@abgov/nx-oc 12.1.0 → 12.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-oc",
-  "version": "12.1.0",
+  "version": "12.2.0",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for OpenShift.",

package/src/generators/apply-infra/schema.json

@@ -1,8 +1,9 @@
 {
   "$schema": "http://json-schema.org/schema",
   "id": "NxOcApplyInfra",
-  "title": "",
+  "title": "Apply OpenShift Infrastructure",
   "type": "object",
   "properties": {},
-  "required": []
+  "required": [],
+  "additionalProperties": false
 }

package/src/generators/deployment/deployment.spec.ts

@@ -33,6 +33,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -64,6 +65,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -94,6 +96,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -121,6 +124,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -152,6 +156,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -179,6 +184,7 @@ describe('Deployment Generator', () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     await pipeline(host, {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',

package/src/generators/deployment/dotnet-files/__projectName__.yml__tmpl__

@@ -11,7 +11,7 @@ parameters:
     value: <%= ocInfraProject %>
     required: true
   - name: PROJECT
-    description: Project to set up.
+    description: Project to deploy into.
     displayName: Project
     required: true
   - name: APP_NAME
@@ -20,7 +20,7 @@ parameters:
     value: <%= projectName %>
     required: true
   - name: DEPLOY_TAG
-    description: Tag of the ImageStream to deploy.
+    description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
@@ -30,42 +30,13 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
-  - apiVersion: build.openshift.io/v1
-    kind: BuildConfig
-    metadata:
-      name: ${APP_NAME}
-      namespace: ${INFRA_PROJECT}
-    spec:
-      output:
-        to:
-          kind: ImageStreamTag
-          name: '${APP_NAME}:latest'
-      resources:
-        limits:
-          cpu: 300m
-          memory: 1Gi
-        requests:
-          cpu: 100m
-          memory: 200Mi
-      runPolicy: Serial
-      source:
-        binary: {}
-        type: Binary
-      strategy:
-        dockerStrategy:
-          buildArgs:
-            - name: PROJECT
-              value: <%= projectName %>
-            - name: ASSEMBLY
-              value: <%= projectName %>.dll
-          dockerfilePath: .openshift/<%= projectName %>/Dockerfile
-        type: Docker
-      triggers: []
   - apiVersion: v1
     kind: ConfigMap
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      labels:
+        reference: "true"
     data:
       configuration: |-
         {
@@ -85,27 +56,36 @@ objects:
           "AllowedHosts": "*",
           "Urls": "http://${APP_NAME}:5000"
         }
-  - apiVersion: apps.openshift.io/v1
-    kind: DeploymentConfig
+  - apiVersion: apps/v1
+    kind: Deployment
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      annotations:
+        image.openshift.io/triggers: |-
+          [
+            {
+              "from": {
+                "kind": "ImageStreamTag",
+                "name": "${APP_NAME}:${DEPLOY_TAG}",
+                "namespace": "${INFRA_PROJECT}"
+              },
+              "fieldPath": "spec.template.spec.containers[0].image",
+              "paused": true
+            }
+          ]
     spec:
       replicas: 1
       selector:
-        name: ${APP_NAME}
+        matchLabels:
+          name: ${APP_NAME}
+      revisionHistoryLimit: 3
+      progressDeadlineSeconds: 600
       strategy:
-        activeDeadlineSeconds: 21600
-        recreateParams:
-          timeoutSeconds: 600
-        resources:
-          limits:
-            cpu: 200m
-            memory: 200Mi
-          requests:
-            cpu: 20m
-            memory: 50Mi
-        type: Recreate
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 25%
+          maxUnavailable: 25%
       template:
         metadata:
           labels:
@@ -113,6 +93,7 @@ objects:
         spec:
           containers:
             - name: ${APP_NAME}
+              image: ${APP_NAME}:${DEPLOY_TAG}
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
@@ -131,28 +112,15 @@ objects:
                 requests:
                   cpu: 20m
                   memory: 200Mi
-              terminationMessagePath: /dev/termination-log
               volumeMounts:
                 - mountPath: /opt/app-root/app/appsettings.json
                   name: config-volume
                   subPath: configuration
-          dnsPolicy: ClusterFirst
-          restartPolicy: Always
-          schedulerName: default-scheduler
           volumes:
             - configMap:
                 defaultMode: 420
                 name: ${APP_NAME}
               name: config-volume
-      triggers:
-        - imageChangeParams:
-            containerNames:
-              - ${APP_NAME}
-            from:
-              kind: ImageStreamTag
-              name: '${APP_NAME}:${DEPLOY_TAG}'
-              namespace: ${INFRA_PROJECT}
-          type: ImageChange
   - apiVersion: v1
     kind: Service
     metadata:

package/src/generators/deployment/frontend-files/__projectName__.yml__tmpl__

@@ -11,7 +11,7 @@ parameters:
     value: <%= ocInfraProject %>
     required: true
   - name: PROJECT
-    description: Project to set up.
+    description: Project to deploy into.
     displayName: Project
     required: true
   - name: APP_NAME
@@ -20,7 +20,7 @@ parameters:
     value: <%= projectName %>
     required: true
   - name: DEPLOY_TAG
-    description: Tag of the ImageStream to deploy.
+    description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
@@ -30,42 +30,15 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
-  - apiVersion: build.openshift.io/v1
-    kind: BuildConfig
-    metadata:
-      name: ${APP_NAME}
-      namespace: ${INFRA_PROJECT}
-    spec:
-      output:
-        to:
-          kind: ImageStreamTag
-          name: '${APP_NAME}:latest'
-      resources:
-        limits:
-          cpu: 300m
-          memory: 1Gi
-        requests:
-          cpu: 100m
-          memory: 200Mi
-      runPolicy: Serial
-      source:
-        binary: {}
-        type: Binary
-      strategy:
-        dockerStrategy:
-          buildArgs:
-            - name: PROJECT
-              value: <%= projectName %>
-          dockerfilePath: .openshift/<%= projectName %>/Dockerfile
-        type: Docker
-      triggers: []
   - apiVersion: v1
     kind: ConfigMap
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      labels:
+        reference: "true"
     data:
-      configuration: |-
+      config.json: |-
         {
           "access": {
             "url": "<%= accessServiceUrl %>",
@@ -73,27 +46,36 @@ objects:
             "client_id": "urn:ads:<%= tenant %>:<%= projectName %>"
           }
         }
-  - apiVersion: apps.openshift.io/v1
-    kind: DeploymentConfig
+  - apiVersion: apps/v1
+    kind: Deployment
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      annotations:
+        image.openshift.io/triggers: |-
+          [
+            {
+              "from": {
+                "kind": "ImageStreamTag",
+                "name": "${APP_NAME}:${DEPLOY_TAG}",
+                "namespace": "${INFRA_PROJECT}"
+              },
+              "fieldPath": "spec.template.spec.containers[0].image",
+              "paused": true
+            }
+          ]
     spec:
       replicas: 1
       selector:
-        name: ${APP_NAME}
+        matchLabels:
+          name: ${APP_NAME}
+      revisionHistoryLimit: 3
+      progressDeadlineSeconds: 600
       strategy:
-        activeDeadlineSeconds: 21600
-        recreateParams:
-          timeoutSeconds: 600
-        resources:
-          limits:
-            cpu: 200m
-            memory: 200Mi
-          requests:
-            cpu: 20m
-            memory: 50Mi
-        type: Recreate
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 25%
+          maxUnavailable: 25%
       template:
         metadata:
           labels:
@@ -101,9 +83,10 @@ objects:
         spec:
           containers:
             - name: ${APP_NAME}
+              image: ${APP_NAME}:${DEPLOY_TAG}
               imagePullPolicy: IfNotPresent
               ports:
-                - containerPort: 3333
+                - containerPort: 8080
                   name: http
                   protocol: TCP
               resources:
@@ -113,30 +96,17 @@ objects:
                 requests:
                   cpu: 20m
                   memory: 50Mi
-              terminationMessagePath: /dev/termination-log
               volumeMounts:
                 - mountPath: /opt/app-root/src/config
                   name: config-volume
-          dnsPolicy: ClusterFirst
-          restartPolicy: Always
-          schedulerName: default-scheduler
           volumes:
             - configMap:
                 defaultMode: 420
                 items:
-                  - key: configuration
+                  - key: config.json
                     path: config.json
                 name: ${APP_NAME}
               name: config-volume
-      triggers:
-        - imageChangeParams:
-            containerNames:
-              - ${APP_NAME}
-            from:
-              kind: ImageStreamTag
-              name: '${APP_NAME}:${DEPLOY_TAG}'
-              namespace: ${INFRA_PROJECT}
-          type: ImageChange
   - apiVersion: v1
     kind: Service
     metadata:

package/src/generators/deployment/node-files/__projectName__.yml__tmpl__

@@ -11,7 +11,7 @@ parameters:
     value: <%= ocInfraProject %>
     required: true
   - name: PROJECT
-    description: Project to set up.
+    description: Project to deploy into.
     displayName: Project
     required: true
   - name: APP_NAME
@@ -20,7 +20,7 @@ parameters:
     value: <%= projectName %>
     required: true
   - name: DEPLOY_TAG
-    description: Tag of the ImageStream to deploy.
+    description: ImageStream tag to deploy.
     displayName: Deploy Tag
     value: latest
     required: true
@@ -30,64 +30,46 @@ objects:
     metadata:
       name: ${APP_NAME}
       namespace: ${INFRA_PROJECT}
-  - apiVersion: build.openshift.io/v1
-    kind: BuildConfig
-    metadata:
-      name: ${APP_NAME}
-      namespace: ${INFRA_PROJECT}
-    spec:
-      output:
-        to:
-          kind: ImageStreamTag
-          name: '${APP_NAME}:latest'
-      resources:
-        limits:
-          cpu: 300m
-          memory: 1Gi
-        requests:
-          cpu: 100m
-          memory: 200Mi
-      runPolicy: Serial
-      source:
-        binary: {}
-        type: Binary
-      strategy:
-        dockerStrategy:
-          buildArgs:
-            - name: PROJECT
-              value: <%= projectName %>
-          dockerfilePath: .openshift/<%= projectName %>/Dockerfile
-        type: Docker
-      triggers: []
   - apiVersion: v1
     kind: ConfigMap
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      labels:
+        reference: "true"
     data:
       TENANT_REALM: <%= tenantRealm %>
       ACCESS_SERVICE_URL: <%= accessServiceUrl %>
-  - apiVersion: apps.openshift.io/v1
-    kind: DeploymentConfig
+  - apiVersion: apps/v1
+    kind: Deployment
     metadata:
       name: ${APP_NAME}
       namespace: ${PROJECT}
+      annotations:
+        image.openshift.io/triggers: |-
+          [
+            {
+              "from": {
+                "kind": "ImageStreamTag",
+                "name": "${APP_NAME}:${DEPLOY_TAG}",
+                "namespace": "${INFRA_PROJECT}"
+              },
+              "fieldPath": "spec.template.spec.containers[0].image",
+              "paused": true
+            }
+          ]
     spec:
       replicas: 1
       selector:
-        name: ${APP_NAME}
+        matchLabels:
+          name: ${APP_NAME}
+      revisionHistoryLimit: 3
+      progressDeadlineSeconds: 600
       strategy:
-        activeDeadlineSeconds: 21600
-        recreateParams:
-          timeoutSeconds: 600
-        resources:
-          limits:
-            cpu: 200m
-            memory: 200Mi
-          requests:
-            cpu: 20m
-            memory: 50Mi
-        type: Recreate
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 25%
+          maxUnavailable: 25%
       template:
         metadata:
           labels:
@@ -95,11 +77,12 @@ objects:
         spec:
           containers:
             - name: ${APP_NAME}
+              image: ${APP_NAME}:${DEPLOY_TAG}
               envFrom:
                 - configMapRef:
                     name: ${APP_NAME}
               env:
-                - name: port
+                - name: PORT
                   value: '3333'
                 - name: LOG_LEVEL
                   value: info
@@ -115,19 +98,6 @@ objects:
                 requests:
                   cpu: 20m
                   memory: 50Mi
-              terminationMessagePath: /dev/termination-log
-          dnsPolicy: ClusterFirst
-          restartPolicy: Always
-          schedulerName: default-scheduler
-      triggers:
-        - imageChangeParams:
-            containerNames:
-              - ${APP_NAME}
-            from:
-              kind: ImageStreamTag
-              name: '${APP_NAME}:${DEPLOY_TAG}'
-              namespace: ${INFRA_PROJECT}
-          type: ImageChange
   - apiVersion: v1
     kind: Service
     metadata:

package/src/generators/deployment/schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "http://json-schema.org/schema",
   "id": "NxOcDeployment",
-  "title": "",
+  "title": "ADSP Application Deployment",
   "type": "object",
   "properties": {
     "project": {
@@ -59,5 +59,6 @@
     "project",
     "appType",
     "env"
-  ]
+  ],
+  "additionalProperties": false
 }

package/src/generators/pipeline/actions/workflows/pipeline.yml__tmpl__

@@ -1,14 +1,19 @@
 # GitHub Actions pipeline.
-# This pipeline runs application build process in GitHub Actions but runs OpenShift BuildConfig for
-# creating runtime containers. It does not require a container registry accessible to both OpenShift
-# and GitHub.
+# Builds container images with Buildah, publishes to a container registry,
+# imports into OpenShift ImageStreams, and deploys via Kubernetes Deployments.
 #
 # Secrets (to be manually added):
-# OPENSHIFT_SERVER  - URL to the OpenShift server.
-# OPENSHIFT_TOKEN   - Token for the service account (github-actions) used for OC cli commands.
+# OPENSHIFT_SERVER    - URL to the OpenShift server.
+# OPENSHIFT_TOKEN     - Token for the service account (github-actions) used for OC cli commands.
 #
-# Envs (auto added but requires manual configuration):
-# Dev, Test, Staging, Prod
+# Optional secrets for pulling Red Hat base images:
+# REDHAT_IO_USERNAME  - Red Hat registry service account username.
+# REDHAT_IO_PASSWORD  - Red Hat registry service account password or token.
+#
+# GitHub Environments (configure in repo Settings > Environments):
+<% ocEnvProjects.forEach(function(ocEnvProject, i){ -%>
+# <%= envs[i] %> - maps to OpenShift project <%= ocEnvProject %>
+<% }); -%>
 name: Pipeline
 
 on:
@@ -22,108 +27,158 @@ on:
         description: Value for --base= in nx affected commands
         required: false
 
+# Deny all permissions by default; each job grants only what it needs.
+permissions: {}
+
+# Cancel any in-progress run for the same branch so stale builds don't
+# race against a newer push on the deploy steps.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write  # Required for pushing images to GHCR with GITHUB_TOKEN
     env:
       AFFECTED_BASE: "origin/main"
     outputs:
       affected_apps: ${{ steps.set_outputs.outputs.affected_apps }}
     steps:
-      # Checkout the source code.
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v5
         with:
-          node-version: "20"
+          node-version: "24"
           cache: "npm"
       - run: npm ci
-      
-      # Determine the last successful build of this (pipeline.yml) workflow and set it as the AFFECTED_BASE.
+
       - name: Get last successful commit
         id: last_successful_commit
-        uses: nrwl/nx-set-shas@v3
+        uses: nrwl/nx-set-shas@v5
       - name: Set AFFECTED_BASE to last successful build commit
-        if: ${{ steps.last_successful_commit.outputs.base }} 
+        if: ${{ steps.last_successful_commit.outputs.base }}
         run: echo "AFFECTED_BASE=${{ steps.last_successful_commit.outputs.base }}" >> $GITHUB_ENV
-      
-      # Input for base takes precedence over last successful build.
-      - name: Set AFFECTED_BASE to input for SELECTED_BASE
+
+      # Workflow dispatch input takes precedence over last successful build.
+      - name: Set AFFECTED_BASE to workflow input
         if: ${{ github.event.inputs.SELECTED_BASE }}
         run: echo "AFFECTED_BASE=${{ github.event.inputs.SELECTED_BASE }}" >> $GITHUB_ENV
 
-      # Project build steps lint, test, and build
       - name: Lint
         run: npx nx affected --target=lint --base=${{ env.AFFECTED_BASE }}
       - name: Test
         run: npx nx affected --target=test --base=${{ env.AFFECTED_BASE }}
       - name: Build
         run: npx nx affected --target=build --base=${{ env.AFFECTED_BASE }} --configuration production
-      # Set affected apps to env for later steps and jobs.
-      - name: Set AFFECTED_APPS for OC steps
+      - name: Set affected apps
         run: echo "AFFECTED_APPS=$(npx nx show projects --affected --type=app --base=${{ env.AFFECTED_BASE }} | tr '\n' ' ')" >> $GITHUB_ENV
 
-      - run: npm prune --production
-      
-      # Run the OC BuildConfigs for create containers.
+      - run: npm prune --omit=dev
+
+      # Log into Red Hat registry if credentials are provided (required for UBI base images).
+      - name: Log in to Red Hat registry
+        if: ${{ secrets.REDHAT_IO_USERNAME != '' }}
+        uses: redhat-actions/podman-login@v1
+        with:
+          registry: registry.redhat.io
+          username: ${{ secrets.REDHAT_IO_USERNAME }}
+          password: ${{ secrets.REDHAT_IO_PASSWORD }}
+
+      # Build container images with Buildah and push to GHCR using GITHUB_TOKEN.
+      - name: Log in to container registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | podman login <%= registry %> -u ${{ github.actor }} --password-stdin
+      - name: Build and publish containers
+        run: |
+          set -eo pipefail
+          for app in $AFFECTED_APPS
+          do
+            buildah build \
+              --build-arg PROJECT=$app \
+              --file .openshift/$app/Dockerfile \
+              --tag <%= registry %>/$app:latest \
+              --tag <%= registry %>/$app:${{ github.sha }} \
+              .
+            buildah push <%= registry %>/$app:latest
+            buildah push <%= registry %>/$app:${{ github.sha }}
+          done
+
+      # Import images into OpenShift and tag for the first environment.
       - name: OC login
         uses: redhat-actions/oc-login@v1
         with:
           openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
           openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
           namespace: <%= ocInfraProject %>
-
-          # Disables SSL cert checking. Use this if you don't have the certificate authority data.
           insecure_skip_tls_verify: true
-          # This method is more secure, if the certificate from Step 4 is available.
-          # certificate_authority_data: ${{ secrets.CA_DATA }}
-      - name: Build containers
+      - name: Import images and tag for <%= envs[0] %>
         run: |
+          set -eo pipefail
           for app in $AFFECTED_APPS
-          do 
-            oc start-build $app --from-dir . --follow --wait
-          done 
-      # Set build job outputs for subsequent jobs.
+          do
+            oc import-image <%= registry %>/$app:latest --reference-policy='local' --confirm
+            oc tag $app:latest $app:<%= envs[0].toLowerCase() %> --reference-policy='local'
+          done
+
       - id: set_outputs
         run: echo "affected_apps=$AFFECTED_APPS" >> $GITHUB_OUTPUT
 <% ocEnvProjects.forEach(function(ocEnvProject, i){ -%>
-  
+
   deploy<%= envs[i] %>:
-    runs-on: ubuntu-20.04
-    needs: [build<%= envs[i - 1] ? `, deploy${envs[i - 1]}` : '' %>]
-    env: 
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [build<%= i > 0 ? `, deploy${envs[i - 1]}` : '' %>]
+    if: needs.build.outputs.affected_apps
+    permissions:
+      contents: read
+    env:
       AFFECTED_APPS: ${{ needs.build.outputs.affected_apps }}
     environment:
       name: <%= envs[i] %>
     steps:
-      # Checkout the source code for manifests
-      - uses: actions/checkout@v3
-      - name: Oc login
+      - uses: actions/checkout@v5
+      - name: OC login
         uses: redhat-actions/oc-login@v1
         with:
           openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
           openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
           namespace: <%= ocInfraProject %>
           insecure_skip_tls_verify: true
-      - name: Tag <%= envs[i] %>
+<% if (i > 0) { -%>
+      - name: Promote image to <%= envs[i] %>
         run: |
+          set -eo pipefail
           for app in $AFFECTED_APPS
-          do 
-            oc tag $app:<%= envs[i - 1] ? envs[i - 1].toLowerCase() : 'latest' %> $app:<%= envs[i].toLowerCase() %>
-          done 
-      - run: oc project <%= ocEnvProject %>
-      - name: Apply Manifests
+          do
+            oc tag $app:<%= envs[i - 1].toLowerCase() %> $app:<%= envs[i].toLowerCase() %> --reference-policy='local'
+          done
+<% } -%>
+      - name: Apply manifests
         run: |
+          set -eo pipefail
           for app in $AFFECTED_APPS
           do
-            oc process -f .openshift/$app/$app.yml -p PROJECT=<%= ocEnvProject %> -p DEPLOY_TAG=<%= envs[i].toLowerCase() %> | oc apply -f -
+            oc process -f .openshift/$app/$app.yml \
+              -p PROJECT=<%= ocEnvProject %> \
+              -p DEPLOY_TAG=<%= envs[i].toLowerCase() %> \
+              | oc apply -l reference!=true -f -
           done
       - name: Deploy <%= envs[i] %>
         run: |
+          set -eo pipefail
           for app in $AFFECTED_APPS
-          do            
-            oc rollout latest dc/$app
-            oc rollout status dc/$app
-          done 
+          do
+            if oc get deployment/$app -n <%= ocEnvProject %> > /dev/null 2>&1 ; then
+              oc set triggers deployment/$app -n <%= ocEnvProject %> --auto
+              oc rollout status deployment/$app -n <%= ocEnvProject %>
+              oc set triggers deployment/$app -n <%= ocEnvProject %> --manual
+            elif oc get dc/$app -n <%= ocEnvProject %> > /dev/null 2>&1 ; then
+              oc rollout latest dc/$app -n <%= ocEnvProject %>
+              oc rollout status dc/$app -n <%= ocEnvProject %>
+            fi
+          done
 <% }); -%>

package/src/generators/pipeline/jenkins/environment.infra.yml__tmpl__

@@ -1,3 +1,5 @@
+# DEPRECATED: Jenkins pipeline support is deprecated and will be removed in the next major version.
+# Use the GitHub Actions pipeline type (--type actions) instead.
 apiVersion: v1
 kind: List
 items:

package/src/generators/pipeline/pipeline.js

@@ -23,6 +23,8 @@ function addFiles(host, options) {
     var _a;
     const templateOptions = Object.assign(Object.assign({}, options), { sourceRepositoryUrl: (_a = (0, git_utils_1.getGitRemoteUrl)()) === null || _a === void 0 ? void 0 : _a.trim(), envs: pipeline_envs_1.pipelineEnvs, tmpl: '' });
     if (options.pipelineType === 'jenkins') {
+        console.warn('WARNING: Jenkins pipeline support is deprecated and will be removed in the next major version. ' +
+            'Use --type actions instead.');
         (0, devkit_1.generateFiles)(host, path.join(__dirname, 'jenkins'), `./.openshift`, templateOptions);
     }
     else if (options.pipelineType === 'actions') {

package/src/generators/pipeline/pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/pipeline/pipeline.ts"],"names":[],"mappings":";;AA4DA,4BASC;;AArED,uCAA8D;AAC9D,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AACxD,4DAA6D;AAG7D,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAe;;IACnD,MAAM,aAAa,GAAG,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,CAAC,GAAG,CAAC,KAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,4BAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,4BAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACxE,CAAC;IACJ,CAAC;IAED,uCACK,OAAO,KACV,cAAc,EAAE,OAAO,CAAC,QAAQ,EAChC,cAAc,EAAE,OAAO,CAAC,KAAK,EAC7B,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAC9B,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAChE;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,mCAChB,OAAO,KACV,mBAAmB,EAAE,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,EAC9C,IAAI,EAAJ,4BAAI,EACJ,IAAI,EAAE,EAAE,GACT,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/B,cAAc,EACd,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,cAAc,EACd,eAAe,CAChB,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,qBAAqB,EACrB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAA,qBAAmB,EAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CAAA"}
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/pipeline/pipeline.ts"],"names":[],"mappings":";;AAgEA,4BASC;;AAzED,uCAA8D;AAC9D,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AACxD,4DAA6D;AAG7D,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAe;;IACnD,MAAM,aAAa,GAAG,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,CAAC,GAAG,CAAC,KAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,4BAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,4BAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACxE,CAAC;IACJ,CAAC;IAED,uCACK,OAAO,KACV,cAAc,EAAE,OAAO,CAAC,QAAQ,EAChC,cAAc,EAAE,OAAO,CAAC,KAAK,EAC7B,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAC9B,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAChE;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,mCAChB,OAAO,KACV,mBAAmB,EAAE,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,EAC9C,IAAI,EAAJ,4BAAI,EACJ,IAAI,EAAE,EAAE,GACT,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,iGAAiG;YAC/F,6BAA6B,CAChC,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/B,cAAc,EACd,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,cAAc,EACd,eAAe,CAChB,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,qBAAqB,EACrB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAA,qBAAmB,EAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CAAA"}

package/src/generators/pipeline/pipeline.spec.ts

@@ -6,6 +6,7 @@ describe('Pipeline Generator', () => {
   describe('Jenkins', () => {
     const options: Schema = {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'jenkins',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -40,6 +41,7 @@ describe('Pipeline Generator', () => {
   describe('GitHub Actions', () => {
     const options: Schema = {
       pipeline: 'test',
+      registry: 'ghcr.io/test-org',
       type: 'actions',
       infra: 'test-infra',
       envs: 'test-dev',
@@ -53,6 +55,16 @@ describe('Pipeline Generator', () => {
       expect(host.exists('.openshift/environments.yml')).toBeTruthy();
     });
 
+    it('includes registry in pipeline workflow', async () => {
+      const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+      await generator(host, options);
+      const workflow = host.read('.github/workflows/pipeline.yml').toString();
+      expect(workflow).toContain('ghcr.io/test-org');
+      expect(workflow).toContain('buildah build');
+      expect(workflow).toContain('oc import-image');
+      expect(workflow).toContain('oc set triggers');
+    });
+
     it('can generate multiple envs', async () => {
       const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
       await generator(host, { ...options, envs: 'test-dev test-test' });

package/src/generators/pipeline/schema.d.ts

@@ -3,6 +3,7 @@ export interface Schema {
   type: string;
   infra: string;
   envs: string;
+  registry: string;
   apply?: boolean;
 }
 

package/src/generators/pipeline/schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "http://json-schema.org/schema",
   "id": "NxOcPipeline",
-  "title": "",
+  "title": "OpenShift CI/CD Pipeline",
   "type": "object",
   "properties": {
     "pipeline": {
@@ -35,6 +35,12 @@
       "alias": "e",
       "x-prompt": "What projects should be used for environments (dev test prod)?"
     },
+    "registry": {
+      "type": "string",
+      "description": "Container registry to publish images to (e.g., ghcr.io/my-org).",
+      "alias": "r",
+      "x-prompt": "What container registry should images be published to (e.g., ghcr.io/my-org)?"
+    },
     "apply": {
       "type": "boolean",
       "description": "Flag indicating if the pipeline should be applied.",
@@ -46,6 +52,8 @@
     "pipeline",
     "infra",
     "type",
-    "envs"
-  ]
+    "envs",
+    "registry"
+  ],
+  "additionalProperties": false
 }

package/src/utils/git-utils.spec.ts

@@ -0,0 +1,34 @@
+import { execSync } from 'child_process';
+import { mocked } from 'jest-mock';
+import { getGitRemoteUrl } from './git-utils';
+
+jest.mock('child_process');
+const mockedExecSync = mocked(execSync);
+
+describe('getGitRemoteUrl', () => {
+  beforeEach(() => {
+    mockedExecSync.mockReset();
+  });
+
+  it('returns the remote origin url', () => {
+    mockedExecSync.mockReturnValue(
+      Buffer.from('https://github.com/GovAlta/nx-tools.git\n')
+    );
+
+    const url = getGitRemoteUrl();
+    expect(url).toBe('https://github.com/GovAlta/nx-tools.git\n');
+    expect(mockedExecSync).toHaveBeenCalledWith(
+      'git config --get remote.origin.url',
+      { stdio: 'pipe' }
+    );
+  });
+
+  it('returns undefined when git command fails', () => {
+    mockedExecSync.mockImplementation(() => {
+      throw new Error('not a git repo');
+    });
+
+    const url = getGitRemoteUrl();
+    expect(url).toBeUndefined();
+  });
+});

package/src/utils/oc-utils.spec.ts

@@ -0,0 +1,60 @@
+import { execSync } from 'child_process';
+import { mocked } from 'jest-mock';
+import { runOcCommand } from './oc-utils';
+
+jest.mock('child_process');
+const mockedExecSync = mocked(execSync);
+
+describe('runOcCommand', () => {
+  beforeEach(() => {
+    mockedExecSync.mockReset();
+  });
+
+  it('returns success with stdout on successful command', () => {
+    const output = Buffer.from('project set to test-dev');
+    mockedExecSync.mockReturnValue(output);
+
+    const result = runOcCommand('project', ['test-dev']);
+    expect(result.success).toBe(true);
+    expect(result.stdout).toBe(output);
+  });
+
+  it('builds the correct command string without input', () => {
+    mockedExecSync.mockReturnValue(Buffer.from(''));
+
+    runOcCommand('process', ['-f .openshift/app.yml', '-p ENV=dev']);
+    expect(mockedExecSync).toHaveBeenCalledWith(
+      'oc process -f .openshift/app.yml -p ENV=dev',
+      expect.objectContaining({ stdio: 'pipe' })
+    );
+  });
+
+  it('uses cat pipe form when input buffer is provided', () => {
+    mockedExecSync.mockReturnValue(Buffer.from(''));
+    const input = Buffer.from('{"kind":"List"}');
+
+    runOcCommand('apply', [], input);
+    const [cmd] = mockedExecSync.mock.calls[0];
+    expect(cmd).toContain('cat |');
+    expect(cmd).toContain('oc apply -f -');
+  });
+
+  it('passes input buffer to execSync', () => {
+    mockedExecSync.mockReturnValue(Buffer.from(''));
+    const input = Buffer.from('yaml-content');
+
+    runOcCommand('apply', [], input);
+    const [, options] = mockedExecSync.mock.calls[0];
+    expect((options as { input: Buffer }).input).toBe(input);
+  });
+
+  it('returns failure when command throws', () => {
+    mockedExecSync.mockImplementation(() => {
+      throw new Error('oc: command not found');
+    });
+
+    const result = runOcCommand('start-build', ['my-pipeline']);
+    expect(result.success).toBe(false);
+    expect(result.stdout).toBeUndefined();
+  });
+});