@docupace/pipeline 1.0.121 → 1.0.122-connect.0

package/bitbucket-pipelines.yml

@@ -7,6 +7,291 @@ clone:
 definitions:
   caches:
     pnpm: ~/.pnpm-store
+
+  # Pipelines under `definitions.pipelines` are the ones other repos can pull in
+  # with `import: pipeline-shared-scripts:master:<name>`. Names under
+  # `pipelines.custom` below are local to this repo and are NOT importable.
+  pipelines:
+    xray-scan: &xray-scan-pipeline
+      - step:
+          name: JFrog Xray Scan (dependencies + Docker image)
+          runs-on:
+            - self.hosted
+            - linux.shell
+            - onprem
+          script:
+            - curl -fL https://install-cli.jfrog.io | sh
+            - jf --version
+            - |
+              # JFROG_XRAY_URL is stored without a scheme in some workspaces; the
+              # jf CLI needs an absolute URL or every call fails with
+              # "unsupported protocol scheme".
+              case "${JFROG_XRAY_URL}" in
+                http://*|https://*) XRAY_URL="${JFROG_XRAY_URL}" ;;
+                "") echo "JFROG_XRAY_URL is not set — cannot scan."; exit 1 ;;
+                *) XRAY_URL="https://${JFROG_XRAY_URL}" ;;
+              esac
+              export XRAY_URL
+              echo "Using Xray URL: ${XRAY_URL}"
+            # Self-hosted runners keep ~/.jfrog between builds, so a server left
+            # behind by an earlier failed run makes `config add` fail. Drop it first.
+            - jf config remove scan1 --quiet || true
+            - jf config add scan1 --url="${XRAY_URL}" --user=$JFROG_XRAY_USER --access-token=$JFROG_XRAY_PASSWORD --interactive=false
+            - jf config use scan1
+            - jf c show
+            - mkdir -p xray-report
+            - |
+              # A repo can hold more than one app (e.g. a frontend and a backend
+              # with separate lockfiles and Dockerfiles), and one context would
+              # only ever scan one of them. SCAN_TARGETS lists them all:
+              #
+              #   label:auditDir:buildContext:dockerfile[;label:...]
+              #
+              # An empty auditDir skips the dependency scan for that target; an
+              # empty buildContext skips the image scan. dockerfile defaults to
+              # <buildContext>/Dockerfile. Example for two apps in one repo:
+              #
+              #   SCAN_TARGETS="frontend:atlas-mui:atlas-mui:atlas-mui/Dockerfile;backend:intel-server:.:Dockerfile"
+              #
+              # With SCAN_TARGETS unset we fall back to the older single-target
+              # XRAY_BUILD_CONTEXT / XRAY_DOCKERFILE_PATH variables.
+              if [ -z "${SCAN_TARGETS:-}" ]; then
+                CTX="${XRAY_BUILD_CONTEXT:-.}"
+                SCAN_TARGETS="app:${CTX}:${CTX}:${XRAY_DOCKERFILE_PATH:-${CTX}/Dockerfile}"
+                echo "SCAN_TARGETS not set — scanning a single target: ${SCAN_TARGETS}"
+              fi
+              printf '%s' "${SCAN_TARGETS}" > /tmp/scan-targets
+            - |
+              # These runners inherit DOCKER_HOST=tcp://localhost:2375 (no daemon
+              # there) and DOCKER_CONTEXT is reserved by the docker CLI for
+              # selecting a named context — clear both so we use the local socket.
+              export DOCKER_HOST=""
+              unset DOCKER_CONTEXT
+              SHORT_SHA="$(printf '%s' "${BITBUCKET_COMMIT:-local}" | cut -c1-7)"
+              WORKDIR="$(pwd)"
+              # xray.txt contains the human-readable table output; kept as an
+              # artifact for quick log reading. bin/xray.sh reads simple-json.
+              : > xray.txt
+              # One "label:file" per line, consumed by the HTML report and the
+              # Code Insights publisher below.
+              : > /tmp/xray-report-args
+              # Split SCAN_TARGETS on ';' into positional params. Piping into a
+              # `while read` loop instead would let a command in the body (docker,
+              # jf) consume the rest of the list from stdin — which silently scans
+              # only the first target.
+              OLD_IFS="${IFS}"
+              IFS=';'
+              set -- $(cat /tmp/scan-targets)
+              IFS="${OLD_IFS}"
+              for target in "$@"; do
+                [ -z "${target}" ] && continue
+                label="$(printf '%s' "${target}" | cut -d: -f1)"
+                audit_dir="$(printf '%s' "${target}" | cut -d: -f2)"
+                build_ctx="$(printf '%s' "${target}" | cut -d: -f3)"
+                dockerfile="$(printf '%s' "${target}" | cut -d: -f4)"
+                [ -z "${label}" ] && label="app"
+                # Labels reach filenames and image tags, so keep them tame.
+                slug="$(printf '%s' "${label}" | tr -c 'A-Za-z0-9._-' '-')"
+                [ -n "${build_ctx}" ] && [ -z "${dockerfile}" ] && dockerfile="${build_ctx}/Dockerfile"
+
+                echo "=============================================================="
+                echo "Target '${label}': deps='${audit_dir:-none}' image='${dockerfile:-none}'"
+                echo "=============================================================="
+
+                if [ -z "${audit_dir}" ]; then
+                  echo "No audit directory for '${label}' — skipping dependency scan."
+                elif [ ! -d "${audit_dir}" ]; then
+                  echo "Audit directory '${audit_dir}' does not exist — skipping dependency scan for '${label}'."
+                else
+                  # `jf audit` resolves the package manager from the working
+                  # directory, so cd in rather than passing a path — and write to
+                  # absolute paths so output lands back in xray-report/.
+                  ( cd "${audit_dir}" \
+                    && jf audit --format=table > "${WORKDIR}/xray-report/${slug}-audit.txt" 2>&1 \
+                    ; jf audit --format=simple-json > "${WORKDIR}/xray-report/${slug}-audit.json" 2>/dev/null ) || true
+                  echo "--- ${label}: dependency scan ---"
+                  cat "xray-report/${slug}-audit.txt" || true
+                  {
+                    echo "### ${label} — dependencies (${audit_dir})"
+                    cat "xray-report/${slug}-audit.txt" 2>/dev/null
+                  } >> xray.txt
+                  echo "${label} deps:xray-report/${slug}-audit.json" >> /tmp/xray-report-args
+                fi
+
+                if [ -z "${dockerfile}" ]; then
+                  echo "No Dockerfile configured for '${label}' — skipping image scan."
+                elif [ ! -f "${dockerfile}" ]; then
+                  echo "No Dockerfile at '${dockerfile}' — skipping image scan for '${label}'."
+                else
+                  SCAN_IMAGE="${BITBUCKET_REPO_SLUG:-image}-${slug}:xray-${SHORT_SHA}"
+                  echo "Building ${SCAN_IMAGE} from ${dockerfile} (context ${build_ctx})..."
+                  # --load is buildx-only; the legacy builder loads locally anyway.
+                  LOAD_FLAG=""
+                  docker buildx version >/dev/null 2>&1 && LOAD_FLAG="--load"
+                  if docker build "${build_ctx}" --file "${dockerfile}" --tag "${SCAN_IMAGE}" ${LOAD_FLAG}; then
+                    jf docker scan "${SCAN_IMAGE}" --format=table > "xray-report/${slug}-docker.txt" 2>&1 || true
+                    echo "--- ${label}: image scan ---"
+                    cat "xray-report/${slug}-docker.txt" || true
+                    jf docker scan "${SCAN_IMAGE}" --format=simple-json > "xray-report/${slug}-docker.json" 2>/dev/null || true
+                    {
+                      echo "### ${label} — image ${SCAN_IMAGE}"
+                      cat "xray-report/${slug}-docker.txt" 2>/dev/null
+                    } >> xray.txt
+                    echo "${label} image:xray-report/${slug}-docker.json" >> /tmp/xray-report-args
+                    docker rmi -f "${SCAN_IMAGE}" || true
+                  else
+                    echo "Docker build failed for '${label}' — no image scan for this target."
+                  fi
+                fi
+              done
+              cp xray.txt xray-report/xray-audit.txt || true
+              cp /tmp/xray-report-args xray-report/scanned-targets.txt || true
+            - |
+              # The report/notify scripts live in bin/ of this shared repo, but an
+              # import only brings the YAML across — so consumers have to fetch
+              # them. The repo is private, so anonymous https fails; try each auth
+              # method the runners actually have, in order of preference.
+              # Local bin/ is used only when all three scripts are present (i.e.
+              # we're running inside the shared repo itself).
+              XRAY_BIN=""
+              if [ -f ./bin/xray.sh ] && [ -f ./bin/xray-html-report.sh ] && [ -f ./bin/xray-bitbucket-insights.sh ]; then
+                XRAY_BIN=./bin
+                echo "Using shared scripts from ./bin"
+              else
+                DEST=/tmp/pipeline-shared-scripts
+                rm -rf "${DEST}"
+                # Parallel arrays of label + URL; only the label is ever printed,
+                # so credentials never reach the build log.
+                LABELS=""; URLS=""
+                add_src() { LABELS="${LABELS}${LABELS:+|}$1"; URLS="${URLS}${URLS:+|}$2"; }
+                [ -n "${SCRIPTS_REPO:-}" ] && add_src "SCRIPTS_REPO" "${SCRIPTS_REPO}"
+                if [ -n "${BITBUCKET_USERNAME:-}" ] && [ -n "${BITBUCKET_APP_PASSWORD:-}" ]; then
+                  add_src "BITBUCKET_USERNAME+APP_PASSWORD" "https://${BITBUCKET_USERNAME}:${BITBUCKET_APP_PASSWORD}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                fi
+                [ -n "${BITBUCKET_STEP_OAUTH_TOKEN:-}" ] && add_src "step OAuth token" "https://x-token-auth:${BITBUCKET_STEP_OAUTH_TOKEN}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                add_src "ssh" "git@bitbucket.org:dp-cloud/pipeline-shared-scripts.git"
+                i=1
+                while :; do
+                  label="$(printf '%s' "${LABELS}" | cut -d'|' -f${i})"
+                  url="$(printf '%s' "${URLS}" | cut -d'|' -f${i})"
+                  [ -z "${label}" ] && break
+                  echo "Fetching shared scripts via ${label}..."
+                  # GIT_TERMINAL_PROMPT=0 so a private repo fails fast instead of
+                  # blocking on a username prompt.
+                  if GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o BatchMode=yes" \
+                       git clone --depth 1 --quiet "${url}" "${DEST}" 2>/dev/null; then
+                    XRAY_BIN="${DEST}/bin"
+                    echo "Fetched shared scripts via ${label}."
+                    break
+                  fi
+                  rm -rf "${DEST}"
+                  i=$((i + 1))
+                done
+                if [ -z "${XRAY_BIN}" ]; then
+                  echo "Could not fetch shared scripts (tried: $(printf '%s' "${LABELS}" | tr '|' ' ')). HTML report, Code Insights and Slack notify will be skipped; JSON/table artifacts are still produced."
+                fi
+              fi
+              [ -n "${XRAY_BIN}" ] && [ -f "${XRAY_BIN}/xray.sh" ] && cp "${XRAY_BIN}/xray.sh" ./xray-notify.sh
+              echo "${XRAY_BIN}" > /tmp/xray-bin-path
+            # Render the browsable HTML report (and PDF when XRAY_REPORT_PDF=true).
+            # Both consumers take one "label:file" argument per scan that ran,
+            # so every target shows up as its own section / report entry.
+            - |
+              XRAY_BIN="$(cat /tmp/xray-bin-path 2>/dev/null || echo '')"
+              if [ -n "${XRAY_BIN}" ] && [ -f "${XRAY_BIN}/xray-html-report.sh" ]; then
+                set -- xray-report/xray-report.html
+                while IFS= read -r a; do [ -n "${a}" ] && set -- "$@" "${a}"; done < /tmp/xray-report-args
+                bash "${XRAY_BIN}/xray-html-report.sh" "$@" || true
+              else
+                echo "xray-html-report.sh unavailable — skipping HTML report."
+              fi
+            # Publish to Bitbucket Code Insights: a report on the commit plus
+            # inline annotations in the PR diff. Never fails the build.
+            - |
+              XRAY_BIN="$(cat /tmp/xray-bin-path 2>/dev/null || echo '')"
+              if [ -n "${XRAY_BIN}" ] && [ -f "${XRAY_BIN}/xray-bitbucket-insights.sh" ]; then
+                set --
+                while IFS= read -r a; do [ -n "${a}" ] && set -- "$@" "${a}"; done < /tmp/xray-report-args
+                if [ "$#" -gt 0 ]; then
+                  bash "${XRAY_BIN}/xray-bitbucket-insights.sh" "$@" || true
+                else
+                  echo "No scan output to publish — skipping Code Insights."
+                fi
+              else
+                echo "xray-bitbucket-insights.sh unavailable — skipping Code Insights."
+              fi
+            - |
+              if [ -f ./xray-notify.sh ]; then
+                if [ -n "${XRAY_SLACK_TOKEN:-}" ] && [ -n "${XRAY_SLACK_CHANNEL:-}" ]; then
+                  bash ./xray-notify.sh || true
+                else
+                  echo "XRAY_SLACK_TOKEN / XRAY_SLACK_CHANNEL not set — skipping Slack notification."
+                fi
+              fi
+            - rm -f ./xray-notify.sh
+          # after-script always runs, so credentials don't survive a failed step.
+          after-script:
+            - jf config remove scan1 --quiet || true
+          artifacts:
+            - xray-report/**
+
+      - step: &tenable-scan-step
+          name: Tenable Cloud Security Scan (container image)
+          runs-on:
+            - self.hosted
+            - linux.shell
+            - onprem
+          script:
+            # bin/tenable-scan.sh lives in this shared repo; an import only brings
+            # the YAML across, so fetch it the same way the Xray step does.
+            - |
+              TENABLE_BIN=""
+              if [ -f ./bin/tenable-scan.sh ]; then
+                TENABLE_BIN=./bin
+              else
+                DEST=/tmp/pipeline-shared-scripts
+                rm -rf "${DEST}"
+                LABELS=""; URLS=""
+                add_src() { LABELS="${LABELS}${LABELS:+|}$1"; URLS="${URLS}${URLS:+|}$2"; }
+                [ -n "${SCRIPTS_REPO:-}" ] && add_src "SCRIPTS_REPO" "${SCRIPTS_REPO}"
+                if [ -n "${BITBUCKET_USERNAME:-}" ] && [ -n "${BITBUCKET_APP_PASSWORD:-}" ]; then
+                  add_src "BITBUCKET_USERNAME+APP_PASSWORD" "https://${BITBUCKET_USERNAME}:${BITBUCKET_APP_PASSWORD}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                fi
+                [ -n "${BITBUCKET_STEP_OAUTH_TOKEN:-}" ] && add_src "step OAuth token" "https://x-token-auth:${BITBUCKET_STEP_OAUTH_TOKEN}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                add_src "ssh" "git@bitbucket.org:dp-cloud/pipeline-shared-scripts.git"
+                i=1
+                while :; do
+                  label="$(printf '%s' "${LABELS}" | cut -d'|' -f${i})"
+                  url="$(printf '%s' "${URLS}" | cut -d'|' -f${i})"
+                  [ -z "${label}" ] && break
+                  echo "Fetching shared scripts via ${label}..."
+                  if GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o BatchMode=yes" \
+                       git clone --depth 1 --quiet "${url}" "${DEST}" 2>/dev/null; then
+                    TENABLE_BIN="${DEST}/bin"
+                    echo "Fetched shared scripts via ${label}."
+                    break
+                  fi
+                  rm -rf "${DEST}"
+                  i=$((i + 1))
+                done
+              fi
+              if [ -z "${TENABLE_BIN}" ]; then
+                echo "Could not fetch shared scripts (tried: $(printf '%s' "${LABELS}" | tr '|' ' ')) — skipping Tenable scan."
+                exit 0
+              fi
+              if [ ! -f "${TENABLE_BIN}/tenable-scan.sh" ]; then
+                echo "tenable-scan.sh not present in ${TENABLE_BIN} — skipping Tenable scan."
+                exit 0
+              fi
+              bash "${TENABLE_BIN}/tenable-scan.sh"
+          artifacts:
+            - tenable-report/**
+
+    # Runs the Tenable image scan on its own, for repos that want it separately
+    # from the Xray scan: import: pipeline-shared-scripts:master:tenable-scan
+    tenable-scan:
+      - step: *tenable-scan-step
+
   steps:
     - step: &version-step
         runs-on:
@@ -21,6 +306,12 @@ definitions:
           - node src/changeset/cli.js version-commit-tag --install-latest
 
 pipelines:
+  # Lets this repo run the shared scans against itself from the Bitbucket UI.
+  custom:
+    xray-scan: *xray-scan-pipeline
+    tenable-scan:
+      - step: *tenable-scan-step
+
   pull-requests:
     '**':
       - step:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.121",
+  "version": "1.0.122-connect.0",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/changeset/cli.js

@@ -133,7 +133,12 @@ program
   .command('version')
   .description('Run Changeset versioning')
   .action(async () => {
-    await versionCommand();
+    try {
+      await versionCommand();
+    } catch (error) {
+      console.error('❌ Changeset versioning failed:', error);
+      process.exit(1);
+    }
   });
 
 // Command: commit-and-tag
@@ -154,10 +159,15 @@ program
   )
   .action(async (options) => {
     console.log('📦 Running all steps...');
-    const releases = await versionCommand(false, options.installLatest);
-    await updateJiraWithVersion(releases);
-    await updateWikiWithVersion(releases);
-    await commitTagCommand(releases);
+    try {
+      const releases = await versionCommand(false, options.installLatest);
+      await updateJiraWithVersion(releases);
+      await updateWikiWithVersion(releases);
+      await commitTagCommand(releases);
+    } catch (error) {
+      console.error('❌ Version-commit-tag failed:', error);
+      process.exit(1);
+    }
   });
 
 program
@@ -165,38 +175,44 @@ program
   .description('Closes a version')
   .action(async () => {
     console.log('📦 Running all steps...');
-    const releases = await versionCommand(true);
-    await commitTagCommand(releases);
-
-    const { stdout: currentBranch } = await $`git rev-parse --abbrev-ref HEAD`;
-
-    if (isMonoRepo()) {
-      for (const release of getAppReleases(releases)) {
-        const appName = getAppNameFromPackageName(release.name);
-        const newVersion = toShortVersion(release.newVersion);
+    try {
+      const releases = await versionCommand(true);
+      await commitTagCommand(releases);
+
+      const { stdout: currentBranch } =
+        await $`git rev-parse --abbrev-ref HEAD`;
+
+      if (isMonoRepo()) {
+        for (const release of getAppReleases(releases)) {
+          const appName = getAppNameFromPackageName(release.name);
+          const newVersion = toShortVersion(release.newVersion);
+          if (!newVersion) {
+            throw new Error('Error calculating branch name');
+          }
+          await $`git checkout -b release/${appName}/${newVersion}`;
+          await $`git push origin release/${appName}/${newVersion}`;
+        }
+      } else {
+        const newVersion = toShortVersion(releases[0].newVersion);
         if (!newVersion) {
           throw new Error('Error calculating branch name');
         }
-        await $`git checkout -b release/${appName}/${newVersion}`;
-        await $`git push origin release/${appName}/${newVersion}`;
+        await $`git checkout -b release/${newVersion}`;
+        await $`git push origin release/${newVersion}`;
       }
-    } else {
-      const newVersion = toShortVersion(releases[0].newVersion);
-      if (!newVersion) {
-        throw new Error('Error calculating branch name');
-      }
-      await $`git checkout -b release/${newVersion}`;
-      await $`git push origin release/${newVersion}`;
-    }
 
-    // Return to original branch
-    await $`git checkout ${currentBranch.trim()}`;
+      // Return to original branch
+      await $`git checkout ${currentBranch.trim()}`;
 
-    // Open next alpha version
-    await $`pnpm changeset pre enter alpha`;
-    await $`git add .`;
-    await $`git commit -m "Open next alpha version"`;
-    await $`git push origin`;
+      // Open next alpha version
+      await $`pnpm changeset pre enter alpha`;
+      await $`git add .`;
+      await $`git commit -m "Open next alpha version"`;
+      await $`git push origin`;
+    } catch (error) {
+      console.error('❌ Close-version failed:', error);
+      process.exit(1);
+    }
   });
 
 program
@@ -213,7 +229,12 @@ program
   .command('convert-prepare <version> [changelogPath]')
   .description('Convert release notes to Canny format - Part 1 (Prepare)')
   .action(async (version, changelogPath) => {
-    await convertPrepare(version, changelogPath);
+    try {
+      await convertPrepare(version, changelogPath);
+    } catch (error) {
+      console.error('❌ Convert-prepare failed:', error);
+      process.exit(1);
+    }
   });
 
 // Command: convert-complete
@@ -221,7 +242,12 @@ program
   .command('convert-complete [changelogPath]')
   .description('Convert release notes to Canny format - Part 2 (Complete)')
   .action(async (changelogPath) => {
-    await convertComplete(changelogPath);
+    try {
+      await convertComplete(changelogPath);
+    } catch (error) {
+      console.error('❌ Convert-complete failed:', error);
+      process.exit(1);
+    }
   });
 
 // Parse arguments

package/src/changeset/convert.js

@@ -361,6 +361,13 @@ export async function convertPrepare(
   console.log(`   Processed: ${processedCount}`);
   console.log(`   Errors: ${errorCount}`);
   console.log(`\n📄 Updated changelog at: ${resolvedChangelogPath}`);
+
+  if (errorCount > 0) {
+    console.error(
+      `❌ Convert-prepare failed to process ${errorCount} ticket(s).`,
+    );
+    process.exit(1);
+  }
 }
 
 /**

package/src/changeset/validate.js

@@ -1,14 +1,24 @@
 import fs from 'fs';
 import path from 'path';
+import { fileURLToPath } from 'url';
 import { $ } from 'zx';
 
 import { setGitInfo } from '../next/util.js';
 import { versionStatus } from './version.js';
 
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const PACKAGE_VERSION = JSON.parse(
+  fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'),
+).version;
+
 export async function validateChangesets() {
+  console.log(`validateChangesets: @docupace/pipeline version = ${PACKAGE_VERSION}`);
   await setGitInfo();
   const destBranch = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
+  console.log(`validateChangesets: destBranch = ${destBranch}`);
+  console.log(`validateChangesets: fetching origin ${destBranch}:${destBranch}`);
   await $`git fetch origin ${destBranch}:${destBranch}`;
+  console.log('validateChangesets: fetch succeeded');
   let releases;
 
   try {

package/src/changeset/version.js

@@ -89,19 +89,23 @@ export async function versionCommand(
   }
 
   let originalBaseBranch;
+  let releases;
   try {
     originalBaseBranch = updateBaseBranch();
-    const releases = await versionStatus();
-    revertBaseBranch(originalBaseBranch);
-    await $`pnpm changeset version`;
-
-    await removeChangesetOutput();
-
-    return releases;
+    releases = await versionStatus();
   } catch {
     revertBaseBranch(originalBaseBranch);
     return [];
   }
+  revertBaseBranch(originalBaseBranch);
+
+  // Intentionally outside the try/catch above: a failure here (e.g. release
+  // notes processing) must fail the build, not be swallowed as "no releases".
+  await $`pnpm changeset version`;
+
+  await removeChangesetOutput();
+
+  return releases;
 }
 
 export async function updateJiraWithVersion(releases) {

package/src/next/deploy.js

@@ -66,7 +66,7 @@ async function updateAndCommitConnectVersion(
 
     await $`cd ${connectDeployPath} && git add .`;
     await $`cd ${connectDeployPath} && git commit -m "Update Connect version for ${toSite} in ${toEnv} to ${getComparedVersion}" || echo "No changes to commit"`;
-    await $`cd ${connectDeployPath} && git push`;
+    await pushWithRetry(connectDeployPath);
 
     console.log('🧹 Cleaning up...');
     await $`rm -rf ${connectDeployPath}`;
@@ -114,6 +114,24 @@ async function compareGetConnectSiteVersions(fromEnv, fromSite, toEnv, toSite) {
     throw error;
   }
 }
+/**
+ * Push commits in repoPath, retrying once with a pull --rebase if the push
+ * is rejected because the remote branch moved (non-fast-forward race).
+ * @param {string} repoPath - The path to the local repository.
+ */
+async function pushWithRetry(repoPath) {
+  try {
+    await $`cd ${repoPath} && git push`;
+  } catch (error) {
+    console.warn(
+      '⚠️  Push rejected, likely because the remote branch moved. Pulling and retrying once...',
+    );
+    console.warn(error.message);
+    await $`cd ${repoPath} && git pull --rebase`;
+    await $`cd ${repoPath} && git push`;
+  }
+}
+
 function getRepoLocalPathByRepoSlug(repoSlug) {
   const repoName = `${repoSlug}`;
   const repoPath = path.join(process.cwd(), repoName);
@@ -270,7 +288,7 @@ export async function pushDeployConfig(repoPath, commitMessage) {
 
   await $`cd ${repoPath} && git add .`;
   await $`cd ${repoPath} && git commit -m ${commitMessage}`;
-  await $`cd ${repoPath} && git push`;
+  await pushWithRetry(repoPath);
   console.log('Changes pushed to the remote repository.');
 
   console.log('🧹 Cleaning up...');

package/src/next/util.js

@@ -85,11 +85,21 @@ export async function getChangedAppPackages() {
 }
 
 export async function setGitInfo() {
+  console.log(`setGitInfo: SET_GITOPS_USER=${process.env.SET_GITOPS_USER || '(unset)'}`);
   if (process.env.SET_GITOPS_USER) {
+    const before = (await $`git remote get-url origin`).stdout.trim();
+    console.log(`setGitInfo: origin before = ${before}`);
+
     await $`git config --global user.email "gitops@docupace.com"`;
     await $`git config --global user.name "Gitops"`;
     const repoUrl = `git@bitbucket.org:dp-cloud/${process.env.BITBUCKET_REPO_SLUG}.git`;
     console.log(`Setting new origin: ${repoUrl}`);
     await $`git remote set-url origin ${repoUrl}`;
+
+    const after = (await $`git remote get-url origin`).stdout.trim();
+    console.log(`setGitInfo: origin after = ${after}`);
+  } else {
+    const current = (await $`git remote get-url origin`).stdout.trim();
+    console.log(`setGitInfo: SET_GITOPS_USER not set, leaving origin as-is = ${current}`);
   }
 }