@docupace/pipeline 1.0.123 → 1.0.124

package/.gitignore

@@ -0,0 +1,103 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# IDE
+.idea
+*.iml
+# Dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# Testing
+/coverage
+
+# Next.js
+/.next/
+/out/
+
+# Production
+/build
+/dist
+
+# Misc
+.DS_Store
+*.pem
+cypress/screenshots/
+
+# Debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Local env files
+.env*.local
+
+# Vercel
+.vercel
+
+# Typescript
+*.tsbuildinfo
+next-env.d.ts
+
+
+# Logs
+logs
+*.log
+
+# Runtime data
+pids
+*.pid
+*.seed
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (http://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules
+jspm_packages
+
+# Optional npm cache directory
+.npm
+
+# Optional REPL history
+.node_repl_history
+.next
+
+scratch
+
+# visual studio code
+.vscode/
+
+src/gql/graphql.js
+.yalc/
+yalc.lock
+
+.last-run.json
+
+test-results
+coverage-reports
+.sonar
+.v8-coverage
+/assets
+tests/lib/data/auth.json
+
+failed-tests.json
+
+/tmp
+
+.claude

package/bitbucket-pipelines.yml

@@ -8,11 +8,33 @@ definitions:
   caches:
     pnpm: ~/.pnpm-store
 
-  # Pipelines under `definitions.pipelines` are the ones other repos can pull in
-  # with `import: pipeline-shared-scripts:master:<name>`. Names under
-  # `pipelines.custom` below are local to this repo and are NOT importable.
+  steps:
+    - step: &version-step
+        runs-on:
+          - self.hosted
+          - linux.shell
+          - onprem
+        name: On Merge
+        script:
+          - npm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+          - pnpm install --frozen-lockfile
+          - export HOME=/tmp
+          - node src/changeset/cli.js version-commit-tag --install-latest
+
+  # Bitbucket's cross-repo `import: pipeline-shared-scripts:master:<name>`
+  # resolves against definitions.pipelines.<name> in the exporting repo, and
+  # extracts just that one target subtree — so each entry here must be fully
+  # self-contained: a YAML alias pointing at an anchor defined outside of it
+  # (in a sibling entry here, or anywhere else in this file) resolves to
+  # nothing once extracted in isolation, and the imported step comes back
+  # "empty, null, or missing" on the consumer side. Content needed in more
+  # than one of these (the Tenable step, the Sonar scan script) is therefore
+  # duplicated instead of shared via anchor/alias. pipelines.custom below
+  # aliases into these (safe: same-document, not crossing the export
+  # boundary) purely so this repo can also run each one manually from its
+  # own Pipelines UI.
   pipelines:
-    xray-scan: &xray-scan-pipeline
+    xray-scan: &def-xray-scan
       - step:
           name: JFrog Xray Scan (dependencies + Docker image)
           runs-on:
@@ -235,15 +257,15 @@ definitions:
           artifacts:
             - xray-report/**
 
-      - step: &tenable-scan-step
+      - step:
           name: Tenable Cloud Security Scan (container image)
           runs-on:
             - self.hosted
             - linux.shell
             - onprem
           script:
-            # bin/tenable-scan.sh lives in this shared repo; an import only brings
-            # the YAML across, so fetch it the same way the Xray step does.
+            # bin/tenable-scan.sh lives in this shared repo, but an import only
+            # brings the YAML across — so fetch it the same way the Xray step does.
             - |
               TENABLE_BIN=""
               if [ -f ./bin/tenable-scan.sh ]; then
@@ -289,8 +311,56 @@ definitions:
 
     # Runs the Tenable image scan on its own, for repos that want it separately
     # from the Xray scan: import: pipeline-shared-scripts:master:tenable-scan
-    tenable-scan:
-      - step: *tenable-scan-step
+    tenable-scan: &def-tenable-scan
+      - step:
+          name: Tenable Cloud Security Scan (container image)
+          runs-on:
+            - self.hosted
+            - linux.shell
+            - onprem
+          script:
+            - |
+              TENABLE_BIN=""
+              if [ -f ./bin/tenable-scan.sh ]; then
+                TENABLE_BIN=./bin
+              else
+                DEST=/tmp/pipeline-shared-scripts
+                rm -rf "${DEST}"
+                LABELS=""; URLS=""
+                add_src() { LABELS="${LABELS}${LABELS:+|}$1"; URLS="${URLS}${URLS:+|}$2"; }
+                [ -n "${SCRIPTS_REPO:-}" ] && add_src "SCRIPTS_REPO" "${SCRIPTS_REPO}"
+                if [ -n "${BITBUCKET_USERNAME:-}" ] && [ -n "${BITBUCKET_APP_PASSWORD:-}" ]; then
+                  add_src "BITBUCKET_USERNAME+APP_PASSWORD" "https://${BITBUCKET_USERNAME}:${BITBUCKET_APP_PASSWORD}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                fi
+                [ -n "${BITBUCKET_STEP_OAUTH_TOKEN:-}" ] && add_src "step OAuth token" "https://x-token-auth:${BITBUCKET_STEP_OAUTH_TOKEN}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                add_src "ssh" "git@bitbucket.org:dp-cloud/pipeline-shared-scripts.git"
+                i=1
+                while :; do
+                  label="$(printf '%s' "${LABELS}" | cut -d'|' -f${i})"
+                  url="$(printf '%s' "${URLS}" | cut -d'|' -f${i})"
+                  [ -z "${label}" ] && break
+                  echo "Fetching shared scripts via ${label}..."
+                  if GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o BatchMode=yes" \
+                       git clone --depth 1 --quiet "${url}" "${DEST}" 2>/dev/null; then
+                    TENABLE_BIN="${DEST}/bin"
+                    echo "Fetched shared scripts via ${label}."
+                    break
+                  fi
+                  rm -rf "${DEST}"
+                  i=$((i + 1))
+                done
+              fi
+              if [ -z "${TENABLE_BIN}" ]; then
+                echo "Could not fetch shared scripts (tried: $(printf '%s' "${LABELS}" | tr '|' ' ')) — skipping Tenable scan."
+                exit 0
+              fi
+              if [ ! -f "${TENABLE_BIN}/tenable-scan.sh" ]; then
+                echo "tenable-scan.sh not present in ${TENABLE_BIN} — skipping Tenable scan."
+                exit 0
+              fi
+              bash "${TENABLE_BIN}/tenable-scan.sh"
+          artifacts:
+            - tenable-report/**
 
     # Uploads and scans one or more app targets with Veracode:
     # import: pipeline-shared-scripts:master:veracode-scan
@@ -300,7 +370,7 @@ definitions:
     #   (an app profile named <appname> must already exist in the Veracode portal)
     # Optional: VERACODE_BUILD_CMD — eval'd before packaging, so this step is
     #   self-contained and needs no separate build step in the consumer pipeline.
-    veracode-scan:
+    veracode-scan: &def-veracode-scan
       - step:
           name: Veracode Upload and Scan
           runs-on:
@@ -409,8 +479,8 @@ definitions:
     #
     # depth: full — Sonar reads git blame to attribute New Code; a shallow clone
     # only sees the tip commit and silently treats everything as new.
-    sonar-scan: &sonar-scan-pipeline
-      - step: &sonar-scan-step
+    sonar-scan: &def-sonar-scan
+      - step:
           name: SonarQube Scan
           runs-on:
             - self.hosted
@@ -424,7 +494,7 @@ definitions:
                 echo "Skipping SonarQube scan: SONAR_TOKEN not set"
                 exit 0
               fi
-            - &sonar-scan-script |
+            - |
               export DOCKER_HOST=""
               unset DOCKER_CONTEXT
               SONAR_HOST="${SONAR_HOST_URL:-https://sonarcloud.io}"
@@ -527,7 +597,7 @@ definitions:
     # Required: SONAR_TOKEN (hard-fails if unset and the gate applies to this PR)
     # Optional: same as sonar-scan, plus SONAR_GATE_BRANCH (default "main") and
     #   SONAR_QUALITYGATE_TIMEOUT (default 300 seconds).
-    sonar-pr-gate:
+    sonar-pr-gate: &def-sonar-pr-gate
       - step:
           name: SonarQube Quality Gate
           runs-on:
@@ -557,27 +627,106 @@ definitions:
               fi
 
               export SONAR_WAIT_FOR_GATE=true
-            - *sonar-scan-script
+            - |
+              export DOCKER_HOST=""
+              unset DOCKER_CONTEXT
+              SONAR_HOST="${SONAR_HOST_URL:-https://sonarcloud.io}"
+              DEFAULT_BRANCH="${SONAR_DEFAULT_BRANCH:-main}"
+              WORKDIR="$(pwd)"
 
-  steps:
-    - step: &version-step
-        runs-on:
-          - self.hosted
-          - linux.shell
-          - onprem
-        name: On Merge
-        script:
-          - npm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
-          - pnpm install --frozen-lockfile
-          - export HOME=/tmp
-          - node src/changeset/cli.js version-commit-tag --install-latest
+              # Bitbucket's built-ins: BITBUCKET_BRANCH / BITBUCKET_PR_ID /
+              # BITBUCKET_PR_DESTINATION_BRANCH. An upload with no branch parameter
+              # is filed against the project's default branch, so scanning a
+              # feature branch without one would silently overwrite that branch's
+              # analysis and quality-gate status. Resolved once — every target in
+              # this run shares the same branch/PR context.
+              BRANCH="${BITBUCKET_BRANCH:-}"
+              PR_ID="${BITBUCKET_PR_ID:-}"
+              PR_BASE="${BITBUCKET_PR_DESTINATION_BRANCH:-}"
+              BRANCH_DOCKER_ARGS=""
+              BRANCH_SONAR_ARGS=""
+
+              if [ -n "${PR_ID}" ]; then
+                BRANCH_DOCKER_ARGS="-e PR_ID=${PR_ID}"
+                BRANCH_SONAR_ARGS="-Dsonar.pullrequest.key=${PR_ID}"
+                [ -n "${BRANCH}" ] && BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.pullrequest.branch=${BRANCH}"
+                [ -n "${PR_BASE}" ] && BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.pullrequest.base=${PR_BASE}"
+              elif [ -n "${BRANCH}" ] && [ "${BRANCH}" != "${DEFAULT_BRANCH}" ]; then
+                BRANCH_DOCKER_ARGS="-e BRANCH=${BRANCH}"
+                BRANCH_SONAR_ARGS="-Dsonar.branch.name=${BRANCH}"
+              elif [ -n "${BITBUCKET_TAG:-}" ] || [ "${BRANCH}" = "${DEFAULT_BRANCH}" ]; then
+                echo "Sonar: analysing as the default branch (${DEFAULT_BRANCH})"
+              else
+                echo "ERROR: cannot tell which branch this analysis belongs to — none of BITBUCKET_PR_ID, BITBUCKET_BRANCH or BITBUCKET_TAG is set." >&2
+                echo "       Refusing to upload: SonarCloud would file it against '${DEFAULT_BRANCH}' and overwrite that branch's analysis." >&2
+                exit 1
+              fi
+
+              if [ "${SONAR_WAIT_FOR_GATE:-false}" = "true" ]; then
+                BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=${SONAR_QUALITYGATE_TIMEOUT:-300}"
+              fi
+
+              # Looks up "${1}_<SLUG>" if set, else prints nothing — POSIX sh has no
+              # ${!indirect} expansion, so this shells out through eval instead.
+              target_var() {
+                eval "printf '%s' \"\${$1_${2}:-}\""
+              }
+
+              # Each target is its own SonarCloud project — like Veracode's per-app
+              # profiles, a repo with several components (frontend/backend) needs
+              # its own sonar.projectKey per component, not one shared analysis.
+              failed=0
+              OLD_IFS="${IFS}"
+              IFS=';'
+              set -- ${SONAR_TARGETS:-default:${SONAR_PROJECT_DIR:-.}}
+              IFS="${OLD_IFS}"
+
+              for target in "$@"; do
+                [ -z "${target}" ] && continue
+                label="$(printf '%s' "${target}" | cut -d: -f1)"
+                project_dir="$(printf '%s' "${target}" | cut -d: -f2)"
+                [ -z "${label}" ] && label="default"
+                [ -z "${project_dir}" ] && project_dir="."
+                slug="$(printf '%s' "${label}" | tr -c 'A-Za-z0-9' '_' | tr 'a-z' 'A-Z')"
+
+                coverage_cmd="$(target_var SONAR_COVERAGE_CMD "${slug}")"
+                [ -z "${coverage_cmd}" ] && coverage_cmd="${SONAR_COVERAGE_CMD:-}"
+                coverage_path="$(target_var SONAR_COVERAGE_REPORT_PATH "${slug}")"
+                [ -z "${coverage_path}" ] && coverage_path="${SONAR_COVERAGE_REPORT_PATH:-}"
+
+                if [ -n "${coverage_cmd}" ]; then
+                  echo "[${label}] Running coverage command..."
+                  eval "${coverage_cmd}" || echo "WARN: coverage command exited non-zero for '${label}'; checking for the report anyway."
+                fi
+                if [ -n "${coverage_path}" ] && [ ! -s "${coverage_path}" ]; then
+                  echo "ERROR: ${coverage_path} missing or empty for target '${label}' — Sonar would report 0% coverage." >&2
+                  failed=1
+                  continue
+                fi
+
+                DOCKER_ARGS="run --rm --platform linux/amd64 -e SONAR_HOST_URL=${SONAR_HOST} -e SONAR_TOKEN ${BRANCH_DOCKER_ARGS} -v ${WORKDIR}:/workspace -w /workspace/${project_dir}"
+                SONAR_ARGS="sonar-scanner -Dsonar.host.url=${SONAR_HOST} -Dproject.settings=/workspace/${project_dir}/sonar-project.properties ${BRANCH_SONAR_ARGS}"
+
+                echo "[${label}] Running: docker ${DOCKER_ARGS} sonarsource/sonar-scanner-cli:latest ${SONAR_ARGS}"
+                docker ${DOCKER_ARGS} sonarsource/sonar-scanner-cli:latest ${SONAR_ARGS} || {
+                  failed=1
+                  echo "ERROR: Sonar scan failed for target '${label}'." >&2
+                }
+              done
+
+              [ "${failed}" -ne 0 ] && exit 1
+              exit 0
 
 pipelines:
-  # Lets this repo run the shared scans against itself from the Bitbucket UI.
+  # These simply alias the definitions.pipelines entries above (safe:
+  # same-document reuse, not a cross-repo import) so this repo can also run
+  # each shared pipeline manually from its own Pipelines UI.
   custom:
-    xray-scan: *xray-scan-pipeline
-    tenable-scan:
-      - step: *tenable-scan-step
+    xray-scan: *def-xray-scan
+    tenable-scan: *def-tenable-scan
+    veracode-scan: *def-veracode-scan
+    sonar-scan: *def-sonar-scan
+    sonar-pr-gate: *def-sonar-pr-gate
 
   pull-requests:
     '**':
@@ -618,4 +767,4 @@ pipelines:
             - pnpm install --frozen-lockfile
             - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
             - pnpm test
-            - pnpm publish --no-git-checks
+            - pnpm publish --no-git-checks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123",
+  "version": "1.0.124",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/changeset/canny.js

@@ -94,6 +94,10 @@ export async function uploadToCanny(releaseNote, labelIDs) {
 
     const body = JSON.stringify(bodyPayload);
 
+    console.log(
+      `📤 Posting to Canny: ${JSON.stringify({ ...bodyPayload, apiKey: undefined }, null, 2)}`,
+    );
+
     // Create a new changelog entry in Canny
     const createResponse = await fetch(
       'https://canny.io/api/v1/entries/create',