From 6e81abb33a32ff7a9a4e4b7ce1a8bc085468ee7e Mon Sep 17 00:00:00 2001
From: Connor Avery <214469360+connoravo-nhs@users.noreply.github.com>
Date: Fri, 30 Jan 2026 10:22:28 +0000
Subject: [PATCH 1/2] Use PR workflow to run out dev-sandbox

Signed-off-by: Connor Avery <214469360+connoravo-nhs@users.noreply.github.com>
---
 .github/workflows/ci.yml           |  2 +-
 .github/workflows/pull_request.yml | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67babfc1d..164ef8bbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,7 +102,7 @@ jobs:
       STACK_NAME: pfp-sandbox
       TARGET_ENVIRONMENT: dev
       APIGEE_ENVIRONMENT: internal-dev-sandbox
-      ENABLE_MUTUAL_TLS: false
+      ENABLE_MUTUAL_TLS: true
       MTLS_KEY: prescriptions-for-patients-mtls-1
       BUILD_ARTIFACT: packaged_sandbox_code
       TRUSTSTORE_FILE: pfp-sandbox-truststore.pem
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 4df0ca290..0d7238b48 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -153,3 +153,32 @@ jobs:
       TARGET_SPINE_SERVER: sandbox
       TARGET_SERVICE_SEARCH_SERVER: sandbox
       PROXYGEN_ROLE: ${{ secrets.PROXYGEN_PTL_ROLE }}
+  release_dev_sandbox:
+    needs: [tag_release, package_code, get_commit_id]
+    uses: ./.github/workflows/sam_release_code.yml
+    with:
+      ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.version_tag}}
+      STACK_NAME: pfp-sandbox
+      TARGET_ENVIRONMENT: dev
+      APIGEE_ENVIRONMENT: internal-dev-sandbox
+      ENABLE_MUTUAL_TLS: false
+      MTLS_KEY: prescriptions-for-patients-mtls-1
+      BUILD_ARTIFACT: packaged_sandbox_code
+      TRUSTSTORE_FILE: pfp-sandbox-truststore.pem
+      VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
+      COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
+      LOG_LEVEL: DEBUG
+      LOG_RETENTION_DAYS: 30
+      STATE_MACHINE_LOG_LEVEL: ALL
+      RUN_REGRESSION_TESTS: false
+      FORWARD_CSOC_LOGS: false
+      TC007_NHS_NUMBERS: ${{vars.TC007_NHS_NUMBERS}}
+      TC008_NHS_NUMBERS: ${{vars.TC008_NHS_NUMBERS}}
+      TC009_NHS_NUMBERS: ${{vars.TC009_NHS_NUMBERS}}
+      ALLOW_NHS_NUMBER_OVERRIDE: true
+    secrets:
+      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
+      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
+      TARGET_SPINE_SERVER: sandbox
+      TARGET_SERVICE_SEARCH_SERVER: sandbox
+      PROXYGEN_ROLE: ${{ secrets.PROXYGEN_PTL_ROLE }}

From 0798e9386df9827806322d0f2c5157c2913e772e Mon Sep 17 00:00:00 2001
From: Connor Avery <214469360+connoravo-nhs@users.noreply.github.com>
Date: Fri, 30 Jan 2026 10:33:26 +0000
Subject: [PATCH 2/2] turn on mtls duh

Signed-off-by: Connor Avery <214469360+connoravo-nhs@users.noreply.github.com>
---
 .github/workflows/pull_request.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 0d7238b48..3b8099363 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -161,7 +161,7 @@ jobs:
       STACK_NAME: pfp-sandbox
       TARGET_ENVIRONMENT: dev
       APIGEE_ENVIRONMENT: internal-dev-sandbox
-      ENABLE_MUTUAL_TLS: false
+      ENABLE_MUTUAL_TLS: true
       MTLS_KEY: prescriptions-for-patients-mtls-1
       BUILD_ARTIFACT: packaged_sandbox_code
       TRUSTSTORE_FILE: pfp-sandbox-truststore.pem