antelope-cli 1.2.5 → 1.2.6

package/ansible/onboarding-ca/roles/onboard_ca/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # Pinned published antelope-cli version that provides the `onboarding-ca` command.
-antelope_cli_version: "1.2.4"
+antelope_cli_version: "1.2.5"
 
 # Where web-client-area is cloned on the control node.
 work_dir: "/tmp/onboard-ca/web-client-area"
@@ -45,7 +45,7 @@ dest_branches: ""
 # Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
 # Service-account auth requires an explicit vault for `op item get` by name (op errors
 # with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
-onepassword_vault: "DevOps"
+onepassword_vault: "jenkins"
 onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
 onepassword_bitbucket_field: "credential"
 onepassword_consul_item: "New_Consul_Token"

package/ansible/onboarding-crm/Jenkinsfile

@@ -0,0 +1,211 @@
+// Self-service CRM onboarding — jenkins.xsites.xyz/job/self-service/job/onboarding/onboarding-crm
+//
+// Pipeline-as-Code (this file is the source of truth; the Jenkins job is just a
+// "Pipeline script from SCM" pointer at antelope-cli@master, path ansible/onboarding-crm/Jenkinsfile).
+//
+// Design (best practice, replacing the legacy freestyle+vault-pem+canRoam pattern):
+//  - ephemeral containerized agent via `agent { dockerfile }`: the pinned runner image
+//    (ansible, node/npx, op, git) is BUILT on the spot fleet from runner.Dockerfile — no
+//    registry/ECR needed. Runs on any agent (the whole fleet is docker-capable).
+//  - ONE secret: a 1Password service-account token (onepassword-service-account-token) —
+//    op fetches the bitbucket/consul/jira tokens from the `jenkins` vault (matches the role)
+//  - a Bitbucket SSH key (bitbucket-jenkins-ssh) for the git push to web-crm
+//  - parameters named exactly as the configs.ts fields, validated up front
+//  - DRY_RUN preview (generate + show configs.ts, no writes) + human approval before any push
+//
+// Provisioning prereqs:
+//  - fleet agents on the docker-enabled AMI (the whole fleet carries docker)
+//  - credential 'onepassword-service-account-token' : Secret text = OP_SERVICE_ACCOUNT_TOKEN
+//    (1Password service account, read-only on the `jenkins` vault)
+//  - credential 'bitbucket-jenkins-ssh'             : SSH key = jenkins Bitbucket push key
+//    (both folder-scoped to self-service/onboarding)
+
+pipeline {
+  agent {
+    dockerfile {
+      dir 'ansible/onboarding-crm'
+      filename 'runner.Dockerfile'
+      additionalBuildArgs '--pull'
+    }
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '30'))
+  }
+
+  parameters {
+    // --- named exactly as configs.ts fields ---
+    string(name: 'brandAssetsFolder', defaultValue: '', trim: true,
+      description: 'Antelope ID (lowercase alphanumeric). configs.ts brandAssetsFolder / devBrandName / colorTheme / templateTheme / favicon all derive from this. e.g. uzumy')
+    string(name: 'title', defaultValue: '', trim: true,
+      description: 'Brand name. configs.ts title becomes "<title> CRM". e.g. Excelttra')
+    choice(name: 'type', choices: ['CORP_FL', 'IB_FL', 'CORP_AFF_FL'],
+      description: 'configs.ts type')
+    string(name: 'baseUrl', defaultValue: '', trim: true,
+      description: 'configs.ts baseUrl. e.g. https://apicrm.mteeks.com/SignalsCRM/')
+    string(name: 'affiliatesApiUrl', defaultValue: '', trim: true,
+      description: 'configs.ts affiliatesApiUrl (FE host). e.g. apife.excelttra.com')
+    booleanParam(name: 'isArcticBrand', defaultValue: false,
+      description: 'configs.ts isArcticBrand')
+    // --- onboarding inputs (not configs.ts fields) ---
+    string(name: 'languages', defaultValue: 'en', trim: true,
+      description: 'Comma-separated 2-letter language codes. e.g. en,ar')
+    string(name: 'logo_url', defaultValue: '', trim: true,
+      description: 'Logo URL. Must be https://logos-<brandAssetsFolder>.s3.eu-west-1.amazonaws.com/logo-<title>.<ext>. Blank => derived.')
+    string(name: 'favicon', defaultValue: '', trim: true,
+      description: 'Favicon URL (configs.ts favicon). Must be https://logos-<brandAssetsFolder>.s3.eu-west-1.amazonaws.com/favicon-<title>.<ext>. Blank => derived.')
+    string(name: 'jira_key_crm_branding', defaultValue: '', trim: true,
+      description: 'Jira key for the branding PRs. e.g. ATLP-47345')
+    // --- safety ---
+    booleanParam(name: 'DRY_RUN', defaultValue: true,
+      description: 'Preview only: generate + show configs.ts, NO branch push / PR / Consul / Jira write')
+  }
+
+  environment {
+    ANSIBLE_HOST_KEY_CHECKING = 'False'
+    ANSIBLE_FORCE_COLOR       = 'true'
+    WORK_DIR                  = '/tmp/onboard-crm/web-crm'
+    PLAYBOOK_DIR              = 'ansible/onboarding-crm'
+    // The dockerfile agent runs the container as the Jenkins UID, which has no home dir
+    // (HOME=/), so ansible (~/.ansible/tmp), npm (~/.npm) and git (~/.gitconfig) can't write
+    // their dotdirs. Point HOME at the writable, correctly-owned workspace.
+    HOME                      = "${env.WORKSPACE}"
+  }
+
+  stages {
+    stage('Validate parameters') {
+      steps {
+        script {
+          def CRM_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL']
+          def errs = []
+          def req  = { v, n -> if (!v?.trim()) errs << "${n} is required" }
+
+          req(params.brandAssetsFolder, 'brandAssetsFolder')
+          if (params.brandAssetsFolder && !(params.brandAssetsFolder ==~ /^[a-z0-9]+$/))
+            errs << "brandAssetsFolder must be lowercase alphanumeric (the Antelope ID); got '${params.brandAssetsFolder}'"
+
+          req(params.title, 'title')
+
+          if (!CRM_TYPES.contains(params.type))
+            errs << "type must be one of ${CRM_TYPES}; got '${params.type}'"
+
+          req(params.baseUrl, 'baseUrl')
+          if (params.baseUrl && !(params.baseUrl ==~ /^https:\/\/apicrm\.[^\/]+\/SignalsCRM\/$/))
+            errs << "baseUrl must look like https://apicrm.<domain>/SignalsCRM/ ; got '${params.baseUrl}'"
+
+          req(params.affiliatesApiUrl, 'affiliatesApiUrl')
+          if (params.affiliatesApiUrl && !(params.affiliatesApiUrl ==~ /^apife\.[a-z0-9.\-]+$/))
+            errs << "affiliatesApiUrl must look like apife.<ca-domain> (no scheme); got '${params.affiliatesApiUrl}'"
+
+          if (!(params.languages ==~ /^[a-z]{2}(,[a-z]{2})*$/))
+            errs << "languages must be comma-separated 2-letter codes; got '${params.languages}'"
+
+          // logo/favicon must follow logos-<antelope_id>/<kind>-<brand_name>.<ext> (when set; blank => derived)
+          def IMG_EXT = ['png', 'jpg', 'jpeg', 'svg', 'webp', 'ico', 'gif']
+          def checkImg = { url, kind ->
+            if (!url?.trim()) return null
+            def m = (url =~ /^https:\/\/logos-([a-z0-9]+)\.s3\.eu-west-1\.amazonaws\.com\/(logo|favicon)-(.+)\.([A-Za-z0-9]+)$/)
+            if (!m) return "${kind} must look like https://logos-<id>.s3.eu-west-1.amazonaws.com/${kind}-<brand>.<ext>; got '${url}'"
+            def (whole, bucketId, prefix, brand, ext) = m[0]
+            if (prefix != kind) return "${kind} filename must start with '${kind}-' (got '${prefix}-')"
+            if (bucketId != params.brandAssetsFolder) return "${kind} bucket must be logos-${params.brandAssetsFolder} (got logos-${bucketId})"
+            if (brand != params.title) return "${kind} filename brand must be '${params.title}' (got '${brand}')"
+            if (!IMG_EXT.contains(ext.toLowerCase())) return "${kind} extension '${ext}' not allowed (${IMG_EXT.join('/')})"
+            return null
+          }
+          [checkImg(params.logo_url, 'logo'), checkImg(params.favicon, 'favicon')].each { if (it) errs << it }
+
+          if (!(params.jira_key_crm_branding ==~ /^[A-Z][A-Z0-9]+-\d+$/))
+            errs << "jira_key_crm_branding must look like ATLP-12345; got '${params.jira_key_crm_branding}'"
+
+          if (errs) {
+            error("Parameter validation failed:\n  - " + errs.join("\n  - "))
+          }
+          echo "✅ Parameters valid — antelope_id=${params.brandAssetsFolder}, type=${params.type}, dry_run=${params.DRY_RUN}"
+          currentBuild.displayName = "#${env.BUILD_NUMBER} ${params.title}${params.DRY_RUN ? ' (dry-run)' : ''}"
+        }
+      }
+    }
+
+    stage('Onboard (dry-run preview)') {
+      when { expression { params.DRY_RUN } }
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          sshagent(['bitbucket-jenkins-ssh']) {
+            sh label: 'ansible dry-run (no writes)', script: '''
+              cd "$PLAYBOOK_DIR"
+              ansible-playbook onboard-crm.yml \
+                -e antelope_id="$brandAssetsFolder" \
+                -e brand_name="$title" \
+                -e crm_type="$type" \
+                -e base_url="$baseUrl" \
+                -e affiliates_api_url="$affiliatesApiUrl" \
+                -e arctic_brand="$isArcticBrand" \
+                -e languages="$languages" \
+                ${logo_url:+-e logo_url=$logo_url} \
+                ${favicon:+-e favicon=$favicon} \
+                -e jira_key_crm_branding="$jira_key_crm_branding" \
+                -e dry_run=true \
+                < /dev/null
+            '''
+          }
+        }
+        script { archiveGeneratedConfigs() }
+      }
+    }
+
+    stage('Approve') {
+      when { expression { !params.DRY_RUN } }
+      steps {
+        script {
+          input message: "Open web-crm PR(s) + write Consul crm_env + stamp Jira for '${params.brandAssetsFolder}'?",
+                ok: 'Onboard'
+        }
+      }
+    }
+
+    stage('Onboard') {
+      when { expression { !params.DRY_RUN } }
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          sshagent(['bitbucket-jenkins-ssh']) {
+            sh label: 'ansible onboard-crm', script: '''
+              cd "$PLAYBOOK_DIR"
+              ansible-playbook onboard-crm.yml \
+                -e antelope_id="$brandAssetsFolder" \
+                -e brand_name="$title" \
+                -e crm_type="$type" \
+                -e base_url="$baseUrl" \
+                -e affiliates_api_url="$affiliatesApiUrl" \
+                -e arctic_brand="$isArcticBrand" \
+                -e languages="$languages" \
+                ${logo_url:+-e logo_url=$logo_url} \
+                ${favicon:+-e favicon=$favicon} \
+                -e jira_key_crm_branding="$jira_key_crm_branding" \
+                < /dev/null
+            '''
+          }
+        }
+        script { archiveGeneratedConfigs() }
+      }
+    }
+  }
+
+  post {
+    always  { cleanWs() }
+    failure { echo 'Onboarding failed — see the validation/ansible output above.' }
+  }
+}
+
+// Archive the generated (gitignored) configs.ts so the operator can copy it into Consul.
+void archiveGeneratedConfigs() {
+  def cfg = "${env.WORK_DIR}/src/configs/configs.ts"
+  if (fileExists(cfg)) {
+    sh "mkdir -p out && cp '${cfg}' out/configs.ts"
+    archiveArtifacts artifacts: 'out/configs.ts', allowEmptyArchive: true
+    currentBuild.description = "configs.ts generated for ${params.brandAssetsFolder}"
+  }
+}

package/ansible/onboarding-crm/README.md

@@ -67,7 +67,7 @@ token with `$` — the shell would try to expand it and send an empty token.
 |-----|----------|---------|-------|
 | `antelope_id` | yes | `xyzxx` | Antelope ID → CLI `--brand_id`; keys every generated file + the branch name (normalized lowercase/no-spaces) |
 | `brand_name` | yes | `Zenith Horizon Group` | → CLI `--brand_name`, PR title, configs title |
-| `crm_type` | yes | `CORP_FL` | → CLI `--type`; one of `CORP_FL`, `IB_FL`, `CORP_AFF_FL`, `CORP_AFF_IB_PORTAL`, `CORP_AFF_MSQ` |
+| `crm_type` | yes | `CORP_FL` | → CLI `--type`; one of `CORP_FL`, `IB_FL`, `CORP_AFF_FL` |
 | `logo_url` | yes | *(url)* | → CLI `--logo_url` (black-background logo) |
 | `favicon_url` | yes | *(url)* | → CLI `--favicon_url` |
 | `languages` | yes | `en,ar` | → CLI `--languages`; CSV string **or** a YAML list (`[en, ar]`) |

package/ansible/onboarding-crm/onboard-crm.yml

@@ -44,7 +44,7 @@
       prompt: "Brand display name — recorded in BRAND_LOCATIONS.md / configs title (e.g. Zenith Horizon Group)"
       private: false
     - name: crm_type
-      prompt: "CRM type (one of: CORP_FL, IB_FL, CORP_AFF_FL, CORP_AFF_IB_PORTAL, CORP_AFF_MSQ)"
+      prompt: "CRM type (one of: CORP_FL, IB_FL, CORP_AFF_FL)"
       private: false
     - name: languages
       prompt: "Languages — 2-letter codes, comma-separated (e.g. en,ar)"

package/ansible/onboarding-crm/roles/onboard_crm/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # Pinned published antelope-cli version that provides the `onboarding-crm` command.
-antelope_cli_version: "1.2.4"
+antelope_cli_version: "1.2.5"
 
 # Where web-crm is cloned on the control node.
 work_dir: "/tmp/onboard-crm/web-crm"
@@ -13,6 +13,7 @@ work_dir: "/tmp/onboard-crm/web-crm"
 antelope_id: ""
 color: ""                                   # --color hex; blank => default palette
 logo_url: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/logo-{{ brand_name }}.png"   # brand-logos.json entry; override with -e
+favicon: "https://logos-{{ antelope_id }}.s3.eu-west-1.amazonaws.com/favicon-{{ brand_name }}.png"  # --favicon => configs.ts favicon; blank => CLI derives the same
 languages: ""                               # --languages: CSV "en,ar" or a YAML list [en, ar]
 crm_type: ""                                # --type: one of allowed_crm_types (per-brand; from group_vars derivation)
 # baseUrl uses the BE/CRM domain; affiliatesApiUrl uses the FE/CA domain (fe_server_url_list.0).
@@ -23,13 +24,13 @@ arctic_brand: false                          # --arctic_brand => configs.ts isAr
 # with write on this path. brand_name = the Consul namespace segment (e.g. Antelope/excelttra/crm_env).
 crm_env_consul_key: "Antelope/{{ brand_name }}/crm_env"
 manage_consul_crm_env: true
+# Preview mode: clone + generate configs.ts/brand-logos but SKIP commit/push/PR/Jira/Consul writes.
+dry_run: false
 # Kept in sync with ALLOWED_TYPES in antelope-cli/onboarding-crm/index.js.
 allowed_crm_types:
   - CORP_FL
   - IB_FL
   - CORP_AFF_FL
-  - CORP_AFF_IB_PORTAL
-  - CORP_AFF_MSQ
 
 # Reviewers for the PR. Empty => auto-fetched from the repo's Bitbucket "Default reviewers"
 # config (the authenticating account is excluded automatically). Override with an explicit
@@ -66,7 +67,7 @@ dest_branches: ""
 # Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
 # Service-account auth requires an explicit vault for `op item get` by name (op errors
 # with "a vault query must be provided" otherwise) — the items live in the DevOps vault.
-onepassword_vault: "DevOps"
+onepassword_vault: "jenkins"
 onepassword_bitbucket_item: "Bitbucket API - jenkins@xsites.co.il"
 onepassword_bitbucket_field: "credential"
 onepassword_consul_item: "New_Consul_Token"

package/ansible/onboarding-crm/roles/onboard_crm/tasks/main.yml

@@ -150,7 +150,7 @@
 # Fix Version, so stamp the release version (V<version/prod>) on the ticket BEFORE the
 # branches are pushed. Non-fatal — a missing token / unmatched version warns and skips.
 - name: Set the Jira Fix Version on the branding ticket
-  when: manage_jira_fix_version | bool
+  when: manage_jira_fix_version | bool and not (dry_run | default(false) | bool)
   block:
     - name: Fetch the Jira token from 1Password
       when: (jira_token | default('') | length) == 0
@@ -336,6 +336,7 @@
     - crm_configs_ts_final is not skipped
     - (crm_configs_ts_final.content | default('') | length) > 0
     - (consul_token | default('') | length) > 0
+    - not (dry_run | default(false) | bool)
   ansible.builtin.uri:
     url: "{{ consul_url }}/v1/kv/{{ crm_env_consul_key }}"
     method: PUT

package/ansible/onboarding-crm/roles/onboard_crm/tasks/per_branch.yml

@@ -53,7 +53,8 @@
           '--affiliates_api_url', affiliates_api_url,
           '--arctic_brand', (arctic_brand | default(false) | string | lower)]
          + (['--color', color] if (color | default('') | length) > 0 else [])
-         + (['--base_url', base_url] if (base_url | default('') | length) > 0 else []) }}
+         + (['--base_url', base_url] if (base_url | default('') | length) > 0 else [])
+         + (['--favicon', favicon] if (favicon | default('') | length) > 0 else []) }}
     chdir: "{{ work_dir }}"
   environment:
     CI: "true"
@@ -96,15 +97,20 @@
       git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
       commit -m "{{ jira_key_crm_branding }}: On-Boarding {{ brand_name }} CRM Branding"
     chdir: "{{ work_dir }}"
-  when: staged.rc == 1
+  when:
+    - staged.rc == 1
+    - not (dry_run | default(false) | bool)
 
 - name: "[{{ dest_branch }}] Push source branch"
   ansible.builtin.command:
     cmd: "git push -u origin {{ source_branch }}"
     chdir: "{{ work_dir }}"
-  when: staged.rc == 1
+  when:
+    - staged.rc == 1
+    - not (dry_run | default(false) | bool)
 
 - name: "[{{ dest_branch }}] Open pull request"
+  when: not (dry_run | default(false) | bool)
   ansible.builtin.uri:
     url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
     method: POST
@@ -128,6 +134,7 @@
   register: pr_response
 
 - name: "[{{ dest_branch }}] Record PR result"
+  when: not (dry_run | default(false) | bool)
   ansible.builtin.set_fact:
     pr_results: >-
       {{ (pr_results | default([])) + [{

package/ansible/onboarding-crm/runner.Dockerfile

@@ -0,0 +1,47 @@
+# Onboarding runner image for the self-service/onboarding/onboarding-crm Jenkins pipeline.
+# Built on the fly by the declarative `agent { dockerfile { … } }` on a docker-capable fleet
+# agent (no registry/ECR). Bakes in the pinned toolchain the onboard_crm role needs:
+# ansible + community.general, node/npx (for `npx antelope-cli`), git + ssh (push to web-crm),
+# and the 1Password CLI (op, reads the bitbucket/consul/jira tokens from the `jenkins` vault
+# via the OP_SERVICE_ACCOUNT_TOKEN Jenkins credential).
+FROM python:3.12-slim
+
+ARG ANSIBLE_VERSION=10.3.0
+ARG OP_VERSION=2.31.1
+ARG NODE_MAJOR=20
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git openssh-client curl ca-certificates gnupg unzip jq \
+ && rm -rf /var/lib/apt/lists/*
+
+# Node.js — provides npx for `npx antelope-cli@<ver> onboarding-crm`
+RUN curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - \
+ && apt-get update && apt-get install -y --no-install-recommends nodejs \
+ && rm -rf /var/lib/apt/lists/*
+
+# Ansible + community.general (dict_kv filter used by the role)
+RUN pip install --no-cache-dir "ansible==${ANSIBLE_VERSION}" \
+ && ansible-galaxy collection install community.general
+
+# 1Password CLI (op)
+RUN curl -fsSL "https://cache.agilebits.com/dist/1P/op2/pkg/v${OP_VERSION}/op_linux_amd64_v${OP_VERSION}.zip" -o /tmp/op.zip \
+ && unzip -o /tmp/op.zip op -d /usr/local/bin/ && rm -f /tmp/op.zip && chmod +x /usr/local/bin/op
+
+# AWS CLI v2 — used by the onboarding-logos pipeline to upload logo/favicon to the brand's
+# logos-<antelope_id> S3 bucket (creds fetched from the brand's Consul folder at runtime).
+RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
+ && unzip -q /tmp/awscliv2.zip -d /tmp && /tmp/aws/install && rm -rf /tmp/aws /tmp/awscliv2.zip
+
+# Pre-trust Bitbucket's host key so `git push` over SSH is non-interactive
+RUN mkdir -p /etc/ssh && ssh-keyscan bitbucket.org >> /etc/ssh/ssh_known_hosts 2>/dev/null || true
+
+# Jenkins runs this container as `-u 1000:1000`. `op` (and other tools) resolve "the current
+# user" via getpwuid(); with no /etc/passwd entry for uid 1000 it fails with
+# 'couldn't start daemon … not owned by the current user' and never enters service-account
+# mode. Bake a uid/gid 1000 user so getpwuid succeeds. Also make /etc/passwd group-writable
+# (root group) so a differently-numbered agent uid can self-register if ever needed.
+RUN groupadd -g 1000 jenkins 2>/dev/null || true \
+ && useradd -u 1000 -g 1000 -m -d /home/jenkins -s /bin/bash jenkins 2>/dev/null || true \
+ && chmod g+w /etc/passwd
+
+WORKDIR /work

package/ansible/onboarding-logos/Jenkinsfile

@@ -0,0 +1,105 @@
+// Self-service logo/favicon upload — jenkins.xsites.xyz/job/self-service/job/onboarding/job/onboarding-logos
+//
+// Pipeline-as-Code (this file is the source of truth; the Jenkins job is a "Pipeline script from SCM"
+// pointer at antelope-cli@master, path ansible/onboarding-logos/Jenkinsfile).
+//
+// Flow: operator uploads the logo + favicon image files -> the pipeline reads the brand's AWS creds
+// from its Consul folder (Antelope/<brand_name>/AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_DEFAULT_REGION)
+// -> uploads them to the brand's S3 bucket logos-<antelope_id> as logo-<brand_name>.<ext> /
+// favicon-<brand_name>.<ext> (the exact objects configs.ts / brand-logos.json reference).
+//
+// Reuses the onboarding-crm runner image (op + curl + jq + aws + uid-1000 user). Requires the
+// file-parameters plugin (base64File) and the onepassword-service-account-token credential
+// (op reads the Consul token from the `jenkins` vault).
+pipeline {
+  agent {
+    dockerfile {
+      dir 'ansible/onboarding-crm'
+      filename 'runner.Dockerfile'
+      additionalBuildArgs '--pull'
+    }
+  }
+
+  options {
+    timestamps()
+    ansiColor('xterm')
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '30'))
+  }
+
+  parameters {
+    string(name: 'brandAssetsFolder', defaultValue: '', trim: true,
+      description: 'Antelope ID (lowercase alphanumeric). Target bucket = logos-<brandAssetsFolder>. e.g. uzumy')
+    string(name: 'brand_name', defaultValue: '', trim: true,
+      description: 'Brand name — the Consul folder Antelope/<brand_name>/ AND the filename token logo-<brand_name>/favicon-<brand_name>. e.g. excelttra')
+    base64File(name: 'logo_file', description: 'Logo image file (uploaded → logo-<brand_name>.<logo_type>)')
+    base64File(name: 'favicon_file', description: 'Favicon image file (uploaded → favicon-<brand_name>.<favicon_type>)')
+    choice(name: 'logo_type', choices: ['png', 'jpg', 'jpeg', 'svg', 'webp', 'gif'], description: 'Logo file extension')
+    choice(name: 'favicon_type', choices: ['png', 'ico', 'jpg', 'jpeg', 'svg', 'webp'], description: 'Favicon file extension')
+    booleanParam(name: 'DRY_RUN', defaultValue: true,
+      description: 'Preview only: resolve creds + validate + aws s3 cp --dryrun (no actual upload)')
+  }
+
+  environment {
+    HOME       = "${env.WORKSPACE}"
+    CONSUL_URL = 'https://consul.xsites.xyz'
+  }
+
+  stages {
+    stage('Validate parameters') {
+      steps {
+        script {
+          def IMG_EXT = ['png', 'jpg', 'jpeg', 'svg', 'webp', 'ico', 'gif']
+          def errs = []
+          if (!(params.brandAssetsFolder ==~ /^[a-z0-9]+$/))
+            errs << "brandAssetsFolder must be lowercase alphanumeric (the Antelope ID); got '${params.brandAssetsFolder}'"
+          // brand_name must be filename-safe so logo-<brand_name>.<ext> / favicon-<brand_name>.<ext> are valid keys
+          if (!(params.brand_name ==~ /^[A-Za-z0-9._-]+$/))
+            errs << "brand_name must be filename-safe (letters/digits/._-, no spaces); got '${params.brand_name}'"
+          if (!IMG_EXT.contains(params.logo_type)) errs << "logo_type '${params.logo_type}' not allowed"
+          if (!IMG_EXT.contains(params.favicon_type)) errs << "favicon_type '${params.favicon_type}' not allowed"
+          if (errs) error("Parameter validation failed:\n  - " + errs.join("\n  - "))
+          env.LOGO_KEY    = "logo-${params.brand_name}.${params.logo_type}"
+          env.FAVICON_KEY = "favicon-${params.brand_name}.${params.favicon_type}"
+          echo "✅ Valid — bucket=logos-${params.brandAssetsFolder}, ${env.LOGO_KEY}, ${env.FAVICON_KEY}, dry_run=${params.DRY_RUN}"
+          currentBuild.displayName = "#${env.BUILD_NUMBER} ${params.brand_name}${params.DRY_RUN ? ' (dry-run)' : ''}"
+        }
+      }
+    }
+
+    stage('Upload to S3') {
+      steps {
+        withCredentials([string(credentialsId: 'onepassword-service-account-token', variable: 'OP_SERVICE_ACCOUNT_TOKEN')]) {
+          withFileParameter('logo_file') {
+            withFileParameter('favicon_file') {
+              sh label: 'resolve Consul AWS creds + upload', script: '''
+                set -eu
+                CT=$(op read "op://jenkins/New_Consul_Token/password")
+                base="$CONSUL_URL/v1/kv/Antelope/$brand_name"
+                AWS_ACCESS_KEY_ID=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_ACCESS_KEY_ID?raw")
+                AWS_SECRET_ACCESS_KEY=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_SECRET_ACCESS_KEY?raw")
+                AWS_DEFAULT_REGION=$(curl -sf -H "X-Consul-Token: $CT" "$base/AWS_DEFAULT_REGION?raw" || echo eu-west-1)
+                export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
+                if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
+                  echo "ERROR: no AWS creds under Consul Antelope/$brand_name/ (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)"; exit 1
+                fi
+                ct() { case "$1" in png) echo image/png;; jpg|jpeg) echo image/jpeg;; svg) echo image/svg+xml;; webp) echo image/webp;; gif) echo image/gif;; ico) echo image/x-icon;; *) echo application/octet-stream;; esac; }
+                DRY=""; [ "$DRY_RUN" = "true" ] && DRY="--dryrun"
+                echo "Uploading to s3://logos-$brandAssetsFolder/ (region $AWS_DEFAULT_REGION)${DRY:+  [DRY-RUN]}"
+                aws s3 cp "$logo_file"    "s3://logos-$brandAssetsFolder/$LOGO_KEY"    --content-type "$(ct $logo_type)"    $DRY
+                aws s3 cp "$favicon_file" "s3://logos-$brandAssetsFolder/$FAVICON_KEY" --content-type "$(ct $favicon_type)" $DRY
+                echo "Done: $LOGO_KEY, $FAVICON_KEY"
+              '''
+            }
+          }
+        }
+      }
+    }
+  }
+
+  post {
+    always  { cleanWs() }
+    success { echo "logos ${params.DRY_RUN ? 'previewed' : 'uploaded'} to logos-${params.brandAssetsFolder}: ${env.LOGO_KEY}, ${env.FAVICON_KEY}" }
+    failure { echo 'Logo upload failed — see the validation/aws output above.' }
+  }
+}

package/onboarding-crm/brand.js

@@ -8,7 +8,8 @@ let brand = {
   affiliatesApiUrl: '',
   isArcticBrand: false,
   type: '',
-  baseUrl: ''
+  baseUrl: '',
+  favicon: ''
 };
 
 function updateBrand(updatedBrand) {

package/onboarding-crm/createConfig.js

@@ -32,7 +32,7 @@ const updateConfigFile = () => {
   templateTheme: 'theme-template-${id}',
   brandAssetsFolder: '${id}',
   devBrandName: '${id}',
-  favicon: 'https://logos-${id}.s3.eu-west-1.amazonaws.com/favicon-${brand.brandName}.png',
+  favicon: '${brand.favicon || `https://logos-${id}.s3.eu-west-1.amazonaws.com/favicon-${brand.brandName}.png`}',
   gaTrackingID: 'UA-70456753-2',
   FCMSenderId: '',
   isFnsStatusActive: true,

package/onboarding-crm/index.js

@@ -8,7 +8,7 @@ const createConfig = require('./createConfig.js');
 const brandLogos = require('./brandLogos.js');
 const brandLocations = require('./brandLocations.js');
 
-const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL', 'CORP_AFF_IB_PORTAL', 'CORP_AFF_MSQ'];
+const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL'];
 const DEFAULT_BASE_URL = 'https://dev-apicrm.antelopesystem.com/SignalsCRM/';
 
 const HELP = `
@@ -34,8 +34,9 @@ Options:
   --arctic_brand <t|f>  configs.ts isArcticBrand. Default: false
   --type <type>         One of: ${ALLOWED_TYPES.join(', ')} → configs.ts (required)
   --base_url <url>      configs.ts baseUrl. Default: ${DEFAULT_BASE_URL}
+  --favicon <url>       configs.ts favicon. Empty => derived (logos-<id>/favicon-<name>.png)
 
-Note: configs.ts favicon is DERIVED (logos-<id>/favicon-<name>.png) and FCMSenderId is always '';
+Note: --favicon defaults to the derived logos-<id>/favicon-<name>.png; FCMSenderId is always '';
 both are placeholders that get hand-edited per brand. configs.ts is gitignored (Consul copy-paste).
   -h, --help            Show this help
 
@@ -51,7 +52,8 @@ const FLAGS = {
   '--affiliates_api_url': 'affiliatesApiUrl',
   '--arctic_brand': 'arcticBrand',
   '--type': 'type',
-  '--base_url': 'baseUrl'
+  '--base_url': 'baseUrl',
+  '--favicon': 'favicon'
 };
 
 function parseArgs(argv) {
@@ -114,6 +116,8 @@ async function run() {
     // from the id + brand_name; FCMSenderId is always ''. isArcticBrand defaults false.
     const affiliatesApiUrl = opts.affiliatesApiUrl || '';
     const isArcticBrand = String(opts.arcticBrand).toLowerCase() === 'true';
+    // favicon: explicit override, else createConfig derives logos-<id>/favicon-<name>.png
+    const favicon = opts.favicon || '';
 
     // Validate required fields.
     const missing = [];
@@ -153,7 +157,8 @@ async function run() {
       affiliatesApiUrl,
       isArcticBrand,
       type,
-      baseUrl
+      baseUrl,
+      favicon
     });
 
     console.log(chalk.bold(chalk.yellow(`\nOnboarding "${brandName}" (id: ${connectedBrandName})`)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antelope-cli",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "CLI-Tool for automating processes for Antelope-Systems ",
   "main": "index.js",
   "bin": {