From 18193419ab95e40cf5ecb9c36d2684a85a8ff34d Mon Sep 17 00:00:00 2001
From: Kat Stevens <katherine.stevens@digital.cabinet-office.gov.uk>
Date: Tue, 12 Nov 2024 11:39:13 +0000
Subject: [PATCH 1/3] PP-12687: Add dedicated PR workflow

Aiming for consistency with app repos
---
 .github/workflows/{run-tests.yml => _run-tests.yml} |  2 +-
 .github/workflows/pr.yml                            | 11 +++++++++++
 .github/workflows/publish-package.yml               |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)
 rename .github/workflows/{run-tests.yml => _run-tests.yml} (96%)
 create mode 100644 .github/workflows/pr.yml

diff --git a/.github/workflows/run-tests.yml b/.github/workflows/_run-tests.yml
similarity index 96%
rename from .github/workflows/run-tests.yml
rename to .github/workflows/_run-tests.yml
index d8cc5b5..7ecb68b 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/_run-tests.yml
@@ -1,7 +1,7 @@
 name: Run tests
 
 on:
-  pull_request:
+  workflow_dispatch:
   workflow_call:
 
 permissions:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 0000000..4c7873b
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,11 @@
+name: PR
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    uses: ./.github/workflows/_run-tests.yml
diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
index c1e3a8b..e91bca6 100644
--- a/.github/workflows/publish-package.yml
+++ b/.github/workflows/publish-package.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   unit-tests:
-    uses: ./.github/workflows/run-tests.yml
+    uses: ./.github/workflows/_run-tests.yml
   publish:
     needs: unit-tests
     runs-on: ubuntu-latest

From 618e65f8656678a1231f650bf9b5c6c3a29966d8 Mon Sep 17 00:00:00 2001
From: Kat Stevens <katherine.stevens@digital.cabinet-office.gov.uk>
Date: Tue, 12 Nov 2024 11:39:42 +0000
Subject: [PATCH 2/3] PP-12687: Add dependency review shared workflow

---
 .github/workflows/pr.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4c7873b..8b61c54 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -9,3 +9,7 @@ permissions:
 jobs:
   tests:
     uses: ./.github/workflows/_run-tests.yml
+
+  dependency-review:
+    name: Dependency Review scan
+    uses: alphagov/pay-ci/.github/workflows/_run-dependency-review.yml@master

From 8b01d403b93e8acd82cf03134dff93edba4ffb2f Mon Sep 17 00:00:00 2001
From: Kat Stevens <katherine.stevens@digital.cabinet-office.gov.uk>
Date: Tue, 12 Nov 2024 11:40:56 +0000
Subject: [PATCH 3/3] PP-12687: Bump deprecated github action versions

---
 .github/workflows/_run-tests.yml                    | 4 ++--
 .github/workflows/prevent-merge-if-release-open.yml | 2 +-
 .github/workflows/publish-package.yml               | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_run-tests.yml b/.github/workflows/_run-tests.yml
index 7ecb68b..7bff95a 100644
--- a/.github/workflows/_run-tests.yml
+++ b/.github/workflows/_run-tests.yml
@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
       - name: Setup Node
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
diff --git a/.github/workflows/prevent-merge-if-release-open.yml b/.github/workflows/prevent-merge-if-release-open.yml
index ac7ad82..2351a23 100644
--- a/.github/workflows/prevent-merge-if-release-open.yml
+++ b/.github/workflows/prevent-merge-if-release-open.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Check for unmerged release
         id: check_pr
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         env:
           THIS_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
index e91bca6..023fce3 100644
--- a/.github/workflows/publish-package.yml
+++ b/.github/workflows/publish-package.yml
@@ -17,9 +17,9 @@ jobs:
     if: "contains(github.event.head_commit.message, '[automated release]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
       - name: Setup Node
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'