antelope-cli 1.2.3 → 1.2.4

package/ansible/onboarding-ca/README.md

@@ -1,105 +1,105 @@
-# Client Area brand onboarding (Ansible)
-
-Automates onboarding a new client brand into
-[`web-client-area`](https://bitbucket.org/xsitesinc/web-client-area): it creates the brand
-assets and opens the pull request(s), reproducing the manual onboarding PRs
-(e.g. [#4266](https://bitbucket.org/xsitesinc/web-client-area/pull-requests/4266)).
-
-Per brand it creates, under the target repo:
-
-- `src/assets/other/<folder>/<folder>.scss` — empty stylesheet
-- `src/assets/other/<folder>/legal/risk-disclaimer.html` — the standard disclaimer
-
-The file creation is delegated to the `onboarding-ca` command of the published
-[`antelope-cli`](https://www.npmjs.com/package/antelope-cli) (`npx antelope-cli@<version> onboarding-ca`);
-this role owns cloning, branching, committing, pushing and PR creation.
-
-## Preconditions (control node)
-
-- `git`, Node.js (engines `^16.20.2`) and `npx` on `PATH`.
-- An **SSH key authorized to push** to `xsitesinc/web-client-area` (push is over SSH).
-- An **Atlassian API token** (`ATATT…`) for the account in `bitbucket_email`, carrying Bitbucket
-  scopes `read:user`, `read:repository`, `read:pullrequest`, `write:pullrequest`. Used only for the
-  REST calls (reviewer lookup + PR creation) via **HTTP Basic auth** (`email:token`) — these tokens
-  are **not** Bearer tokens. Create at <https://id.atlassian.com/manage-profile/security/api-tokens>.
-  Provide via `--extra-vars` / Ansible Vault, or leave it blank and let the playbook fetch it from
-  1Password (item `jenkins@xsites.co.il`, field `bitbucket_scoped_token`).
-- A **Consul token** with `read` scope on `version/*` (v2 cluster) — used to derive the destination
-  branches from the release train. Provide via `-e consul_token=…`, `$CONSUL_HTTP_TOKEN`, or leave it
-  blank and let the playbook fetch it from 1Password (item `New_Consul_Token`, field `password`).
-  Not needed when you pass an explicit `dest_branches` override.
-- A **signed-in `op` CLI** (`op signin`, or `OP_SERVICE_ACCOUNT_TOKEN`) if you rely on the 1Password
-  fallbacks above instead of passing the tokens explicitly.
-- The **`community.general`** collection (for the `dict_kv` filter): `ansible-galaxy collection install -r requirements.yml`.
-
-## Usage
-
-Interactive (prompts for the inputs):
-
-```bash
-ansible-playbook onboard-ca.yml
-```
-
-Non-interactive (for CI / wrapping playbooks) — extra-vars skip the prompts. Destination
-branches are derived from Consul, and both tokens fall back to 1Password, so the minimal run is:
-
-```bash
-ansible-playbook onboard-ca.yml \
-  -e brand_name="Zenith Horizon Group" \
-  -e jira_key_client_branding=ATLP-47067
-```
-
-Passing the tokens explicitly (skips the 1Password lookups) and pinning the branches:
-
-```bash
-ansible-playbook onboard-ca.yml \
-  -e brand_name="Zenith Horizon Group" \
-  -e jira_key_client_branding=ATLP-47067 \
-  -e dest_branches=develop,master-26.9 \
-  -e consul_token="$CONSUL_HTTP_TOKEN" \
-  -e bitbucket_email=jenkins@xsites.co.il \
-  -e bitbucket_token="$BITBUCKET_TOKEN"
-```
-
-Note: pass token values literally (or via a shell variable as above). Do **not** prefix a raw
-`ATATT…` token with `$` — the shell would try to expand it as a variable and send an empty token.
-
-## Inputs
-
-| var | required | example                                           | notes |
-|-----|----------|---------------------------------------------------|-------|
-| `brand_name` | yes | `Zenith Horizon Group`                            | display name → PR title |
-| `jira_key_client_branding` | yes | `ATLP-47067`                                      | PR title prefix + branch name |
-| `bitbucket_token` | no* | *(secret)*                                        | Atlassian API token (`ATATT…`) for the REST calls; sent via Basic auth. *Blank ⇒ fetched from 1Password (`jenkins@xsites.co.il` / `bitbucket_scoped_token`)* |
-| `bitbucket_email` | yes | `jenkins@xsites.co.il`                            | account that owns the token (Basic-auth username); defaults to the Jenkins service account |
-| `dest_branches` | no | `develop,master-26.9`                             | comma-separated override; **blank ⇒ derived from Consul** (see below). **One PR per branch** |
-| `consul_token` | no* | *(secret)*                                        | read scope on `version/*`. *Blank ⇒ `$CONSUL_HTTP_TOKEN`, else 1Password (`New_Consul_Token` / `password`)*. Unused when `dest_branches` is set |
-| `brand_assets_folder` | no | `zenithhorizongroup`                              | folder name → CLI `--brand_assets_folder`, branch name; prompted separately. Blank ⇒ derived from `brand_name` (lowercased, spaces removed) |
-| `reviewers` | no | *(auto)*                                          | default: repo's Bitbucket default-reviewers (author excluded); override with `[{account_id: "..."}]` |
-| `consul_url` | no | `https://consul.xsites.xyz`                       | Consul base URL for the version lookup |
-| `onepassword_bitbucket_item` / `_field` | no | `jenkins@xsites.co.il` / `bitbucket_scoped_token` | 1Password source for the Bitbucket token |
-| `onepassword_consul_item` / `_field` | no | `New_Consul_Token` / `password`                   | 1Password source for the Consul token |
-| `antelope_cli_version` | no | `1.2.3`                                           | pinned published CLI version |
-| `work_dir` | no | `/tmp/onboard-ca/web-client-area`                 | clone location |
-| `git_user_name` / `git_user_email` | no |                                                   | commit identity |
-
-## Behavior notes
-
-- **Destination branches are derived from the release train in Consul** (unless `dest_branches`
-  is passed). `develop` is always onboarded; `master-<version/prod>` tracks the live release; and
-  while a new release is staged (`version/staging != version/prod`) its `master-<version/staging>`
-  is onboarded too. Once staging has shipped (`staging == prod`) there is a single master branch.
-- **One PR per destination branch.** `develop` → `feature/<jira>-onboarding-<folder>`;
-  `master-*`/`release-*` → `hotfix/<jira>-onboarding-<folder>`. Each branch is based on its own
-  destination so diverged histories don't bleed across PRs.
-- **Reviewers** are read from the repo's Bitbucket *Default reviewers* config; the authenticating
-  account is excluded (Bitbucket rejects a PR whose author is a reviewer).
-- **Idempotent:** re-running with the same inputs recreates the (identical) files on the existing
-  source branch, detects no staged changes, skips commit/push, and tolerates the "PR already exists"
-  response (HTTP 400).
-- The playbook prints a summary of created PRs (destination, source branch, status, URL).
-
-## Scope
-
-Client Area only. web-crm onboarding is a separate, independent process (its file edits live in
-antelope-cli's existing `onboarding` command) and is not run by this playbook.
+# Client Area brand onboarding (Ansible)
+
+Automates onboarding a new client brand into
+[`web-client-area`](https://bitbucket.org/xsitesinc/web-client-area): it creates the brand
+assets and opens the pull request(s), reproducing the manual onboarding PRs
+(e.g. [#4266](https://bitbucket.org/xsitesinc/web-client-area/pull-requests/4266)).
+
+Per brand it creates, under the target repo:
+
+- `src/assets/other/<folder>/<folder>.scss` — empty stylesheet
+- `src/assets/other/<folder>/legal/risk-disclaimer.html` — the standard disclaimer
+
+The file creation is delegated to the `onboarding-ca` command of the published
+[`antelope-cli`](https://www.npmjs.com/package/antelope-cli) (`npx antelope-cli@<version> onboarding-ca`);
+this role owns cloning, branching, committing, pushing and PR creation.
+
+## Preconditions (control node)
+
+- `git`, Node.js (engines `^16.20.2`) and `npx` on `PATH`.
+- An **SSH key authorized to push** to `xsitesinc/web-client-area` (push is over SSH).
+- An **Atlassian API token** (`ATATT…`) for the account in `bitbucket_email`, carrying Bitbucket
+  scopes `read:user`, `read:repository`, `read:pullrequest`, `write:pullrequest`. Used only for the
+  REST calls (reviewer lookup + PR creation) via **HTTP Basic auth** (`email:token`) — these tokens
+  are **not** Bearer tokens. Create at <https://id.atlassian.com/manage-profile/security/api-tokens>.
+  Provide via `--extra-vars` / Ansible Vault, or leave it blank and let the playbook fetch it from
+  1Password (item `jenkins@xsites.co.il`, field `bitbucket_scoped_token`).
+- A **Consul token** with `read` scope on `version/*` (v2 cluster) — used to derive the destination
+  branches from the release train. Provide via `-e consul_token=…`, `$CONSUL_HTTP_TOKEN`, or leave it
+  blank and let the playbook fetch it from 1Password (item `New_Consul_Token`, field `password`).
+  Not needed when you pass an explicit `dest_branches` override.
+- A **signed-in `op` CLI** (`op signin`, or `OP_SERVICE_ACCOUNT_TOKEN`) if you rely on the 1Password
+  fallbacks above instead of passing the tokens explicitly.
+- The **`community.general`** collection (for the `dict_kv` filter): `ansible-galaxy collection install -r requirements.yml`.
+
+## Usage
+
+Interactive (prompts for the inputs):
+
+```bash
+ansible-playbook onboard-ca.yml
+```
+
+Non-interactive (for CI / wrapping playbooks) — extra-vars skip the prompts. Destination
+branches are derived from Consul, and both tokens fall back to 1Password, so the minimal run is:
+
+```bash
+ansible-playbook onboard-ca.yml \
+  -e brand_name="Zenith Horizon Group" \
+  -e jira_key_client_branding=ATLP-47067
+```
+
+Passing the tokens explicitly (skips the 1Password lookups) and pinning the branches:
+
+```bash
+ansible-playbook onboard-ca.yml \
+  -e brand_name="Zenith Horizon Group" \
+  -e jira_key_client_branding=ATLP-47067 \
+  -e dest_branches=develop,master-26.9 \
+  -e consul_token="$CONSUL_HTTP_TOKEN" \
+  -e bitbucket_email=jenkins@xsites.co.il \
+  -e bitbucket_token="$BITBUCKET_TOKEN"
+```
+
+Note: pass token values literally (or via a shell variable as above). Do **not** prefix a raw
+`ATATT…` token with `$` — the shell would try to expand it as a variable and send an empty token.
+
+## Inputs
+
+| var | required | example                                           | notes |
+|-----|----------|---------------------------------------------------|-------|
+| `brand_name` | yes | `Zenith Horizon Group`                            | display name → PR title |
+| `jira_key_client_branding` | yes | `ATLP-47067`                                      | PR title prefix + branch name |
+| `bitbucket_token` | no* | *(secret)*                                        | Atlassian API token (`ATATT…`) for the REST calls; sent via Basic auth. *Blank ⇒ fetched from 1Password (`jenkins@xsites.co.il` / `bitbucket_scoped_token`)* |
+| `bitbucket_email` | yes | `jenkins@xsites.co.il`                            | account that owns the token (Basic-auth username); defaults to the Jenkins service account |
+| `dest_branches` | no | `develop,master-26.9`                             | comma-separated override; **blank ⇒ derived from Consul** (see below). **One PR per branch** |
+| `consul_token` | no* | *(secret)*                                        | read scope on `version/*`. *Blank ⇒ `$CONSUL_HTTP_TOKEN`, else 1Password (`New_Consul_Token` / `password`)*. Unused when `dest_branches` is set |
+| `brand_assets_folder` | no | `zenithhorizongroup`                              | folder name → CLI `--brand_assets_folder`, branch name; prompted separately. Blank ⇒ derived from `brand_name` (lowercased, spaces removed) |
+| `reviewers` | no | *(auto)*                                          | default: repo's Bitbucket default-reviewers (author excluded); override with `[{account_id: "..."}]` |
+| `consul_url` | no | `https://consul.xsites.xyz`                       | Consul base URL for the version lookup |
+| `onepassword_bitbucket_item` / `_field` | no | `jenkins@xsites.co.il` / `bitbucket_scoped_token` | 1Password source for the Bitbucket token |
+| `onepassword_consul_item` / `_field` | no | `New_Consul_Token` / `password`                   | 1Password source for the Consul token |
+| `antelope_cli_version` | no | `1.2.3`                                           | pinned published CLI version |
+| `work_dir` | no | `/tmp/onboard-ca/web-client-area`                 | clone location |
+| `git_user_name` / `git_user_email` | no |                                                   | commit identity |
+
+## Behavior notes
+
+- **Destination branches are derived from the release train in Consul** (unless `dest_branches`
+  is passed). `develop` is always onboarded; `master-<version/prod>` tracks the live release; and
+  while a new release is staged (`version/staging != version/prod`) its `master-<version/staging>`
+  is onboarded too. Once staging has shipped (`staging == prod`) there is a single master branch.
+- **One PR per destination branch.** `develop` → `feature/<jira>-onboarding-<folder>`;
+  `master-*`/`release-*` → `hotfix/<jira>-onboarding-<folder>`. Each branch is based on its own
+  destination so diverged histories don't bleed across PRs.
+- **Reviewers** are read from the repo's Bitbucket *Default reviewers* config; the authenticating
+  account is excluded (Bitbucket rejects a PR whose author is a reviewer).
+- **Idempotent:** re-running with the same inputs recreates the (identical) files on the existing
+  source branch, detects no staged changes, skips commit/push, and tolerates the "PR already exists"
+  response (HTTP 400).
+- The playbook prints a summary of created PRs (destination, source branch, status, URL).
+
+## Scope
+
+Client Area only. web-crm onboarding is a separate, independent process (its file edits live in
+antelope-cli's existing `onboarding` command) and is not run by this playbook.

package/ansible/onboarding-ca/onboard-ca.yml

@@ -1,51 +1,43 @@
----
-# Onboard a Client Area brand into web-client-area and open the PR(s).
-#
-# Destination branches are derived from the release train in Consul (no manual input):
-#   develop is always onboarded; master-<version/prod> tracks the live release; while a
-#   new release is staged (version/staging != version/prod) its master-<version/staging>
-#   exists too and is onboarded as well. Pass -e dest_branches=... to override the lookup.
-#
-# Interactive:
-#   ansible-playbook onboard-ca.yml
-#
-# Non-interactive (e.g. from another playbook / CI), pass everything as extra-vars:
-  # ansible-playbook onboard-ca.yml \
-  #   -e brand_name="Eldadtestbrand" \
-  #   -e brand_assets_folder=eldadtestbrand \
-  #   -e jira_key_client_branding=ATLP-47067 \
-  #   -e consul_token="$CONSUL_HTTP_TOKEN" \   # read scope on version/*; used to derive dest branches
-  #   -e bitbucket_email=jenkins@xsites.co.il \
-  #   -e bitbucket_token=ATATT3x...   # Atlassian API token WITHOUT a leading '$' (it is a literal, not a shell var)
-
-# Preconditions on the control node: git + Node (>=16) + npx, an SSH key authorized to
-# push to xsitesinc/web-client-area, and an Atlassian API token (ATATT…) owned by
-# bitbucket_email, carrying Bitbucket scopes read:user / read:repository /
-# read+write:pullrequest. The token is used via HTTP Basic auth (email:token).
-- name: Onboard a Client Area brand (web-client-area)
-  hosts: localhost
-  connection: local
-  gather_facts: false
-
-  vars_prompt:
-    - name: brand_name
-      prompt: "Brand display name — used in the PR title (e.g. Zenith Horizon Group)"
-      private: false
-    - name: brand_assets_folder
-      prompt: "Brand assets folder name — the src/assets/other/<folder> (e.g. zenithhorizongroup); leave blank to derive from the display name"
-      default: ""
-      private: false
-    - name: jira_key_client_branding
-      prompt: "Jira key (e.g. ATLP-47067)"
-      private: false
-    - name: bitbucket_email
-      prompt: "Atlassian account email that owns the API token (Basic-auth username)"
-      default: "jenkins@xsites.co.il"
-      private: false
-    - name: bitbucket_token
-      prompt: "Atlassian API token (ATATT…); leave blank to fetch from 1Password (item jenkins@xsites.co.il)"
-      default: ""
-      private: true
-
-  roles:
-    - onboard_ca
+---
+# Onboard a Client Area brand into web-client-area and open the PR(s).
+#
+# Destination branches are derived from the release train in Consul (no manual input):
+#   develop is always onboarded; master-<version/prod> tracks the live release; while a
+#   new release is staged (version/staging != version/prod) its master-<version/staging>
+#   exists too and is onboarded as well. Pass -e dest_branches=... to override the lookup.
+#
+# Interactive:
+#   ansible-playbook onboard-ca.yml
+#
+# Non-interactive (e.g. from another playbook / CI), pass everything as extra-vars:
+  # ansible-playbook onboard-ca.yml \
+  #   -e brand_name="Eldadtestbrand" \
+  #   -e brand_assets_folder=eldadtestbrand \
+  #   -e jira_key_client_branding=ATLP-47067 \
+  #   -e consul_token="$CONSUL_HTTP_TOKEN" \   # read scope on version/*; used to derive dest branches
+  #   -e bitbucket_email=jenkins@xsites.co.il \
+  #   -e bitbucket_token=ATATT3x...   # Atlassian API token WITHOUT a leading '$' (it is a literal, not a shell var)
+
+# Preconditions on the control node: git + Node (>=16) + npx, an SSH key authorized to
+# push to xsitesinc/web-client-area, and an Atlassian API token (ATATT…) owned by
+# bitbucket_email, carrying Bitbucket scopes read:user / read:repository /
+# read+write:pullrequest. The token is used via HTTP Basic auth (email:token).
+- name: Onboard a Client Area brand (web-client-area)
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  # Only the required, non-defaulted inputs are prompted. Everything else comes from role
+  # defaults (brand_assets_folder derived from brand_name; bitbucket_email = jenkins service
+  # account; bitbucket_token / consul_token / jira_token from 1Password). Override any of
+  # them with -e. Pass -e brand_name=… -e jira_key_client_branding=… for a non-interactive run.
+  vars_prompt:
+    - name: brand_name
+      prompt: "Brand display name — used in the PR title (e.g. Zenith Horizon Group)"
+      private: false
+    - name: jira_key_client_branding
+      prompt: "Jira key (e.g. ATLP-47067)"
+      private: false
+
+  roles:
+    - onboard_ca

package/ansible/onboarding-ca/requirements.yml

@@ -1,8 +1,8 @@
----
-# Ansible collection dependencies for the onboarding-ca playbook.
-# Install with:  ansible-galaxy collection install -r requirements.yml
-collections:
-  # Provides the community.general.dict_kv filter used to build the Bitbucket
-  # reviewers array (roles/onboard_ca/tasks/main.yml).
-  - name: community.general
-    version: ">=8.0.0"
+---
+# Ansible collection dependencies for the onboarding-ca playbook.
+# Install with:  ansible-galaxy collection install -r requirements.yml
+collections:
+  # Provides the community.general.dict_kv filter used to build the Bitbucket
+  # reviewers array (roles/onboard_ca/tasks/main.yml).
+  - name: community.general
+    version: ">=8.0.0"

package/ansible/onboarding-ca/roles/onboard_ca/defaults/main.yml

@@ -1,49 +1,77 @@
----
-# Pinned published antelope-cli version that provides the `onboarding-ca` command.
-antelope_cli_version: "1.2.3"
-
-# Where web-client-area is cloned on the control node.
-work_dir: "/tmp/onboard-ca/web-client-area"
-
-# Brand assets folder name (used for ENV_branding.brand_assets_folder and the src/assets/other/<folder>).
-# Empty => derived from brand_name (lowercased, spaces removed), matching antelope-cli's
-# connectedBrandName so the folder name is identical across repos.
-brand_assets_folder: ""
-
-# Reviewers for the PR. Empty => auto-fetched from the repo's Bitbucket "Default reviewers"
-# config (the authenticating account is excluded automatically). Override with an explicit
-# list, e.g. [{ account_id: "..." }] or [{ uuid: "{...}" }], to bypass the lookup.
-reviewers: []
-
-# Identity used for the commit (control-node git may have no global config).
-git_user_name: "Jenkins"
-git_user_email: "jenkins@xsites.co.il"
-
-# Atlassian API token (ATATT…) for the reviewer lookup + PR creation. Sent via HTTP
-# Basic auth together with bitbucket_email — these tokens are NOT Bearer tokens and
-# must carry Bitbucket scopes (read:user, read:repository, read/write:pullrequest).
-# Empty => fetched from 1Password (see onepassword_bitbucket_* below). Provide via
-# --extra-vars or Ansible Vault to skip the lookup; never commit a real value.
-bitbucket_token: ""
-
-# Email of the Atlassian account that owns bitbucket_token (the Basic-auth username).
-# Defaults to the Jenkins service account; override via --extra-vars for a different account.
-bitbucket_email: "jenkins@xsites.co.il"
-
-# Consul token with read scope on version/* (v2 cluster). Used to derive the destination
-# branches from the release train (version/prod, version/staging). Empty => resolved from
-# $CONSUL_HTTP_TOKEN, else from 1Password (see onepassword_consul_* below). Not needed when
-# an explicit dest_branches override is passed. Never commit a real value.
-consul_token: ""
-
-# Explicit destination-branch override (comma-separated). Empty => derived from Consul:
-# develop + master-<version/prod> [+ master-<version/staging> while a release is staged].
-# Set this to bypass the Consul lookup entirely, e.g. dest_branches=develop,master-26.9.
-dest_branches: ""
-
-# 1Password fallbacks — used only when the corresponding token is not otherwise provided.
-# Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
-onepassword_bitbucket_item: "jenkins@xsites.co.il"
-onepassword_bitbucket_field: "bitbucket_scoped_token"
-onepassword_consul_item: "New_Consul_Token"
-onepassword_consul_field: "password"
+---
+# Pinned published antelope-cli version that provides the `onboarding-ca` command.
+antelope_cli_version: "1.2.3"
+
+# Where web-client-area is cloned on the control node.
+work_dir: "/tmp/onboard-ca/web-client-area"
+
+# Brand assets folder name (used for ENV_branding.brand_assets_folder and the src/assets/other/<folder>).
+# Empty => derived from brand_name (lowercased, spaces removed), matching antelope-cli's
+# connectedBrandName so the folder name is identical across repos.
+brand_assets_folder: ""
+
+# Reviewers for the PR. Empty => auto-fetched from the repo's Bitbucket "Default reviewers"
+# config (the authenticating account is excluded automatically). Override with an explicit
+# list, e.g. [{ account_id: "..." }] or [{ uuid: "{...}" }], to bypass the lookup.
+reviewers: []
+
+# Identity used for the commit (control-node git may have no global config).
+git_user_name: "Jenkins"
+git_user_email: "jenkins@xsites.co.il"
+
+# Atlassian API token (ATATT…) for the reviewer lookup + PR creation. Sent via HTTP
+# Basic auth together with bitbucket_email — these tokens are NOT Bearer tokens and
+# must carry Bitbucket scopes (read:user, read:repository, read/write:pullrequest).
+# Empty => fetched from 1Password (see onepassword_bitbucket_* below). Provide via
+# --extra-vars or Ansible Vault to skip the lookup; never commit a real value.
+bitbucket_token: ""
+
+# Email of the Atlassian account that owns bitbucket_token (the Basic-auth username).
+# Defaults to the Jenkins service account; override via --extra-vars for a different account.
+bitbucket_email: "jenkins@xsites.co.il"
+
+# Consul token with read scope on version/* (v2 cluster). Used to derive the destination
+# branches from the release train (version/prod, version/staging). Empty => resolved from
+# $CONSUL_HTTP_TOKEN, else from 1Password (see onepassword_consul_* below). Not needed when
+# an explicit dest_branches override is passed. Never commit a real value.
+consul_token: ""
+
+# Explicit destination-branch override (comma-separated). Empty => derived from Consul:
+# develop + master-<version/prod> [+ master-<version/staging> while a release is staged].
+# Set this to bypass the Consul lookup entirely, e.g. dest_branches=develop,master-26.9.
+dest_branches: ""
+
+# 1Password fallbacks — used only when the corresponding token is not otherwise provided.
+# Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
+# Service-account auth requires an explicit vault for `op item get` by name (op errors
+# with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
+onepassword_vault: "DevOps"
+onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
+onepassword_bitbucket_field: "credential"
+onepassword_consul_item: "New_Consul_Token"
+onepassword_consul_field: "password"
+
+# --- Jira automation (DangerJS Fix Version gate) -------------------------------------
+# The web-client-area DangerJS pipeline FAILS any PR whose linked Jira issue has no Fix
+# Version ("ATLP-XXXXX doesn't have a fix version") — develop feature branches included,
+# not only hotfix→master. This step stamps the release Fix Version on
+# jira_key_client_branding BEFORE the branches are pushed (so the pipeline is green on its
+# first run). Non-fatal: a missing jira_token / unmatched version just warns and skips.
+manage_jira_fix_version: true
+jira_base_url: "https://xsites.atlassian.net"
+# Project key — defaults to the prefix of the Jira key (ATLP-47269 -> ATLP).
+jira_project_key: "{{ (jira_key_client_branding | default('')).split('-')[0] }}"
+# Release version name = jira_version_prefix + <version/prod> (e.g. 27.0 -> V27.0).
+jira_version_prefix: "V"
+# Atlassian API token (ATATT) that carries JIRA scopes + the email that owns it (Basic
+# auth). This is SEPARATE from bitbucket_token, which is Bitbucket-scoped only. Empty =>
+# fetched from 1Password (onepassword_jira_* below). Override via --extra-vars in CI.
+jira_token: ""
+# NOTE: jira_email must own jira_token (Atlassian Basic auth = email:token). jenkins@xsites.co.il
+# now has a Jira seat (2026-07-16) with BROWSE_PROJECTS + EDIT_ISSUES on ATLP; its token is a
+# CLASSIC (unscoped) Atlassian API token stored in the DevOps note 'Jira API - jenkins@xsites.co.il'
+# (field credential). Verified /myself 200 + fixVersions add. NB scoped tokens 401 on Jira REST —
+# must be the classic unscoped kind. (eldadp personal my_attlasian_token still works as a fallback.)
+jira_email: "jenkins@xsites.co.il"
+onepassword_jira_item: "Jira API - jenkins@xsites.co.il"
+onepassword_jira_field: "credential"

package/ansible/onboarding-ca/roles/onboard_ca/meta/main.yml

@@ -1,10 +1,10 @@
----
-galaxy_info:
-  role_name: onboard_ca
-  author: Antelope Systems
-  description: >-
-    Onboard a Client Area brand: create the brand assets in web-client-area
-    (via antelope-cli onboarding-ca) and open the pull request(s).
-  license: ISC
-  min_ansible_version: "2.12"
-dependencies: []
+---
+galaxy_info:
+  role_name: onboard_ca
+  author: Antelope Systems
+  description: >-
+    Onboard a Client Area brand: create the brand assets in web-client-area
+    (via antelope-cli onboarding-ca) and open the pull request(s).
+  license: ISC
+  min_ansible_version: "2.12"
+dependencies: []