Update alphagov references to govuk-forms

[cadmiumcat]

What problem does this pull request solve?

We have transferred all repos to govuk-forms

Trello card:

Things to consider when reviewing

• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Do the end to end tests need updating before these changes will pass?
• Has all relevant documentation been updated?

In general, the fix is to add an explicit permissions block to the workflow (either at the root level or within the specific job) that grants only the minimal permissions required. For a typical build-only workflow that just checks out code and builds a Docker image, read-only access to repository contents (contents: read) is usually sufficient. If the reusable workflow needs more (e.g., to push images or create releases), those scopes can be added there; but given the information available, the minimal safe baseline is to set contents: read at the job level.

The best change with minimal impact is to add a permissions block under the build-image job in .github/workflows/docker_build.yml. That way, we constrain the GITHUB_TOKEN used for this job (and therefore for the called reusable workflow) without altering the triggering conditions or job structure. Concretely, in .github/workflows/docker_build.yml, under jobs:, inside build-image:, we will insert:

permissions:
  contents: read

with proper indentation, just before the existing uses: line. No additional methods, imports, or definitions are needed, as this is pure workflow configuration.

In general, the fix is to add an explicit permissions block that grants only the minimal required scopes for GITHUB_TOKEN. For a workflow that just lints workflow files (no pushing, no status writes beyond what GitHub itself does, no issue manipulation), contents: read is typically sufficient at the workflow level.

For this specific file (.github/workflows/lint-workflows.yml), the best, non-functional change is to add a root-level permissions block applying to all jobs. It should go between the on: block and the jobs: block to follow common style and avoid altering the job definition. The block will be:

permissions:
  contents: read

No additional imports or dependencies are needed; this is purely a configuration change in the workflow YAML. Only the shown snippet needs editing: insert the permissions section after line 9 and before line 10.

[stephencdaly]

I think the SHA pinning check is failing because you missed updating alphagov -> govuk-forms in .github/workflows/review_apps_on_pr_close.yml

[github-actions]

🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-1110.www.review.forms.service.gov.uk/

It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
to debug, or otherwise ask an infrastructure person.

For the sign in details and more information, see the review apps wiki page.