NHSDigital · oliverbeumkes-nhs · Jan 12, 2026 · Dec 3, 2025 · Dec 3, 2025 · Dec 3, 2025
@@ -19,7 +19,7 @@ updates:
     open-pull-requests-limit: 100
 
 - package-ecosystem: "pip"
-    directory: "/lambda"
+    directory: "/lambdas"
       schedule:
         interval: "weekly"
         timezone: "Europe/London"

@@ -4,20 +4,20 @@ on:
   push:
     branches: [main]
     paths:
-      - "stacks/container-repositories/**"
-      - "stacks/base-support/**"
-      - "stacks/base-networking/**"
-      - "stacks/ecs-cluster/**"
+      - "../../stacks/container_repositories/**"
+      - "../../stacks/base_support/**"
+      - "../../stacks/base_networking/**"
+      - "../../stacks/ecs_cluster/**"
       - ".github/workflows/automated-base-infrastructure-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
 
   pull_request:
     branches: [main]
     paths:
-      - "stacks/container-repositories/**"
-      - "stacks/base-support/**"
-      - "stacks/base-networking/**"
-      - "stacks/ecs-cluster/**"
+      - "../../stacks/container_repositories/**"
+      - "../../stacks/base_support/**"
+      - "../../stacks/base_networking/**"
+      - "../../stacks/ecs_cluster/**"
       - ".github/workflows/automated-base-infrastructure-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
 
@@ -34,11 +34,19 @@ jobs:
       matrix:
         environment: [dev]
         terraform_stack:
-          [container-repositories, base-support, base-networking, ecs-cluster]
+          - name: "container_repositories"
+            hyphenated_alias: "container-repositories"
+          - name: "base_support"
+            hyphenated_alias: "base-support"
+          - name: "base_networking"
+            hyphenated_alias: "base-networking"
+          - name: "ecs_cluster"
+            hyphenated_alias: "ecs-cluster"
     uses: ./.github/workflows/deploy-stack.yml
     with:
       environment: ${{ matrix.environment }}
-      terraform_stack: ${{ matrix.terraform_stack }}
+      terraform_stack: ${{ matrix.terraform_stack.name }}
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
       git_ref: ${{ github.ref }}
+      hyphenated_alias: ${{ matrix.terraform_stack.hyphenated_alias }}
     secrets: inherit
@@ -4,27 +4,27 @@ on:
   push:
     branches: [main]
     paths:
-      - "stacks/step-function/**"
-      - "stacks/transfer-classifier/**"
-      - "stacks/validate-metrics/**"
-      - "stacks/ods-downloader/**"
-      - "stacks/reports-generator/**"
-      - "stacks/spine-exporter/**"
-      - "stacks/metrics-calculator/**"
+      - "../../stacks/step_function/**"
+      - "../../stacks/transfer_classifier/**"
+      - "../../stacks/validate_metrics/**"
+      - "../../stacks/ods_downloader/**"
+      - "../../stacks/reports_generator/**"
+      - "../../stacks/spine_exporter/**"
+      - "../../stacks/metrics_calculator/**"
       - ".github/workflows/automated-data-pipeline-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
-      - "lambda/validate-metrics"
+      - "../../lambdas/validate_metrics"
 
   pull_request:
     branches: [main]
     paths:
-      - "stacks/step-function/**"
-      - "stacks/transfer-classifier/**"
-      - "stacks/validate-metrics/**"
-      - "stacks/ods-downloader/**"
-      - "stacks/reports-generator/**"
-      - "stacks/spine-exporter/**"
-      - "stacks/metrics-calculator/**"
+      - "../../stacks/step_function/**"
+      - "../../stacks/transfer_classifier/**"
+      - "../../stacks/validate_metrics/**"
+      - "../../stacks/ods_downloader/**"
+      - "../../stacks/reports_generator/**"
+      - "../../stacks/spine_exporter/**"
+      - "../../stacks/metrics_calculator/**"
       - ".github/workflows/automated-data-pipeline-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
 
@@ -39,8 +39,9 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: step-function
+      terraform_stack: step_function
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "step-function"
     secrets: inherit
 
   transfer-classifier:
@@ -49,9 +50,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: transfer-classifier
-      image_tag: transfer_classifier
+      terraform_stack: transfer_classifier
+      image_tag: transfer-classifier
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "transfer-classifier"
     secrets: inherit
 
   validate-metrics:
@@ -60,9 +62,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: validate-metrics
+      terraform_stack: validate_metrics
       build_lambda: true
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "validate-metrics"
     secrets: inherit
 
   ods-downloader:
@@ -71,9 +74,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: ods-downloader
-      image_tag: ods_downloader
+      terraform_stack: ods_downloader
+      image_tag: ods-downloader
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "ods-downloader"
     secrets: inherit
 
   reports-generator:
@@ -82,9 +86,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: reports-generator
-      image_tag: reports_generator
+      terraform_stack: reports_generator
+      image_tag: reports-generator
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "reports_generator"
     secrets: inherit
 
   spine-exporter:
@@ -93,9 +98,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: spine-exporter
-      image_tag: spine_exporter
+      terraform_stack: spine_exporter
+      image_tag: spine-exporter
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "spine-exporter"
     secrets: inherit
 
   metrics-calculator:
@@ -104,7 +110,8 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: metrics-calculator
-      image_tag: metrics_calculator
+      terraform_stack: metrics_calculator
+      image_tag: metrics-calculator
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "metrics_calculator"
     secrets: inherit
@@ -4,21 +4,21 @@ on:
   push:
     branches: [main]
     paths:
-      - "stacks/email-and-alerting/**"
-      - "stacks/gp2gp-dashboard/**"
+      - "../../stacks/email_and_alerting/**"
+      - "../../stacks/gp2gp_dashboard/**"
       - ".github/workflows/automated-email-and-alerting-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
-      - "lambda/email-report/**"
-      - "lambda/gp2gp-dashboard-alert/**"
-      - "lambda/log-alerts-pipeline-error/**"
-      - "lambda/log-alerts-technical-failures-above-threshold/**"
-      - "lambda/store-asid-lookup/**"
+      - "../../lambdas/email_report/**"
+      - "../../lambdas/gp2gp_dashboard_alert/**"
+      - "../../lambdas/log_alerts_pipeline_error/**"
+      - "../../lambdas/log_alerts_technical_failures_above_threshold/**"
+      - "../../lambdas/store_asid_lookup/**"
 
   pull_request:
     branches: [main]
     paths:
-      - "stacks/email-and-alerting/**"
-      - "stacks/gp2gp-dashboard/**"
+      - "../../stacks/email_and_alerting/**"
+      - "../../stacks/gp2gp_dashboard/**"
       - ".github/workflows/automated-email-and-alerting-terraform.yml"
       - ".github/workflows/deploy-stack.yml"
 
@@ -33,9 +33,10 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: email-and-alerting
+      terraform_stack: email_and_alerting
       build_lambda: true
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "email-and-alerting"
     secrets: inherit
 
   gp2gp-dashboard:
@@ -44,8 +45,9 @@ jobs:
     with:
       environment: dev
       is_deployment: ${{ github.ref == 'refs/heads/main' }}
-      terraform_stack: gp2gp-dashboard
-      image_tag: gp2gp_dashboard
+      terraform_stack: gp2gp_dashboard
+      image_tag: gp2gp-dashboard
       build_lambda: true
       git_ref: ${{ github.ref }}
+      hyphenated_alias: "gp2gp-dashboard"
     secrets: inherit
@@ -23,8 +23,26 @@ jobs:
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
 
+      - name: Set up Python 3.14
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.14
+
+      - name: Make virtual environment
+        run: |
+          make env
+
+      - name: Test with pytest
+        run: |
+          make test-coverage
+          cd ./lambdas
+          sed -i "s@filename=\"@filename=\"lambdas/@" coverage.xml
+          cd ..
+
       - name: SonarQube Cloud Scan
         uses: SonarSource/sonarqube-scan-action@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+#
@@ -12,7 +12,7 @@ on:
         type: string
         required: true
       build_lambda:
-        description: "Does the workflow need a lambda build"
+        description: "Does the workflow need a lambdas build"
         type: boolean
         default: false
       image_tag:
@@ -23,6 +23,10 @@ on:
         description: "The git_ref to deploy"
         type: string
         default: main
+      hyphenated_alias:
+        description: "Hyphenated stack Alias"
+        type: string
+        default: ""
 
 permissions:
   pull-requests: write
@@ -61,8 +65,8 @@ jobs:
       - name: ECR Copy
         id: ecr-copy
         run: |
-          source_repo=${{ secrets.AWS_DEV_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{ secrets.AWS_ECR_DEV_REPOSITORY }}${{ inputs.terraform_stack }}
-          destination_repo=${{ steps.creds.outputs.aws-account-id }}.dkr.ecr.eu-west-2.amazonaws.com/${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.terraform_stack }}
+          source_repo=${{ secrets.AWS_DEV_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{ secrets.AWS_ECR_DEV_REPOSITORY }}${{ inputs.hyphenated_alias }}
+          destination_repo=${{ steps.creds.outputs.aws-account-id }}.dkr.ecr.eu-west-2.amazonaws.com/${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.hyphenated_alias }}
           docker pull $source_repo:latest
           docker tag $source_repo:latest $destination_repo:latest
           docker tag $source_repo:latest $destination_repo:${{ steps.checkout.outputs.commit }}
@@ -83,6 +87,7 @@ jobs:
       image_tag: ${{ inputs.image_tag }}
       build_lambda: ${{ inputs.build_lambda }}
       git_ref: ${{ inputs.git_ref }}
+      hyphenated_alias: ${{ inputs.hyphenated_alias }}
     secrets: inherit
 
   deploy-infra-no-images:
@@ -128,7 +133,7 @@ jobs:
       - name: Terraform Init
         id: init
         run: |
-          terraform init -no-color -backend-config="key=data-pipeline/${{ inputs.terraform_stack }}/terraform.tfstate" \
+          terraform init -no-color -backend-config="key=data-pipeline/${{ inputs.hyphenated_alias }}/terraform.tfstate" \
           -backend-config="bucket=${{ secrets.AWS_STATE_BUCKET }}" \
           -backend-config="dynamodb_table=${{ secrets.AWS_STATE_LOCK_TABLE }}"
         shell: bash
@@ -145,19 +150,19 @@ jobs:
           EOF
 
       - name: Setup Terraform variables for Build Lambda
-        id: update-lambda-build-references
+        id: update-lambdas-build-references
         if: inputs.build_lambda
         run: |-
           aws_env="${{ vars.AWS_ENVIRONMENT }}"
           cat > pipeline.auto.tfvars <<EOF
               environment = "$aws_env"
-              log_alerts_pipeline_error_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/log-alerts-pipeline-error.zip"
-              log_alerts_technical_failures_above_threshold_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/log-alerts-technical-failures-above-threshold.zip"
-              gp2gp_dashboard_alert_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/gp2gp-dashboard-alert.zip"
-              email_report_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/email-report.zip"
-              validate_metrics_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/validate-metrics.zip"
-              degrades_dashboards_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/degrades-dashboards.zip"
-              store_asid_lookup_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/store-asid-lookup.zip"
+              log_alerts_pipeline_error_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/log_alerts_pipeline_error.zip"
+              log_alerts_technical_failures_above_threshold_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/log_alerts_technical_failures_above_threshold.zip"
+              gp2gp_dashboard_alert_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/gp2gp_dashboard_alert.zip"
+              email_report_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/email_report.zip"
+              validate_metrics_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/validate_metrics.zip"
+              degrades_dashboards_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/degrades-dashboards.zip"
+              store_asid_lookup_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/store_asid_lookup.zip"
           EOF
 
       - name: Terraform Plan
@@ -214,7 +219,7 @@ jobs:
       - name: Terraform Init
         id: init
         run: |
-          terraform init -no-color -backend-config="key=data-pipeline/${{ inputs.terraform_stack }}/terraform.tfstate" \
+          terraform init -no-color -backend-config="key=data-pipeline/${{ inputs.hyphenated_alias }}/terraform.tfstate" \
           -backend-config="bucket=${{ secrets.AWS_STATE_BUCKET }}" \
           -backend-config="dynamodb_table=${{ secrets.AWS_STATE_LOCK_TABLE }}"
         shell: bash
@@ -234,30 +239,30 @@ jobs:
         id: vars-image-tag
         if: inputs.image_tag
         run: |-
-          IMAGE_TAG=$(aws ecr describe-images --repository-name ${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.terraform_stack }} --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]')
+          IMAGE_TAG=$(aws ecr describe-images --repository-name ${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.image_tag }} --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]')
           cat > pipeline.auto.tfvars <<EOF
-          ${{ inputs.image_tag }}_image_tag = $IMAGE_TAG
+          ${{ inputs.terraform_stack }}_image_tag = $IMAGE_TAG
           environment = "${{ vars.AWS_ENVIRONMENT }}"
           EOF
 
       - name: Setup Terraform variables for Build Lambda
-        id: update-lambda-build-references
+        id: update-lambdas-build-references
         if: inputs.build_lambda
         run: |-
           image_key="${{ inputs.image_tag }}"
           aws_env="${{ vars.AWS_ENVIRONMENT }}"
           cat > pipeline.auto.tfvars <<EOF
               environment = "$aws_env"
-              log_alerts_pipeline_error_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/log-alerts-pipeline-error.zip"
-              log_alerts_technical_failures_above_threshold_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/log-alerts-technical-failures-above-threshold.zip"
-              gp2gp_dashboard_alert_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/gp2gp-dashboard-alert.zip"
-              email_report_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/email-report.zip"
-              validate_metrics_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/validate-metrics.zip"
-              degrades_dashboards_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/degrades-dashboards.zip"
-              store_asid_lookup_lambda_zip = "$GITHUB_WORKSPACE/lambda/build/store-asid-lookup.zip"
+              log_alerts_pipeline_error_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/log_alerts_pipeline_error.zip"
+              log_alerts_technical_failures_above_threshold_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/log_alerts_technical_failures_above_threshold.zip"
+              gp2gp_dashboard_alert_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/gp2gp_dashboard_alert.zip"
+              email_report_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/email_report.zip"
+              validate_metrics_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/validate_metrics.zip"
+              degrades_dashboards_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/degrades-dashboards.zip"
+              store_asid_lookup_lambda_zip = "$GITHUB_WORKSPACE/lambdas/build/store_asid_lookup.zip"
           EOF
           if [[ -n "$image_key" ]]; then
-            IMAGE_TAG=$(aws ecr describe-images --repository-name ${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.terraform_stack }} --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]')
+            IMAGE_TAG=$(aws ecr describe-images --repository-name ${{ secrets.AWS_ECR_REPOSITORY }}${{ inputs.hyphenated_alias }} --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]')
             image_tag=$IMAGE_TAG
             echo "${image_key}_image_tag = $image_tag" >> pipeline.auto.tfvars
             cat pipeline.auto.tfvars