuk-media-query($until: tablet) {
+    .govuk-grid-column-one-half > p,
+    .govuk-grid-column-one-half > h2 {
+      margin-left: govuk-spacing(2);
+      margin-right: govuk-spacing(2);
+    }
+  }
 }
 
 
@@ -86,8 +97,8 @@ Internal
 */
 pre.code-tip {
   padding: 0 5px;
-  color: govuk-colour("red");
-  background-color: govuk-colour("light-grey");
+  color: govuk-colour('red');
+  background-color: govuk-colour('light-grey');
 }
 
 .debug_dump {
@@ -103,7 +114,7 @@ pre.code-tip {
 
 .app-sidebar {
   padding: govuk-spacing(5) govuk-spacing(3);
-  background-color: govuk-colour("light-grey");
+  background-color: govuk-colour('light-grey');
 
   *:last-child {
     margin: 0;
@@ -117,11 +128,21 @@ pre.code-tip {
 .light-grey-box {
   padding: govuk-spacing(5);
   margin-bottom: govuk-spacing(5);
-  background: govuk-colour("light-grey");
+  background: govuk-colour('light-grey');
 
-  .govuk-button {
-    margin: 0;
+  @include govuk-media-query($until: tablet) {
+    margin-top: govuk-spacing(6);
+    margin-bottom: govuk-spacing(6);
   }
+
+  &.enrol-box {
+    border-radius: 6px;
+
+    .govuk-button {
+      margin: 0;
+    }
+  }
+
 }
 
 .float-right {

app/assets/stylesheets/assets-page.scss

@@ -4,6 +4,7 @@
     padding-bottom: 60px;
     width: 100%;
   }
+
   .thumbnail--image {
     outline: 5px solid rgba(11,12,12,0.1);
     box-shadow: 0 2px 2px rgb(11 12 12 / 40%);