@docupace/pipeline 1.0.8-6.xray → 1.0.9

package/src/next/jenkins.js

@@ -1,7 +1,7 @@
 import axios from 'axios';
 
-const CORE_JENKINS_URL = process.env.CORE_JENKINS_URL;
-const CORE_JOB_NAME = process.env.CORE_JENKINS_JOB_NAME;
+const CORE_JENKINS_URL = 'http://devops.corp.docupace.com';
+const CORE_JOB_NAME = 'auto-deploy-site';
 const CORE_USERNAME = process.env.CORE_JENKINS_USERNAME;
 const CORE_API_TOKEN = process.env.CORE_JENKINS_API_TOKEN;
 
@@ -26,7 +26,6 @@ export async function deployCore(env, site, liquibase, gitBranch) {
   });
 }
 
-// eslint-disable-next-line no-unused-vars
 export async function deployConnect(env, site, liquibase, branch) {
   const parameters = {
     BUILD_ENVIRONMENT: env,

package/src/next/pipline.js

@@ -99,6 +99,7 @@ export async function runPipeline(
       return;
     }
 
+
     let status = '';
     do {
       console.log('Checking pipeline status...');

package/src/next/publish.js

@@ -1,71 +1,48 @@
-import { $ } from './logger.js';
+import { $ } from 'zx';
 
-const {
-  JF_REGISTRY_URL,
-  JF_REGISTRY_REPO_NAME,
-  JF_REGISTRY_PASSWORD_DEV,
-  JF_REGISTRY_USER_DEV,
-  BITBUCKET_REPO_SLUG,
-  BITBUCKET_BUILD_NUMBER,
-  APP_NAME,
-} = process.env;
+export async function publish(GIT_SHA) {
+  const BITBUCKET_REPO_SLUG = process.env.BITBUCKET_REPO_SLUG;
+  const BUILD_IMAGE_NAME = `${BITBUCKET_REPO_SLUG}:build-${process.env.BITBUCKET_BUILD_NUMBER}`;
+  const IMAGE_NAME = `${BITBUCKET_REPO_SLUG}:sha-${GIT_SHA}`;
+  const JF_REGISTRY_FULL_URL = `${process.env.JF_REGISTRY_URL}/${process.env.JF_REGISTRY_REPO_NAME}`;
 
-const JF_REGISTRY_FULL_URL = `${JF_REGISTRY_URL}/${JF_REGISTRY_REPO_NAME}`;
+  console.log(`Publishing Docker image: ${IMAGE_NAME}`);
 
-async function loginRegistry() {
-  await $`echo ${JF_REGISTRY_PASSWORD_DEV} | docker login --username ${JF_REGISTRY_USER_DEV} --password-stdin ${JF_REGISTRY_URL}`;
-}
-
-async function logoutRegistry() {
-  await $`docker logout ${JF_REGISTRY_URL}`;
-}
-
-export async function publish(gitSha) {
-  process.env.DOCKER_HOST = '';
-
-  console.log(JSON.stringify(process.env));
-
-  const IMAGE_PREFIX = APP_NAME ?? BITBUCKET_REPO_SLUG;
-  const BUILD_IMAGE_NAME = `${IMAGE_PREFIX}:build-${BITBUCKET_BUILD_NUMBER}`;
-  const IMAGE_NAME = `${IMAGE_PREFIX}:sha-${gitSha}`;
-
-  console.log(`Publishing Docker image ${IMAGE_NAME}...`);
+  // Docker login
+  await $`echo ${process.env.JF_REGISTRY_PASSWORD_DEV} | docker login --username ${process.env.JF_REGISTRY_USER_DEV} --password-stdin ${process.env.JF_REGISTRY_URL}`;
 
-  await loginRegistry();
-
-  let manifestExists = false;
+  // Check if the image already exists
   try {
-    $.verbose = false; // Silence output temporarily
     await $`docker manifest inspect ${JF_REGISTRY_FULL_URL}/${IMAGE_NAME}`;
-    manifestExists = true;
-  } catch {
-    manifestExists = false;
-  } finally {
-    $.verbose = true; // Restore normal output
-  }
-
-  if (manifestExists) {
     console.log(
-      `Tag sha-${gitSha} already exists in the remote repository. Skipping push.`,
+      `Tag sha-${GIT_SHA} already exists in the remote repository. Skipping push.`,
     );
-  } else {
+  } catch {
     await $`docker tag ${IMAGE_NAME} ${JF_REGISTRY_FULL_URL}/${IMAGE_NAME}`;
     await $`docker push ${JF_REGISTRY_FULL_URL}/${IMAGE_NAME}`;
   }
 
+  // Tag and push build image
   await $`docker tag ${IMAGE_NAME} ${JF_REGISTRY_FULL_URL}/${BUILD_IMAGE_NAME}`;
   await $`docker push ${JF_REGISTRY_FULL_URL}/${BUILD_IMAGE_NAME}`;
 
-  const gitTags = (await $`git tag --points-at HEAD`).stdout
-    .trim()
-    .split('\n')
-    .filter(Boolean);
-  for (const gitTag of gitTags) {
-    const version = gitTag.includes('@') ? 'v' + gitTag.split('@')[1] : gitTag;
-    const tagName = `${IMAGE_PREFIX}:${version}`;
-    await $`docker tag ${IMAGE_NAME} ${JF_REGISTRY_FULL_URL}/${tagName}`;
-    await $`docker push ${JF_REGISTRY_FULL_URL}/${tagName}`;
+  // Fetch Git tags pointing to the current HEAD
+  const gitTagsOutput = (await $`git tag --points-at HEAD`).stdout.trim();
+  const gitTags = gitTagsOutput.split('\n').filter((tag) => tag);
+
+  // Tag and push each Git tag as a Docker tag
+  if (gitTags.length > 0) {
+    console.log(`Found Git tags pointing to HEAD: ${gitTags.join(', ')}`);
+    for (const gitTag of gitTags) {
+      const dockerTag = `${JF_REGISTRY_FULL_URL}/${BITBUCKET_REPO_SLUG}:${gitTag}`;
+      console.log(`Tagging and pushing Docker image for Git tag: ${gitTag}`);
+      await $`docker tag ${IMAGE_NAME} ${dockerTag}`;
+      await $`docker push ${dockerTag}`;
+    }
+  } else {
+    console.log('No Git tags found pointing to the current HEAD.');
   }
 
-  await logoutRegistry();
+  // Docker logout
+  await $`docker logout ${process.env.JF_REGISTRY_URL}`;
 }

package/README.md

@@ -1,136 +0,0 @@
-# Pipeline Shared Scripts
-
-A collection of CLI tools for Docupace's CI/CD pipelines and deployment workflows.
-
-## Overview
-
-This package provides a set of command-line interfaces (CLIs) to facilitate various DevOps operations in the Docupace ecosystem:
-
-- `dp-next-cli`: Deployment and pipeline management for Next applications
-- `dp-changeset-cli`: Versioning and changeset management 
-- `dp-auth0-cli`: Auth0 tenant configuration and management
-
-## Installation
-
-```bash
-npm install @docupace/pipeline
-```
-
-Or with pnpm:
-
-```bash
-pnpm add @docupace/pipeline
-```
-
-## Command Line Interfaces
-
-### dp-next-cli
-
-Manages deployment, Docker image handling, and infrastructure configuration.
-
-```bash
-dp-next-cli [command] [options]
-```
-
-**Commands:**
-
-- `pull <imageName>`: Pull a Docker image from the registry
-- `sonar`: Run Sonar analysis
-- `addApacheSite`: Add site to apache
-- `connectClone`: Clone connect site
-- `haproxySync`: Sync haproxy config
-- `vaultAddSiteData`: Add m2m auth0 data to vault
-  - `-s, --site-name <siteName>`: Site name
-  - `-p, --site-config-remote-path <path>`: Site config remote path
-- `publish`: Publish a Docker image
-- `deploy-from-site`: Deploy an application for a specific site
-  - `-f, --from-env <fromEnv>`: Source environment
-  - `-t, --to-env <toEnv>`: Target environment
-  - `-F, --from-site <fromSite>`: Source site
-  - `-T, --to-site <toSite>`: Target site
-  - `-c, --deploy-core <deployCore>`: Deploy Core (default: "false")
-  - `-C, --deploy-connect <deployConnect>`: Deploy Connect (default: "false")
-- `deploy-template`: Deploy an application for a specific site
-- `deploy-app <application>`: Deploy an application for a specific site
-- `deploy-core <env> <site>`: Deploy Core
-  - `-l, --liquibase <liquibase>`: Application name (default: "true")
-  - `-b, --branch <branch>`: Branch (default: "master")
-- `deploy-connect <env> <site>`: Deploy Connect
-  - `-l, --liquibase <liquibase>`: Application name (default: "true")
-  - `-b, --branch <branch>`: Branch (default: "master")
-- `deploy-core-pipeline <env> <site>`: Deploy Core via pipeline
-  - `-l, --liquibase <liquibase>`: Application name (default: "true")
-  - `-b, --branch <branch>`: Branch (default: "master")
-- `copy`: Copy a Docker image between registries
-  - `-a, --application <application>`: Application name
-  - `-f, --from-env <fromEnv>`: Source environment
-  - `-t, --to-env <toEnv>`: Target environment
-  - `-g, --tag <tag>`: Image tag
-- `run-pipeline`: Trigger a pipeline by name
-  - `-r, --repository <repository>`: Repository name
-  - `-p, --pipeline-name <pipelineName>`: Pipeline name
-  - `-b, --branch <branch>`: Branch name
-  - `-v, --variables <key=value>`: Pipeline variable as key=value pair
-  - `-w, --wait`: Wait for the pipeline to complete (default: false)
-
-### dp-changeset-cli
-
-Manages versioning and changesets for mono-repos and single-package repos.
-
-```bash
-dp-changeset-cli [command] [options]
-```
-
-**Commands:**
-
-- `validate`: Validate changesets for the provided PR
-- `version`: Run Changeset versioning
-- `commit-tag`: Commit and tag the new version
-- `version-commit-tag`: Run versioning and commit-and-tag in sequence
-- `close-version`: Close a version and create a release branch
-- `create-changeset`: Create a changeset based on the current branch and Jira ticket information
-
-### dp-auth0-cli
-
-Manages Auth0 tenant configuration across environments.
-
-```bash
-dp-auth0-cli [command] [options]
-```
-
-**Commands:**
-
-- `configureFromSite <fromSite> <toSite> <fromEnv> <toEnv> <deployUI> <deployGraphQLServer> <useNewDomain> <useS3>`: Configure Auth0 tenants
-- `getVaultSecrets <vaultPath>`: Get secrets from Vault
-- `configureAlias <site> <env> <username> <password> <realm>`: Configure Core Alias for the given site
-- `exportConf <site> <env>`: Export Auth0 configuration for the given site
-- `getAuth0Metadata <site> <env>`: Get Auth0 metadata for the given site
-
-## Environment Configuration
-
-The CLI tools look for environment configuration in the following locations:
-- `.env.pipeline.local`
-- `config/.env.pipeline.local`
-
-## Examples
-
-```bash
-# Deploy from one site to another
-dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true
-
-# Run a pipeline
-dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa
-
-# Validate changesets
-dp-changeset-cli validate
-
-# Create a new changeset
-dp-changeset-cli create-changeset
-
-# Configure Auth0 for a site
-dp-auth0-cli configureFromSite sourceSite targetSite dev prod true true true false
-```
-
-## License
-
-ISC

package/bin/azuread_update_callbacks_for_app.sh

@@ -1,58 +0,0 @@
-#!/bin/bash
-set -e
-
-ENV=$1
-
-if [ -z "$ENV" ]; then
-    echo "Usage: $0 <environment>"
-    exit 1
-fi
-
-TENANT_ID="docupace.onmicrosoft.com"
-CLIENT_ID=$ARM_CLIENT_ID
-CLIENT_SECRET=$ARM_CLIENT_SECRET
-NEW_REDIRECT="https://docupace-$ENV-$SITE_NAME.us.auth0.com/login/callback"
-APP_ID="auth0-$ENV-docupace"
-APP_SCOPE="https://graph.microsoft.com/.default"
-GRAPH_API="https://graph.microsoft.com/v1.0"
-
-ACCESS_TOKEN=$(curl -s -X POST \
--H "Content-Type: application/x-www-form-urlencoded" \
--d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&scope=$APP_SCOPE" \
-https://login.microsoftonline.com/$TENANT_ID/oauth2/v2.0/token | jq -r '.access_token')
-
-APP_DETAILS=$(curl -s -G "https://graph.microsoft.com/v1.0/applications" \
-    -H "Authorization: Bearer $ACCESS_TOKEN" \
-    -H "Content-Type: application/json" \
-    --data-urlencode "\$filter=appId eq '$CLIENT_ID'")
-
-APP_ID=$(echo "$APP_DETAILS" | jq -r '.value[0].id')
-echo "Application ID: $APP_ID"
-
-CURRENT_REDIRECTS=$(echo "$APP_DETAILS" | jq -r '.value[0].web.redirectUris // []')
-echo "Current redirect URIs: $CURRENT_REDIRECTS"
-
-if echo "$CURRENT_REDIRECTS" | jq -e --arg uri "$NEW_REDIRECT" 'index($uri)' > /dev/null; then
-    echo "Redirect URI '$NEW_REDIRECT' already exists. No update needed."
-else
-    UPDATED_REDIRECTS=$(echo "$CURRENT_REDIRECTS" | jq --arg uri "$NEW_REDIRECT" '. + [$uri]')
-    echo "Updated redirect URIs: $UPDATED_REDIRECTS"
-
-    UPDATE_REDIRECTS=$(curl -fs -X PATCH \
-        -H "Authorization: Bearer $ACCESS_TOKEN" \
-        -H "Content-Type: application/json" \
-        -d "{
-          \"web\": {
-            \"redirectUris\": $UPDATED_REDIRECTS
-          }
-        }" \
-        "https://graph.microsoft.com/v1.0/applications/$APP_ID")
-
-    if [ $? -eq 0 ]; then
-        echo "Successfully updated redirect URIs"
-        echo $UPDATE_REDIRECTS
-    else
-        echo "Failed to update redirect URIs"
-        echo $UPDATE_REDIRECTS
-    fi
-fi

package/bin/xray.sh

@@ -1,273 +0,0 @@
-#!/usr/bin/env bash
-GIT_PATH=$(git rev-parse --show-toplevel)
-BASENAME=$(basename $GIT_PATH)
-BASENAME="${BITBUCKET_REPO_SLUG}"
-SLACK_API="https://slack.com/api/chat.postMessage"
-INPUT_TABLE="xray.txt"
-INPUT_JSON="xray.json"
-
-# ------------------------------------------------
-# 1️⃣ Parse table to JSON (handle multi-line wrapping)
-# ------------------------------------------------
-
-awk '
-BEGIN {
-  print "["
-  first = 1
-  in_vuln = 0
-}
-
-# Skip separator and header lines
-/^[┌├└]/ { next }
-/CVE.*SEVERITY.*DIRECT.*DEPENDENCY/ { next }
-
-# Process data rows
-/^│/ {
-  gsub(/^│ /, "")
-  gsub(/ *│ *$/, "")
-  
-  n = split($0, fields, / *│ */)
-  
-  # New vulnerability (has CVE in first column)
-  if (n >= 8 && fields[1] ~ /^CVE-/) {
-    # Output previous entry if exists
-    if (in_vuln) {
-      # Parse fixed versions
-      fixed_versions = "[]"
-      if (saved_fixed_raw != "") {
-        gsub(/\] *\[/, "][", saved_fixed_raw)
-        gsub(/\[/, "\"", saved_fixed_raw)
-        gsub(/\]/, "\"", saved_fixed_raw)
-        gsub(/"  *"/, "\", \"", saved_fixed_raw)
-        gsub(/""/, "\", \"", saved_fixed_raw)
-        fixed_versions = "[" saved_fixed_raw "]"
-      }
-      
-      component_key = saved_type "://" saved_affected
-      direct_component = saved_type "://" saved_direct
-      
-      print "    {"
-      print "      \"vulnerabilities\": [{"
-      print "        \"severity\": \"" saved_severity "\","
-      print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
-      print "        \"components\": {"
-      print "          \"" component_key "\": {"
-      print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
-      print "            \"affected_version\": \"" saved_affected_ver "\","
-      print "            \"fixed_versions\": " fixed_versions
-      print "          }"
-      print "        }"
-      print "      }]"
-      print "    },"
-    }
-    
-    first = 0
-    in_vuln = 1
-    
-    # Store new vulnerability
-    saved_cve = fields[1]
-    saved_severity = fields[2]
-    saved_direct = fields[3]
-    saved_direct_ver = fields[4]
-    saved_affected = fields[5]
-    saved_affected_ver = fields[6]
-    saved_fixed_raw = fields[7]
-    saved_type = tolower(fields[8])
-  }
-  # Continuation line - append to previous field
-  else if (in_vuln && fields[1] == "" && fields[2] == "") {
-    if (fields[3] != "") {
-      saved_direct = saved_direct fields[3]
-    }
-    if (fields[5] != "") {
-      saved_affected = saved_affected fields[5]
-    }
-    if (fields[7] != "") {
-      saved_fixed_raw = saved_fixed_raw " " fields[7]
-    }
-  }
-}
-
-END {
-  if (in_vuln) {
-    # Output the last entry
-    fixed_versions = "[]"
-    if (saved_fixed_raw != "") {
-      gsub(/\] *\[/, "][", saved_fixed_raw)
-      gsub(/\[/, "\"", saved_fixed_raw)
-      gsub(/\]/, "\"", saved_fixed_raw)
-      gsub(/"  *"/, "\", \"", saved_fixed_raw)
-      gsub(/""/, "\", \"", saved_fixed_raw)
-      fixed_versions = "[" saved_fixed_raw "]"
-    }
-    
-    component_key = saved_type "://" saved_affected
-    direct_component = saved_type "://" saved_direct
-    
-    print "    {"
-    print "      \"vulnerabilities\": [{"
-    print "        \"severity\": \"" saved_severity "\","
-    print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
-    print "        \"components\": {"
-    print "          \"" component_key "\": {"
-    print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
-    print "            \"affected_version\": \"" saved_affected_ver "\","
-    print "            \"fixed_versions\": " fixed_versions
-    print "          }"
-    print "        }"
-    print "      }]"
-    print "    }"
-  }
-  print "]"
-}
-' "$INPUT_TABLE" > "$INPUT_JSON"
-
-# Validate JSON
-if ! jq empty "$INPUT_JSON" 2>/dev/null; then
-  echo "❌ Failed to create valid JSON"
-  cat "$INPUT_JSON"
-  exit 1
-fi
-
-echo "✅ JSON created: $INPUT_JSON"
-
-# ------------------------------------------------
-# 2️⃣ Severity counts
-# ------------------------------------------------
-read CRITICAL HIGH MEDIUM LOW <<< $(
-jq -r '
-.[]
-| select(.vulnerabilities != null)
-| .vulnerabilities[]
-| .severity
-' "$INPUT_JSON" | awk '
-{ c[$1]++ }
-END {
-  print c["Critical"]+0, c["High"]+0, c["Medium"]+0, c["Low"]+0
-}'
-)
-
-echo "📊 Counts: Critical=$CRITICAL, High=$HIGH, Medium=$MEDIUM, Low=$LOW"
-
-# ------------------------------------------------
-# 3️⃣ Parent Slack message
-# ------------------------------------------------
-read -r -d '' PARENT_PAYLOAD <<JSON
-{
-  "channel": "$XRAY_SLACK_CHANNEL",
-  "blocks": [
-    {
-      "type": "header",
-      "text": { "type": "plain_text", "text": "🚨 Dependency Vulnerability Report" }
-    },
-    {
-      "type": "section",
-      "text": { "type": "mrkdwn", "text": "*Project:* $BASENAME" }
-    },
-    {
-      "type": "section",
-      "text": {
-        "type": "mrkdwn",
-        "text": "🔴 *Critical:* $CRITICAL    🔥 *High:* $HIGH    🎃 *Medium:* $MEDIUM  "
-      }
-    },
-    {
-      "type": "context",
-      "elements": [
-        { "type": "mrkdwn", "text": "Detailed findings are posted in the thread below 👇" }
-      ]
-    },
-    { "type": "divider" }
-  ]
-}
-JSON
-
-PARENT_RESPONSE=$(curl -s -X POST "$SLACK_API" \
-  -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
-  -H "Content-Type: application/json" \
-  --data "$PARENT_PAYLOAD")
-
-THREAD_TS=$(echo "$PARENT_RESPONSE" | jq -r '.ts')
-
-if [[ -z "$THREAD_TS" || "$THREAD_TS" == "null" ]]; then
-  echo "❌ Failed to create parent message"
-  echo "$PARENT_RESPONSE"
-  exit 1
-fi
-
-echo "✅ Parent message created. thread_ts=$THREAD_TS"
-
-# ------------------------------------------------
-# 4️⃣ Thread entries (sorted, CVE links)
-# ------------------------------------------------
-jq -r '
-def rank:
-  if . == "Critical" then 0
-  elif . == "High"   then 1
-  elif . == "Medium" then 2
-  elif . == "Low"    then 3
-  else 9 end;
-
-[
-  .[]
-  | select(.vulnerabilities != null)
-  | .vulnerabilities[]
-  | . as $v
-  | ($v.components | to_entries[]) as $comp
-  | ($v.cves // [{cve:"N/A"}])[]
-  | {
-      sev: $v.severity,
-      r: ($v.severity | rank),
-      text: "*<https://nvd.nist.gov/vuln/detail/\(.cve)|\(.cve)>*\n*Impacted:* `\(
-        $comp.key | sub("^[a-z]+://"; "")
-      )` v\(
-        $comp.value.affected_version // "N/A"
-      )\n*Fixed in:* \(
-        ($comp.value.fixed_versions // [])
-        | join(", ")
-        | if . == "" then "N/A" else . end
-      )\n*Direct dependencies:*\n• \(
-        $comp.value.impact_paths[0][1].component_id
-        | sub("^[a-z]+://"; "")
-      )"
-    }
-]
-| sort_by(.r)
-| .[]
-| [.sev, .text]
-| @tsv
-' "$INPUT_JSON" |
-while IFS=$'\t' read -r SEV TEXT; do
-
-  EMOJI="👻"
-  [[ "$SEV" == "Critical" ]] && EMOJI="🔴"
-  [[ "$SEV" == "High"     ]] && EMOJI="🔥"
-  [[ "$SEV" == "Medium"   ]] && EMOJI="🎃"
-
-  read -r -d '' THREAD_PAYLOAD <<JSON
-{
-  "channel": "$XRAY_SLACK_CHANNEL",
-  "thread_ts": "$THREAD_TS",
-  "blocks": [
-    {
-      "type": "section",
-      "text": {
-        "type": "mrkdwn",
-        "text": "$EMOJI *$SEV*\n$TEXT"
-      }
-    }
-  ]
-}
-JSON
-
-  curl -s -X POST "$SLACK_API" \
-    -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
-    -H "Content-Type: application/json" \
-    --data "$THREAD_PAYLOAD" > /dev/null
-  
-  # Small delay to avoid rate limiting
-  sleep 0.1
-
-done
-
-echo "✅ All vulnerabilities posted to thread"