@docupace/pipeline 1.0.138 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @docupace/pipeline
 
+## 1.1.1
+
+### Patch Changes
+
+- acec071: DC-106888 Publish the CONNECT AWS onboarding release under a new version. The 1.1.0 release commit could not be tagged because v1.1.0 already existed on an older commit, so this patch release tags the onboarding code as v1.1.1 with no code changes.
+
+## 1.1.0
+
+### Minor Changes
+
+- 126e3d3: DC-106887 Create or populate the dedicated CONNECT runtime secret with its existing secret.conf field, validate required values, reuse complete credentials, and resolve SSO settings and database credentials from target environment sources. Keep the shared site secret and Helm charts unchanged.
+
+  DC-106888 Add idempotent CONNECT/CORE/NEXT fleet registration for prepared site values, preserving existing chart revisions and unrelated applications. Validate that CONNECT onboarding branches contain only the intended fleet addition before automatic merge.
+
+  Normalize preprod to qa and staging/stg to stage across onboarding commands, retaining preprod-site-settings and staging-site-settings repository names. Preserve matching explicit namespaces in existing fleet entries.
+
+  Require successful downstream configuration sync completion when requested by onboarding, with bounded polling and failure reporting after Git publication.
+
+- 213dbc2: DC-106885 Add copy-connect-site for the existing site-setup pipeline, supporting the default template or an existing site, cross-environment copies with target backend settings, target Core identity and Auth0 SAML metadata. Keep CONNECT AWS SAML generation in connect-aws.js and route the metadata CLI to it without changing the working directory; leave the legacy metadata module unchanged.
+
+  Resolve target Core identity and database configuration from the target environment's site-settings checkout, retaining explicit overrides for exceptional configurations.
+
+  Add explicit force-overwrite support to regenerate an existing target, preparing replacement files before swapping directories and restoring the previous files if installation fails.
+
+  Add read-only Pod Identity/runtime-secret readiness and published-image checks for conditional GitOps merges. Restore the legacy Connect auto-login and Next UI launch settings when copying a site.
+
+  Preserve the selected source image repository and exact tag. An explicit image-tag override changes only the tag; image validation does not substitute a shared repository or a v-prefixed tag.
+
 ## 1.1.0
 
 ### Minor Changes

package/package.json

@@ -1,9 +1,19 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.138",
+  "version": "1.1.1",
   "description": "",
   "main": "index.js",
   "type": "module",
+  "scripts": {
+    "prepublishOnly": "pnpm test",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage --testPathIgnorePatterns='src/next/test\\.js'",
+    "test-deploy-core": "dp-next-cli deploy-core-pipeline dev template",
+    "test-deploy-from-site": "dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true",
+    "test-run-pipline": "dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa",
+    "test-validate": "dp-changset-cli validate",
+    "test-create": "dp-changset-cli create-changeset",
+    "lint:fix": "eslint --fix \"src/**/*.{js,jsx,ts,tsx}\""
+  },
   "exports": {
     "./changelogCanny": "./src/changeset/changelog-module.cjs"
   },
@@ -53,14 +63,5 @@
     "globals": "^15.14.0",
     "jest": "^30.4.2",
     "prettier": "^3.4.2"
-  },
-  "scripts": {
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage --testPathIgnorePatterns='src/next/test\\.js'",
-    "test-deploy-core": "dp-next-cli deploy-core-pipeline dev template",
-    "test-deploy-from-site": "dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true",
-    "test-run-pipline": "dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa",
-    "test-validate": "dp-changset-cli validate",
-    "test-create": "dp-changset-cli create-changeset",
-    "lint:fix": "eslint --fix \"src/**/*.{js,jsx,ts,tsx}\""
   }
-}
+}

package/pnpm-workspace.yaml

@@ -1,3 +1,6 @@
+packages:
+  - '.'
+
 allowBuilds:
   '@parcel/watcher': true
   esbuild: true

package/src/next/cli.js

@@ -20,7 +20,8 @@ import { connectClone } from './connect.js';
 import dotenv from 'dotenv';
 import { $ } from 'zx';
 import { deployConnect, deployCore } from './jenkins.js';
-import { deployConnectAws } from './connect-aws.js';
+import { deployConnectAws, runPipelineChecked } from './connect-aws.js';
+import { registerConnectAwsCommands } from './connect-aws-cli.js';
 import { runPipeline } from './pipline.js';
 
 dotenv.config({ path: ['.env.pipeline.local', 'config/.env.pipeline.local'] });
@@ -57,6 +58,8 @@ program
     await connectClone();
   });
 
+registerConnectAwsCommands(program);
+
 program
   .command('haproxySync')
   .description('Sync haproxy config')
@@ -318,12 +321,22 @@ program
     {},
   )
   .option('-w, --wait', 'Wait for the pipeline to complete', false) // Defaults to false
+  .option(
+    '--require-success',
+    'Fail unless the downstream pipeline succeeds',
+    false,
+  )
   .action(async (cmdObj) => {
     try {
       const { repository, pipelineName, branch, variables, wait } = cmdObj;
 
       // Call the triggerPipelineByName function
-      await runPipeline(repository, pipelineName, branch, variables, wait);
+      if (cmdObj.requireSuccess) {
+        if (!wait) throw new Error('--require-success requires --wait.');
+        await runPipelineChecked(repository, pipelineName, branch, variables);
+      } else {
+        await runPipeline(repository, pipelineName, branch, variables, wait);
+      }
     } catch (error) {
       console.error('Error triggering pipeline:', error.message);
       process.exit(1);

package/src/next/connect-aws-cli.js

@@ -0,0 +1,206 @@
+import { writeFile } from 'node:fs/promises';
+import {
+  copyConnectSite,
+  ensureConnectRuntimeSecret,
+  registerSiteApps,
+  getFleetValuesSource,
+  validateConnectFleetChange,
+  syncConnectConfig,
+} from './connect-aws.js';
+
+export function registerConnectAwsCommands(program) {
+  program
+    .command('prepare-connect-secret')
+    .description('Create or populate the dedicated CONNECT runtime secret')
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .requiredOption(
+      '--site-settings-path <path>',
+      'Target Core site-settings checkout',
+    )
+    .option('--core-schema <schema>', 'Override target Core settings directory')
+    .option(
+      '--db-source-secret <name>',
+      'Target-account DB credential source; defaults to target CONNECT template',
+    )
+    .option(
+      '--db-user-property <name>',
+      'DB username property',
+      'CONNECT_DB_USER',
+    )
+    .option(
+      '--db-password-property <name>',
+      'DB password property',
+      'CONNECT_DB_PASSWORD',
+    )
+    .option('--dry-run', 'Validate and report without writing AWS', false)
+    .option(
+      '--result-file <path>',
+      'Write secret reference only, without credential values',
+    )
+    .action(async ({ resultFile, ...options }) => {
+      try {
+        const result = await ensureConnectRuntimeSecret(options);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+        console.log(
+          `CONNECT runtime secret ${result.status}: ${result.secretName}`,
+        );
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('validate-connect-fleet-change')
+    .description(
+      'Reject existing or unrelated fleet edits before an automatic CONNECT merge',
+    )
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .requiredOption('--before-file <path>', 'Fleet at the branch merge base')
+    .requiredOption('--after-file <path>', 'Prepared fleet')
+    .action(async (options) => {
+      try {
+        await validateConnectFleetChange(options);
+        console.log(
+          'CONNECT fleet changes are limited to the target registration.',
+        );
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('register-site-apps')
+    .description(
+      'Register prepared CONNECT, CORE and NEXT site values in the target fleets',
+    )
+    .requiredOption('--env <env>', 'Target environment')
+    .requiredOption('--site <site>', 'Target site')
+    .option('--apps <apps>', 'Comma-separated CONNECT,CORE,NEXT', 'CONNECT')
+    .option('--connect-repo-path <path>', 'CONNECT GitOps checkout')
+    .option('--next-repo-path <path>', 'NEXT/Core chart and fleet checkout')
+    .option('--config-repo-path <path>', 'Target gitops-env values checkout')
+    .option(
+      '--config-revision <revision>',
+      'Revision of the target values checkout',
+    )
+    .option(
+      '--chart-revision <revision>',
+      'Chart revision for new CORE/NEXT applications',
+      'develop',
+    )
+    .option('--dry-run', 'Validate and report without writing files', false)
+    .option(
+      '--resolve-config-source',
+      'Report the configured CORE/NEXT values source only',
+      false,
+    )
+    .option('--result-file <path>', 'Write planned/updated fleet paths')
+    .action(async ({ resultFile, ...options }) => {
+      try {
+        const result = options.resolveConfigSource
+          ? await getFleetValuesSource(options)
+          : await registerSiteApps(options);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+        console.log(JSON.stringify(result));
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('copy-connect-site')
+    .description(
+      'Copy a CONNECT GitOps template and generate target Auth0 SAML configuration',
+    )
+    .requiredOption('-e, --env <env>', 'Target environment')
+    .requiredOption('-s, --site <site>', 'New target site')
+    .option(
+      '--force-overwrite',
+      'Replace an existing target site with regenerated source configuration',
+      false,
+    )
+    .option(
+      '--site-settings-path <path>',
+      'Target Core site-settings checkout for automatic configuration',
+    )
+    .option('--core-schema <schema>', 'Override target Core database schema')
+    .option('--core-realm <realm>', 'Override target Core private realm')
+    .option(
+      '--runtime-secret-name <name>',
+      'Prepared target AWS runtime secret',
+    )
+    .option(
+      '--template-site <site>',
+      'Source template or existing site',
+      'template',
+    )
+    .option(
+      '--template-env <env>',
+      'Source environment (defaults to target environment)',
+    )
+    .option(
+      '--db-url <url>',
+      'Target JDBC URL; required for cross-environment copies',
+    )
+    .option(
+      '--core-api-url <url>',
+      'Target Core backend URL; required for cross-environment copies',
+    )
+    .option(
+      '--result-file <path>',
+      'Write generated site identity as JSON for pipeline orchestration',
+    )
+    .option(
+      '--repo-path <path>',
+      'Existing CONNECT GitOps checkout',
+      process.cwd(),
+    )
+    .option('--base-url <url>', 'Public CONNECT HTTPS origin')
+    .option(
+      '--core-url <url>',
+      'Public Core URL (defaults to target origin/core)',
+    )
+    .option(
+      '--image-tag <tag>',
+      'Override the inherited image tag; keep the source image repository',
+    )
+    .option('--context-path <path>', 'CONNECT context path', '/connect')
+    .option(
+      '--auth0-tenant <tenant>',
+      'Target Auth0 tenant name or auth0.com domain',
+      '',
+    )
+    .action(async (options) => {
+      try {
+        const { resultFile, ...copyOptions } = options;
+        const result = await copyConnectSite(copyOptions);
+        if (resultFile)
+          await writeFile(resultFile, JSON.stringify(result, null, 2));
+      } catch (error) {
+        console.error(`CONNECT site copy failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  program
+    .command('sync-connect-config')
+    .description(
+      'Run the target CONNECT GitOps configuration sync and require success',
+    )
+    .requiredOption('-e, --env <env>', 'Target CONNECT environment')
+    .action(async (options) => {
+      try {
+        await syncConnectConfig(options);
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+}