Pipeline Shared Scripts

A collection of CLI tools for Docupace's CI/CD pipelines and deployment workflows.

Overview

This package provides a set of command-line interfaces (CLIs) to facilitate various DevOps operations in the Docupace ecosystem:

• dp-next-cli: Deployment and pipeline management for Next applications
• dp-changeset-cli: Versioning and changeset management
• dp-auth0-cli: Auth0 tenant configuration and management

Installation

npm install @docupace/pipeline

Or with pnpm:

pnpm add @docupace/pipeline

Command Line Interfaces

dp-next-cli

Manages deployment, Docker image handling, and infrastructure configuration.

dp-next-cli [command] [options]

Commands:

• pull <imageName>: Pull a Docker image from the registry
• sonar: Run Sonar analysis
• validate-seeding-guids: Fail on duplicate or non-string GUIDs, warn on non-32-char ones, in template seeding data (run from the template repo root)
  • --data-dir <dir>: Seeding data directory (default data)
• addApacheSite: Add site to apache
• connectClone: Clone connect site
• haproxySync: Sync haproxy config
• vaultAddSiteData: Add m2m auth0 data to vault
  • -s, --site-name <siteName>: Site name
  • -p, --site-config-remote-path <path>: Site config remote path
• publish: Publish a Docker image
• deploy-from-site: Deploy an application for a specific site
  • -f, --from-env <fromEnv>: Source environment
  • -t, --to-env <toEnv>: Target environment
  • -F, --from-site <fromSite>: Source site
  • -T, --to-site <toSite>: Target site
  • -j, --jira-ticket [jiraTicket]: JIRA ticket (optional)
  • -c, --deploy-core <deployCore>: Deploy Core (default: "false")
  • -C, --deploy-connect <deployConnect>: Deploy Connect (default: "false")
  • -A, --deploy-connect-aws <deployConnectAws>: Deploy Connect UI on AWS via dp-eks-connect-ui-gitops (default: "false")
• update-site-version <env> <site>: Update specific version components for a site
  • -u, --ui-version <uiVersion>: UI image tag
  • -g, --graph-version <graphVersion>: GraphQL-server image tag
  • -S, --standard-config <standardConfig>: Standard config remote branch
  • -s, --site-config <siteConfig>: Site config remote branch
  • -c, --connect-version <connectVersion>: AWS Connect UI image tag (optional)
  • -j, --jira-ticket [jiraTicket]: JIRA ticket (required for prod)
• deploy-template: Deploy an application for a specific site
• deploy-app <application>: Deploy an application for a specific site
  • deploy-app connect -e <env> -s <site>: Deploy AWS Connect UI (triggers deploy-connect-aws / gitops update-site-image)
  • -e, --env <env> / -s, --site <site>: Target env/site (optional; otherwise uses auto-deploy targets)
• deploy-core <env> <site>: Deploy Core
  • -l, --liquibase <liquibase>: Application name (default: "true")
  • -b, --branch <branch>: Branch (default: "master")
• deploy-connect <env> <site>: Deploy Connect
  • -l, --liquibase <liquibase>: Application name (default: "true")
  • -b, --branch <branch>: Branch (default: "master")
• deploy-connect-aws <env> <sites> <version>: Deploy Connect UI on AWS (updates dp-eks-connect-ui-gitops image.tag via Bitbucket pipeline)
  • <sites>: single site or comma-separated list (e.g. oa or oa,athene,template)
  • -b, --branch <branch>: Gitops branch for the pipeline (default: "main")
  • -w, --wait / --no-wait: Wait for pipeline completion (default: wait)
• deploy-core-pipeline <env> <site>: Deploy Core via pipeline
  • -l, --liquibase <liquibase>: Application name (default: "true")
  • -b, --branch <branch>: Branch (default: "master")
• copy: Copy a Docker image between registries
  • -a, --application <application>: Application name
  • -f, --from-env <fromEnv>: Source environment
  • -t, --to-env <toEnv>: Target environment
  • -g, --tag <tag>: Image tag
• run-pipeline: Trigger a pipeline by name
  • -r, --repository <repository>: Repository name
  • -p, --pipeline-name <pipelineName>: Pipeline name
  • -b, --branch <branch>: Branch name
  • -v, --variables <key=value>: Pipeline variable as key=value pair
  • -w, --wait: Wait for the pipeline to complete (default: false)

dp-changeset-cli

Manages versioning and changesets for mono-repos and single-package repos.

dp-changeset-cli [command] [options]

Commands:

• validate: Validate changesets for the provided PR
• version: Run Changeset versioning
• commit-tag: Commit and tag the new version
• version-commit-tag: Run versioning and commit-and-tag in sequence
• close-version: Close a version and create a release branch
• create-changeset: Create a changeset based on the current branch and Jira ticket information

dp-auth0-cli

Manages Auth0 tenant configuration across environments and secrets management (Vault and AWS Secrets Manager).

dp-auth0-cli [command] [options]

Commands:

• configureFromSite <fromSite> <toSite> <fromEnv> <toEnv> <deployUI> <deployGraphQLServer> <useNewDomain> <useS3> [auth0Tenant]: Configure Auth0 tenants
• getVaultSecrets <vaultPath>: Get secrets from Vault
• getAwsSecrets <secretName>: Get secrets from AWS Secrets Manager
• saveAwsSecret <secretName> <secretData> [-d, --description <desc>]: Save secrets to AWS Secrets Manager
• listAwsSecretsForSite <site>: List AWS Secrets Manager paths for a site
• configureAlias <site> <env> <username> <password> <realm>: Configure Core Alias for the given site
• exportConf <site> <env>: Export Auth0 configuration for the given site
• getAuth0Metadata <site> <env>: Get Auth0 metadata for the given site

Environment Configuration

The CLI tools look for environment configuration in the following locations:

• .env.pipeline.local
• config/.env.pipeline.local

Secrets Manager Configuration

By default, the tools use HashiCorp Vault for secrets management. To use AWS Secrets Manager instead, set the SECRETS_MANAGER_TYPE environment variable:

# Use HashiCorp Vault (default)
export SECRETS_MANAGER_TYPE=vault

# Use AWS Secrets Manager
export SECRETS_MANAGER_TYPE=aws

Vault Configuration (Default)

• VAULT_ADDR: Vault server URL (e.g., https://vault.example.com)
• VAULT_TOKEN: Vault authentication token
• VAULT_SKIP_VERIFY: Skip TLS certificate verification (optional, set to true)

AWS Secrets Manager Configuration

• AWS_REGION: AWS region (e.g., us-east-1, eu-west-1)
• AWS_ACCESS_KEY_ID: AWS access key ID (for manual authentication)
• AWS_SECRET_ACCESS_KEY: AWS secret access key (for manual authentication)

Note: When running in AWS environments (EC2, ECS, EKS, Lambda), credentials are automatically provided via IAM roles, so you don't need to set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

AWS Secrets Manager Paths

For a given site (e.g., myapp), AWS Secrets Manager follows this naming convention:

• common/config - Common secrets
• myapp/common/config - Site common secrets (Auth0 client credentials)
• myapp/graphql-server/config - GraphQL server secrets
• myapp/ui/config - UI Main app secrets
• myapp/ui-cc/config - UI CC app secrets
• myapp/aws/config - AWS S3 configuration secrets

Secrets Supported by App Type

The following secrets are stored for each application:

Examples

# Deploy from one site to another
dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true

# Run a pipeline
dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa

# Validate changesets
dp-changeset-cli validate

# Create a new changeset
dp-changeset-cli create-changeset

# Configure Auth0 for a site
dp-auth0-cli configureFromSite sourceSite targetSite dev prod true true true false

# Deploy Connect UI image tag on AWS (single site or comma-separated sites)
dp-next-cli deploy-connect-aws qa 1stglobal 4.75.52
dp-next-cli deploy-connect-aws qa oa,athene,template 4.75.52

# Promote AWS Connect UI version from one site to another via deploy-from-site
dp-next-cli deploy-from-site -f dev -t qa -F template -T template -A true

License

ISC