@docupace/pipeline 1.0.7-beta.2 → 1.0.8-6.xray

package/README.md

@@ -0,0 +1,136 @@
+# Pipeline Shared Scripts
+
+A collection of CLI tools for Docupace's CI/CD pipelines and deployment workflows.
+
+## Overview
+
+This package provides a set of command-line interfaces (CLIs) to facilitate various DevOps operations in the Docupace ecosystem:
+
+- `dp-next-cli`: Deployment and pipeline management for Next applications
+- `dp-changeset-cli`: Versioning and changeset management 
+- `dp-auth0-cli`: Auth0 tenant configuration and management
+
+## Installation
+
+```bash
+npm install @docupace/pipeline
+```
+
+Or with pnpm:
+
+```bash
+pnpm add @docupace/pipeline
+```
+
+## Command Line Interfaces
+
+### dp-next-cli
+
+Manages deployment, Docker image handling, and infrastructure configuration.
+
+```bash
+dp-next-cli [command] [options]
+```
+
+**Commands:**
+
+- `pull <imageName>`: Pull a Docker image from the registry
+- `sonar`: Run Sonar analysis
+- `addApacheSite`: Add site to apache
+- `connectClone`: Clone connect site
+- `haproxySync`: Sync haproxy config
+- `vaultAddSiteData`: Add m2m auth0 data to vault
+  - `-s, --site-name <siteName>`: Site name
+  - `-p, --site-config-remote-path <path>`: Site config remote path
+- `publish`: Publish a Docker image
+- `deploy-from-site`: Deploy an application for a specific site
+  - `-f, --from-env <fromEnv>`: Source environment
+  - `-t, --to-env <toEnv>`: Target environment
+  - `-F, --from-site <fromSite>`: Source site
+  - `-T, --to-site <toSite>`: Target site
+  - `-c, --deploy-core <deployCore>`: Deploy Core (default: "false")
+  - `-C, --deploy-connect <deployConnect>`: Deploy Connect (default: "false")
+- `deploy-template`: Deploy an application for a specific site
+- `deploy-app <application>`: Deploy an application for a specific site
+- `deploy-core <env> <site>`: Deploy Core
+  - `-l, --liquibase <liquibase>`: Application name (default: "true")
+  - `-b, --branch <branch>`: Branch (default: "master")
+- `deploy-connect <env> <site>`: Deploy Connect
+  - `-l, --liquibase <liquibase>`: Application name (default: "true")
+  - `-b, --branch <branch>`: Branch (default: "master")
+- `deploy-core-pipeline <env> <site>`: Deploy Core via pipeline
+  - `-l, --liquibase <liquibase>`: Application name (default: "true")
+  - `-b, --branch <branch>`: Branch (default: "master")
+- `copy`: Copy a Docker image between registries
+  - `-a, --application <application>`: Application name
+  - `-f, --from-env <fromEnv>`: Source environment
+  - `-t, --to-env <toEnv>`: Target environment
+  - `-g, --tag <tag>`: Image tag
+- `run-pipeline`: Trigger a pipeline by name
+  - `-r, --repository <repository>`: Repository name
+  - `-p, --pipeline-name <pipelineName>`: Pipeline name
+  - `-b, --branch <branch>`: Branch name
+  - `-v, --variables <key=value>`: Pipeline variable as key=value pair
+  - `-w, --wait`: Wait for the pipeline to complete (default: false)
+
+### dp-changeset-cli
+
+Manages versioning and changesets for mono-repos and single-package repos.
+
+```bash
+dp-changeset-cli [command] [options]
+```
+
+**Commands:**
+
+- `validate`: Validate changesets for the provided PR
+- `version`: Run Changeset versioning
+- `commit-tag`: Commit and tag the new version
+- `version-commit-tag`: Run versioning and commit-and-tag in sequence
+- `close-version`: Close a version and create a release branch
+- `create-changeset`: Create a changeset based on the current branch and Jira ticket information
+
+### dp-auth0-cli
+
+Manages Auth0 tenant configuration across environments.
+
+```bash
+dp-auth0-cli [command] [options]
+```
+
+**Commands:**
+
+- `configureFromSite <fromSite> <toSite> <fromEnv> <toEnv> <deployUI> <deployGraphQLServer> <useNewDomain> <useS3>`: Configure Auth0 tenants
+- `getVaultSecrets <vaultPath>`: Get secrets from Vault
+- `configureAlias <site> <env> <username> <password> <realm>`: Configure Core Alias for the given site
+- `exportConf <site> <env>`: Export Auth0 configuration for the given site
+- `getAuth0Metadata <site> <env>`: Get Auth0 metadata for the given site
+
+## Environment Configuration
+
+The CLI tools look for environment configuration in the following locations:
+- `.env.pipeline.local`
+- `config/.env.pipeline.local`
+
+## Examples
+
+```bash
+# Deploy from one site to another
+dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true
+
+# Run a pipeline
+dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa
+
+# Validate changesets
+dp-changeset-cli validate
+
+# Create a new changeset
+dp-changeset-cli create-changeset
+
+# Configure Auth0 for a site
+dp-auth0-cli configureFromSite sourceSite targetSite dev prod true true true false
+```
+
+## License
+
+ISC

package/bin/azuread_update_callbacks_for_app.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+set -e
+
+ENV=$1
+
+if [ -z "$ENV" ]; then
+    echo "Usage: $0 <environment>"
+    exit 1
+fi
+
+TENANT_ID="docupace.onmicrosoft.com"
+CLIENT_ID=$ARM_CLIENT_ID
+CLIENT_SECRET=$ARM_CLIENT_SECRET
+NEW_REDIRECT="https://docupace-$ENV-$SITE_NAME.us.auth0.com/login/callback"
+APP_ID="auth0-$ENV-docupace"
+APP_SCOPE="https://graph.microsoft.com/.default"
+GRAPH_API="https://graph.microsoft.com/v1.0"
+
+ACCESS_TOKEN=$(curl -s -X POST \
+-H "Content-Type: application/x-www-form-urlencoded" \
+-d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&scope=$APP_SCOPE" \
+https://login.microsoftonline.com/$TENANT_ID/oauth2/v2.0/token | jq -r '.access_token')
+
+APP_DETAILS=$(curl -s -G "https://graph.microsoft.com/v1.0/applications" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data-urlencode "\$filter=appId eq '$CLIENT_ID'")
+
+APP_ID=$(echo "$APP_DETAILS" | jq -r '.value[0].id')
+echo "Application ID: $APP_ID"
+
+CURRENT_REDIRECTS=$(echo "$APP_DETAILS" | jq -r '.value[0].web.redirectUris // []')
+echo "Current redirect URIs: $CURRENT_REDIRECTS"
+
+if echo "$CURRENT_REDIRECTS" | jq -e --arg uri "$NEW_REDIRECT" 'index($uri)' > /dev/null; then
+    echo "Redirect URI '$NEW_REDIRECT' already exists. No update needed."
+else
+    UPDATED_REDIRECTS=$(echo "$CURRENT_REDIRECTS" | jq --arg uri "$NEW_REDIRECT" '. + [$uri]')
+    echo "Updated redirect URIs: $UPDATED_REDIRECTS"
+
+    UPDATE_REDIRECTS=$(curl -fs -X PATCH \
+        -H "Authorization: Bearer $ACCESS_TOKEN" \
+        -H "Content-Type: application/json" \
+        -d "{
+          \"web\": {
+            \"redirectUris\": $UPDATED_REDIRECTS
+          }
+        }" \
+        "https://graph.microsoft.com/v1.0/applications/$APP_ID")
+
+    if [ $? -eq 0 ]; then
+        echo "Successfully updated redirect URIs"
+        echo $UPDATE_REDIRECTS
+    else
+        echo "Failed to update redirect URIs"
+        echo $UPDATE_REDIRECTS
+    fi
+fi

package/bin/xray.sh

@@ -0,0 +1,273 @@
+#!/usr/bin/env bash
+GIT_PATH=$(git rev-parse --show-toplevel)
+BASENAME=$(basename $GIT_PATH)
+BASENAME="${BITBUCKET_REPO_SLUG}"
+SLACK_API="https://slack.com/api/chat.postMessage"
+INPUT_TABLE="xray.txt"
+INPUT_JSON="xray.json"
+
+# ------------------------------------------------
+# 1️⃣ Parse table to JSON (handle multi-line wrapping)
+# ------------------------------------------------
+
+awk '
+BEGIN {
+  print "["
+  first = 1
+  in_vuln = 0
+}
+
+# Skip separator and header lines
+/^[┌├└]/ { next }
+/CVE.*SEVERITY.*DIRECT.*DEPENDENCY/ { next }
+
+# Process data rows
+/^│/ {
+  gsub(/^│ /, "")
+  gsub(/ *│ *$/, "")
+  
+  n = split($0, fields, / *│ */)
+  
+  # New vulnerability (has CVE in first column)
+  if (n >= 8 && fields[1] ~ /^CVE-/) {
+    # Output previous entry if exists
+    if (in_vuln) {
+      # Parse fixed versions
+      fixed_versions = "[]"
+      if (saved_fixed_raw != "") {
+        gsub(/\] *\[/, "][", saved_fixed_raw)
+        gsub(/\[/, "\"", saved_fixed_raw)
+        gsub(/\]/, "\"", saved_fixed_raw)
+        gsub(/"  *"/, "\", \"", saved_fixed_raw)
+        gsub(/""/, "\", \"", saved_fixed_raw)
+        fixed_versions = "[" saved_fixed_raw "]"
+      }
+      
+      component_key = saved_type "://" saved_affected
+      direct_component = saved_type "://" saved_direct
+      
+      print "    {"
+      print "      \"vulnerabilities\": [{"
+      print "        \"severity\": \"" saved_severity "\","
+      print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
+      print "        \"components\": {"
+      print "          \"" component_key "\": {"
+      print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
+      print "            \"affected_version\": \"" saved_affected_ver "\","
+      print "            \"fixed_versions\": " fixed_versions
+      print "          }"
+      print "        }"
+      print "      }]"
+      print "    },"
+    }
+    
+    first = 0
+    in_vuln = 1
+    
+    # Store new vulnerability
+    saved_cve = fields[1]
+    saved_severity = fields[2]
+    saved_direct = fields[3]
+    saved_direct_ver = fields[4]
+    saved_affected = fields[5]
+    saved_affected_ver = fields[6]
+    saved_fixed_raw = fields[7]
+    saved_type = tolower(fields[8])
+  }
+  # Continuation line - append to previous field
+  else if (in_vuln && fields[1] == "" && fields[2] == "") {
+    if (fields[3] != "") {
+      saved_direct = saved_direct fields[3]
+    }
+    if (fields[5] != "") {
+      saved_affected = saved_affected fields[5]
+    }
+    if (fields[7] != "") {
+      saved_fixed_raw = saved_fixed_raw " " fields[7]
+    }
+  }
+}
+
+END {
+  if (in_vuln) {
+    # Output the last entry
+    fixed_versions = "[]"
+    if (saved_fixed_raw != "") {
+      gsub(/\] *\[/, "][", saved_fixed_raw)
+      gsub(/\[/, "\"", saved_fixed_raw)
+      gsub(/\]/, "\"", saved_fixed_raw)
+      gsub(/"  *"/, "\", \"", saved_fixed_raw)
+      gsub(/""/, "\", \"", saved_fixed_raw)
+      fixed_versions = "[" saved_fixed_raw "]"
+    }
+    
+    component_key = saved_type "://" saved_affected
+    direct_component = saved_type "://" saved_direct
+    
+    print "    {"
+    print "      \"vulnerabilities\": [{"
+    print "        \"severity\": \"" saved_severity "\","
+    print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
+    print "        \"components\": {"
+    print "          \"" component_key "\": {"
+    print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
+    print "            \"affected_version\": \"" saved_affected_ver "\","
+    print "            \"fixed_versions\": " fixed_versions
+    print "          }"
+    print "        }"
+    print "      }]"
+    print "    }"
+  }
+  print "]"
+}
+' "$INPUT_TABLE" > "$INPUT_JSON"
+
+# Validate JSON
+if ! jq empty "$INPUT_JSON" 2>/dev/null; then
+  echo "❌ Failed to create valid JSON"
+  cat "$INPUT_JSON"
+  exit 1
+fi
+
+echo "✅ JSON created: $INPUT_JSON"
+
+# ------------------------------------------------
+# 2️⃣ Severity counts
+# ------------------------------------------------
+read CRITICAL HIGH MEDIUM LOW <<< $(
+jq -r '
+.[]
+| select(.vulnerabilities != null)
+| .vulnerabilities[]
+| .severity
+' "$INPUT_JSON" | awk '
+{ c[$1]++ }
+END {
+  print c["Critical"]+0, c["High"]+0, c["Medium"]+0, c["Low"]+0
+}'
+)
+
+echo "📊 Counts: Critical=$CRITICAL, High=$HIGH, Medium=$MEDIUM, Low=$LOW"
+
+# ------------------------------------------------
+# 3️⃣ Parent Slack message
+# ------------------------------------------------
+read -r -d '' PARENT_PAYLOAD <<JSON
+{
+  "channel": "$XRAY_SLACK_CHANNEL",
+  "blocks": [
+    {
+      "type": "header",
+      "text": { "type": "plain_text", "text": "🚨 Dependency Vulnerability Report" }
+    },
+    {
+      "type": "section",
+      "text": { "type": "mrkdwn", "text": "*Project:* $BASENAME" }
+    },
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "🔴 *Critical:* $CRITICAL    🔥 *High:* $HIGH    🎃 *Medium:* $MEDIUM  "
+      }
+    },
+    {
+      "type": "context",
+      "elements": [
+        { "type": "mrkdwn", "text": "Detailed findings are posted in the thread below 👇" }
+      ]
+    },
+    { "type": "divider" }
+  ]
+}
+JSON
+
+PARENT_RESPONSE=$(curl -s -X POST "$SLACK_API" \
+  -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data "$PARENT_PAYLOAD")
+
+THREAD_TS=$(echo "$PARENT_RESPONSE" | jq -r '.ts')
+
+if [[ -z "$THREAD_TS" || "$THREAD_TS" == "null" ]]; then
+  echo "❌ Failed to create parent message"
+  echo "$PARENT_RESPONSE"
+  exit 1
+fi
+
+echo "✅ Parent message created. thread_ts=$THREAD_TS"
+
+# ------------------------------------------------
+# 4️⃣ Thread entries (sorted, CVE links)
+# ------------------------------------------------
+jq -r '
+def rank:
+  if . == "Critical" then 0
+  elif . == "High"   then 1
+  elif . == "Medium" then 2
+  elif . == "Low"    then 3
+  else 9 end;
+
+[
+  .[]
+  | select(.vulnerabilities != null)
+  | .vulnerabilities[]
+  | . as $v
+  | ($v.components | to_entries[]) as $comp
+  | ($v.cves // [{cve:"N/A"}])[]
+  | {
+      sev: $v.severity,
+      r: ($v.severity | rank),
+      text: "*<https://nvd.nist.gov/vuln/detail/\(.cve)|\(.cve)>*\n*Impacted:* `\(
+        $comp.key | sub("^[a-z]+://"; "")
+      )` v\(
+        $comp.value.affected_version // "N/A"
+      )\n*Fixed in:* \(
+        ($comp.value.fixed_versions // [])
+        | join(", ")
+        | if . == "" then "N/A" else . end
+      )\n*Direct dependencies:*\n• \(
+        $comp.value.impact_paths[0][1].component_id
+        | sub("^[a-z]+://"; "")
+      )"
+    }
+]
+| sort_by(.r)
+| .[]
+| [.sev, .text]
+| @tsv
+' "$INPUT_JSON" |
+while IFS=$'\t' read -r SEV TEXT; do
+
+  EMOJI="👻"
+  [[ "$SEV" == "Critical" ]] && EMOJI="🔴"
+  [[ "$SEV" == "High"     ]] && EMOJI="🔥"
+  [[ "$SEV" == "Medium"   ]] && EMOJI="🎃"
+
+  read -r -d '' THREAD_PAYLOAD <<JSON
+{
+  "channel": "$XRAY_SLACK_CHANNEL",
+  "thread_ts": "$THREAD_TS",
+  "blocks": [
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "$EMOJI *$SEV*\n$TEXT"
+      }
+    }
+  ]
+}
+JSON
+
+  curl -s -X POST "$SLACK_API" \
+    -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data "$THREAD_PAYLOAD" > /dev/null
+  
+  # Small delay to avoid rate limiting
+  sleep 0.1
+
+done
+
+echo "✅ All vulnerabilities posted to thread"

package/bitbucket-pipelines.yml

@@ -0,0 +1,142 @@
+# bitbucket-pipelines.yml
+export: true
+
+clone:
+  depth: 2
+
+
+definitions:
+  caches:
+    pnpm: ~/.pnpm-store
+  
+  scripts:
+    - &detect-and-prepare |
+        echo "Detecting project type..."
+        PROJECT_TYPE=""
+        
+        if [ -f "package.json" ]; then
+          if [ -f "pnpm-lock.yaml" ]; then
+            PROJECT_TYPE="--pnpm"
+          elif [ -f "package-lock.json" ]; then
+            PROJECT_TYPE="--npm"
+          elif [ -f "yarn.lock" ]; then
+            PROJECT_TYPE="--yarn"
+          else
+            PROJECT_TYPE="--npm"
+          fi
+        elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ] || [ -f "settings.gradle" ]; then
+          PROJECT_TYPE="--gradle"
+          echo "Detected: Gradle project"
+          if [ -f "./gradlew" ]; then
+            chmod +x ./gradlew
+            echo "Fixed gradlew permissions"
+          fi
+        else
+          echo "Error: Could not detect project type"
+          exit 1
+        fi
+        export PROJECT_TYPE
+
+  pipelines:
+    xray-scan:
+      - step:
+          name: JFrog Xray Security Scan
+          runs-on:
+            - self.hosted
+            - linux.shell
+            - onprem
+          caches:
+            - node
+            - pnpm
+            - gradle
+          script:
+            # Setup JFrog CLI
+            - curl -fL https://install-cli.jfrog.io | sh
+            - jf --version
+            - jf config remove scan1 || true
+            - jf config add scan1 --url=$JFROG_XRAY_URL --user=$JFROG_XRAY_USER --access-token=$JFROG_XRAY_PASSWORD
+            - jf c show
+            
+            # Detect and prepare project
+            - *detect-and-prepare
+            
+            # Create Slack notification script
+            - echo 'IyEvdXNyL2Jpbi9lbnYgYmFzaApHSVRfUEFUSD0kKGdpdCByZXYtcGFyc2UgLS1zaG93LXRvcGxldmVsKQpCQVNFTkFNRT0kKGJhc2VuYW1lICRHSVRfUEFUSCkKQkFTRU5BTUU9IiR7QklUQlVDS0VUX1JFUE9fU0xVR30iClNMQUNLX0FQST0iaHR0cHM6Ly9zbGFjay5jb20vYXBpL2NoYXQucG9zdE1lc3NhZ2UiCklOUFVUX1RBQkxFPSJ4cmF5LnR4dCIKSU5QVVRfSlNPTj0ieHJheS5qc29uIgoKIyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyAx77iP4oOjIFBhcnNlIHRhYmxlIHRvIEpTT04gKGhhbmRsZSBtdWx0aS1saW5lIHdyYXBwaW5nKQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKYXdrICcKQkVHSU4gewogIHByaW50ICJbIgogIGZpcnN0ID0gMQogIGluX3Z1bG4gPSAwCn0KCiMgU2tpcCBzZXBhcmF0b3IgYW5kIGhlYWRlciBsaW5lcwovXlvilIzilJzilJRdLyB7IG5leHQgfQovQ1ZFLipTRVZFUklUWS4qRElSRUNULipERVBFTkRFTkNZLyB7IG5leHQgfQoKIyBQcm9jZXNzIGRhdGEgcm93cwovXuKUgi8gewogIGdzdWIoL17ilIIgLywgIiIpCiAgZ3N1YigvICrilIIgKiQvLCAiIikKICAKICBuID0gc3BsaXQoJDAsIGZpZWxkcywgLyAq4pSCICovKQogIAogICMgTmV3IHZ1bG5lcmFiaWxpdHkgKGhhcyBDVkUgaW4gZmlyc3QgY29sdW1uKQogIGlmIChuID49IDggJiYgZmllbGRzWzFdIH4gL15DVkUtLykgewogICAgIyBPdXRwdXQgcHJldmlvdXMgZW50cnkgaWYgZXhpc3RzCiAgICBpZiAoaW5fdnVsbikgewogICAgICAjIFBhcnNlIGZpeGVkIHZlcnNpb25zCiAgICAgIGZpeGVkX3ZlcnNpb25zID0gIltdIgogICAgICBpZiAoc2F2ZWRfZml4ZWRfcmF3ICE9ICIiKSB7CiAgICAgICAgZ3N1YigvXF0gKlxbLywgIl1bIiwgc2F2ZWRfZml4ZWRfcmF3KQogICAgICAgIGdzdWIoL1xbLywgIlwiIiwgc2F2ZWRfZml4ZWRfcmF3KQogICAgICAgIGdzdWIoL1xdLywgIlwiIiwgc2F2ZWRfZml4ZWRfcmF3KQogICAgICAgIGdzdWIoLyIgICoiLywgIlwiLCBcIiIsIHNhdmVkX2ZpeGVkX3JhdykKICAgICAgICBnc3ViKC8iIi8sICJcIiwgXCIiLCBzYXZlZF9maXhlZF9yYXcpCiAgICAgICAgZml4ZWRfdmVyc2lvbnMgPSAiWyIgc2F2ZWRfZml4ZWRfcmF3ICJdIgogICAgICB9CiAgICAgIAogICAgICBjb21wb25lbnRfa2V5ID0gc2F2ZWRfdHlwZSAiOi8vIiBzYXZlZF9hZmZlY3RlZAogICAgICBkaXJlY3RfY29tcG9uZW50ID0gc2F2ZWRfdHlwZSAiOi8vIiBzYXZlZF9kaXJlY3QKICAgICAgCiAgICAgIHByaW50ICIgICAgeyIKICAgICAgcHJpbnQgIiAgICAgIFwidnVsbmVyYWJpbGl0aWVzXCI6IFt7IgogICAgICBwcmludCAiICAgICAgICBcInNldmVyaXR5XCI6IFwiIiBzYXZlZF9zZXZlcml0eSAiXCIsIgogICAgICBwcmludCAiICAgICAgICBcImN2ZXNcIjogW3tcImN2ZVwiOiBcIiIgc2F2ZWRfY3ZlICJcIn1dLCIKICAgICAgcHJpbnQgIiAgICAgICAgXCJjb21wb25lbnRzXCI6IHsiCiAgICAgIHByaW50ICIgICAgICAgICAgXCIiIGNvbXBvbmVudF9rZXkgIlwiOiB7IgogICAgICBwcmludCAiICAgICAgICAgICAgXCJpbXBhY3RfcGF0aHNcIjogW1tudWxsLCB7XCJjb21wb25lbnRfaWRcIjogXCIiIGRpcmVjdF9jb21wb25lbnQgIlwifV1dLCIKICAgICAgcHJpbnQgIiAgICAgICAgICAgIFwiYWZmZWN0ZWRfdmVyc2lvblwiOiBcIiIgc2F2ZWRfYWZmZWN0ZWRfdmVyICJcIiwiCiAgICAgIHByaW50ICIgICAgICAgICAgICBcImZpeGVkX3ZlcnNpb25zXCI6ICIgZml4ZWRfdmVyc2lvbnMKICAgICAgcHJpbnQgIiAgICAgICAgICB9IgogICAgICBwcmludCAiICAgICAgICB9IgogICAgICBwcmludCAiICAgICAgfV0iCiAgICAgIHByaW50ICIgICAgfSwiCiAgICB9CiAgICAKICAgIGZpcnN0ID0gMAogICAgaW5fdnVsbiA9IDEKICAgIAogICAgIyBTdG9yZSBuZXcgdnVsbmVyYWJpbGl0eQogICAgc2F2ZWRfY3ZlID0gZmllbGRzWzFdCiAgICBzYXZlZF9zZXZlcml0eSA9IGZpZWxkc1syXQogICAgc2F2ZWRfZGlyZWN0ID0gZmllbGRzWzNdCiAgICBzYXZlZF9kaXJlY3RfdmVyID0gZmllbGRzWzRdCiAgICBzYXZlZF9hZmZlY3RlZCA9IGZpZWxkc1s1XQogICAgc2F2ZWRfYWZmZWN0ZWRfdmVyID0gZmllbGRzWzZdCiAgICBzYXZlZF9maXhlZF9yYXcgPSBmaWVsZHNbN10KICAgIHNhdmVkX3R5cGUgPSB0b2xvd2VyKGZpZWxkc1s4XSkKICB9CiAgIyBDb250aW51YXRpb24gbGluZSAtIGFwcGVuZCB0byBwcmV2aW91cyBmaWVsZAogIGVsc2UgaWYgKGluX3Z1bG4gJiYgZmllbGRzWzFdID09ICIiICYmIGZpZWxkc1syXSA9PSAiIikgewogICAgaWYgKGZpZWxkc1szXSAhPSAiIikgewogICAgICBzYXZlZF9kaXJlY3QgPSBzYXZlZF9kaXJlY3QgZmllbGRzWzNdCiAgICB9CiAgICBpZiAoZmllbGRzWzVdICE9ICIiKSB7CiAgICAgIHNhdmVkX2FmZmVjdGVkID0gc2F2ZWRfYWZmZWN0ZWQgZmllbGRzWzVdCiAgICB9CiAgICBpZiAoZmllbGRzWzddICE9ICIiKSB7CiAgICAgIHNhdmVkX2ZpeGVkX3JhdyA9IHNhdmVkX2ZpeGVkX3JhdyAiICIgZmllbGRzWzddCiAgICB9CiAgfQp9CgpFTkQgewogIGlmIChpbl92dWxuKSB7CiAgICAjIE91dHB1dCB0aGUgbGFzdCBlbnRyeQogICAgZml4ZWRfdmVyc2lvbnMgPSAiW10iCiAgICBpZiAoc2F2ZWRfZml4ZWRfcmF3ICE9ICIiKSB7CiAgICAgIGdzdWIoL1xdICpcWy8sICJdWyIsIHNhdmVkX2ZpeGVkX3JhdykKICAgICAgZ3N1YigvXFsvLCAiXCIiLCBzYXZlZF9maXhlZF9yYXcpCiAgICAgIGdzdWIoL1xdLywgIlwiIiwgc2F2ZWRfZml4ZWRfcmF3KQogICAgICBnc3ViKC8iICAqIi8sICJcIiwgXCIiLCBzYXZlZF9maXhlZF9yYXcpCiAgICAgIGdzdWIoLyIiLywgIlwiLCBcIiIsIHNhdmVkX2ZpeGVkX3JhdykKICAgICAgZml4ZWRfdmVyc2lvbnMgPSAiWyIgc2F2ZWRfZml4ZWRfcmF3ICJdIgogICAgfQogICAgCiAgICBjb21wb25lbnRfa2V5ID0gc2F2ZWRfdHlwZSAiOi8vIiBzYXZlZF9hZmZlY3RlZAogICAgZGlyZWN0X2NvbXBvbmVudCA9IHNhdmVkX3R5cGUgIjovLyIgc2F2ZWRfZGlyZWN0CiAgICAKICAgIHByaW50ICIgICAgeyIKICAgIHByaW50ICIgICAgICBcInZ1bG5lcmFiaWxpdGllc1wiOiBbeyIKICAgIHByaW50ICIgICAgICAgIFwic2V2ZXJpdHlcIjogXCIiIHNhdmVkX3NldmVyaXR5ICJcIiwiCiAgICBwcmludCAiICAgICAgICBcImN2ZXNcIjogW3tcImN2ZVwiOiBcIiIgc2F2ZWRfY3ZlICJcIn1dLCIKICAgIHByaW50ICIgICAgICAgIFwiY29tcG9uZW50c1wiOiB7IgogICAgcHJpbnQgIiAgICAgICAgICBcIiIgY29tcG9uZW50X2tleSAiXCI6IHsiCiAgICBwcmludCAiICAgICAgICAgICAgXCJpbXBhY3RfcGF0aHNcIjogW1tudWxsLCB7XCJjb21wb25lbnRfaWRcIjogXCIiIGRpcmVjdF9jb21wb25lbnQgIlwifV1dLCIKICAgIHByaW50ICIgICAgICAgICAgICBcImFmZmVjdGVkX3ZlcnNpb25cIjogXCIiIHNhdmVkX2FmZmVjdGVkX3ZlciAiXCIsIgogICAgcHJpbnQgIiAgICAgICAgICAgIFwiZml4ZWRfdmVyc2lvbnNcIjogIiBmaXhlZF92ZXJzaW9ucwogICAgcHJpbnQgIiAgICAgICAgICB9IgogICAgcHJpbnQgIiAgICAgICAgfSIKICAgIHByaW50ICIgICAgICB9XSIKICAgIHByaW50ICIgICAgfSIKICB9CiAgcHJpbnQgIl0iCn0KJyAiJElOUFVUX1RBQkxFIiA+ICIkSU5QVVRfSlNPTiIKCiMgVmFsaWRhdGUgSlNPTgppZiAhIGpxIGVtcHR5ICIkSU5QVVRfSlNPTiIgMj4vZGV2L251bGw7IHRoZW4KICBlY2hvICLinYwgRmFpbGVkIHRvIGNyZWF0ZSB2YWxpZCBKU09OIgogIGNhdCAiJElOUFVUX0pTT04iCiAgZXhpdCAxCmZpCgplY2hvICLinIUgSlNPTiBjcmVhdGVkOiAkSU5QVVRfSlNPTiIKCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgMu+4j+KDoyBTZXZlcml0eSBjb3VudHMKIyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KcmVhZCBDUklUSUNBTCBISUdIIE1FRElVTSBMT1cgPDw8ICQoCmpxIC1yICcKLltdCnwgc2VsZWN0KC52dWxuZXJhYmlsaXRpZXMgIT0gbnVsbCkKfCAudnVsbmVyYWJpbGl0aWVzW10KfCAuc2V2ZXJpdHkKJyAiJElOUFVUX0pTT04iIHwgYXdrICcKeyBjWyQxXSsrIH0KRU5EIHsKICBwcmludCBjWyJDcml0aWNhbCJdKzAsIGNbIkhpZ2giXSswLCBjWyJNZWRpdW0iXSswLCBjWyJMb3ciXSswCn0nCikKCmVjaG8gIvCfk4ogQ291bnRzOiBDcml0aWNhbD0kQ1JJVElDQUwsIEhpZ2g9JEhJR0gsIE1lZGl1bT0kTUVESVVNLCBMb3c9JExPVyIKCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgM++4j+KDoyBQYXJlbnQgU2xhY2sgbWVzc2FnZQojIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpyZWFkIC1yIC1kICcnIFBBUkVOVF9QQVlMT0FEIDw8SlNPTgp7CiAgImNoYW5uZWwiOiAiJFhSQVlfU0xBQ0tfQ0hBTk5FTCIsCiAgImJsb2NrcyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiaGVhZGVyIiwKICAgICAgInRleHQiOiB7ICJ0eXBlIjogInBsYWluX3RleHQiLCAidGV4dCI6ICLwn5qoIERlcGVuZGVuY3kgVnVsbmVyYWJpbGl0eSBSZXBvcnQiIH0KICAgIH0sCiAgICB7CiAgICAgICJ0eXBlIjogInNlY3Rpb24iLAogICAgICAidGV4dCI6IHsgInR5cGUiOiAibXJrZHduIiwgInRleHQiOiAiKlByb2plY3Q6KiAkQkFTRU5BTUUiIH0KICAgIH0sCiAgICB7CiAgICAgICJ0eXBlIjogInNlY3Rpb24iLAogICAgICAidGV4dCI6IHsKICAgICAgICAidHlwZSI6ICJtcmtkd24iLAogICAgICAgICJ0ZXh0IjogIvCflLQgKkNyaXRpY2FsOiogJENSSVRJQ0FMICAgIPCflKUgKkhpZ2g6KiAkSElHSCAgICDwn46DICpNZWRpdW06KiAkTUVESVVNICAiCiAgICAgIH0KICAgIH0sCiAgICB7CiAgICAgICJ0eXBlIjogImNvbnRleHQiLAogICAgICAiZWxlbWVudHMiOiBbCiAgICAgICAgeyAidHlwZSI6ICJtcmtkd24iLCAidGV4dCI6ICJEZXRhaWxlZCBmaW5kaW5ncyBhcmUgcG9zdGVkIGluIHRoZSB0aHJlYWQgYmVsb3cg8J+RhyIgfQogICAgICBdCiAgICB9LAogICAgeyAidHlwZSI6ICJkaXZpZGVyIiB9CiAgXQp9CkpTT04KClBBUkVOVF9SRVNQT05TRT0kKGN1cmwgLXMgLVggUE9TVCAiJFNMQUNLX0FQSSIgXAogIC1IICJBdXRob3JpemF0aW9uOiBCZWFyZXIgJFhSQVlfU0xBQ0tfVE9LRU4iIFwKICAtSCAiQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uIiBcCiAgLS1kYXRhICIkUEFSRU5UX1BBWUxPQUQiKQoKVEhSRUFEX1RTPSQoZWNobyAiJFBBUkVOVF9SRVNQT05TRSIgfCBqcSAtciAnLnRzJykKCmlmIFtbIC16ICIkVEhSRUFEX1RTIiB8fCAiJFRIUkVBRF9UUyIgPT0gIm51bGwiIF1dOyB0aGVuCiAgZWNobyAi4p2MIEZhaWxlZCB0byBjcmVhdGUgcGFyZW50IG1lc3NhZ2UiCiAgZWNobyAiJFBBUkVOVF9SRVNQT05TRSIKICBleGl0IDEKZmkKCmVjaG8gIuKchSBQYXJlbnQgbWVzc2FnZSBjcmVhdGVkLiB0aHJlYWRfdHM9JFRIUkVBRF9UUyIKCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgNO+4j+KDoyBUaHJlYWQgZW50cmllcyAoc29ydGVkLCBDVkUgbGlua3MpCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCmpxIC1yICcKZGVmIHJhbms6CiAgaWYgLiA9PSAiQ3JpdGljYWwiIHRoZW4gMAogIGVsaWYgLiA9PSAiSGlnaCIgICB0aGVuIDEKICBlbGlmIC4gPT0gIk1lZGl1bSIgdGhlbiAyCiAgZWxpZiAuID09ICJMb3ciICAgIHRoZW4gMwogIGVsc2UgOSBlbmQ7CgpbCiAgLltdCiAgfCBzZWxlY3QoLnZ1bG5lcmFiaWxpdGllcyAhPSBudWxsKQogIHwgLnZ1bG5lcmFiaWxpdGllc1tdCiAgfCAuIGFzICR2CiAgfCAoJHYuY29tcG9uZW50cyB8IHRvX2VudHJpZXNbXSkgYXMgJGNvbXAKICB8ICgkdi5jdmVzIC8vIFt7Y3ZlOiJOL0EifV0pW10KICB8IHsKICAgICAgc2V2OiAkdi5zZXZlcml0eSwKICAgICAgcjogKCR2LnNldmVyaXR5IHwgcmFuayksCiAgICAgIHRleHQ6ICIqPGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL1woLmN2ZSl8XCguY3ZlKT4qXG4qSW1wYWN0ZWQ6KiBgXCgKICAgICAgICAkY29tcC5rZXkgfCBzdWIoIl5bYS16XSs6Ly8iOyAiIikKICAgICAgKWAgdlwoCiAgICAgICAgJGNvbXAudmFsdWUuYWZmZWN0ZWRfdmVyc2lvbiAvLyAiTi9BIgogICAgICApXG4qRml4ZWQgaW46KiBcKAogICAgICAgICgkY29tcC52YWx1ZS5maXhlZF92ZXJzaW9ucyAvLyBbXSkKICAgICAgICB8IGpvaW4oIiwgIikKICAgICAgICB8IGlmIC4gPT0gIiIgdGhlbiAiTi9BIiBlbHNlIC4gZW5kCiAgICAgIClcbipEaXJlY3QgZGVwZW5kZW5jaWVzOipcbuKAoiBcKAogICAgICAgICRjb21wLnZhbHVlLmltcGFjdF9wYXRoc1swXVsxXS5jb21wb25lbnRfaWQKICAgICAgICB8IHN1YigiXlthLXpdKzovLyI7ICIiKQogICAgICApIgogICAgfQpdCnwgc29ydF9ieSgucikKfCAuW10KfCBbLnNldiwgLnRleHRdCnwgQHRzdgonICIkSU5QVVRfSlNPTiIgfAp3aGlsZSBJRlM9JCdcdCcgcmVhZCAtciBTRVYgVEVYVDsgZG8KCiAgRU1PSkk9IvCfkbsiCiAgW1sgIiRTRVYiID09ICJDcml0aWNhbCIgXV0gJiYgRU1PSkk9IvCflLQiCiAgW1sgIiRTRVYiID09ICJIaWdoIiAgICAgXV0gJiYgRU1PSkk9IvCflKUiCiAgW1sgIiRTRVYiID09ICJNZWRpdW0iICAgXV0gJiYgRU1PSkk9IvCfjoMiCgogIHJlYWQgLXIgLWQgJycgVEhSRUFEX1BBWUxPQUQgPDxKU09OCnsKICAiY2hhbm5lbCI6ICIkWFJBWV9TTEFDS19DSEFOTkVMIiwKICAidGhyZWFkX3RzIjogIiRUSFJFQURfVFMiLAogICJibG9ja3MiOiBbCiAgICB7CiAgICAgICJ0eXBlIjogInNlY3Rpb24iLAogICAgICAidGV4dCI6IHsKICAgICAgICAidHlwZSI6ICJtcmtkd24iLAogICAgICAgICJ0ZXh0IjogIiRFTU9KSSAqJFNFVipcbiRURVhUIgogICAgICB9CiAgICB9CiAgXQp9CkpTT04KCiAgY3VybCAtcyAtWCBQT1NUICIkU0xBQ0tfQVBJIiBcCiAgICAtSCAiQXV0aG9yaXphdGlvbjogQmVhcmVyICRYUkFZX1NMQUNLX1RPS0VOIiBcCiAgICAtSCAiQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uIiBcCiAgICAtLWRhdGEgIiRUSFJFQURfUEFZTE9BRCIgPiAvZGV2L251bGwKICAKICAjIFNtYWxsIGRlbGF5IHRvIGF2b2lkIHJhdGUgbGltaXRpbmcKICBzbGVlcCAwLjEKCmRvbmUKCmVjaG8gIuKchSBBbGwgdnVsbmVyYWJpbGl0aWVzIHBvc3RlZCB0byB0aHJlYWQiCg==' | base64 -d > xray.sh
+            - chmod +x xray.sh
+            
+            # Run Xray scan
+            - |
+              echo "🔍 Running JFrog Xray scan..."
+              set +e
+              jf audit $PROJECT_TYPE --server-id=scan1 --format table --min-severity Medium . > xray.txt
+              SCAN_EXIT_CODE=$?
+              set -e
+              echo "Scan completed with exit code: $SCAN_EXIT_CODE"
+            - cat xray.txt
+            # Cleanup JFrog config
+            - jf config remove scan1 || true
+            
+            # Send to Slack
+            - |
+              if [ -n "$XRAY_SLACK_TOKEN" ] && [ -n "$XRAY_SLACK_CHANNEL" ]; then
+                echo "📤 Sending results to Slack..."
+                bash xray.sh
+              else
+                echo "⚠️  Slack tokens not configured, skipping notification"
+              fi
+
+pipelines:
+  pull-requests:
+    '**':
+      - step:
+          runs-on:
+            - self.hosted
+            - linux.shell
+          name: On Pull Request
+          script:
+            - npm install -g pnpm
+            - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+            - pnpm install --frozen-lockfile
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+          after-script:
+            - echo "Pipeline completed with status $BITBUCKET_EXIT_CODE"
+
+  custom:
+    scheduled-tests:
+      - step:
+          runs-on:
+            - self.hosted
+            - linux.shell
+          name: Scheduled Tests
+          script:
+            - npm install -g pnpm
+            - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+            - pnpm install --frozen-lockfile
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+          after-script:
+            - echo "Pipeline completed with status $BITBUCKET_EXIT_CODE"
+
+  branches:
+    main:
+      - step:
+          runs-on:
+            - self.hosted
+            - linux.shell
+          name: Main Branch Build
+          script:
+            - npm install -g pnpm
+            - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+            - pnpm install --frozen-lockfile
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+
+
+

package/eslint.config.js

@@ -2,25 +2,48 @@ import globals from 'globals';
 import pluginJs from '@eslint/js';
 import prettierConfig from 'eslint-config-prettier';
 import prettierPlugin from 'eslint-plugin-prettier';
+import importPlugin from 'eslint-plugin-import';
 
-/** @type {import('eslint').Linter.Config[]} */
 export default [
   {
     languageOptions: {
       globals: {
         ...globals.browser,
-        ...globals.node, // Add Node.js globals
+        ...globals.node,
       },
     },
   },
+
+  // Core JS rules
   pluginJs.configs.recommended,
+
+  // Jest globals for test files only
+  {
+    files: ['**/*.test.js', '**/__tests__/**/*.js'],
+    languageOptions: {
+      globals: {
+        ...globals.jest,
+      },
+    },
+  },
+
   {
     plugins: {
       prettier: prettierPlugin,
+      import: importPlugin,
+    },
+    settings: {
+      'import/resolver': {
+        node: { extensions: ['.js', '.mjs', '.cjs'] },
+        typescript: {},
+      },
     },
     rules: {
       ...prettierConfig.rules,
       'prettier/prettier': 'error',
+      'import/no-unresolved': 'error',
+      'import/named': 'error',
+      'import/no-extraneous-dependencies': 'error',
     },
   },
 ];

package/jest.config.js

@@ -0,0 +1,15 @@
+// jest.config.js
+export default {
+  testEnvironment: 'node',
+  transform: {},
+  verbose: true,
+  collectCoverage: true,
+  coverageDirectory: 'coverage',
+  coverageReporters: ['text', 'lcov', 'json', 'html'],
+  collectCoverageFrom: [
+    'src/**/*.{js,ts}',
+    '!src/**/cli.js',
+    '!src/**/*.test.{js,ts}',
+    '!**/node_modules/**',
+  ],
+};