Merge up latest updates to main

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Run '...'
+2. Observe on '....'
+3. See error/exception (etc)
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**System (please complete the following information):**
+- Container [e.g. docker image]
+- OS: [e.g. Ubuntu]
+- Version [e.g. 20.04.3]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/pull_request_template.md

@@ -0,0 +1,32 @@
+## Sensitive Credential Checks
+
+- [ ] As the author of these changes, I have checked for any sensitive credentials prior to this review being requested.
+- [ ] As a reviewer of these changes, I have checked for any sensitive credentials prior to approving this merge.
+
+<!--- When merging the branch to dev please use the SQUASH AND MERGE --->
+
+## Motivation and Context
+
+<!--- Why is this change required? What problem does it solve? -->
+<!--- If it fixes an open issue, please link to the issue here. -->
+
+## Description
+
+- Describe your changes in detail
+
+## How Has This Been Tested?
+
+<!--- Please describe in detail how you tested your changes. -->
+<!--- Include details of your testing environment, and the tests you ran. -->
+<!--- How does your change affect other areas of the code, etc. -->
+
+## Screenshots (if appropriate):
+
+## Checklist:
+
+<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
+<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+- [ ] It contains only changes required by issue (does not contain other PR)
+- [ ] Includes link to an issue (if apply)
+- [ ] I have added tests to cover my changes.
+

.github/workflows/oss-checker.yml

@@ -0,0 +1,124 @@
+# SPDX-License-Identifier: Apache-2.0
+# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity.
+
+name: Run OSS check helper
+
+on:
+  workflow_dispatch:
+
+jobs:
+  oss-checks:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch GitHub App token for target repo
+        id: target_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }}
+          permission-contents: read
+
+      - name: Fetch GitHub App token for OSPO source repo (read-only)
+        id: ospo_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }}
+          owner: National-Digital-Twin
+          repositories: ospo-resources
+          permission-contents: read
+
+      - name: Checkout target repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.target_token.outputs.token }}
+
+      - name: Checkout OSPO source repository
+        uses: actions/checkout@v4
+        with:
+          repository: National-Digital-Twin/ospo-resources
+          path: ospo-resources
+          token: ${{ steps.ospo_token.outputs.token }}
+
+      - name: Checkout archetypes source repository
+        uses: actions/checkout@v4
+        with:
+          repository: National-Digital-Twin/archetypes
+          path: archetypes
+
+      - name: Test for presence of OSS files and variation from templated content
+        run: |
+          missing_files=()
+          unchanged_files=()
+
+          while IFS= read -r file || [ -n "$file" ]; do
+            # Skip comments and empty lines
+            if [[ -z "$file" || "$file" == \#* ]]; then
+              continue
+            fi
+
+            target_path="$file"
+            archetypes_path="archetypes/$file"
+
+            if [ ! -f "$target_path" ]; then
+              echo "Missing OSS file in target repository: $target_path"
+              missing_files+=("$file")
+            elif cmp -s "$target_path" "$archetypes_path"; then
+              echo "OSS file unchanged from archetypes template: $target_path"
+              unchanged_files+=("$file")
+            else
+              echo "OSS file present and different from the archetypes template: $target_path"
+            fi
+          done < ospo-resources/oss-checklist-files.txt
+
+          echo ""
+          if [ ${#missing_files[@]} -ne 0 ]; then
+            echo "The following OSS required files are missing:"
+            printf '%s\n' "${missing_files[@]}"
+          fi
+
+          if [ ${#unchanged_files[@]} -ne 0 ]; then
+            echo "The following OSS required files are unchanged from the archetypes template:"
+            printf '%s\n' "${unchanged_files[@]}"
+          fi
+
+          if [ ${#missing_files[@]} -ne 0 ] || [ ${#unchanged_files[@]} -ne 0 ]; then
+            echo "OSS required file check failed."
+            exit 1
+          else
+            echo "All OSS files are present and have been updated from their original templated content."
+          fi
+
+      - name: Check GitHub template files are present
+        run: |
+          echo "Checking for pull request and issue template files"
+
+          missing_templates=()
+
+          files_to_check=(
+            ".github/PULL_REQUEST_TEMPLATE.md"
+            ".github/ISSUE_TEMPLATE/bug_report.md"
+            ".github/ISSUE_TEMPLATE/feature_request.md"
+          )
+
+          for file in "${files_to_check[@]}"; do
+            if [ ! -f "$file" ]; then
+              missing_templates+=("$file")
+            fi
+          done
+
+          if [ ${#missing_templates[@]} -ne 0 ]; then
+            echo ""
+            echo "Required GitHub template files not found:"
+            printf '  - %s\n' "${missing_templates[@]}"
+            echo ""
+            echo "These files help improve project collaboration and are considered best practice."
+            echo "These need to be included in repository contents to improve the developer and repository consumer experience."
+
+            # Fail the job
+            echo "Missing required GitHub template files."
+            exit 1
+          else
+            echo "Required pull request and issue template files present."
+          fi

.github/workflows/publish-github-release.yml

@@ -0,0 +1,117 @@
+# SPDX-License-Identifier: Apache-2.0
+# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity.
+
+# This workflow is triggered when a pull request is merged into the main branch
+# from a release/* branch. It extracts the release version from the source branch,
+# generates a Software Bill of Materials (SBOM) using the GitHub API,
+# creates a Git tag with the version, and publishes a GitHub release including the SBOM file.
+
+name: Generate SBOM, Tag and Publish GitHub Release
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  versioning:
+    if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
+    name: Extract Release Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.extract_version.outputs.VERSION }}
+    steps:
+      - name: Extract Version from Source Branch Name
+        id: extract_version
+        run: |
+          SOURCE_BRANCH="${{ github.head_ref }}"
+          VERSION=$(echo "$SOURCE_BRANCH" | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+')
+
+          if [ -z "$VERSION" ]; then
+            echo "Error: No semantic release version found in source branch: $SOURCE_BRANCH"
+            exit 1
+          fi
+
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Validate Version Format (Semantic Versioning)
+        run: |
+          if [[ ! "${{ env.VERSION }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Invalid version format found. Expected semantic version in release branch name (e.g., release/0.9.0)"
+            exit 1
+          fi
+
+      - name: Print Tag Version
+        run: |
+          echo "Identified release semantic version: ${{ steps.extract_version.outputs.version }}"
+
+  generate-sbom:
+    name: Generate SPDX SBOM
+    runs-on: ubuntu-latest
+    needs: [versioning]
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Generate SPDX SBOM
+        run: |
+          # Call GitHub API to generate SBOM
+          api_response=$(curl -sSL \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "$GITHUB_API_URL/repos/${{ github.repository }}/dependency-graph/sbom")
+
+          # Extract nested "sbom" object into a valid SPDX file
+          echo "$api_response" | jq '.sbom' > sbom.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.spdx.json
+
+  create-git-tag:
+    name: Create Git Tag
+    needs: [versioning, generate-sbom]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create Git Tag
+        uses: rickstaa/action-create-tag@v1
+        with:
+          tag: "v${{ needs.versioning.outputs.version }}"
+          message: "Release v${{ needs.versioning.outputs.version }}"
+          force_push_tag: true
+
+  create-git-release:
+    name: Create GitHub Release
+    needs: [versioning, generate-sbom, create-git-tag]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download SBOM Artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: sbom
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "v${{ needs.versioning.outputs.version }}"
+          name: "Release v${{ needs.versioning.outputs.version }}"
+          body: "Automated release for version ${{ needs.versioning.outputs.version }}. For details of fixes, new features and changes in this release, please see [CHANGELOG.md](${{ github.server_url }}/${{ github.repository }}/blob/main/CHANGELOG.md)."
+          draft: false
+          prerelease: false
+          files: |
+            sbom.spdx.json
+

ACKNOWLEDGEMENTS.md

@@ -0,0 +1,30 @@
+# Acknowledgements
+
+**Repository:** `label-builder`  
+**Description:** `Recognises suppliers, partner organisations, and other contributors to the repository's development.`  
+
+The National Digital Twin Programme (NDTP) would like to acknowledge the contributions of various organisations and individuals who have supported the development of this repository.
+
+## Organisational contributions
+
+Over time, the following organisations have provided technical expertise, development support, and domain knowledge that have contributed to the evolution of this project:
+
+- [Kainos](https://www.kainos.com/)
+- [Telicent](https://telicent.io/)
+
+We are grateful for the collaboration that has helped shape this repository.
+
+## Individual contributions
+
+For a list of individual contributors who have made direct commits to this repository, see GitHub’s auto-generated contributor insights: [Contributors](../../graphs/contributors).
+
+---
+
+**Note:** This acknowledgment does not confer any legal rights, ownership, or imply ongoing involvement by any of the named organisations or individuals. All contributions are made in accordance with the repository’s licensing terms.
+
+© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity.
+
+Licensed under the NDTP InnerSource Licence – Version 1.0.
+
+For full licensing terms, see [LICENSE.md](LICENSE.md).
+