[CDAPI-100]: Integrate CI Tests with APIM Proxy III

[nhsd-rebecca-flynn]

Description

Update the integration, contract, schema and acceptance tests ran as part of the CI process to run against the deployed APIM proxy

Summary

Dual-environment test infrastructure: Tests now run against either a local Lambda (ENV=local) or a remote APIM proxy preview environment (ENV=remote), driven by .env files and Makefile targets.
Client abstraction: Client is now a Protocol with LocalClient and RemoteClient implementations; remote requests carry APIM auth headers and have longer timeouts.
CI pipeline restructure: Acceptance tests, coverage merging, and SonarCloud analysis moved from stage-2-test.yaml into preview-env.yaml; a new reusable run-test-suite composite action reduces duplication. Integration, Contract and Schema validation tests still also run locally.
Contract/status endpoint updates: _status response changed from text/plain "OK" to application/json {"status": "pass", ...} (Proxygen standard format); pact contract updated accordingly.

Context

To allow for the CI process to run before the APIM integration has been completed, the tests are currently executed against a container running within the same process, which invokes the lambda in the same way as it would be ran within AWS. This ticket looks to alter the target of the tests to instead point at the deployed APIM proxy for the Pull Request.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming
• Exceptions/Exclusions to coding standards (e.g. #noqa or #NOSONAR) are included within this Pull Request.

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[github-actions]

✅ Trivy gate: no Critical/High vulnerabilities.

Trivy Filesystem Scan Summary

Filesystem: /tmp/artifact

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	0
LOW	0
UNKNOWN	0

✅ No vulnerabilities found.

[neil-sproston]

From a platform POV it looks sane and sensible and leave us in a perfect position ready when we re-plumb the preview-env functionality back into the man CI pipelines.

[nhsd-jack-wainwright]

Looks good to me 👍 , just a few minor comments / questions.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Deployment Complete

• Preview URL: https://feature-cdapi-100-2.dev.endpoints.pathology-laboratory-reporting.national.nhs.uk — Status
  • Smoke Test: ✅ Passed (HTTP 200)
• Mock URL: https://feature-cdapi-100-2.m.dev.endpoints.pathology-laboratory-reporting.national.nhs.uk
  • Smoke Mock Test: ✅ Passed (HTTP 200)
• Proxy URL: https://internal-dev.api.service.nhs.uk/pathology-laboratory-reporting-pr-41
• Lambda Function: pr-feature-cdapi-100-2
• Mock Lambda Function: mock-feature-cdapi-100-2