National-Digital-Twin · ndtppm · Dec 12, 2025 · Dec 11, 2025 · Dec 11, 2025
diff --git a/.github/workflows/oss-checker.yml b/.github/workflows/oss-checker.yml
@@ -0,0 +1,138 @@
+# SPDX-License-Identifier: Apache-2.0
+# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity.
+
+name: Run OSS check helper
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  oss-checks:
+    if: github.actor != 'dependabot[bot]' && 
+      (github.event.repository.private == false ||
+        (github.event.repository.private == true &&
+         contains(join(github.event.pull_request.labels.*.name), 'oss-preparation')))
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch GitHub App token for target repo
+        id: target_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }}
+          permission-contents: read
+
+      - name: Fetch GitHub App token for OSPO source repo (read-only)
+        id: ospo_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }}
+          owner: National-Digital-Twin
+          repositories: ospo-resources
+          permission-contents: read
+
+      - name: Checkout target repository
+        uses: actions/checkout@v6
+        with:
+          token: ${{ steps.target_token.outputs.token }}
+
+      - name: Checkout OSPO source repository
+        uses: actions/checkout@v6
+        with:
+          repository: National-Digital-Twin/ospo-resources
+          path: ospo-resources
+          token: ${{ steps.ospo_token.outputs.token }}
+
+      - name: Checkout archetypes source repository
+        uses: actions/checkout@v6
+        with:
+          repository: National-Digital-Twin/archetypes
+          path: archetypes
+
+      - name: Test for presence of OSS files and variation from templated content
+        run: |
+          missing_files=()
+          unchanged_files=()
+
+          while IFS= read -r file || [ -n "$file" ]; do
+            # Skip comments and empty lines
+            if [[ -z "$file" || "$file" == \#* ]]; then
+              continue
+            fi
+
+            target_path="$file"
+            archetypes_path="archetypes/$file"
+
+            if [ ! -f "$target_path" ]; then
+              echo "Missing OSS file in target repository: $target_path"
+              missing_files+=("$file")
+            elif cmp -s "$target_path" "$archetypes_path"; then
+              echo "OSS file unchanged from archetypes template: $target_path"
+              unchanged_files+=("$file")
+            else
+              echo "OSS file present and different from the archetypes template: $target_path"
+            fi
+          done < ospo-resources/oss-checklist-files.txt
+
+          echo ""
+          if [ ${#missing_files[@]} -ne 0 ]; then
+            echo "The following OSS required files are missing:"
+            printf '%s\n' "${missing_files[@]}"
+          fi
+
+          if [ ${#unchanged_files[@]} -ne 0 ]; then
+            echo "The following OSS required files are unchanged from the archetypes template:"
+            printf '%s\n' "${unchanged_files[@]}"
+          fi
+
+          if [ ${#missing_files[@]} -ne 0 ] || [ ${#unchanged_files[@]} -ne 0 ]; then
+            echo "OSS required file check failed."
+            exit 1
+          else
+            echo "All OSS files are present and have been updated from their original templated content."
+          fi
+
+      - name: Check GitHub template files are present
+        run: |
+          echo "Checking for pull request and issue template files"
+
+          missing_templates=()
+
+          files_to_check=(
+            ".github/PULL_REQUEST_TEMPLATE.md"
+            ".github/ISSUE_TEMPLATE/bug_report.md"
+            ".github/ISSUE_TEMPLATE/feature_request.md"
+          )
+
+          for file in "${files_to_check[@]}"; do
+            if [ ! -f "$file" ]; then
+              missing_templates+=("$file")
+            fi
+          done
+
+          if [ ${#missing_templates[@]} -ne 0 ]; then
+            echo ""
+            echo "Required GitHub template files not found:"
+            printf '  - %s\n' "${missing_templates[@]}"
+            echo ""
+            echo "These files help improve project collaboration and are considered best practice."
+            echo "These need to be included in repository contents to improve the developer and repository consumer experience."
+
+            # Fail the job
+            echo "Missing required GitHub template files."
+            exit 1
+          else
+            echo "Required pull request and issue template files present."
+          fi
diff --git a/.github/workflows/publish-github-release.yml b/.github/workflows/publish-github-release.yml
@@ -0,0 +1,117 @@
+# SPDX-License-Identifier: Apache-2.0
+# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity.
+
+# This workflow is triggered when a pull request is merged into the main branch
+# from a release/* branch. It extracts the release version from the source branch,
+# generates a Software Bill of Materials (SBOM) using the GitHub API,
+# creates a Git tag with the version, and publishes a GitHub release including the SBOM file.
+
+name: Generate SBOM, Tag and Publish GitHub Release
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  versioning:
+    if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
+    name: Extract Release Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.extract_version.outputs.VERSION }}
+    steps:
+      - name: Extract Version from Source Branch Name
+        id: extract_version
+        run: |
+          SOURCE_BRANCH="${{ github.head_ref }}"
+          VERSION=$(echo "$SOURCE_BRANCH" | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+')
+
+          if [ -z "$VERSION" ]; then
+            echo "Error: No semantic release version found in source branch: $SOURCE_BRANCH"
+            exit 1
+          fi
+
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Validate Version Format (Semantic Versioning)
+        run: |
+          if [[ ! "${{ env.VERSION }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Invalid version format found. Expected semantic version in release branch name (e.g., release/0.9.0)"
+            exit 1
+          fi
+
+      - name: Print Tag Version
+        run: |
+          echo "Identified release semantic version: ${{ steps.extract_version.outputs.version }}"
+
+  generate-sbom:
+    name: Generate SPDX SBOM
+    runs-on: ubuntu-latest
+    needs: [versioning]
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Generate SPDX SBOM
+        run: |
+          # Call GitHub API to generate SBOM
+          api_response=$(curl -sSL \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "$GITHUB_API_URL/repos/${{ github.repository }}/dependency-graph/sbom")
+
+          # Extract nested "sbom" object into a valid SPDX file
+          echo "$api_response" | jq '.sbom' > sbom.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: sbom
+          path: sbom.spdx.json
+
+  create-git-tag:
+    name: Create Git Tag
+    needs: [versioning, generate-sbom]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Create Git Tag
+        uses: rickstaa/action-create-tag@v1
+        with:
+          tag: "v${{ needs.versioning.outputs.version }}"
+          message: "Release v${{ needs.versioning.outputs.version }}"
+          force_push_tag: true
+
+  create-git-release:
+    name: Create GitHub Release
+    needs: [versioning, generate-sbom, create-git-tag]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download SBOM Artifact
+        uses: actions/download-artifact@v6
+        with:
+          name: sbom
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "v${{ needs.versioning.outputs.version }}"
+          name: "Release v${{ needs.versioning.outputs.version }}"
+          body: "Automated release for version ${{ needs.versioning.outputs.version }}. For details of fixes, new features and changes in this release, please see [CHANGELOG.md](${{ github.server_url }}/${{ github.repository }}/blob/main/CHANGELOG.md)."
+          draft: false
+          prerelease: false
+          files: |
+            sbom.spdx.json
+
diff --git a/profile/README.md b/profile/README.md
@@ -0,0 +1,42 @@
+# National Digital Twin Programme on GitHub
+
+This GitHub organisation hosts the open-source assets developed by the **National Digital Twin Programme (NDTP)**. Our repositories contain code, tools, and documentation that enable the secure and interoperable sharing of information between digital systems and organisations.
+
+These assets are designed to support developers, integrators, and collaborators working with the foundational components of the UK’s future National Digital Twin ecosystem. These repositories provide practical implementations of our data-sharing architecture, demonstrator applications, and supporting libraries to accelerate adoption and development.
+
+---
+
+## Key Repositories
+
+### Integration Architecture (IA)
+
+The Integration Architecture is a federated framework that enables trusted data exchange between organisations. Each participant runs an IA Node, and nodes can share structured data securely under common governance principles.
+
+We provide:
+
+- The core IA Node reference implementation
+- Deployment templates and Helm charts for cloud-native environments
+- Documentation for implementation, integration, and extension
+
+### Demonstrator Applications
+
+These applications illustrate how NDTP technologies can be used to solve real-world problems using data.
+
+- **IRIS** – A demonstrator supporting energy-efficiency decision-making for homes
+- **LISA** – A multi-agency incident management and coordination tool
+
+The following demonstrators are currently under development and will be released in future phases:
+
+- **NOVA**, **SALUS**, and **VISTA** – Covering renewable energy generation, vulnerable persons support, and emergency planning and response (expected Q4 2025–2026)
+
+## Contributing
+
+We welcome community engagement via issues and discussion. While direct code contributions are limited to approved delivery partners at this stage, your feedback helps shape ongoing development.
+
+If you’d like to get involved, please refer to the contributing guidance within our [archetypes repository](https://github.com/National-Digital-Twin/archetypes/blob/main/CONTRIBUTING.md).
+
+---
+
+## Licensing
+
+All code is released under the Apache License 2.0. Documentation and content are published under the Open Government Licence v3.0.