antelope-cli 1.2.3 → 1.2.5

package/ansible/onboarding-crm/roles/onboard_crm/tasks/main.yml

@@ -0,0 +1,357 @@
+---
+# --- Resolve secrets: prefer the provided value, else fall back to 1Password (op CLI) ---
+# The op fallback needs a signed-in `op` on the control node (op signin, or
+# OP_SERVICE_ACCOUNT_TOKEN). A missing/failed op is tolerated here; the validate step
+# below reports the still-empty token with a clear message.
+- name: Fetch the Bitbucket API token from 1Password
+  when: (bitbucket_token | default('') | length) == 0
+  ansible.builtin.command:
+    argv:
+      - op
+      - item
+      - get
+      - "{{ onepassword_bitbucket_item }}"
+      - "--vault"
+      - "{{ onepassword_vault }}"
+      - "--fields"
+      - "label={{ onepassword_bitbucket_field }}"
+      - "--reveal"
+  register: op_bitbucket
+  changed_when: false
+  failed_when: false
+  no_log: true
+
+- name: Adopt the 1Password Bitbucket token
+  when:
+    - (bitbucket_token | default('') | length) == 0
+    - op_bitbucket is not skipped
+    - (op_bitbucket.rc | default(1)) == 0
+    - (op_bitbucket.stdout | default('') | length) > 0
+  ansible.builtin.set_fact:
+    bitbucket_token: "{{ op_bitbucket.stdout | trim }}"
+  no_log: true
+
+# Consul token is only needed when destination branches are derived (no dest_branches override).
+- name: Resolve the Consul token from the environment
+  when: (consul_token | default('') | length) == 0
+  ansible.builtin.set_fact:
+    consul_token: "{{ lookup('env', 'CONSUL_HTTP_TOKEN') }}"
+  no_log: true
+
+- name: Fetch the Consul token from 1Password
+  when:
+    - (consul_token | default('') | length) == 0
+    - (dest_branches | default('') | length) == 0
+  ansible.builtin.command:
+    argv:
+      - op
+      - item
+      - get
+      - "{{ onepassword_consul_item }}"
+      - "--vault"
+      - "{{ onepassword_vault }}"
+      - "--fields"
+      - "label={{ onepassword_consul_field }}"
+      - "--reveal"
+  register: op_consul
+  changed_when: false
+  failed_when: false
+  no_log: true
+
+- name: Adopt the 1Password Consul token
+  when:
+    - (consul_token | default('') | length) == 0
+    - op_consul is not skipped
+    - (op_consul.rc | default(1)) == 0
+    - (op_consul.stdout | default('') | length) > 0
+  ansible.builtin.set_fact:
+    consul_token: "{{ op_consul.stdout | trim }}"
+  no_log: true
+
+- name: Validate required inputs
+  ansible.builtin.assert:
+    that:
+      - antelope_id is defined and (antelope_id | length) > 0
+      - brand_name is defined and (brand_name | length) > 0
+      - jira_key_crm_branding is defined and (jira_key_crm_branding | length) > 0
+      - logo_url is defined and (logo_url | length) > 0
+      - languages is defined and (languages | length) > 0
+      - crm_type is defined and (crm_type | length) > 0
+      - crm_type in allowed_crm_types
+      - bitbucket_token is defined and (bitbucket_token | length) > 0
+      - bitbucket_email is defined and (bitbucket_email | length) > 0
+    fail_msg: >-
+      Required: antelope_id, brand_name, jira_key_crm_branding, logo_url, languages, crm_type (one of {{ allowed_crm_types | join(', ') }}), bitbucket_email.
+      bitbucket_token must be provided (via --extra-vars / prompt) or resolvable from 1Password
+      item '{{ onepassword_bitbucket_item }}' field '{{ onepassword_bitbucket_field }}' (op signin).
+
+# The CRM CLI keys everything off the Antelope ID (connectedBrandName); normalize it the same
+# way the CLI does (lowercase, no spaces) so the branch name / assets folder match the repo.
+- name: Normalize the brand id
+  ansible.builtin.set_fact:
+    antelope_id_norm: "{{ antelope_id | lower | regex_replace(' ', '') }}"
+
+# languages may arrive as a YAML list (brand_vars) or a CSV string (prompt / extra-var);
+# the CLI wants a comma-separated string.
+- name: Normalize languages to a CSV string
+  ansible.builtin.set_fact:
+    languages_csv: "{{ (languages | join(',')) if (languages is not string) else languages }}"
+
+# --- Destination branches: derived from the release train in Consul ------------------
+# develop is always onboarded. master-<version/prod> tracks the live release; while a new
+# release is staged (version/staging != version/prod) its master-<version/staging> exists
+# too and is onboarded as well. Once staging == prod (the release has shipped) there is a
+# single master branch. An explicit dest_branches extra-var bypasses the lookup entirely.
+- name: Resolve destination branches from Consul
+  when: (dest_branches | default('') | length) == 0
+  block:
+    - name: Consul token is required to derive destination branches
+      ansible.builtin.assert:
+        that:
+          - consul_token is defined and (consul_token | length) > 0
+        fail_msg: >-
+          consul_token is required to read version/prod and version/staging. Provide it via
+          -e consul_token=..., $CONSUL_HTTP_TOKEN, or 1Password item '{{ onepassword_consul_item }}'
+          (op signin); or pass -e dest_branches=develop,master-XX.Y to bypass the Consul lookup.
+
+    - name: Read the prod release version from Consul
+      ansible.builtin.uri:
+        url: "{{ consul_url }}/v1/kv/version/prod?raw=1"
+        headers:
+          X-Consul-Token: "{{ consul_token }}"
+        return_content: true
+      register: consul_prod
+
+    - name: Read the staging release version from Consul
+      ansible.builtin.uri:
+        url: "{{ consul_url }}/v1/kv/version/staging?raw=1"
+        headers:
+          X-Consul-Token: "{{ consul_token }}"
+        return_content: true
+      register: consul_staging
+
+    - name: Derive the destination branch list from the release versions
+      ansible.builtin.set_fact:
+        dest_branch_list: >-
+          {{ ['develop', 'master-' + (consul_prod.content | trim)]
+             + (['master-' + (consul_staging.content | trim)]
+                if (consul_staging.content | trim) != (consul_prod.content | trim) else []) }}
+
+- name: Normalize destination branch list (explicit override)
+  when: (dest_branches | default('') | length) > 0
+  ansible.builtin.set_fact:
+    dest_branch_list: "{{ dest_branches.split(',') | map('trim') | reject('equalto', '') | list }}"
+
+- name: Show the resolved destination branches
+  ansible.builtin.debug:
+    msg: "Destination branches: {{ dest_branch_list }}"
+
+# --- Jira Fix Version: DangerJS fails any web-crm PR whose linked issue has no
+# Fix Version, so stamp the release version (V<version/prod>) on the ticket BEFORE the
+# branches are pushed. Non-fatal — a missing token / unmatched version warns and skips.
+- name: Set the Jira Fix Version on the branding ticket
+  when: manage_jira_fix_version | bool
+  block:
+    - name: Fetch the Jira token from 1Password
+      when: (jira_token | default('') | length) == 0
+      ansible.builtin.command:
+        argv:
+          - op
+          - item
+          - get
+          - "{{ onepassword_jira_item }}"
+          - "--vault"
+          - "{{ onepassword_vault }}"
+          - "--fields"
+          - "label={{ onepassword_jira_field }}"
+          - "--reveal"
+      register: op_jira
+      changed_when: false
+      failed_when: false
+      no_log: true
+
+    - name: Adopt the 1Password Jira token
+      when:
+        - (jira_token | default('') | length) == 0
+        - op_jira is not skipped
+        - (op_jira.rc | default(1)) == 0
+        - (op_jira.stdout | default('') | length) > 0
+      ansible.builtin.set_fact:
+        jira_token: "{{ op_jira.stdout | trim }}"
+      no_log: true
+
+    # master-<ver> / release-<ver> destination branches → Fix Version names (e.g. V27.0).
+    - name: Derive the release Fix Version name(s)
+      ansible.builtin.set_fact:
+        jira_fix_versions: >-
+          {{ dest_branch_list
+             | select('match', '^(master|release)-')
+             | map('regex_replace', '^(master|release)-', jira_version_prefix)
+             | list | unique }}
+
+    - name: Warn when the Fix Version cannot be set
+      when: (jira_token | default('') | length) == 0 or (jira_fix_versions | length) == 0
+      ansible.builtin.debug:
+        msg: >-
+          Skipping Jira Fix Version ({{ 'no jira_token — provide -e jira_token= or 1Password item '
+          ~ onepassword_jira_item if (jira_token | default('') | length) == 0
+          else 'no master-<ver> destination branch to derive the version from' }}).
+          DangerJS will fail until a Fix Version is set on {{ jira_key_crm_branding }}.
+
+    - name: Look up the Jira project versions
+      when:
+        - (jira_token | default('') | length) > 0
+        - (jira_fix_versions | length) > 0
+      ansible.builtin.uri:
+        url: "{{ jira_base_url }}/rest/api/2/project/{{ jira_project_key }}/versions"
+        url_username: "{{ jira_email }}"
+        url_password: "{{ jira_token }}"
+        force_basic_auth: true
+        return_content: true
+      register: jira_versions
+      failed_when: false
+      no_log: true
+
+    - name: Map Fix Version name(s) to id(s)
+      when:
+        - jira_versions is defined
+        - (jira_versions.status | default(0)) == 200
+      ansible.builtin.set_fact:
+        jira_fix_version_ids: >-
+          {{ jira_versions.json
+             | selectattr('name', 'in', jira_fix_versions)
+             | map(attribute='id')
+             | map('community.general.dict_kv', 'id')
+             | list }}
+
+    - name: Report Fix Version names not found in the project
+      when:
+        - jira_versions is defined
+        - (jira_versions.status | default(0)) == 200
+        - (jira_fix_version_ids | default([]) | length) < (jira_fix_versions | length)
+      ansible.builtin.debug:
+        msg: >-
+          Some Fix Version name(s) in {{ jira_fix_versions }} do not exist in project
+          {{ jira_project_key }} — create them in Jira first. Setting only the matched ones.
+
+    # Additive (keeps any existing fixVersions); Jira dedups by id, so re-runs are idempotent.
+    - name: Set the Fix Version on {{ jira_key_crm_branding }}
+      when: (jira_fix_version_ids | default([]) | length) > 0
+      ansible.builtin.uri:
+        url: "{{ jira_base_url }}/rest/api/2/issue/{{ jira_key_crm_branding }}"
+        method: PUT
+        url_username: "{{ jira_email }}"
+        url_password: "{{ jira_token }}"
+        force_basic_auth: true
+        body_format: json
+        body:
+          update:
+            fixVersions: "{{ jira_fix_version_ids | map('community.general.dict_kv', 'add') | list }}"
+        status_code: [204]
+      register: jira_fixver_set
+      failed_when: false
+      no_log: true
+
+    - name: Confirm the Fix Version result
+      ansible.builtin.debug:
+        msg: >-
+          {{ 'Set Fix Version ' ~ jira_fix_versions | join(', ') ~ ' on ' ~ jira_key_crm_branding
+             if (jira_fixver_set.status | default(0)) == 204
+             else 'Fix Version not set (HTTP ' ~ (jira_fixver_set.status | default('n/a')) ~ ')' }}
+      when: jira_fixver_set is defined and (jira_fixver_set is not skipped)
+
+# --- Reviewers: pull from the repo's Bitbucket default-reviewers config -------------
+- name: Resolve reviewers from repo default-reviewers config
+  when: (reviewers | length) == 0
+  block:
+    - name: Identify the authenticating Bitbucket account (PR author)
+      ansible.builtin.uri:
+        url: "{{ api_base }}/user"
+        url_username: "{{ bitbucket_email }}"
+        url_password: "{{ bitbucket_token }}"
+        force_basic_auth: true
+        return_content: true
+      register: bb_user
+
+    - name: Fetch the repository default reviewers
+      ansible.builtin.uri:
+        url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/default-reviewers?pagelen=100"
+        url_username: "{{ bitbucket_email }}"
+        url_password: "{{ bitbucket_token }}"
+        force_basic_auth: true
+        return_content: true
+      register: bb_default_reviewers
+
+    # Bitbucket rejects a PR whose author is also a reviewer, so drop the authenticating account.
+    # The REST API does not auto-apply default reviewers, so we pass them explicitly.
+    # Bitbucket's PR-create reviewers array is keyed by uuid; exclude the author by account_id.
+    # Built in a single expression (not an accumulating set_fact loop, which is nondeterministic).
+    - name: Build reviewers list (excluding the PR author)
+      ansible.builtin.set_fact:
+        reviewers: >-
+          {{ bb_default_reviewers.json['values']
+             | rejectattr('account_id', 'equalto', bb_user.json.account_id)
+             | map(attribute='uuid')
+             | map('community.general.dict_kv', 'uuid')
+             | list }}
+
+- name: Ensure clone parent directory exists
+  ansible.builtin.file:
+    path: "{{ work_dir | dirname }}"
+    state: directory
+    mode: "0755"
+
+- name: Clone / refresh web-crm over SSH
+  ansible.builtin.git:
+    repo: "{{ repo_ssh_url }}"
+    dest: "{{ work_dir }}"
+    version: "{{ dest_branch_list[0] }}"
+    update: true
+    force: true
+    accept_hostkey: true
+
+- name: Onboard the brand on each destination branch
+  ansible.builtin.include_tasks: per_branch.yml
+  loop: "{{ dest_branch_list }}"
+  loop_control:
+    loop_var: dest_branch
+
+- name: Summary of pull requests
+  ansible.builtin.debug:
+    msg: "{{ pr_results | default([]) }}"
+
+# --- Consul: publish the generated configs.ts to the brand's crm_env KV --------------
+# configs.ts is gitignored (not committed) — it is the env's CRM config, so push it to Consul
+# (Antelope/<brand>/crm_env) in addition to the PR body. Non-fatal: warns if the token lacks write.
+- name: Read generated configs.ts for Consul crm_env
+  when: manage_consul_crm_env | default(true) | bool
+  ansible.builtin.slurp:
+    src: "{{ work_dir }}/src/configs/configs.ts"
+  register: crm_configs_ts_final
+  failed_when: false
+
+- name: Update Consul crm_env with the generated configs.ts
+  when:
+    - manage_consul_crm_env | default(true) | bool
+    - crm_configs_ts_final is not skipped
+    - (crm_configs_ts_final.content | default('') | length) > 0
+    - (consul_token | default('') | length) > 0
+  ansible.builtin.uri:
+    url: "{{ consul_url }}/v1/kv/{{ crm_env_consul_key }}"
+    method: PUT
+    headers:
+      X-Consul-Token: "{{ consul_token }}"
+    body: "{{ crm_configs_ts_final.content | b64decode }}"
+    status_code: [200]
+  register: consul_crm_env_put
+  failed_when: false
+  no_log: false
+
+- name: Confirm the Consul crm_env update
+  when: manage_consul_crm_env | default(true) | bool and (consul_crm_env_put is defined)
+  ansible.builtin.debug:
+    msg: >-
+      {{ 'Updated Consul ' ~ crm_env_consul_key
+         if (consul_crm_env_put.status | default(0)) == 200
+         else 'Consul crm_env NOT updated (HTTP ' ~ (consul_crm_env_put.status | default('n/a'))
+              ~ ') - token may lack write on ' ~ crm_env_consul_key }}

package/ansible/onboarding-crm/roles/onboard_crm/tasks/per_branch.yml

@@ -0,0 +1,138 @@
+---
+# Runs once per destination branch. `dest_branch` is the loop var.
+
+- name: "[{{ dest_branch }}] Compose source branch name"
+  ansible.builtin.set_fact:
+    branch_prefix: "{{ 'hotfix' if dest_branch is match('(master|release)') else 'feature' }}"
+
+# Suffix the release version onto master/release targets so each destination gets its OWN
+# source branch. Without it, master-27.0 and master-27.1 (both present during a staged
+# release, e.g. after a code freeze) collapse to one hotfix branch → the 2nd PR reuses the
+# 1st's branch (wrong base) and close_source_branch on either merge kills the other PR.
+- name: "[{{ dest_branch }}] Set source branch"
+  ansible.builtin.set_fact:
+    source_branch: >-
+      {{ branch_prefix }}/{{ jira_key_crm_branding }}-onboarding-crm-{{ antelope_id_norm }}{{
+         ('-' ~ (dest_branch | regex_replace('^(master|release)-', '')))
+         if dest_branch is match('(master|release)') else '' }}
+
+- name: "[{{ dest_branch }}] Fetch all remote branches"
+  ansible.builtin.command:
+    cmd: git fetch origin --prune
+    chdir: "{{ work_dir }}"
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Does the source branch already exist on origin?"
+  ansible.builtin.command:
+    cmd: "git ls-remote --exit-code --heads origin {{ source_branch }}"
+    chdir: "{{ work_dir }}"
+  register: remote_src
+  failed_when: false
+  changed_when: false
+
+# Base the working branch on its own remote head if it already exists (idempotent re-run),
+# otherwise on the destination branch.
+- name: "[{{ dest_branch }}] Check out the working branch"
+  ansible.builtin.command:
+    cmd: >-
+      git checkout -B {{ source_branch }}
+      {{ ('origin/' + source_branch) if remote_src.rc == 0 else ('origin/' + dest_branch) }}
+    chdir: "{{ work_dir }}"
+
+# Required flags always passed; --color and --base_url are optional (blank => CLI defaults:
+# $corp palette and the dev baseUrl). argv is built as a list so no shell quoting is involved.
+- name: "[{{ dest_branch }}] Generate brand files via antelope-cli"
+  ansible.builtin.command:
+    argv: >-
+      {{ ['npx', 'antelope-cli@' ~ antelope_cli_version, 'onboarding-crm',
+          '--brand_id', antelope_id_norm,
+          '--brand_name', brand_name,
+          '--logo_url', logo_url,
+          '--languages', languages_csv,
+          '--type', crm_type,
+          '--affiliates_api_url', affiliates_api_url,
+          '--arctic_brand', (arctic_brand | default(false) | string | lower)]
+         + (['--color', color] if (color | default('') | length) > 0 else [])
+         + (['--base_url', base_url] if (base_url | default('') | length) > 0 else []) }}
+    chdir: "{{ work_dir }}"
+  environment:
+    CI: "true"
+  changed_when: true
+
+- name: "[{{ dest_branch }}] Read generated configs.ts (gitignored) for the PR body / Consul"
+  ansible.builtin.slurp:
+    src: "{{ work_dir }}/src/configs/configs.ts"
+  register: crm_configs_ts
+  failed_when: false
+
+- name: "[{{ dest_branch }}] Compose PR description (ticket + configs.ts for Consul copy-paste)"
+  ansible.builtin.set_fact:
+    pr_description: |-
+      {{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding
+
+      configs.ts — copy into Consul `{{ crm_env_consul_key }}`:
+
+      ```ts
+      {{ crm_configs_ts.content | default('') | b64decode }}
+      ```
+
+- name: "[{{ dest_branch }}] Stage changes"
+  ansible.builtin.command:
+    cmd: git add -A
+    chdir: "{{ work_dir }}"
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Detect staged changes"
+  ansible.builtin.command:
+    cmd: git diff --cached --quiet
+    chdir: "{{ work_dir }}"
+  register: staged
+  failed_when: false
+  changed_when: false
+
+- name: "[{{ dest_branch }}] Commit"
+  ansible.builtin.command:
+    cmd: >-
+      git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
+      commit -m "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
+    chdir: "{{ work_dir }}"
+  when: staged.rc == 1
+
+- name: "[{{ dest_branch }}] Push source branch"
+  ansible.builtin.command:
+    cmd: "git push -u origin {{ source_branch }}"
+    chdir: "{{ work_dir }}"
+  when: staged.rc == 1
+
+- name: "[{{ dest_branch }}] Open pull request"
+  ansible.builtin.uri:
+    url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
+    method: POST
+    url_username: "{{ bitbucket_email }}"
+    url_password: "{{ bitbucket_token }}"
+    force_basic_auth: true
+    body_format: json
+    body:
+      title: "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
+      description: "{{ pr_description }}"
+      source:
+        branch:
+          name: "{{ source_branch }}"
+      destination:
+        branch:
+          name: "{{ dest_branch }}"
+      reviewers: "{{ reviewers }}"
+      close_source_branch: true
+    return_content: true
+    status_code: [201, 400]   # 400 tolerated: a PR for this source->dest already exists
+  register: pr_response
+
+- name: "[{{ dest_branch }}] Record PR result"
+  ansible.builtin.set_fact:
+    pr_results: >-
+      {{ (pr_results | default([])) + [{
+           'destination': dest_branch,
+           'source': source_branch,
+           'status': pr_response.status,
+           'url': (pr_response.json.links.html.href | default('(already exists or not created)'))
+         }] }}

package/ansible/onboarding-crm/roles/onboard_crm/vars/main.yml

@@ -0,0 +1,9 @@
+---
+# Constants — the target repository for CRM onboarding.
+api_base: "https://api.bitbucket.org/2.0"
+workspace: "xsitesinc"
+repo_slug: "web-crm"
+repo_ssh_url: "git@bitbucket.org:xsitesinc/web-crm.git"
+
+# Consul (v2 cluster) — source of the release train used to derive destination branches.
+consul_url: "https://consul.xsites.xyz"

package/index.js

@@ -1,12 +1,12 @@
-#!/usr/bin/env node
-const args = process.argv.slice(2);
-
-if (args[0] === "onboarding") {
-    require('./onboarding');
-} else if (args[0] === "onboarding-ca") {
-    require('./onboarding-ca');
-} else if (args[0] === "onboarding-crm") {
-    require('./onboarding-crm');
-} else {
-    console.log("Unknown command");
-}
+#!/usr/bin/env node
+const args = process.argv.slice(2);
+
+if (args[0] === "onboarding") {
+    require('./onboarding');
+} else if (args[0] === "onboarding-ca") {
+    require('./onboarding-ca');
+} else if (args[0] === "onboarding-crm") {
+    require('./onboarding-crm');
+} else {
+    console.log("Unknown command");
+}

package/onboarding/brand.js

@@ -1,21 +1,21 @@
-let brand = {
-  brandName: '',
-  kebabCaseName: '',
-  connectedBrandName: '',
-  color: '',
-  languages: null,
-  favicon: '',
-  type: '',
-  FCMSenderId: '',
-  logo: ''
-};
-
-function updateBrand(updatedBrand) {
-  brand = { ...brand, ...updatedBrand };
-}
-
-function getBrand() {
-  return brand;
-}
-
-module.exports = { updateBrand, getBrand };
+let brand = {
+  brandName: '',
+  kebabCaseName: '',
+  connectedBrandName: '',
+  color: '',
+  languages: null,
+  favicon: '',
+  type: '',
+  FCMSenderId: '',
+  logo: ''
+};
+
+function updateBrand(updatedBrand) {
+  brand = { ...brand, ...updatedBrand };
+}
+
+function getBrand() {
+  return brand;
+}
+
+module.exports = { updateBrand, getBrand };