antelope-cli 1.2.3 → 1.2.5

package/ansible/onboarding-ca/roles/onboard_ca/tasks/per_branch.yml

@@ -1,107 +1,114 @@
----
-# Runs once per destination branch. `dest_branch` is the loop var.
-
-- name: "[{{ dest_branch }}] Compose source branch name"
-  ansible.builtin.set_fact:
-    branch_prefix: "{{ 'hotfix' if dest_branch is match('(master|release)') else 'feature' }}"
-
-- name: "[{{ dest_branch }}] Set source branch"
-  ansible.builtin.set_fact:
-    source_branch: "{{ branch_prefix }}/{{ jira_key_client_branding }}-onboarding-{{ brand_assets_folder }}"
-
-- name: "[{{ dest_branch }}] Fetch all remote branches"
-  ansible.builtin.command:
-    cmd: git fetch origin --prune
-    chdir: "{{ work_dir }}"
-  changed_when: false
-
-- name: "[{{ dest_branch }}] Does the source branch already exist on origin?"
-  ansible.builtin.command:
-    cmd: "git ls-remote --exit-code --heads origin {{ source_branch }}"
-    chdir: "{{ work_dir }}"
-  register: remote_src
-  failed_when: false
-  changed_when: false
-
-# Base the working branch on its own remote head if it already exists (idempotent re-run),
-# otherwise on the destination branch.
-- name: "[{{ dest_branch }}] Check out the working branch"
-  ansible.builtin.command:
-    cmd: >-
-      git checkout -B {{ source_branch }}
-      {{ ('origin/' + source_branch) if remote_src.rc == 0 else ('origin/' + dest_branch) }}
-    chdir: "{{ work_dir }}"
-
-- name: "[{{ dest_branch }}] Generate brand files via antelope-cli"
-  ansible.builtin.command:
-    argv:
-      - npx
-      - "antelope-cli@{{ antelope_cli_version }}"
-      - onboarding-ca
-      - --brand_assets_folder
-      - "{{ brand_assets_folder }}"
-    chdir: "{{ work_dir }}"
-  environment:
-    CI: "true"
-  changed_when: true
-
-- name: "[{{ dest_branch }}] Stage changes"
-  ansible.builtin.command:
-    cmd: git add -A
-    chdir: "{{ work_dir }}"
-  changed_when: false
-
-- name: "[{{ dest_branch }}] Detect staged changes"
-  ansible.builtin.command:
-    cmd: git diff --cached --quiet
-    chdir: "{{ work_dir }}"
-  register: staged
-  failed_when: false
-  changed_when: false
-
-- name: "[{{ dest_branch }}] Commit"
-  ansible.builtin.command:
-    cmd: >-
-      git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
-      commit -m "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
-    chdir: "{{ work_dir }}"
-  when: staged.rc == 1
-
-- name: "[{{ dest_branch }}] Push source branch"
-  ansible.builtin.command:
-    cmd: "git push -u origin {{ source_branch }}"
-    chdir: "{{ work_dir }}"
-  when: staged.rc == 1
-
-- name: "[{{ dest_branch }}] Open pull request"
-  ansible.builtin.uri:
-    url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
-    method: POST
-    url_username: "{{ bitbucket_email }}"
-    url_password: "{{ bitbucket_token }}"
-    force_basic_auth: true
-    body_format: json
-    body:
-      title: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
-      description: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
-      source:
-        branch:
-          name: "{{ source_branch }}"
-      destination:
-        branch:
-          name: "{{ dest_branch }}"
-      reviewers: "{{ reviewers }}"
-      close_source_branch: true
-    return_content: true
-    status_code: [201, 400]   # 400 tolerated: a PR for this source->dest already exists
-  register: pr_response
-
-- name: "[{{ dest_branch }}] Record PR result"
-  ansible.builtin.set_fact:
-    pr_results: >-
-      {{ (pr_results | default([])) + [{
-           'destination': dest_branch,
-           'source': source_branch,
-           'status': pr_response.status,
-           'url': (pr_response.json.links.html.href | default('(already exists or not created)'))
-         }] }}
+---
+# Runs once per destination branch. `dest_branch` is the loop var.
+
+- name: "[{{ dest_branch }}] Compose source branch name"
+  ansible.builtin.set_fact:
+    branch_prefix: "{{ 'hotfix' if dest_branch is match('(master|release)') else 'feature' }}"
+
+# Suffix the release version onto master/release targets so each destination gets its OWN
+# source branch. Without it, master-27.0 and master-27.1 (both present during a staged
+# release, e.g. after a code freeze) collapse to one hotfix branch → the 2nd PR reuses the
+# 1st's branch (wrong base) and close_source_branch on either merge kills the other PR.
+- name: "[{{ dest_branch }}] Set source branch"
+  ansible.builtin.set_fact:
+    source_branch: >-
+      {{ branch_prefix }}/{{ jira_key_client_branding }}-onboarding-{{ brand_assets_folder }}{{
+         ('-' ~ (dest_branch | regex_replace('^(master|release)-', '')))
+         if dest_branch is match('(master|release)') else '' }}
+
+- name: "[{{ dest_branch }}] Fetch all remote branches"
+  ansible.builtin.command:
+    cmd: git fetch origin --prune
+    chdir: "{{ work_dir }}"
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Does the source branch already exist on origin?"
+  ansible.builtin.command:
+    cmd: "git ls-remote --exit-code --heads origin {{ source_branch }}"
+    chdir: "{{ work_dir }}"
+  register: remote_src
+  failed_when: false
+  changed_when: false
+
+# Base the working branch on its own remote head if it already exists (idempotent re-run),
+# otherwise on the destination branch.
+- name: "[{{ dest_branch }}] Check out the working branch"
+  ansible.builtin.command:
+    cmd: >-
+      git checkout -B {{ source_branch }}
+      {{ ('origin/' + source_branch) if remote_src.rc == 0 else ('origin/' + dest_branch) }}
+    chdir: "{{ work_dir }}"
+
+- name: "[{{ dest_branch }}] Generate brand files via antelope-cli"
+  ansible.builtin.command:
+    argv:
+      - npx
+      - "antelope-cli@{{ antelope_cli_version }}"
+      - onboarding-ca
+      - --brand_assets_folder
+      - "{{ brand_assets_folder }}"
+    chdir: "{{ work_dir }}"
+  environment:
+    CI: "true"
+  changed_when: true
+
+- name: "[{{ dest_branch }}] Stage changes"
+  ansible.builtin.command:
+    cmd: git add -A
+    chdir: "{{ work_dir }}"
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Detect staged changes"
+  ansible.builtin.command:
+    cmd: git diff --cached --quiet
+    chdir: "{{ work_dir }}"
+  register: staged
+  failed_when: false
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Commit"
+  ansible.builtin.command:
+    cmd: >-
+      git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
+      commit -m "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
+    chdir: "{{ work_dir }}"
+  when: staged.rc == 1
+
+- name: "[{{ dest_branch }}] Push source branch"
+  ansible.builtin.command:
+    cmd: "git push -u origin {{ source_branch }}"
+    chdir: "{{ work_dir }}"
+  when: staged.rc == 1
+
+- name: "[{{ dest_branch }}] Open pull request"
+  ansible.builtin.uri:
+    url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
+    method: POST
+    url_username: "{{ bitbucket_email }}"
+    url_password: "{{ bitbucket_token }}"
+    force_basic_auth: true
+    body_format: json
+    body:
+      title: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
+      description: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
+      source:
+        branch:
+          name: "{{ source_branch }}"
+      destination:
+        branch:
+          name: "{{ dest_branch }}"
+      reviewers: "{{ reviewers }}"
+      close_source_branch: true
+    return_content: true
+    status_code: [201, 400]   # 400 tolerated: a PR for this source->dest already exists
+  register: pr_response
+
+- name: "[{{ dest_branch }}] Record PR result"
+  ansible.builtin.set_fact:
+    pr_results: >-
+      {{ (pr_results | default([])) + [{
+           'destination': dest_branch,
+           'source': source_branch,
+           'status': pr_response.status,
+           'url': (pr_response.json.links.html.href | default('(already exists or not created)'))
+         }] }}

package/ansible/onboarding-ca/roles/onboard_ca/vars/main.yml

@@ -1,9 +1,9 @@
----
-# Constants — the target repository for Client Area onboarding.
-api_base: "https://api.bitbucket.org/2.0"
-workspace: "xsitesinc"
-repo_slug: "web-client-area"
-repo_ssh_url: "git@bitbucket.org:xsitesinc/web-client-area.git"
-
-# Consul (v2 cluster) — source of the release train used to derive destination branches.
-consul_url: "https://consul.xsites.xyz"
+---
+# Constants — the target repository for Client Area onboarding.
+api_base: "https://api.bitbucket.org/2.0"
+workspace: "xsitesinc"
+repo_slug: "web-client-area"
+repo_ssh_url: "git@bitbucket.org:xsitesinc/web-client-area.git"
+
+# Consul (v2 cluster) — source of the release train used to derive destination branches.
+consul_url: "https://consul.xsites.xyz"

package/ansible/onboarding-crm/README.md

@@ -0,0 +1,107 @@
+# CRM brand onboarding (Ansible)
+
+Automates onboarding a new CRM brand into
+[`web-crm`](https://bitbucket.org/xsitesinc/web-crm): it creates the brand assets and opens
+the pull request(s). Sister automation to [`../onboarding-ca`](../onboarding-ca) — same
+clone / branch / commit / push / PR + Consul-derived branches + 1Password tokens + Jira
+Fix Version pattern, targeting `web-crm` instead of `web-client-area`.
+
+Per brand, in the target repo (all delegated to `npx antelope-cli@<version> onboarding-crm`):
+
+- `src/ng1/assets/css/sass/variables-colors.scss` — `$<id>` shades + `$colors` entry
+- `src/ng1/assets/css/sass/materialism/themes.scss` — theme maps + `.theme-template-<id>` block
+- `src/assets/brands/<id>/languages/<lang>.json` — one empty file per language
+- `src/configs/configs.ts` — rewritten for the brand (copy into the env's Consul config; gitignored, not committed)
+- `src/configs/brand-logos.json` — `"theme-template-<id>": "<logo_url>"` entry (the committed logo registry)
+- `BRAND_LOCATIONS.md` — sprint-tracking row `<name> -> <id>`
+
+This role owns cloning, branching, committing, pushing and PR creation.
+
+## Preconditions (control node)
+
+- `git`, Node.js (engines `^16.20.2`) and `npx` on `PATH`.
+- An **SSH key authorized to push** to `xsitesinc/web-crm` (push is over SSH).
+- An **Atlassian API token** (`ATATT…`) for the account in `bitbucket_email`, carrying Bitbucket
+  scopes `read:user`, `read:repository`, `read:pullrequest`, `write:pullrequest`. Used only for the
+  REST calls (reviewer lookup + PR creation) via **HTTP Basic auth** (`email:token`) — these tokens
+  are **not** Bearer tokens. Provide via `--extra-vars` / Ansible Vault, or leave it blank and let
+  the playbook fetch it from 1Password (item `jenkins@xsites.co.il`, field `bitbucket_scoped_token`).
+- A **Consul token** with `read` scope on `version/*` (v2 cluster) — used to derive the destination
+  branches. Provide via `-e consul_token=…`, `$CONSUL_HTTP_TOKEN`, or the 1Password item
+  `New_Consul_Token` / `password`. Not needed when you pass an explicit `dest_branches` override.
+- A **Jira token** (personal ATATT, `jira_email` owns it) for the Fix Version step — see below. Blank
+  ⇒ fetched from 1Password (`xvouzkhjw55xffdwyzk5npi2mu` / `my_attlasian_token`). The jenkins service
+  account has **no Jira seat**, so its tokens 401 on Jira — use a personal Jira-enabled token.
+- A **signed-in `op` CLI** (`op signin`, or `OP_SERVICE_ACCOUNT_TOKEN`) if you rely on the 1Password
+  fallbacks above instead of passing the tokens explicitly.
+- The **`community.general`** collection: `ansible-galaxy collection install -r requirements.yml`.
+
+## Usage
+
+Interactive (prompts for the inputs):
+
+```bash
+ansible-playbook onboard-crm.yml
+```
+
+Non-interactive (tokens fall back to 1Password; branches derived from Consul):
+
+```bash
+ansible-playbook onboard-crm.yml \
+  -e antelope_id=xyzxx \
+  -e brand_name="Zenith Horizon Group" \
+  -e crm_type=CORP_FL \
+  -e logo_url=https://.../logo.png \
+  -e favicon_url=https://.../favicon.png \
+  -e languages=en,ar \
+  -e fcm_sender_id=123456789 \
+  -e jira_key_crm_branding=ATLP-47067
+```
+
+Note: pass token values literally (or via a shell variable). Do **not** prefix a raw `ATATT…`
+token with `$` — the shell would try to expand it and send an empty token.
+
+## Inputs
+
+| var | required | example | notes |
+|-----|----------|---------|-------|
+| `antelope_id` | yes | `xyzxx` | Antelope ID → CLI `--brand_id`; keys every generated file + the branch name (normalized lowercase/no-spaces) |
+| `brand_name` | yes | `Zenith Horizon Group` | → CLI `--brand_name`, PR title, configs title |
+| `crm_type` | yes | `CORP_FL` | → CLI `--type`; one of `CORP_FL`, `IB_FL`, `CORP_AFF_FL`, `CORP_AFF_IB_PORTAL`, `CORP_AFF_MSQ` |
+| `logo_url` | yes | *(url)* | → CLI `--logo_url` (black-background logo) |
+| `favicon_url` | yes | *(url)* | → CLI `--favicon_url` |
+| `languages` | yes | `en,ar` | → CLI `--languages`; CSV string **or** a YAML list (`[en, ar]`) |
+| `fcm_sender_id` | yes | `123456789` | → CLI `--fcm_sender_id` (Firebase) |
+| `jira_key_crm_branding` | yes | `ATLP-47067` | PR title prefix + branch name + Jira Fix Version target |
+| `color` | no | `#1a2b3c` | → CLI `--color`; blank ⇒ default `$corp` palette |
+| `base_url` | no | *(url)* | → CLI `--base_url` (configs.ts baseUrl); blank ⇒ CLI default (dev URL) |
+| `bitbucket_token` | no* | *(secret)* | Bitbucket API token; *blank ⇒ 1Password (`jenkins@xsites.co.il` / `bitbucket_scoped_token`)* |
+| `bitbucket_email` | yes | `jenkins@xsites.co.il` | account that owns the token; defaults to the Jenkins service account |
+| `dest_branches` | no | `develop,master-27.0` | comma-separated override; **blank ⇒ derived from Consul**. One PR per branch |
+| `consul_token` | no* | *(secret)* | read scope on `version/*`; *blank ⇒ `$CONSUL_HTTP_TOKEN`, else 1Password (`New_Consul_Token` / `password`)*. Unused when `dest_branches` is set |
+| `jira_token` / `jira_email` | no* | *(secret)* / `eldadp@…` | Jira Basic auth for the Fix Version step; *blank token ⇒ 1Password (`xvouzkhjw55xffdwyzk5npi2mu` / `my_attlasian_token`)* |
+| `manage_jira_fix_version` | no | `true` | set `false` to skip the Fix Version stamping |
+| `reviewers` | no | *(auto)* | default: repo's Bitbucket default-reviewers (author excluded) |
+| `antelope_cli_version` | no | `1.2.3` | pinned published CLI version |
+| `work_dir` | no | `/tmp/onboard-crm/web-crm` | clone location |
+
+## Behavior notes
+
+- **Destination branches are derived from the release train in Consul** (unless `dest_branches`
+  is passed): `develop` always; `master-<version/prod>`; and `master-<version/staging>` too while a
+  release is staged (`version/staging != version/prod`).
+- **One PR per destination branch.** `develop` → `feature/<jira>-onboarding-crm-<id>`;
+  `master-*`/`release-*` → `hotfix/<jira>-onboarding-crm-<id>-<ver>` (the `-<ver>` suffix keeps the
+  two master branches of a staged release from colliding onto one source branch).
+- **Jira Fix Version** `V<version/prod>` (+ `V<version/staging>` when staged) is stamped on
+  `jira_key_crm_branding` **before** the push, so the web-crm DangerJS pipeline is green on first run.
+  Additive/idempotent; non-fatal if the token/version is missing (warns and skips).
+- **Reviewers** come from the repo's Bitbucket *Default reviewers* config; the authenticating account
+  is excluded (Bitbucket rejects a PR whose author is a reviewer).
+- **Idempotent:** re-running recreates the identical files on the existing source branch, detects no
+  staged changes, skips commit/push, and tolerates the "PR already exists" 400.
+
+## Scope
+
+CRM only (`web-crm`). Client-Area onboarding is the separate [`../onboarding-ca`](../onboarding-ca)
+playbook.

package/ansible/onboarding-crm/onboard-crm.yml

@@ -0,0 +1,57 @@
+---
+# Onboard a CRM brand into web-crm and open the PR(s).
+#
+# Destination branches are derived from the release train in Consul (no manual input):
+#   develop is always onboarded; master-<version/prod> tracks the live release; while a
+#   new release is staged (version/staging != version/prod) its master-<version/staging>
+#   exists too and is onboarded as well. Pass -e dest_branches=... to override the lookup.
+#
+# Interactive:
+#   ansible-playbook onboard-crm.yml
+#
+# Non-interactive (e.g. from another playbook / CI), pass everything as extra-vars:
+  # ansible-playbook onboard-crm.yml \
+  #   -e antelope_id=xyzxx \
+  #   -e brand_name="Zenith Horizon Group" \
+  #   -e crm_type=CORP_FL \
+  #   -e logo_url=https://.../logo.png \
+  #   -e favicon_url=https://.../favicon.png \
+  #   -e languages=en,ar \
+  #   -e fcm_sender_id=123456789 \
+  #   -e jira_key_crm_branding=ATLP-47067 \
+  #   -e consul_token="$CONSUL_HTTP_TOKEN" \   # read scope on version/*; used to derive dest branches
+  #   -e bitbucket_email=jenkins@xsites.co.il \
+  #   -e bitbucket_token=ATATT3x...   # Atlassian API token WITHOUT a leading '$' (it is a literal, not a shell var)
+
+# Preconditions on the control node: git + Node (>=16) + npx, an SSH key authorized to
+# push to xsitesinc/web-crm, and an Atlassian API token (ATATT…) owned by bitbucket_email,
+# carrying Bitbucket scopes read:user / read:repository / read+write:pullrequest. The token
+# is used via HTTP Basic auth (email:token).
+- name: Onboard a CRM brand (web-crm)
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  # Only the required, non-defaulted inputs are prompted. Everything else comes from role
+  # defaults: favicon_url + base_url derive from antelope_id/brand_name/crm_server_url; color
+  # blank => default palette; bitbucket_email = jenkins service account; bitbucket/consul/jira
+  # tokens from 1Password. Override any with -e (e.g. -e base_url=… when crm_server_url is unset).
+  vars_prompt:
+    - name: antelope_id
+      prompt: "Brand Antelope ID — the code identifier used everywhere (e.g. xyzxx)"
+      private: false
+    - name: brand_name
+      prompt: "Brand display name — recorded in BRAND_LOCATIONS.md / configs title (e.g. Zenith Horizon Group)"
+      private: false
+    - name: crm_type
+      prompt: "CRM type (one of: CORP_FL, IB_FL, CORP_AFF_FL, CORP_AFF_IB_PORTAL, CORP_AFF_MSQ)"
+      private: false
+    - name: languages
+      prompt: "Languages — 2-letter codes, comma-separated (e.g. en,ar)"
+      private: false
+    - name: jira_key_crm_branding
+      prompt: "Jira key (e.g. ATLP-47067)"
+      private: false
+
+  roles:
+    - onboard_crm

package/ansible/onboarding-crm/requirements.yml

@@ -0,0 +1,8 @@
+---
+# Ansible collection dependencies for the onboarding-ca playbook.
+# Install with:  ansible-galaxy collection install -r requirements.yml
+collections:
+  # Provides the community.general.dict_kv filter used to build the Bitbucket
+  # reviewers array (roles/onboard_ca/tasks/main.yml).
+  - name: community.general
+    version: ">=8.0.0"

package/ansible/onboarding-crm/roles/onboard_crm/defaults/main.yml

@@ -0,0 +1,98 @@
+---
+# Pinned published antelope-cli version that provides the `onboarding-crm` command.
+antelope_cli_version: "1.2.4"
+
+# Where web-crm is cloned on the control node.
+work_dir: "/tmp/onboard-crm/web-crm"
+
+# --- CRM brand inputs (map to the `onboarding-crm` CLI flags) ------------------------
+# antelope_id => --brand_id (connectedBrandName; keys theme/folder/devBrandName/favicon in configs.ts).
+# REQUIRED: antelope_id, brand_name, crm_type, logo_url, languages. base_url + affiliates_api_url
+# derive from the brand vars in create_brand; pass -e for a standalone run. configs.ts favicon is
+# DERIVED by the CLI (logos-<id>/favicon-<name>.png) and FCMSenderId is always '' (both placeholders).
+antelope_id: ""
+color: ""                                   # --color hex; blank => default palette
+logo_url: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/logo-{{ brand_name }}.png"   # brand-logos.json entry; override with -e
+languages: ""                               # --languages: CSV "en,ar" or a YAML list [en, ar]
+crm_type: ""                                # --type: one of allowed_crm_types (per-brand; from group_vars derivation)
+# baseUrl uses the BE/CRM domain; affiliatesApiUrl uses the FE/CA domain (fe_server_url_list.0).
+base_url: "{{ ('https://' ~ crm_server_url ~ '/SignalsCRM/') if (crm_server_url | default('') | length > 0) else '' }}"
+affiliates_api_url: "{{ fe_server_url_list.0 | default('') }}"
+arctic_brand: false                          # --arctic_brand => configs.ts isArcticBrand
+# Consul KV key the generated configs.ts is PUT to (the env CRM config). Needs a consul_token
+# with write on this path. brand_name = the Consul namespace segment (e.g. Antelope/excelttra/crm_env).
+crm_env_consul_key: "Antelope/{{ brand_name }}/crm_env"
+manage_consul_crm_env: true
+# Kept in sync with ALLOWED_TYPES in antelope-cli/onboarding-crm/index.js.
+allowed_crm_types:
+  - CORP_FL
+  - IB_FL
+  - CORP_AFF_FL
+  - CORP_AFF_IB_PORTAL
+  - CORP_AFF_MSQ
+
+# Reviewers for the PR. Empty => auto-fetched from the repo's Bitbucket "Default reviewers"
+# config (the authenticating account is excluded automatically). Override with an explicit
+# list, e.g. [{ account_id: "..." }] or [{ uuid: "{...}" }], to bypass the lookup.
+reviewers: []
+
+# Identity used for the commit (control-node git may have no global config).
+git_user_name: "Jenkins"
+git_user_email: "jenkins@xsites.co.il"
+
+# Atlassian API token (ATATT…) for the reviewer lookup + PR creation. Sent via HTTP
+# Basic auth together with bitbucket_email — these tokens are NOT Bearer tokens and
+# must carry Bitbucket scopes (read:user, read:repository, read/write:pullrequest).
+# Empty => fetched from 1Password (see onepassword_bitbucket_* below). Provide via
+# --extra-vars or Ansible Vault to skip the lookup; never commit a real value.
+bitbucket_token: ""
+
+# Email of the Atlassian account that owns bitbucket_token (the Basic-auth username).
+# Defaults to the Jenkins service account; override via --extra-vars for a different account.
+bitbucket_email: "jenkins@xsites.co.il"
+
+# Consul token with read scope on version/* (v2 cluster). Used to derive the destination
+# branches from the release train (version/prod, version/staging). Empty => resolved from
+# $CONSUL_HTTP_TOKEN, else from 1Password (see onepassword_consul_* below). Not needed when
+# an explicit dest_branches override is passed. Never commit a real value.
+consul_token: ""
+
+# Explicit destination-branch override (comma-separated). Empty => derived from Consul:
+# develop + master-<version/prod> [+ master-<version/staging> while a release is staged].
+# Set this to bypass the Consul lookup entirely, e.g. dest_branches=develop,master-26.9.
+dest_branches: ""
+
+# 1Password fallbacks — used only when the corresponding token is not otherwise provided.
+# Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
+# Service-account auth requires an explicit vault for `op item get` by name (op errors
+# with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
+onepassword_vault: "DevOps"
+onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
+onepassword_bitbucket_field: "credential"
+onepassword_consul_item: "New_Consul_Token"
+onepassword_consul_field: "password"
+
+# --- Jira automation (DangerJS Fix Version gate) -------------------------------------
+# The web-crm DangerJS pipeline FAILS any PR whose linked Jira issue has no Fix
+# Version ("ATLP-XXXXX doesn't have a fix version") — develop feature branches included,
+# not only hotfix→master. This step stamps the release Fix Version on
+# jira_key_crm_branding BEFORE the branches are pushed (so the pipeline is green on its
+# first run). Non-fatal: a missing jira_token / unmatched version just warns and skips.
+manage_jira_fix_version: true
+jira_base_url: "https://xsites.atlassian.net"
+# Project key — defaults to the prefix of the Jira key (ATLP-47269 -> ATLP).
+jira_project_key: "{{ (jira_key_crm_branding | default('')).split('-')[0] }}"
+# Release version name = jira_version_prefix + <version/prod> (e.g. 27.0 -> V27.0).
+jira_version_prefix: "V"
+# Atlassian API token (ATATT) that carries JIRA scopes + the email that owns it (Basic
+# auth). This is SEPARATE from bitbucket_token, which is Bitbucket-scoped only. Empty =>
+# fetched from 1Password (onepassword_jira_* below). Override via --extra-vars in CI.
+jira_token: ""
+# NOTE: jira_email must own jira_token (Atlassian Basic auth = email:token). jenkins@xsites.co.il
+# now has a Jira seat (2026-07-16) with BROWSE_PROJECTS + EDIT_ISSUES on ATLP; its token is a
+# CLASSIC (unscoped) Atlassian API token stored in the DevOps note 'Jira API - jenkins@xsites.co.il'
+# (field credential). Verified /myself 200 + fixVersions add. NB scoped tokens 401 on Jira REST —
+# must be the classic unscoped kind. (eldadp personal my_attlasian_token still works as a fallback.)
+jira_email: "jenkins@xsites.co.il"
+onepassword_jira_item: "Jira API - jenkins@xsites.co.il"
+onepassword_jira_field: "credential"

package/ansible/onboarding-crm/roles/onboard_crm/meta/main.yml

@@ -0,0 +1,10 @@
+---
+galaxy_info:
+  role_name: onboard_crm
+  author: Antelope Systems
+  description: >-
+    Onboard a CRM brand: create the brand assets in web-crm
+    (via antelope-cli onboarding-crm) and open the pull request(s).
+  license: ISC
+  min_ansible_version: "2.12"
+dependencies: []