@docupace/pipeline 1.0.137 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @docupace/pipeline
 
+## 1.1.1
+
+### Patch Changes
+
+- acec071: DC-106888 Publish the CONNECT AWS onboarding release under a new version. The 1.1.0 release commit could not be tagged because v1.1.0 already existed on an older commit, so this patch release tags the onboarding code as v1.1.1 with no code changes.
+
+## 1.1.0
+
+### Minor Changes
+
+- 126e3d3: DC-106887 Create or populate the dedicated CONNECT runtime secret with its existing secret.conf field, validate required values, reuse complete credentials, and resolve SSO settings and database credentials from target environment sources. Keep the shared site secret and Helm charts unchanged.
+
+  DC-106888 Add idempotent CONNECT/CORE/NEXT fleet registration for prepared site values, preserving existing chart revisions and unrelated applications. Validate that CONNECT onboarding branches contain only the intended fleet addition before automatic merge.
+
+  Normalize preprod to qa and staging/stg to stage across onboarding commands, retaining preprod-site-settings and staging-site-settings repository names. Preserve matching explicit namespaces in existing fleet entries.
+
+  Require successful downstream configuration sync completion when requested by onboarding, with bounded polling and failure reporting after Git publication.
+
+- 213dbc2: DC-106885 Add copy-connect-site for the existing site-setup pipeline, supporting the default template or an existing site, cross-environment copies with target backend settings, target Core identity and Auth0 SAML metadata. Keep CONNECT AWS SAML generation in connect-aws.js and route the metadata CLI to it without changing the working directory; leave the legacy metadata module unchanged.
+
+  Resolve target Core identity and database configuration from the target environment's site-settings checkout, retaining explicit overrides for exceptional configurations.
+
+  Add explicit force-overwrite support to regenerate an existing target, preparing replacement files before swapping directories and restoring the previous files if installation fails.
+
+  Add read-only Pod Identity/runtime-secret readiness and published-image checks for conditional GitOps merges. Restore the legacy Connect auto-login and Next UI launch settings when copying a site.
+
+  Preserve the selected source image repository and exact tag. An explicit image-tag override changes only the tag; image validation does not substitute a shared repository or a v-prefixed tag.
+
+## 1.1.0
+
+### Minor Changes
+
+- 1fb7d37: Add support for Connect deploy
+
 ## 1.0.136
 
 ### Patch Changes

package/README.md

@@ -51,20 +51,28 @@ dp-next-cli [command] [options]
   - `-j, --jira-ticket [jiraTicket]`: JIRA ticket (optional)
   - `-c, --deploy-core <deployCore>`: Deploy Core (default: "false")
   - `-C, --deploy-connect <deployConnect>`: Deploy Connect (default: "false")
+  - `-A, --deploy-connect-aws <deployConnectAws>`: Deploy Connect UI on AWS via `dp-eks-connect-ui-gitops` (default: "false")
 - `update-site-version <env> <site>`: Update specific version components for a site
   - `-u, --ui-version <uiVersion>`: UI image tag
   - `-g, --graph-version <graphVersion>`: GraphQL-server image tag
   - `-S, --standard-config <standardConfig>`: Standard config remote branch
   - `-s, --site-config <siteConfig>`: Site config remote branch
+  - `-c, --connect-version <connectVersion>`: AWS Connect UI image tag (optional)
   - `-j, --jira-ticket [jiraTicket]`: JIRA ticket (required for prod)
 - `deploy-template`: Deploy an application for a specific site
 - `deploy-app <application>`: Deploy an application for a specific site
+  - `deploy-app connect -e <env> -s <site>`: Deploy AWS Connect UI (triggers `deploy-connect-aws` / gitops `update-site-image`)
+  - `-e, --env <env>` / `-s, --site <site>`: Target env/site (optional; otherwise uses auto-deploy targets)
 - `deploy-core <env> <site>`: Deploy Core
   - `-l, --liquibase <liquibase>`: Application name (default: "true")
   - `-b, --branch <branch>`: Branch (default: "master")
 - `deploy-connect <env> <site>`: Deploy Connect
   - `-l, --liquibase <liquibase>`: Application name (default: "true")
   - `-b, --branch <branch>`: Branch (default: "master")
+- `deploy-connect-aws <env> <sites> <version>`: Deploy Connect UI on AWS (updates `dp-eks-connect-ui-gitops` image.tag via Bitbucket pipeline)
+  - `<sites>`: single site or comma-separated list (e.g. `oa` or `oa,athene,template`)
+  - `-b, --branch <branch>`: Gitops branch for the pipeline (default: "main")
+  - `-w, --wait` / `--no-wait`: Wait for pipeline completion (default: wait)
 - `deploy-core-pipeline <env> <site>`: Deploy Core via pipeline
   - `-l, --liquibase <liquibase>`: Application name (default: "true")
   - `-b, --branch <branch>`: Branch (default: "master")
@@ -187,6 +195,13 @@ dp-changeset-cli create-changeset
 
 # Configure Auth0 for a site
 dp-auth0-cli configureFromSite sourceSite targetSite dev prod true true true false
+
+# Deploy Connect UI image tag on AWS (single site or comma-separated sites)
+dp-next-cli deploy-connect-aws qa 1stglobal 4.75.52
+dp-next-cli deploy-connect-aws qa oa,athene,template 4.75.52
+
+# Promote AWS Connect UI version from one site to another via deploy-from-site
+dp-next-cli deploy-from-site -f dev -t qa -F template -T template -A true
 ```
 
 ## License

package/package.json

@@ -1,9 +1,19 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.137",
+  "version": "1.1.1",
   "description": "",
   "main": "index.js",
   "type": "module",
+  "scripts": {
+    "prepublishOnly": "pnpm test",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage --testPathIgnorePatterns='src/next/test\\.js'",
+    "test-deploy-core": "dp-next-cli deploy-core-pipeline dev template",
+    "test-deploy-from-site": "dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true",
+    "test-run-pipline": "dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa",
+    "test-validate": "dp-changset-cli validate",
+    "test-create": "dp-changset-cli create-changeset",
+    "lint:fix": "eslint --fix \"src/**/*.{js,jsx,ts,tsx}\""
+  },
   "exports": {
     "./changelogCanny": "./src/changeset/changelog-module.cjs"
   },
@@ -53,14 +63,5 @@
     "globals": "^15.14.0",
     "jest": "^30.4.2",
     "prettier": "^3.4.2"
-  },
-  "scripts": {
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage --testPathIgnorePatterns='src/next/test\\.js'",
-    "test-deploy-core": "dp-next-cli deploy-core-pipeline dev template",
-    "test-deploy-from-site": "dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true",
-    "test-run-pipline": "dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa",
-    "test-validate": "dp-changset-cli validate",
-    "test-create": "dp-changset-cli create-changeset",
-    "lint:fix": "eslint --fix \"src/**/*.{js,jsx,ts,tsx}\""
   }
-}
+}

package/pnpm-workspace.yaml

@@ -1,3 +1,7 @@
+packages:
+  - '.'
+
 allowBuilds:
+  '@parcel/watcher': true
   esbuild: true
   unrs-resolver: true

package/src/next/cli.js

@@ -20,6 +20,8 @@ import { connectClone } from './connect.js';
 import dotenv from 'dotenv';
 import { $ } from 'zx';
 import { deployConnect, deployCore } from './jenkins.js';
+import { deployConnectAws, runPipelineChecked } from './connect-aws.js';
+import { registerConnectAwsCommands } from './connect-aws-cli.js';
 import { runPipeline } from './pipline.js';
 
 dotenv.config({ path: ['.env.pipeline.local', 'config/.env.pipeline.local'] });
@@ -56,6 +58,8 @@ program
     await connectClone();
   });
 
+registerConnectAwsCommands(program);
+
 program
   .command('haproxySync')
   .description('Sync haproxy config')
@@ -93,6 +97,11 @@ program
   .option('-j, --jira-ticket [jiraTicket]', 'JIRA ticket (optional)')
   .option('-c, --deploy-core <deployCore>', 'Deploy Core', 'false')
   .option('-C, --deploy-connect <deployConnect>', 'Deploy Connect', 'false')
+  .option(
+    '-A, --deploy-connect-aws <deployConnectAws>',
+    'Deploy Connect UI on AWS (dp-eks-connect-ui-gitops)',
+    'false',
+  )
   .action(async (options) => {
     const {
       fromEnv,
@@ -101,6 +110,7 @@ program
       toSite,
       deployCore,
       deployConnect,
+      deployConnectAws: deployConnectAwsFlag,
       jiraTicket,
     } = options;
     await deployFromSite(
@@ -111,6 +121,7 @@ program
       deployCore,
       deployConnect,
       jiraTicket,
+      deployConnectAwsFlag,
     );
   });
 
@@ -124,10 +135,20 @@ program
     'Standard config remote branch',
   )
   .option('-s, --site-config <siteConfig>', 'Site config remote branch')
+  .option(
+    '-c, --connect-version <connectVersion>',
+    'AWS Connect UI image tag (triggers deploy-connect-aws)',
+  )
   .option('-j, --jira-ticket [jiraTicket]', 'JIRA ticket (required for prod)')
   .action(async (env, site, options) => {
-    const { uiVersion, graphVersion, standardConfig, siteConfig, jiraTicket } =
-      options;
+    const {
+      uiVersion,
+      graphVersion,
+      standardConfig,
+      siteConfig,
+      connectVersion,
+      jiraTicket,
+    } = options;
     await updateSiteVersion(
       env,
       site,
@@ -136,6 +157,7 @@ program
       standardConfig,
       siteConfig,
       jiraTicket,
+      connectVersion,
     );
   });
 
@@ -174,7 +196,9 @@ program
 
 program
   .command('deploy-app <application>')
-  .description('Deploy an application for a specific site')
+  .description(
+    'Deploy an application for a specific site (use application "connect" for AWS Connect UI)',
+  )
   .option('-e, --env <env>', 'Target environment (overrides default sites)')
   .option('-s, --site <site>', 'Target site (overrides default sites)')
   .action(async (application, options) => {
@@ -183,6 +207,19 @@ program
       options.env && options.site
         ? [{ env: options.env, site: options.site }]
         : await getDefaultDeploySite(deployTag);
+
+    // Batch Connect AWS updates into one pipeline run per env (comma-separated sites).
+    if (application === 'connect') {
+      const sitesByEnv = sites.reduce((acc, { env, site }) => {
+        (acc[env] ??= []).push(site);
+        return acc;
+      }, {});
+      for (const [env, envSites] of Object.entries(sitesByEnv)) {
+        await deployAppWithTag('connect', env, envSites.join(','), deployTag);
+      }
+      return;
+    }
+
     for (const { env, site } of sites) {
       await deployAppWithTag(application, env, site, deployTag);
     }
@@ -223,6 +260,21 @@ program
     await deployConnect(env, site, options.liquibase, options.branch);
   });
 
+program
+  .command('deploy-connect-aws <env> <sites> <version>')
+  .description(
+    'Deploy Connect UI on AWS by updating image.tag via dp-eks-connect-ui-gitops pipeline',
+  )
+  .option('-b, --branch <branch>', 'Gitops branch to run pipeline on', 'main')
+  .option('-w, --wait', 'Wait for the pipeline to complete', true)
+  .option('--no-wait', 'Do not wait for the pipeline to complete')
+  .action(async (env, sites, version, options) => {
+    await deployConnectAws(env, sites, version, {
+      wait: options.wait,
+      branch: options.branch,
+    });
+  });
+
 program
   .command('deploy-core-pipeline <env> <site>')
   .description('Deploy Core')
@@ -269,12 +321,22 @@ program
     {},
   )
   .option('-w, --wait', 'Wait for the pipeline to complete', false) // Defaults to false
+  .option(
+    '--require-success',
+    'Fail unless the downstream pipeline succeeds',
+    false,
+  )
   .action(async (cmdObj) => {
     try {
       const { repository, pipelineName, branch, variables, wait } = cmdObj;
 
       // Call the triggerPipelineByName function
-      await runPipeline(repository, pipelineName, branch, variables, wait);
+      if (cmdObj.requireSuccess) {
+        if (!wait) throw new Error('--require-success requires --wait.');
+        await runPipelineChecked(repository, pipelineName, branch, variables);
+      } else {
+        await runPipeline(repository, pipelineName, branch, variables, wait);
+      }
     } catch (error) {
       console.error('Error triggering pipeline:', error.message);
       process.exit(1);

package/src/next/connect-aws-cli.js

@@ -0,0 +1,206 @@
+import { writeFile } from 'node:fs/promises';
+import {
+  copyConnectSite,
+  ensureConnectRuntimeSecret,
+  registerSiteApps,
+  getFleetValuesSource,
+  validateConnectFleetChange,
+  syncConnectConfig,
+} from './connect-aws.js';
+
+export function registerConnectAwsCommands(program) {
+  program
+    .command('prepare-connect-secret')
+    .description('Create or populate the dedicated CONNECT runtime secret')
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .requiredOption(
+      '--site-settings-path <path>',
+      'Target Core site-settings checkout',
+    )
+    .option('--core-schema <schema>', 'Override target Core settings directory')
+    .option(
+      '--db-source-secret <name>',
+      'Target-account DB credential source; defaults to target CONNECT template',
+    )
+    .option(
+      '--db-user-property <name>',
+      'DB username property',
+      'CONNECT_DB_USER',
+    )
+    .option(
+      '--db-password-property <name>',
+      'DB password property',
+      'CONNECT_DB_PASSWORD',
+    )
+    .option('--dry-run', 'Validate and report without writing AWS', false)
+    .option(
+      '--result-file <path>',
+      'Write secret reference only, without credential values',
+    )
+    .action(async ({ resultFile, ...options }) => {
+      try {
+        const result = await ensureConnectRuntimeSecret(options);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+        console.log(
+          `CONNECT runtime secret ${result.status}: ${result.secretName}`,
+        );
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('validate-connect-fleet-change')
+    .description(
+      'Reject existing or unrelated fleet edits before an automatic CONNECT merge',
+    )
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .requiredOption('--before-file <path>', 'Fleet at the branch merge base')
+    .requiredOption('--after-file <path>', 'Prepared fleet')
+    .action(async (options) => {
+      try {
+        await validateConnectFleetChange(options);
+        console.log(
+          'CONNECT fleet changes are limited to the target registration.',
+        );
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('register-site-apps')
+    .description(
+      'Register prepared CONNECT, CORE and NEXT site values in the target fleets',
+    )
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .option('--apps <apps>', 'Comma-separated CONNECT,CORE,NEXT', 'CONNECT')
+    .option('--connect-repo-path <path>', 'CONNECT GitOps checkout')
+    .option('--next-repo-path <path>', 'NEXT/Core chart and fleet checkout')
+    .option('--config-repo-path <path>', 'Target gitops-env values checkout')
+    .option(
+      '--config-revision <revision>',
+      'Revision of the target values checkout',
+    )
+    .option(
+      '--chart-revision <revision>',
+      'Chart revision for new CORE/NEXT applications',
+      'develop',
+    )
+    .option('--dry-run', 'Validate and report without writing files', false)
+    .option(
+      '--resolve-config-source',
+      'Report the configured CORE/NEXT values source only',
+      false,
+    )
+    .option('--result-file <path>', 'Write planned/updated fleet paths')
+    .action(async ({ resultFile, ...options }) => {
+      try {
+        const result = options.resolveConfigSource
+          ? await getFleetValuesSource(options)
+          : await registerSiteApps(options);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+        console.log(JSON.stringify(result));
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('copy-connect-site')
+    .description(
+      'Copy a CONNECT GitOps template and generate target Auth0 SAML configuration',
+    )
+    .requiredOption('-e, --env <env>', 'Target environment')
+    .requiredOption('-s, --site <site>', 'New target site')
+    .option(
+      '--force-overwrite',
+      'Replace an existing target site with regenerated source configuration',
+      false,
+    )
+    .option(
+      '--site-settings-path <path>',
+      'Target Core site-settings checkout for automatic configuration',
+    )
+    .option('--core-schema <schema>', 'Override target Core database schema')
+    .option('--core-realm <realm>', 'Override target Core private realm')
+    .option(
+      '--runtime-secret-name <name>',
+      'Prepared target AWS runtime secret',
+    )
+    .option(
+      '--template-site <site>',
+      'Source template or existing site',
+      'template',
+    )
+    .option(
+      '--template-env <env>',
+      'Source environment (defaults to target environment)',
+    )
+    .option(
+      '--db-url <url>',
+      'Target JDBC URL; required for cross-environment copies',
+    )
+    .option(
+      '--core-api-url <url>',
+      'Target Core backend URL; required for cross-environment copies',
+    )
+    .option(
+      '--result-file <path>',
+      'Write generated site identity as JSON for pipeline orchestration',
+    )
+    .option(
+      '--repo-path <path>',
+      'Existing CONNECT GitOps checkout',
+      process.cwd(),
+    )
+    .option('--base-url <url>', 'Public CONNECT HTTPS origin')
+    .option(
+      '--core-url <url>',
+      'Public Core URL (defaults to target origin/core)',
+    )
+    .option(
+      '--image-tag <tag>',
+      'Override the inherited image tag; keep the source image repository',
+    )
+    .option('--context-path <path>', 'CONNECT context path', '/connect')
+    .option(
+      '--auth0-tenant <tenant>',
+      'Target Auth0 tenant name or auth0.com domain',
+      '',
+    )
+    .action(async (options) => {
+      try {
+        const { resultFile, ...copyOptions } = options;
+        const result = await copyConnectSite(copyOptions);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+      } catch (error) {
+        console.error(`CONNECT site copy failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('sync-connect-config')
+    .description(
+      'Run the target CONNECT GitOps configuration sync and require success',
+    )
+    .requiredOption('-e, --env <env>', 'Target CONNECT environment')
+    .action(async (options) => {
+      try {
+        await syncConnectConfig(options);
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+}