@ibm-cloud/cd-tools 1.5.3 → 1.6.0

package/cmd/copy-toolchain.js

@@ -22,25 +22,22 @@ import { Command, Option } from 'commander';
 import { parseEnvVar } from './utils/utils.js';
 import { logger, LOG_STAGES } from './utils/logger.js';
 import { setTerraformEnv, initProviderFile, setupTerraformFiles, runTerraformInit, getNumResourcesPlanned, runTerraformApply, getNumResourcesCreated, getNewToolchainId } from './utils/terraform.js';
-import { getAccountId, getBearerToken, getCdInstanceByRegion, getResourceGroupIdAndName, getToolchain } from './utils/requests.js';
+import { getAccountId, getBearerToken, getCdInstanceByRegion, getResourceGroups, getToolchain } from './utils/requests.js';
 import { validatePrereqsVersions, validateTag, validateToolchainId, validateToolchainName, validateTools, validateOAuth, warnDuplicateName, validateGritUrl } from './utils/validate.js';
 import { importTerraform } from './utils/import-terraform.js';
 
-import { COPY_TOOLCHAIN_DESC, DOCS_URL, TARGET_REGIONS, SOURCE_REGIONS } from '../config.js';
+import { COPY_TOOLCHAIN_DESC, TARGET_REGIONS, SOURCE_REGIONS } from '../config.js';
 
 import packageJson from '../package.json' with { type: "json" };
 
-process.on('exit', (code) => {
-	if (code !== 0) logger.print(`Need help? Visit ${DOCS_URL} for more troubleshooting information.`);
-});
-
 const TIME_SUFFIX = new Date().getTime();
 const LOGS_DIR = '.logs';
 const TEMP_DIR = '.migration-temp-' + TIME_SUFFIX;
 const LOG_DUMP = process.env['LOG_DUMP'] === 'false' ? false : true;	// when true or not specified, logs are also written to a log file in LOGS_DIR
-const DEBUG_MODE = process.env['DEBUG_MODE'] === 'true' ? true : false; // when true, temp folder is preserved
+const DEBUG_MODE = process.env['DEBUG_MODE'] === 'true'; // when true, temp folder is preserved
 const OUTPUT_DIR = 'output-' + TIME_SUFFIX;
 const DRY_RUN = false; // when true, terraform apply does not run
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM_DOMAIN'] || 'cloud.ibm.com';
 
 
 const command = new Command('copy-toolchain')
@@ -106,7 +103,7 @@ async function main(options) {
 	// Validate arguments are valid and check if Terraform is installed appropriately
 	try {
 		validatePrereqsVersions();
-    	logger.info(`\x1b[32m✔\x1b[0m cd-tools Version:  ${packageJson.version}`, LOG_STAGES.setup);
+		logger.info(`\x1b[32m✔\x1b[0m cd-tools Version:  ${packageJson.version}`, LOG_STAGES.setup);
 
 		if (!apiKey) apiKey = parseEnvVar('IBMCLOUD_API_KEY');
 		bearer = await getBearerToken(apiKey);
@@ -163,8 +160,8 @@ async function main(options) {
 			exit(1);
 		}
 
-		({ id: targetRgId, name: targetRgName } = await getResourceGroupIdAndName(bearer, accountId, targetRg || sourceToolchainData['resource_group_id']));
-
+		const resourceGroups = await getResourceGroups(bearer, accountId, [targetRg || sourceToolchainData['resource_group_id']]);
+		({ id: targetRgId, name: targetRgName } = resourceGroups[0])
 		// reuse name if not provided
 		if (!targetToolchainName) targetToolchainName = sourceToolchainData['name'];
 		[targetToolchainName, targetTag] = await warnDuplicateName(bearer, accountId, targetToolchainName, sourceRegion, targetRegion, targetRgId, targetRgName, targetTag, skipUserConfirmation);
@@ -321,7 +318,7 @@ async function main(options) {
 
 				// copy script
 				const s2sScript = fs.readFileSync(resolve(__dirname, '../create-s2s-script.js'));
-				fs.writeFileSync(resolve(`${outputDir}/create-s2s-script.js`), s2sScript);
+				fs.writeFileSync(resolve(`${outputDir}/create-s2s-script.cjs`), s2sScript);
 			}
 
 			// create toolchain, which invokes script to create s2s if applicable
@@ -341,7 +338,7 @@ async function main(options) {
 
 			logger.print('\n');
 			logger.info(`Toolchain "${sourceToolchainData['name']}" from ${sourceRegion} was cloned to "${targetToolchainName ?? sourceToolchainData['name']}" in ${targetRegion} ${applyErrors ? 'with some errors' : 'successfully'}, with ${numResourcesCreated} / ${numResourcesPlanned} resources created!`, LOG_STAGES.info);
-			if (newTcId) logger.info(`See cloned toolchain: https://cloud.ibm.com/devops/toolchains/${newTcId}?env_id=ibm:yp:${targetRegion}`, LOG_STAGES.info, true);
+			if (newTcId) logger.info(`See cloned toolchain: https://${CLOUD_PLATFORM}/devops/toolchains/${newTcId}?env_id=ibm:yp:${targetRegion}`, LOG_STAGES.info, true);
 		} else {
 			logger.info(`DRY_RUN: ${dryRun}, skipping terraform apply...`, LOG_STAGES.tf);
 		}

package/cmd/export-secrets.js

@@ -0,0 +1,323 @@
+/**
+ * Licensed Materials - Property of IBM
+ * (c) Copyright IBM Corporation 2025. All Rights Reserved.
+ *
+ * Note to U.S. Government Users Restricted Rights:
+ * Use, duplication or disclosure restricted by GSA ADP Schedule
+ * Contract with IBM Corp.
+ */
+'use strict';
+
+import { exit } from 'node:process';
+import { Command } from 'commander';
+import { parseEnvVar, decomposeCrn, isSecretReference, promptUserSelection, promptUserYesNo, promptUserInput } from './utils/utils.js';
+import { logger, LOG_STAGES } from './utils/logger.js';
+import { getBearerToken, getToolchain, getToolchainTools, getPipelineData, getSmInstances, createTool, getAccountId, getResourceGroups, migrateToolchainSecrets } from './utils/requests.js';
+import { SECRET_KEYS_MAP } from '../config.js';
+
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM_DOMAIN'] || 'cloud.ibm.com';
+
+const command = new Command('export-secrets')
+    .description('Exports Toolchain stored secrets to a Secrets Manager instance')
+    .requiredOption('-c, --toolchain-crn <crn>', 'The CRN of the toolchain to check')
+    .option('-a, --apikey <api_key>', 'API key used to authenticate. Must have IAM permission to read toolchains and create secrets in Secrets Manager')
+    .option('--check', '(Optional) Checks and lists any stored secrets in your toolchain')
+    .option('-v, --verbose', '(Optional) Increase log output')
+    .showHelpAfterError()
+    .hook('preAction', cmd => cmd.showHelpAfterError(false)) // only show help during validation
+    .action(main);
+
+async function main(options) {
+    const toolchainCrn = options.toolchainCrn;
+    const verbosity = options.verbose ? 2 : 1;
+    const runMigration = !options.check;
+
+    logger.setVerbosity(verbosity);
+
+    let apiKey;
+    let bearer;
+    let accountId;
+    let toolchainId;
+    let region;
+    let toolchainData;
+    let tools;
+
+    try {
+        const toolResults = [];
+        const pipelineResults = [];
+
+        apiKey = options.apikey || parseEnvVar('IBMCLOUD_API_KEY');
+        if (!apiKey) {
+            logger.error('Missing IBM Cloud IAM API key', LOG_STAGES.setup);
+            exit(1);
+        };
+
+        try {
+            const decomposedCrn = decomposeCrn(toolchainCrn);
+            toolchainId = decomposedCrn.serviceInstance;
+            region = decomposedCrn.location;
+        } catch (e) {
+            throw Error('Provided toolchain CRN is invalid');
+        }
+
+        // Display toolchain data to user
+        const getToolchainData = async () => {
+            bearer = await getBearerToken(apiKey);
+            toolchainData = await getToolchain(bearer, toolchainId, region);
+        }
+        await logger.withSpinner(getToolchainData, `Reading Toolchain`, 'Valid Toolchain found!');
+        logger.print(`Name: ${toolchainData.name}\nRegion: ${region}\nResource Group ID: ${toolchainData.resource_group_id}\nURL:https://${CLOUD_PLATFORM}/devops/toolchains/${toolchainId}?env_id=ibm:yp:${region}\n`);
+
+        // Check for plain-text secrets in all tools
+        const exportSecrets = async () => {
+            const getToolsRes = await getToolchainTools(bearer, toolchainId, region);
+            tools = getToolsRes.tools;
+
+            if (tools.length > 0) {
+                for (let i = 0; i < tools.length; i++) {
+                    const tool = tools[i];
+                    const toolUrl = `https://${CLOUD_PLATFORM}/devops/toolchains/${tool.toolchain_id}/configure/${tool.id}?env_id=ibm:yp:${region}`;
+                    const toolName = (tool.name || tool.parameters?.name || tool.parameters?.label || '').replace(/\s+/g, '+');
+
+                    // Skip iff it's GitHub/GitLab/GRIT integration with OAuth
+                    if (['githubconsolidated', 'github_integrated', 'gitlab', 'hostedgit'].includes(tool.tool_type_id) && (tool.parameters?.auth_type === '' || tool.parameters?.auth_type === 'oauth'))
+                        continue;
+
+                    // Check tool integrations for any plain text secret values
+                    if (SECRET_KEYS_MAP[tool.tool_type_id]) {
+                        SECRET_KEYS_MAP[tool.tool_type_id].forEach((entry) => {
+                            const updateableSecretParam = entry.key;
+                            if (tool.parameters[updateableSecretParam] && !isSecretReference(tool.parameters[updateableSecretParam]) && tool.parameters[updateableSecretParam].length > 0) {
+                                toolResults.push({
+                                    'Tool ID': tool.id,
+                                    'Tool Name': toolName,
+                                    'Tool Type': tool.tool_type_id,
+                                    'Property Name': updateableSecretParam,
+                                    'Url': toolUrl
+                                });
+                            };
+                        });
+                    };
+
+                    // For tekton pipelines, check for any plain text secret properties
+                    if (tool.tool_type_id === 'pipeline' && tool.parameters?.type === 'tekton') {
+                        const pipelineBaseUrl = `https://${CLOUD_PLATFORM}/devops/pipelines/tekton/${tool.id}`
+                        const pipelineData = await getPipelineData(bearer, tool.id, region);
+
+                        pipelineData?.properties.forEach((prop) => {
+                            if (prop.type === 'secure' && !isSecretReference(prop.value) && prop.value.length > 0) {
+                                pipelineResults.push({
+                                    'Pipeline ID': pipelineData.id,
+                                    'Pipeline Name': toolName,
+                                    'Trigger Name': '',
+                                    'Property Name': prop.name,
+                                    'Url': pipelineBaseUrl + `/config/envProperties?env_id=ibm:yp:${region}`,
+                                });
+                            };
+                        });
+
+                        pipelineData?.triggers.forEach((trigger) => {
+                            trigger.properties?.forEach((prop) => {
+                                if (prop.type === 'secure' && !isSecretReference(prop.value) && prop.value.length > 0) {
+                                    pipelineResults.push({
+                                        'Pipeline ID': pipelineData.id,
+                                        'Pipeline Name': toolName,
+                                        'Trigger Name': trigger.name,
+                                        'Trigger ID': trigger.id,
+                                        'Property Name': prop.name,
+                                        'Url': pipelineBaseUrl + `?env_id=ibm:yp:${region}`
+                                    });
+                                };
+                            });
+                        });
+                    }
+                };
+            };
+        };
+
+        await logger.withSpinner(exportSecrets, `Checking secrets for toolchain ${toolchainCrn}`, 'Secret check complete!');
+
+        const numTotalSecrets = toolResults.length + pipelineResults.length;
+        if (numTotalSecrets > 0) {
+            logger.warn(`\nNote: ${numTotalSecrets} locally stored secret(s) found!`)
+        } else {
+            logger.success('\nNo locally stored secrets found!');
+        }
+        if (toolResults.length > 0) {
+            logger.print();
+            logger.print('The following plain text properties were found in tool integrations bound to the toolchain:');
+            logger.table(toolResults, 'Url');
+        }
+        if (pipelineResults.length > 0) {
+            logger.print();
+            logger.print('The following plain text properties were found in Tekton pipeline(s) bound to the toolchain:');
+            logger.table(pipelineResults, 'Url', ['Trigger ID']);
+        }
+        if (numTotalSecrets > 0 && !runMigration) {
+            logger.warn(`\nNote: ${numTotalSecrets} locally stored secret(s) found!\nSecrets stored locally in Toolchains and Pipelines will not be exported when copying a toolchain. It is recommended that secrets be moved to a Secrets Manager instance and converted to secret references if these secrets are required.`);
+            logger.warn(`\nTo migrate secrets to Secrets Manager, ensure that you have provisioned an instance of Secrets Manager which you have write access to and rerun the command without the additional param '--check' to move the secrets into Secrets Manager.`)
+        }
+
+        // Facilitate Secrets Migration
+        const migrateSecrets = async () => {
+            accountId = await getAccountId(bearer, apiKey);
+
+            let allSmInstances = await getSmInstances(bearer, accountId);
+            if (allSmInstances.length === 0) {
+                logger.warn('No Secrets Manager instances found. Please create a Secrets Manager instance and try again.');
+                return;
+            }
+
+            const resourceGroups = await getResourceGroups(bearer, accountId, allSmInstances.map(inst => inst.resource_group_id));
+            const groupNameById = Object.fromEntries(
+                resourceGroups.map(g => [g.id, g.name])
+            );
+            allSmInstances = allSmInstances.map(inst => ({
+                ...inst,
+                resource_group_name: groupNameById[inst.resource_group_id] || 'Unknown'
+            }));
+
+            const instanceChoice = await promptUserSelection(
+                'Select a Secrets Manager Instance to migrate secret(s) to:',
+                allSmInstances.map(inst => (`\n    Name: ${inst.name} (${inst.id})\n    Region: ${inst.region_id}\n    Resource Group: ${inst.resource_group_name}`))
+            );
+            const smInstance = allSmInstances[instanceChoice];
+
+            // Check if there's an existing Secrets Manager tool integration
+            let hasSmIntegration = false;
+            for (const tool of tools) {
+                if (tool.state === 'configured' && tool.tool_type_id === 'secretsmanager') {
+                    if (
+                        (tool.parameters?.['instance-id-type'] === 'instance-name' && tool.parameters?.['instance-name'] === smInstance.name &&
+                            tool.parameters?.region === smInstance.region_id && tool.parameters?.['resource-group'] === smInstance.resource_group_name) ||
+                        (tool.parameters?.['instance-id-type'] === 'instance-crn' && tool.parameters?.['instance-crn'] === smInstance.crn)
+                    ) {
+                        hasSmIntegration = true;
+                        break;
+                    }
+                }
+            }
+
+            // Prompt user to create a Secrets Manager tool integration if it doesn't already exist
+            if (!hasSmIntegration) {
+                logger.warn('No valid Secrets Manager tool integration found.');
+                const toCreateSmTool = await promptUserYesNo(`Create a Secrets Manager tool integration?`);
+                if (!toCreateSmTool) {
+                    logger.warn('Toolchain secrets will not be migrated to Secrets Manager. Please create a Secrets Manager tool integration and try again.');
+                    return;
+                }
+                const smToolName = await promptUserInput(`Enter the name of the Secrets Manager tool integration to create [Press 'enter' to skip]: `, '', async (input) => {
+                    if (input.length > 128) {
+                        throw new Error('The tool integration name must be between 0 and 128 characters long.');
+                    }
+                    // from https://cloud.ibm.com/apidocs/toolchain#create-tool
+                    else if (input !== '' && !/^([^\x00-\x7F]|[a-zA-Z0-9-._ ])+$/.test(input)) {
+                        throw new Error('Provided tool integration name contains invalid characters.');
+                    }
+                });
+
+                const smToolParams = {
+                    'tool_type_id': 'secretsmanager',
+                    'parameters': {
+                        'name': smToolName || 'Secrets Manager',
+                        'instance-id-type': 'instance-crn',
+                        'instance-crn': smInstance.crn,
+                    }
+                };
+                try {
+                    const smTool = await createTool(bearer, toolchainId, region, smToolParams);
+                    logger.success(`Secrets Manager tool integration created: ${smTool.parameters.name} (${smTool.id})`);
+                    const smToolUrl = `https://${CLOUD_PLATFORM}/devops/toolchains/${toolchainId}/configure/${smTool.id}?env_id=ibm:yp:${region}`;
+                    logger.warn(`Create necessary IAM service authorization for toolchain to access Secrets Manager service instance:\n${smToolUrl}`);
+                } catch (e) {
+                    logger.error(`Failed to create Secrets Manager tool integration: ${e.message}`);
+                    throw e;
+                }
+            }
+
+            let numSecretsMigrated = 0;
+            const allSecrets = toolResults.concat(pipelineResults);
+            for (let i = 0; i < allSecrets.length; i++) {
+                logger.print('-------');
+                const secret = allSecrets[i];
+                const toolName = secret['Tool Name'] || secret['Pipeline Name'];
+                const toolType = secret['Tool Type'] || 'pipeline';
+                const toolId = secret['Tool ID'] || secret['Pipeline ID'];
+                const triggerId = secret['Trigger ID'];
+                const triggerName = secret['Trigger Name'];
+                const toolSecretKey = secret['Property Name'];
+                const toolSecretUrl = secret['Url'];
+                const secretPath = `${toolName || toolType}.${triggerName ? triggerName + '.' : ''}${toolSecretKey}`;
+
+                logger.print(`[${i + 1}]\n    Tool integration: ${toolName ? `'${toolName}' (${toolType})` : toolType}\n    Property: '${triggerName ? triggerName + '.' : ''}${toolSecretKey}'\n    URL: ${toolSecretUrl}\n`);
+
+                const shouldMigrateSecret = await promptUserYesNo(`Migrate this secret to Secrets Manager instance '${smInstance.name}'?`);
+                if (!shouldMigrateSecret) {
+                    continue;
+                }
+
+                const smSecretName = await promptUserInput(`Enter the name of the secret to create [${secretPath}]: `, '', async (input) => {
+                    if (input.length < 2 || input.length > 256) {
+                        throw new Error('The secret name must be between 2 and 256 characters long.');
+                    }
+                    // from https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2#create-secret
+                    else if (!/^[A-Za-z0-9_][A-Za-z0-9_]*(?:_*-*\.*[A-Za-z0-9]*)*[A-Za-z0-9]+$/.test(input)) {
+                        throw new Error('Provided secret name contains invalid characters.');
+                    }
+                });
+
+                const smSecretGroupId = await promptUserInput(`Enter the ID of the secret group to create secret '${smSecretName}' in: `, 'default', async (input) => {
+                    if (input.length < 7 || input.length > 36) {
+                        throw new Error('The secret group name must be between 7 and 36 characters long.');
+                    }
+                    // from https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2#create-secret
+                    else if (!/^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/.test(input)) {
+                        throw new Error('Provided secret group name is invalid. It should be a UUID or the word \'default\'');
+                    }
+                });
+
+                try {
+                    const commonProps = {
+                        toolchain_id: toolchainId,
+                        destination: {
+                            is_private: false, // TODO: set this back to 'true' once 'otc-api' has the 'export_secret' endpoint, should always use SM private endpoint
+                            is_production: CLOUD_PLATFORM === 'cloud.ibm.com',
+                            secrets_manager_crn: smInstance.crn,
+                            secret_name: smSecretName,
+                            secret_group_id: smSecretGroupId
+                        }
+                    };
+                    const payload = {
+                        source: {
+                            type: toolType === 'pipeline' ? toolType : 'tool',
+                            id: toolType === 'pipeline' ? (triggerId || toolId) : toolId,
+                            secret_key: toolSecretKey,
+                            kind: toolType === 'pipeline' ? (triggerId ? 'trigger' : 'env') : undefined,
+                            parent_id: toolType === 'pipeline' ? (triggerId ? toolId : undefined) : undefined
+                        },
+                        ...commonProps
+                    };
+
+                    const smSecretUrl = await migrateToolchainSecrets(bearer, payload, region);
+                    logger.success(`Secret successfully migrated!\nSecret URL: ${smSecretUrl}`);
+                    numSecretsMigrated += 1;
+                }
+                catch (e) {
+                    logger.error(`Failed to migrate secret '${secretPath}'. Error message: ${e.message}`, '', true);
+                }
+            }
+            logger.success(`Toolchain secrets migration complete, ${numSecretsMigrated} secret(s) successfully migrated.`);
+        };
+
+        if (numTotalSecrets > 0 && runMigration) await migrateSecrets();
+    }
+    catch (err) {
+        if (err.message && err.stack) {
+            const errMsg = verbosity > 1 ? err.stack : err.message;
+            logger.error(errMsg);
+        }
+        exit(1);
+    }
+};
+
+export default command;

package/cmd/index.js

@@ -7,7 +7,7 @@
  * Contract with IBM Corp.
  */
 
-import checkSecrets from './check-secrets.js';
+import exportSecrets from './export-secrets.js';
 import copyToolchain from './copy-toolchain.js';
 import directTransfer from './direct-transfer.js';
-export { checkSecrets, copyToolchain, directTransfer };
+export { exportSecrets, copyToolchain, directTransfer };

package/cmd/utils/logger.js

@@ -60,9 +60,9 @@ class Logger {
 
     #baseLog(type, msg, prefix) {
         const level = LEVELS[type] || LEVELS.log;
-        const formatted = this.#getFullPrefix(prefix) + ' ' + `${level.color}${msg}${COLORS.reset}`;
+        const formatted = (prefix ? this.#getFullPrefix(prefix) + ' ' : '') + `${level.color}${msg}${COLORS.reset}`;
         console[level.method](formatted);
-        this.logStream?.write(stripAnsi(this.#getFullPrefix(prefix) + ` [${type.toUpperCase()}] ` + msg) + '\n');
+        this.logStream?.write(stripAnsi((prefix ? this.#getFullPrefix(prefix) + ' ' : '') + `[${type.toUpperCase()}] ` + msg) + '\n');
     }
 
     info(msg, prefix = '', force = false) { if (this.verbosity >= 1 || force) this.#baseLog('info', msg, prefix); }
@@ -132,10 +132,10 @@ class Logger {
         return res;
     }
 
-    table(data, rowSpanField = 'url') {
+    table(data, rowSpanField = 'url', colsToSkip = []) {
         if (!Array.isArray(data) || data.length < 1) return;
         const tableData = structuredClone(data);
-        const headers = Object.keys(tableData[0]).filter(key => key !== rowSpanField);
+        const headers = Object.keys(tableData[0]).filter(key => key !== rowSpanField && !colsToSkip.includes(key));
         const t = new Table({
             head: headers,
             style: { head: ['cyan'] }
@@ -151,13 +151,18 @@ class Logger {
                 delete row[rowKey];
             }
             tableRow.push(
-                ...Object.values(row).map(val => {
-                    if (Array.isArray(val))
-                        return val.map((item, idx) => `${idx + 1}: ${item}`).join('\n');
-                    else if (typeof val === 'string')
-                        return val;
-                    return JSON.stringify(val);
-                })
+                ...Object.entries(row)
+                    .filter(([key]) => !colsToSkip.includes(key))
+                    .map(([_, val]) => {
+                        if (Array.isArray(val))
+                            return val
+                                .map((item, idx) => `${idx + 1}: ${item ?? '-'}`).join('\n');
+                        else if (val === '')
+                            return '-';
+                        else if (typeof val === 'string')
+                            return val;
+                        return JSON.stringify(val);
+                    })
             );
             t.push(tableRow);
             if (rowSpanFieldVal !== '') t.push([{ content: rowSpanFieldVal, colSpan: headers.length - 1 }]);
@@ -172,5 +177,6 @@ export const LOG_STAGES = {
     setup: 'setup',
     import: 'import',
     tf: 'terraform',
-    info: 'info'
+    info: 'info',
+    request: 'request'
 };

package/cmd/utils/requests.js

@@ -13,6 +13,16 @@ import axiosRetry from 'axios-retry';
 import mocks from '../../test/data/mocks.js'
 import { logger, LOG_STAGES } from './logger.js';
 
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM_DOMAIN'] || 'cloud.ibm.com';
+const DEV_MODE = CLOUD_PLATFORM !== 'cloud.ibm.com';
+const IAM_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_IAM_API_ENDPOINT'] : 'https://iam.cloud.ibm.com';
+const GHOST_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_GS_API_ENDPOINT'] : 'https://api.global-search-tagging.cloud.ibm.com';
+const DEVOPS_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_DEVOPS_URL'] : 'https://cloud.ibm.com/devops';
+const TOOLCHAIN_BASE_ENDPOINT = DEV_MODE ? process.env['IBMCLOUD_TOOLCHAIN_ENDPOINT'] : '';
+const PIPELINE_BASE_ENDPOINT = DEV_MODE ? process.env['IBMCLOUD_TEKTON_PIPELINE_ENDPOINT'] : '';
+const GIT_BASE_ENDPOINT = DEV_MODE ? process.env['IBMCLOUD_GIT_ENDPOINT'] : '';
+const OTC_BASE_ENDPOINT = DEV_MODE ? process.env['IBMCLOUD_OTC_ENDPOINT'] : '';
+
 const MOCK_ALL_REQUESTS = process.env.MOCK_ALL_REQUESTS === 'true' || 'false';
 
 axiosRetry(axios, {
@@ -23,13 +33,15 @@ axiosRetry(axios, {
     },
 });
 
+axios.defaults.timeout = 10000;     // 10 seconds
+
 axios.interceptors.request.use(request => {
-    logger.debug(`${request.method.toUpperCase()} ${request.url}`, LOG_STAGES.setup);
+    logger.debug(`${request.method.toUpperCase()} ${request.url}`, LOG_STAGES.request);
     if (request.data) {
         const body = typeof request.data === 'string'
             ? request.data
             : JSON.stringify(request.data);
-        logger.log(`Https Request body: ${body}`, LOG_STAGES.setup);
+        logger.log(`Https Request body: ${body}`, LOG_STAGES.request);
     }
     return request;
 });
@@ -41,21 +53,21 @@ axios.interceptors.response.use(response => {
             : JSON.stringify(response.data);
         if (response.data.access_token)   // Redact user access token in logs
             body = body.replaceAll(response.data.access_token, '<USER ACCESS TOKEN>');
-        logger.log(`Https Response body: ${body}`, LOG_STAGES.setup);
+        logger.log(`Https Response body: ${body}`, LOG_STAGES.request);
     }
     return response;
 }, error => {
     if (error.response) {
-        logger.log(`Error response status: ${error.response.status} ${error.response.statusText}`);
-        logger.log(`Error response body: ${JSON.stringify(error.response.data)}`);
+        logger.log(`Error response status: ${error.response.status} ${error.response.statusText}`, LOG_STAGES.request);
+        logger.log(`Error response body: ${JSON.stringify(error.response.data)}`, LOG_STAGES.request);
     } else {
-        logger.log(`Error message: ${error.message}`);
+        logger.log(`Error message: ${error.message}`, LOG_STAGES.request);
     }
     return Promise.reject(error);
 });
 
 async function getBearerToken(apiKey) {
-    const iamUrl = 'https://iam.cloud.ibm.com/identity/token';
+    const iamUrl = IAM_BASE_URL + '/identity/token';
     const params = new URLSearchParams();
     params.append('grant_type', 'urn:ibm:params:oauth:grant-type:apikey');
     params.append('apikey', apiKey);
@@ -78,7 +90,7 @@ async function getBearerToken(apiKey) {
 }
 
 async function getAccountId(bearer, apiKey) {
-    const iamUrl = 'https://iam.cloud.ibm.com/v1/apikeys/details';
+    const iamUrl = IAM_BASE_URL + '/v1/apikeys/details';
     const options = {
         method: 'GET',
         url: iamUrl,
@@ -97,7 +109,7 @@ async function getAccountId(bearer, apiKey) {
 }
 
 async function getToolchain(bearer, toolchainId, region) {
-    const apiBaseUrl = `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
+    const apiBaseUrl = TOOLCHAIN_BASE_ENDPOINT || `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
     const options = {
         method: 'GET',
         url: `${apiBaseUrl}/toolchains/${toolchainId}`,
@@ -120,9 +132,8 @@ async function getToolchain(bearer, toolchainId, region) {
 }
 
 async function getToolchainsByName(bearer, accountId, toolchainName) {
-    const apiBaseUrl = 'https://api.global-search-tagging.cloud.ibm.com/v3';
     const options = {
-        url: apiBaseUrl + '/resources/search',
+        url: GHOST_BASE_URL + '/v3/resources/search',
         method: 'POST',
         headers: {
             'Authorization': `Bearer ${bearer}`,
@@ -149,9 +160,8 @@ async function getCdInstanceByRegion(bearer, accountId, region) {
         return mocks.getCdInstanceByRegionResponses[process.env.MOCK_GET_CD_INSTANCE_BY_REGION_SCENARIO].data.items.length > 0;
     }
 
-    const apiBaseUrl = 'https://api.global-search-tagging.cloud.ibm.com/v3';
     const options = {
-        url: apiBaseUrl + '/resources/search',
+        url: GHOST_BASE_URL + '/v3/resources/search',
         method: 'POST',
         headers: {
             'Authorization': `Bearer ${bearer}`,
@@ -174,7 +184,7 @@ async function getCdInstanceByRegion(bearer, accountId, region) {
 }
 
 async function getToolchainTools(bearer, toolchainId, region) {
-    const apiBaseUrl = `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
+    const apiBaseUrl = TOOLCHAIN_BASE_ENDPOINT || `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
     const options = {
         method: 'GET',
         url: `${apiBaseUrl}/toolchains/${toolchainId}/tools`,
@@ -196,7 +206,7 @@ async function getToolchainTools(bearer, toolchainId, region) {
 }
 
 async function getPipelineData(bearer, pipelineId, region) {
-    const apiBaseUrl = `https://api.${region}.devops.cloud.ibm.com/pipeline/v2`;
+    const apiBaseUrl = PIPELINE_BASE_ENDPOINT || `https://api.${region}.devops.cloud.ibm.com/pipeline/v2`;
     const options = {
         method: 'GET',
         url: `${apiBaseUrl}/tekton_pipelines/${pipelineId}`,
@@ -216,18 +226,17 @@ async function getPipelineData(bearer, pipelineId, region) {
     }
 }
 
-// takes in resource group ID or name
-async function getResourceGroupIdAndName(bearer, accountId, resourceGroup) {
-    const apiBaseUrl = 'https://api.global-search-tagging.cloud.ibm.com/v3';
+// takes in list of resource group IDs or names
+async function getResourceGroups(bearer, accountId, resourceGroups) {
     const options = {
-        url: apiBaseUrl + '/resources/search',
+        url: GHOST_BASE_URL + '/v3/resources/search',
         method: 'POST',
         headers: {
             'Authorization': `Bearer ${bearer}`,
             'Content-Type': 'application/json',
         },
         data: {
-            'query': `type:resource-group AND (name:${resourceGroup} OR doc.id:${resourceGroup}) AND doc.state:ACTIVE`,
+            'query': `type:resource-group AND doc.state:ACTIVE AND (${resourceGroups.map(rg => `name:${rg} OR doc.id:${rg}`).join(' OR ')})`,
             'fields': ['doc.id', 'doc.name']
         },
         params: { account_id: accountId },
@@ -236,17 +245,16 @@ async function getResourceGroupIdAndName(bearer, accountId, resourceGroup) {
     const response = await axios(options);
     switch (response.status) {
         case 200:
-            if (response.data.items.length != 1) throw Error('The resource group with provided ID or name was not found or is not accessible');
-            return { id: response.data.items[0].doc.id, name: response.data.items[0].doc.name };
+            if (response.data.items.length === 0) throw Error('No matching resource groups were found for the provided id(s) or name(s)');
+            return response.data.items.map(item => { return { id: item.doc.id, name: item.doc.name } });
         default:
-            throw Error('The resource group with provided ID or name was not found or is not accessible');
+            throw Error('No matching resource groups were found for the provided id(s) or name(s)');
     }
 }
 
 async function getAppConfigHealthcheck(bearer, tcId, toolId, region) {
-    const apiBaseUrl = 'https://cloud.ibm.com/devops/api/v1';
     const options = {
-        url: apiBaseUrl + '/appconfig/healthcheck',
+        url: DEVOPS_BASE_URL + '/api/v1/appconfig/healthcheck',
         method: 'GET',
         headers: {
             'Authorization': `Bearer ${bearer}`,
@@ -265,9 +273,8 @@ async function getAppConfigHealthcheck(bearer, tcId, toolId, region) {
 }
 
 async function getSecretsHealthcheck(bearer, tcId, toolName, region) {
-    const apiBaseUrl = 'https://cloud.ibm.com/devops/api/v1';
     const options = {
-        url: apiBaseUrl + '/secrets/healthcheck',
+        url: DEVOPS_BASE_URL + '/api/v1/secrets/healthcheck',
         method: 'GET',
         headers: {
             'Authorization': `Bearer ${bearer}`,
@@ -286,15 +293,14 @@ async function getSecretsHealthcheck(bearer, tcId, toolName, region) {
 }
 
 async function getGitOAuth(bearer, targetRegion, gitId) {
-    const url = 'https://cloud.ibm.com/devops/git/api/v1/tokens';
     const options = {
-        url: url,
+        url: DEVOPS_BASE_URL + '/git/api/v1/tokens',
         method: 'GET',
         headers: {
             'Authorization': `Bearer ${bearer}`,
             'Content-Type': 'application/json',
         },
-        params: { env_id: `ibm:yp:${targetRegion}`, git_id: gitId, console_url: 'https://cloud.ibm.com', return_uri: `https://cloud.ibm.com/devops/git/static/github_return.html` },
+        params: { env_id: `ibm:yp:${targetRegion}`, git_id: gitId, console_url: `https://${CLOUD_PLATFORM}`, return_uri: `https://${CLOUD_PLATFORM}/devops/git/static/github_return.html` },
         validateStatus: () => true
     };
     const response = await axios(options);
@@ -309,9 +315,9 @@ async function getGitOAuth(bearer, targetRegion, gitId) {
 }
 
 async function getGritUserProject(privToken, region, user, projectName) {
-    const url = `https://${region}.git.cloud.ibm.com/api/v4/users/${user}/projects`
+    const apiBaseUrl = GIT_BASE_ENDPOINT || `https://${region}.git.cloud.ibm.com/api/v4`;
     const options = {
-        url: url,
+        url: apiBaseUrl + `/users/${user}/projects`,
         method: 'GET',
         headers: {
             'PRIVATE-TOKEN': privToken
@@ -331,9 +337,9 @@ async function getGritUserProject(privToken, region, user, projectName) {
 }
 
 async function getGritGroup(privToken, region, groupName) {
-    const url = `https://${region}.git.cloud.ibm.com/api/v4/groups/${groupName}`
+    const apiBaseUrl = GIT_BASE_ENDPOINT || `https://${region}.git.cloud.ibm.com/api/v4`;
     const options = {
-        url: url,
+        url: apiBaseUrl + `/groups/${groupName}`,
         method: 'GET',
         headers: {
             'PRIVATE-TOKEN': privToken
@@ -352,9 +358,9 @@ async function getGritGroup(privToken, region, groupName) {
 }
 
 async function getGritGroupProject(privToken, region, groupId, projectName) {
-    const url = `https://${region}.git.cloud.ibm.com/api/v4/groups/${groupId}/projects`
+    const apiBaseUrl = GIT_BASE_ENDPOINT || `https://${region}.git.cloud.ibm.com/api/v4`;
     const options = {
-        url: url,
+        url: apiBaseUrl + `/groups/${groupId}/projects`,
         method: 'GET',
         headers: {
             'PRIVATE-TOKEN': privToken
@@ -374,7 +380,7 @@ async function getGritGroupProject(privToken, region, groupId, projectName) {
 }
 
 async function deleteToolchain(bearer, toolchainId, region) {
-    const apiBaseUrl = `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
+    const apiBaseUrl = TOOLCHAIN_BASE_ENDPOINT || `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
     const options = {
         method: 'DELETE',
         url: `${apiBaseUrl}/toolchains/${toolchainId}`,
@@ -394,6 +400,83 @@ async function deleteToolchain(bearer, toolchainId, region) {
     }
 }
 
+async function getSmInstances(bearer, accountId) {
+    const options = {
+        url: GHOST_BASE_URL + '/v3/resources/search',
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+        data: {
+            'query': `service_name:secrets-manager AND doc.state:ACTIVE`,
+            'fields': ['doc.resource_group_id', 'doc.region_id', 'doc.dashboard_url', 'doc.name', 'doc.guid']
+        },
+        params: { account_id: accountId },
+        validateStatus: () => true
+    };
+    const response = await axios(options);
+    switch (response.status) {
+        case 200:
+            return response.data.items.map(item => {
+                return {
+                    id: item.doc.guid,
+                    crn: item.crn,
+                    name: item.doc.name,
+                    resource_group_id: item.doc.resource_group_id,
+                    region_id: item.doc.region_id,
+                    dashboard_url: item.doc.dashboard_url
+                }
+            });
+        default:
+            throw Error('Get Secrets Manager instances failed');
+    }
+}
+
+async function createTool(bearer, toolchainId, region, params) {
+    const apiBaseUrl = TOOLCHAIN_BASE_ENDPOINT || `https://api.${region}.devops.cloud.ibm.com/toolchain/v2`;
+    const options = {
+        method: 'POST',
+        url: `${apiBaseUrl}/toolchains/${toolchainId}/tools`,
+        headers: {
+            'Accept': 'application/json',
+            'Authorization': `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+        data: params,
+        validateStatus: () => true
+    };
+    const response = await axios(options);
+    switch (response.status) {
+        case 201:
+            return response.data;
+        default:
+            throw Error(response.statusText);
+    }
+}
+
+async function migrateToolchainSecrets(bearer, data, region) {
+    const apiBaseUrl = DEV_MODE ? OTC_BASE_ENDPOINT : `https://otc-api.${region}.devops.cloud.ibm.com/api/v1`;
+    const options = {
+        method: 'POST',
+        url: `${apiBaseUrl}/export_secret`,
+        headers: {
+            'Accept': 'application/json',
+            'Authorization': `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+        data: data,
+        validateStatus: () => true
+    };
+    const response = await axios(options);
+    switch (response.status) {
+        case 201:
+            return response.headers.location;
+        default:
+            throw Error(response.data?.errors.length > 0 ? response.data.errors[0]?.message : response.statusText);
+    }
+}
+
 export {
     getBearerToken,
     getAccountId,
@@ -402,12 +485,15 @@ export {
     getToolchainsByName,
     getToolchainTools,
     getPipelineData,
-    getResourceGroupIdAndName,
+    getResourceGroups,
     getAppConfigHealthcheck,
     getSecretsHealthcheck,
     getGitOAuth,
     getGritUserProject,
     getGritGroup,
     getGritGroupProject,
-    deleteToolchain
+    deleteToolchain,
+    createTool,
+    getSmInstances,
+    migrateToolchainSecrets
 }

package/cmd/utils/terraform.js

@@ -18,6 +18,11 @@ import { validateToolchainId, validateGritUrl } from './validate.js';
 import { logger, LOG_STAGES } from './logger.js';
 import { getRandChars, promptUserInput, replaceUrlRegion } from './utils.js';
 
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM_DOMAIN'] || 'cloud.ibm.com';
+const DEV_MODE = CLOUD_PLATFORM !== 'cloud.ibm.com';
+const GIT_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_GIT_URL'] : '';
+const IAM_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_IAM_API_ENDPOINT'] : 'https://iam.cloud.ibm.com';
+
 // promisify
 const readFilePromise = promisify(fs.readFile);
 const readDirPromise = promisify(fs.readdir);
@@ -36,6 +41,19 @@ async function execPromise(command, options) {
 function setTerraformEnv(apiKey, verbosity) {
     if (verbosity >= 2) process.env['TF_LOG'] = 'DEBUG';
     process.env['TF_VAR_ibmcloud_api_key'] = apiKey;
+    // reset all Terraform environment variables if pointing to prod domain
+    if (!DEV_MODE) {
+        delete process.env['IBMCLOUD_TOOLCHAIN_ENDPOINT'];
+        delete process.env['IBMCLOUD_TEKTON_PIPELINE_ENDPOINT'];
+        delete process.env['IBMCLOUD_IAM_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_USER_MANAGEMENT_ENDPOINT'];
+        delete process.env['IBMCLOUD_RESOURCE_MANAGEMENT_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_RESOURCE_CONTROLLER_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_IS_NG_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_GT_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_GS_API_ENDPOINT'];
+        delete process.env['IBMCLOUD_USER_MANAGEMENT_ENDPOINT'];
+    }
 }
 
 async function initProviderFile(targetRegion, dir) {
@@ -177,7 +195,7 @@ async function setupTerraformFiles({ token, srcRegion, targetRegion, targetTag,
                                     logger.print('Skipping... (URL will remain unchanged in the generatedTerraform configuration)');
                                     return '';
                                 }
-                                const newUrl = `https://${targetRegion}.git.cloud.ibm.com/${str}.git`;
+                                const newUrl = (GIT_BASE_URL || `https://${targetRegion}.git.cloud.ibm.com`) + `/${str}.git`;
                                 if (usedGritUrls.has(newUrl)) throw Error(`"${newUrl}" has already been used in another mapping entry`);
                                 return validateGritUrl(token, targetRegion, str, false);
                             }
@@ -187,10 +205,10 @@ async function setupTerraformFiles({ token, srcRegion, targetRegion, targetTag,
                                 logger.print('Please enter the new URLs for the following GRIT tool(s) (or submit empty input to skip):\n');
                             }
 
-                            const newRepoSlug = await promptUserInput(`Old URL: ${thisUrl.slice(0, thisUrl.length - 4)}\nNew URL: https://${targetRegion}.git.cloud.ibm.com/`, '', validateGritUrlPrompt);
+                            const newRepoSlug = await promptUserInput(`Old URL: ${thisUrl.slice(0, thisUrl.length - 4)}\nNew URL: ${GIT_BASE_URL || 'https://' + targetRegion + '.git.cloud.ibm.com'}`, '', validateGritUrlPrompt);
 
                             if (newRepoSlug) {
-                                newUrl = `https://${targetRegion}.git.cloud.ibm.com/${newRepoSlug}.git`;
+                                newUrl = (GIT_BASE_URL || `https://${targetRegion}.git.cloud.ibm.com`) + `/${newRepoSlug}.git`;
                                 newTfFileObj['resource']['ibm_cd_toolchain_tool_hostedgit'][k]['initialization'][0]['repo_url'] = newUrl;
                                 attemptAddUsedGritUrl(newUrl);
                                 gritMapping[thisUrl] = newUrl;
@@ -473,10 +491,12 @@ function replaceDependsOn(str) {
 
 function addS2sScriptToToolchainTf(str) {
     const provisionerStr = (tfName) => `\n\n  provisioner "local-exec" {
-    command = "node create-s2s-script.js"
+    command = "node create-s2s-script.cjs"
     environment = {
       IBMCLOUD_API_KEY = var.ibmcloud_api_key
       TARGET_TOOLCHAIN_ID = ibm_cd_toolchain.${tfName}.id
+      IBMCLOUD_PLATFORM = "${CLOUD_PLATFORM}"
+      IAM_BASE_URL = "${IAM_BASE_URL}"
     }\n  }`
     try {
         if (typeof str === 'string') {

package/cmd/utils/utils.js

@@ -21,6 +21,32 @@ export function parseEnvVar(name) {
     return value;
 };
 
+export async function promptUserYesNo(question) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+
+    const fullPrompt = `${question} [Ctrl-C to abort] (y)es (n)o: `;
+
+    const answer = await rl.question(fullPrompt);
+
+    logger.dump(fullPrompt + '\n' + answer + '\n');
+    rl.close();
+
+    const normalized = answer.toLowerCase().trim();
+    if (normalized === 'y' || normalized === 'yes') {
+        logger.print();
+        return true;
+    }
+    if (normalized === 'n' || normalized === 'no') {
+        logger.print();
+        return false;
+    }
+    logger.warn('\nInvalid input. Please enter \'y\' or \'n\'.');
+    return await promptUserYesNo(question);
+}
+
 export async function promptUserConfirmation(question, expectedAns, exitMsg) {
     const rl = readline.createInterface({
         input: process.stdin,
@@ -33,7 +59,7 @@ export async function promptUserConfirmation(question, expectedAns, exitMsg) {
     logger.dump(fullPrompt + '\n' + answer + '\n');
 
     if (answer.toLowerCase().trim() !== expectedAns) {
-        logger.print('\n' + exitMsg);
+        if (exitMsg) logger.print('\n' + exitMsg);
         rl.close();
         await logger.close();
         process.exit(1);
@@ -59,7 +85,7 @@ export async function promptUserInput(question, initialInput, validationFn) {
     });
 
     rl.prompt(true);
-    rl.write(initialInput);
+    if (initialInput) rl.write(initialInput);
 
     for await (const ans of rl) {
         try {
@@ -72,7 +98,7 @@ export async function promptUserInput(question, initialInput, validationFn) {
             logger.warn(`Validation failed... ${e.message}`, '', true);
 
             rl.prompt(true);
-            rl.write(initialInput);
+            if (initialInput) rl.write(initialInput);
         }
     }
 
@@ -81,6 +107,44 @@ export async function promptUserInput(question, initialInput, validationFn) {
     return answer.trim();
 }
 
+export async function promptUserSelection(question, choices) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+
+    rl.on('SIGINT', async () => {
+        logger.print('\n' + 'Received SIGINT signal');
+        await logger.close();
+        process.exit(1);
+    });
+
+    const list = choices
+        .map((choice, i) => `[${i + 1}] ${choice}`)
+        .join('\n');
+
+    const promptText = `${question}\n\n${list}\n\nEnter the number of your choice (Ctrl-C to abort): `;
+
+    let index;
+
+    while (true) {
+        const answer = await rl.question(promptText);
+        logger.dump(promptText + '\n' + answer + '\n');
+
+        index = parseInt(answer.trim(), 10) - 1;
+
+        if (!Number.isNaN(index) && index >= 0 && index < choices.length) {
+            break;
+        }
+
+        logger.warn('\nInvalid choice. Please enter a valid number.\n', '', true);
+    }
+
+    rl.close();
+    logger.print();
+    return index;
+}
+
 export function replaceUrlRegion(inputUrl, srcRegion, targetRegion) {
     if (!inputUrl) return '';
 

package/cmd/utils/validate.js

@@ -10,9 +10,12 @@
 import { execSync } from 'child_process';
 import { logger, LOG_STAGES } from './logger.js'
 import { RESERVED_GRIT_PROJECT_NAMES, RESERVED_GRIT_GROUP_NAMES, RESERVED_GRIT_SUBGROUP_NAME, TERRAFORM_REQUIRED_VERSION, SECRET_KEYS_MAP } from '../../config.js';
-import { getToolchainsByName, getToolchainTools, getPipelineData, getAppConfigHealthcheck, getSecretsHealthcheck, getGitOAuth, getGritUserProject, getGritGroup, getGritGroupProject } from './requests.js';
+import { getToolchainsByName, getToolchainTools, getPipelineData, getAppConfigHealthcheck, getSecretsHealthcheck, getGitOAuth, getGritUserProject, getGritGroupProject } from './requests.js';
 import { promptUserConfirmation, promptUserInput, isSecretReference } from './utils.js';
 
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM_DOMAIN'] || 'cloud.ibm.com';
+const DEV_MODE = CLOUD_PLATFORM !== 'cloud.ibm.com';
+const GIT_BASE_URL = DEV_MODE ? process.env['IBMCLOUD_GIT_URL'] : '';
 
 function validatePrereqsVersions() {
     const compareVersions = (verInstalled, verRequired) => {
@@ -151,7 +154,7 @@ async function validateTools(token, tcId, region, skipPrompt) {
     for (const tool of allTools.tools) {
         const toolName = (tool.name || tool.parameters?.name || tool.parameters?.label || '').replace(/\s+/g, '+');
         logger.updateSpinnerMsg(`Validating tool \'${toolName}\'`);
-        const toolUrl = `https://cloud.ibm.com/devops/toolchains/${tool.toolchain_id}/configure/${tool.id}?env_id=ibm:yp:${region}`;
+        const toolUrl = `https://${CLOUD_PLATFORM}/devops/toolchains/${tool.toolchain_id}/configure/${tool.id}?env_id=ibm:yp:${region}`;
 
         if (tool.state !== 'configured') {  // Check for tools in misconfigured/unconfigured/configuring state
             nonConfiguredTools.push({
@@ -278,7 +281,7 @@ async function validateTools(token, tcId, region, skipPrompt) {
     }
 
     if (toolsWithHashedParams.length > 0) {
-        logger.warn('Warning! The following tools contain secrets that cannot be migrated, please use the \'check-secrets\' command to export the secrets: \n', LOG_STAGES.setup, true);
+        logger.warn('Warning! The following tools contain secrets that cannot be migrated, please use the \'export-secrets\' command to export the secrets: \n', LOG_STAGES.setup, true);
         logger.table(toolsWithHashedParams);
     }
 
@@ -394,7 +397,7 @@ async function validateOAuth(token, tools, targetRegion, skipPrompt) {
             logger.print(`${o.type}: \x1b[36m${o.link}\x1b[0m\n`);
         });
 
-        if (hasFailedLink) logger.print(`Please manually verify failed authorization(s): https://cloud.ibm.com/devops/git?env_id=ibm:yp:${targetRegion}\n`);
+        if (hasFailedLink) logger.print(`Please manually verify failed authorization(s): https://${CLOUD_PLATFORM}/devops/git?env_id=ibm:yp:${targetRegion}\n`);
 
         if (!skipPrompt) await promptUserConfirmation('Caution: The above git tool integration(s) will not be properly configured post migration. Do you want to proceed?', 'yes', 'Toolchain migration cancelled.');
     }
@@ -405,8 +408,9 @@ async function validateGritUrl(token, region, url, validateFull) {
     let trimmed;
 
     if (validateFull) {
-        if (!url.startsWith(`https://${region}.git.cloud.ibm.com/`) || !url.endsWith('.git')) throw Error('Provided full GRIT url is not valid');
-        trimmed = url.slice(`https://${region}.git.cloud.ibm.com/`.length, url.length - '.git'.length);
+        const baseUrl = (GIT_BASE_URL || `https://${region}.git.cloud.ibm.com`) + '/';
+        if (!url.startsWith(baseUrl) || !url.endsWith('.git')) throw Error('Provided full GRIT url is not valid');
+        trimmed = url.slice(baseUrl.length, url.length - '.git'.length);
     } else {
         trimmed = url.trim();
     }

package/create-s2s-script.js

@@ -16,9 +16,13 @@ if (!API_KEY) throw Error(`Missing 'IBMCLOUD_API_KEY'`);
 const TC_ID = process.env['TARGET_TOOLCHAIN_ID'];
 if (!TC_ID) throw Error(`Missing 'TARGET_TOOLCHAIN_ID'`);
 
+const CLOUD_PLATFORM = process.env['IBMCLOUD_PLATFORM'] || 'cloud.ibm.com';
+if (!CLOUD_PLATFORM) throw Error(`Missing 'IBMCLOUD_PLATFORM'`);
+
+const IAM_BASE_URL = process.env['IAM_BASE_URL'] || 'https://iam.cloud.ibm.com';
+if (!IAM_BASE_URL) throw Error(`Missing 'IAM_BASE_URL'`);
+
 const INPUT_PATH = 'create-s2s.json';
-const CLOUD_PLATFORM = 'https://cloud.ibm.com';
-const IAM_BASE_URL = 'https://iam.cloud.ibm.com';
 
 async function getBearer() {
     const url = `${IAM_BASE_URL}/identity/token`;
@@ -69,7 +73,7 @@ async function getBearer() {
 */
 
 async function createS2sAuthPolicy(bearer, item) {
-    const url = `${CLOUD_PLATFORM}/devops/setup/api/v2/s2s_authorization?${new URLSearchParams({
+    const url = `https://${CLOUD_PLATFORM}/devops/setup/api/v2/s2s_authorization?${new URLSearchParams({
         toolchainId: TC_ID,
         serviceId: item['serviceId'],
         env_id: item['env_id']

package/index.js

@@ -10,13 +10,20 @@
 
 import { program } from 'commander';
 import * as commands from './cmd/index.js'
+import { DOCS_URL } from './config.js';
+import { logger } from './cmd/utils/logger.js';
+
 import packageJson from './package.json' with { type: "json" };
 
+process.on('exit', (code) => {
+    if (code !== 0) logger.print(`Need help? Visit ${DOCS_URL} for more troubleshooting information.`);
+});
+
 program
-  .name(packageJson.name)
-  .description('Tools and utilities for the IBM Cloud Continuous Delivery service and resources.')
-  .version(packageJson.version)
-  .showHelpAfterError();
+    .name(packageJson.name)
+    .description('Tools and utilities for the IBM Cloud Continuous Delivery service and resources.')
+    .version(packageJson.version)
+    .showHelpAfterError();
 
 for (let i in commands) {
     program.addCommand(commands[i]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibm-cloud/cd-tools",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Tools and utilities for the IBM Cloud Continuous Delivery service and resources",
   "repository": {
     "type": "git",

package/test/README.md

@@ -36,6 +36,6 @@ You can customize the behavior of the tests by defining configuration properties
 | `TEST_TEMP_DIR`    | `string`  | `test/.tmp`       | The directory to store temporary files generated by test cases                                                               |
 | `TEST_LOG_DIR`     | `string`  | `test/.test-logs` | The directory to store test run log files                                                                                    |
 | `IBMCLOUD_API_KEY` | `string`  | `null`            | The IBM Cloud API Key used to run the tests                                                                                  |
-| `LOG_DUMP`         | `boolean` | `false`           | When set to `true`, individual test case's process's log file generation is enabled                                          |
+| `LOG_DUMP`         | `boolean` | `false`           | When set to `true`, individual test case's process's log file generation is enabled, and logs are written to `TEST_TEMP_DIR` |
 | `DISABLE_SPINNER`  | `boolean` | `true`            | When set to `true`, visual spinner is disabled across all test cases' processes                                              |
-| `VERBOSE_MODE`     | `boolean` | `false`           |  When set to `true`, each test case's log output increases                                                                   |
+| `VERBOSE_MODE`     | `boolean` | `false`           | When set to `true`, each test case's log output increases                                                                    |

package/test/config/local.template.json

@@ -3,7 +3,7 @@
     "TEST_TEMP_DIR": "test/.tmp",
     "TEST_LOG_DIR": "test/.logs",
     "IBMCLOUD_API_KEY": "<YOUR IBMCLOUD API KEY>",
-    "LOG_DUMP": true,
+    "LOG_DUMP": false,
     "DISABLE_SPINNER": true,
     "VERBOSE_MODE": false
 }

package/test/copy-toolchain/functionalities.test.js

@@ -11,8 +11,6 @@ import path from 'node:path';
 import nconf from 'nconf';
 import fs from 'node:fs';
 
-import * as chai from 'chai';
-chai.config.truncateThreshold = 0;
 import { expect, assert } from 'chai';
 
 import { assertPtyOutput, assertExecError, areFilesInDir, deleteCreatedToolchains, parseTcIdAndRegion } from '../utils/testUtils.js';

package/test/copy-toolchain/input-validation.test.js

@@ -11,9 +11,7 @@ import path from 'node:path';
 import nconf from 'nconf';
 import fs from 'node:fs';
 
-import * as chai from 'chai';
 import { expect } from 'chai';
-chai.config.truncateThreshold = 0;
 
 import mocks from '../data/mocks.js';
 import { assertExecError, assertPtyOutput } from '../utils/testUtils.js';
@@ -81,12 +79,12 @@ describe('copy-toolchain: Test user input handling', function () {
         {
             name: 'Invalid Resource Group name is provided',
             cmd: [CLI_PATH, COMMAND, '-c', validCrn, '-r', TARGET_REGIONS[0], '-g', mocks.invalidRgName],
-            expected: /The resource group with provided ID or name was not found or is not accessible/,
+            expected: /No matching resource groups were found for the provided id\(s\) or name\(s\)/,
         },
         {
             name: 'Invalid Resource Group ID is provided',
             cmd: [CLI_PATH, COMMAND, '-c', validCrn, '-r', TARGET_REGIONS[0], '-g', mocks.invalidRgId],
-            expected: /The resource group with provided ID or name was not found or is not accessible/,
+            expected: /No matching resource groups were found for the provided id\(s\) or name\(s\)/,
         },
         {
             name: 'Non-existent GRIT mapping file provided',

package/test/copy-toolchain/tf-import.test.js

@@ -10,9 +10,6 @@
 import path from 'node:path';
 import nconf from 'nconf';
 
-import * as chai from 'chai';
-chai.config.truncateThreshold = 0;
-
 import { assertTfResourcesInDir, assertPtyOutput } from '../utils/testUtils.js';
 import { TEST_TOOLCHAINS } from '../data/test-toolchains.js';
 

package/test/copy-toolchain/tool-validation.test.js

@@ -10,8 +10,6 @@
 import path from 'node:path';
 import nconf from 'nconf';
 
-import * as chai from 'chai';
-chai.config.truncateThreshold = 0;
 import { expect } from 'chai';
 
 import { assertPtyOutput, deleteCreatedToolchains } from '../utils/testUtils.js';
@@ -87,7 +85,7 @@ describe('copy-toolchain: Test tool validation', function () {
                 timeout: 30000
             },
             assertionFunc: (output) => {
-                expect(output).to.match(/Warning! The following GRIT integration\(s\) are using auth_type "pat", please switch to auth_type "oauth" before proceeding/);
+                expect(output).to.match(/Warning! The following GRIT integration\(s\) with auth_type "pat" are unsupported during migration and will automatically be converted to auth_type "oauth"/);
                 expect(output).to.match(/hostedgit/);
                 expect(output).to.match(/Warning! The following tools contain secrets that cannot be migrated/);
                 expect(output).to.match(/githubconsolidated[\s\S]*?api_token/);

package/cmd/check-secrets.js

@@ -1,111 +0,0 @@
-/**
- * Licensed Materials - Property of IBM
- * (c) Copyright IBM Corporation 2025. All Rights Reserved.
- *
- * Note to U.S. Government Users Restricted Rights:
- * Use, duplication or disclosure restricted by GSA ADP Schedule
- * Contract with IBM Corp.
- */
-'use strict';
-
-import { exit } from 'node:process';
-import { Command } from 'commander';
-import { parseEnvVar, decomposeCrn, isSecretReference } from './utils/utils.js';
-import { logger, LOG_STAGES } from './utils/logger.js';
-import { getBearerToken, getToolchainTools, getPipelineData } from './utils/requests.js';
-import { SECRET_KEYS_MAP } from '../config.js';
-
-const command = new Command('check-secrets')
-    .description('Checks if you have any stored secrets in your toolchain or pipelines')
-    .requiredOption('-c, --toolchain-crn <crn>', 'The CRN of the source toolchain to check')
-    .option('-a --apikey <api key>', 'IBM Cloud IAM API key with permissions to read the toolchain.')
-    .showHelpAfterError()
-    .hook('preAction', cmd => cmd.showHelpAfterError(false)) // only show help during validation
-    .action(main);
-
-async function main(options) {
-    const toolchainCrn = options.toolchainCrn;
-    const apiKey = options.apikey || parseEnvVar('IBMCLOUD_API_KEY');
-
-    if (!apiKey) {
-        logger.error('Missing IBM Cloud IAM API key', LOG_STAGES.setup);
-        exit(1);
-    };
-
-    logger.print(`Checking secrets for toolchain ${toolchainCrn}...`);
-
-    const decomposedCrn = decomposeCrn(toolchainCrn);
-
-    const token = await getBearerToken(apiKey);
-    const toolchainId = decomposedCrn.serviceInstance;
-    const region = decomposedCrn.location;
-
-    const getToolsRes = await getToolchainTools(token, toolchainId, region);
-
-    const toolResults = [];
-    const pipelineResults = [];
-
-    if (getToolsRes?.tools?.length > 0) {
-        for (let i = 0; i < getToolsRes.tools.length; i++) {
-            const tool = getToolsRes.tools[i];
-
-            // Skip iff it's GitHub/GitLab/GRIT integration with OAuth
-            if (['githubconsolidated', 'github_integrated', 'gitlab', 'hostedgit'].includes(tool.tool_type_id) && (tool.parameters?.auth_type === '' || tool.parameters?.auth_type === 'oauth'))
-                continue;
-
-            // Check tool integrations for any plain text secret values
-            if (SECRET_KEYS_MAP[tool.tool_type_id]) {
-                SECRET_KEYS_MAP[tool.tool_type_id].forEach((entry) => {
-                    const updateableSecretParam = entry.key;
-                    if (tool.parameters[updateableSecretParam] && !isSecretReference(tool.parameters[updateableSecretParam]) && tool.parameters[updateableSecretParam].length > 0) {
-                        toolResults.push({
-                            'Tool ID': tool.id,
-                            'Tool Type': tool.tool_type_id,
-                            'Property Name': updateableSecretParam
-                        });
-                    };
-                });
-            };
-
-            // For tekton pipelines, check for any plain text secret properties
-            if (tool.tool_type_id === 'pipeline' && tool.parameters?.type === 'tekton') {
-                const pipelineData = await getPipelineData(token, tool.id, region);
-
-                pipelineData?.properties.forEach((prop) => {
-                    if (prop.type === 'secure' && !isSecretReference(prop.value) && prop.value.length > 0) {
-                        pipelineResults.push({
-                            'Pipeline ID': pipelineData.id,
-                            'Trigger Name': '-',
-                            'Property Name': prop.name
-                        });
-                    };
-                });
-
-                pipelineData?.triggers.forEach((trigger) => {
-                    trigger.properties?.forEach((prop) => {
-                        if (prop.type === 'secure' && !isSecretReference(prop.value) && prop.value.length > 0) {
-                            pipelineResults.push({
-                                'Pipeline ID': pipelineData.id,
-                                'Trigger Name': trigger.name,
-                                'Property Name': prop.name
-                            });
-                        };
-                    });
-                });
-            }
-        };
-    };
-
-    if (toolResults.length > 0) {
-        logger.print();
-        logger.print('The following plain text properties were found in tool integrations bound to the toolchain:');
-        logger.table(toolResults);
-    };
-    if (pipelineResults.length > 0) {
-        logger.print();
-        logger.print('The following plain text properties were found in Tekton pipeline(s) bound to the toolchain:');
-        logger.table(pipelineResults);
-    };
-};
-
-export default command;