diff --git a/.gitignore b/.gitignore index 4418711..b3e170a 100644 --- a/.gitignore +++ b/.gitignore @@ -15,8 +15,5 @@ node_modules/ .idea/ .vscode/ -# Claude Code -.claude/ -docs/TODO.md -docs/PLAN-*.md -docs/SESSION-STATE.md +# Claude Code (keep settings.local.json out -- machine-specific permissions) +.claude/settings.local.json diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..f3a174e --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,39 @@ +# Munitor + +CircleCI orb that generates CI/CD pipeline configurations from a `.munitor.yml` manifest. Supports 8 pipeline types: java-webapp, gradle-webapp, node-api, node-webapp, terraform, validate-cd-repo, sdk-distribution, argocd-apps. + +## Key Commands + +```bash +make test # Run all tests (BATS) +make pack # Pack orb YAML from src/ +make all # lint + pack + test +make validate # Validate packed orb with CircleCI CLI +``` + +## Project Structure + +- `src/commands/` - CircleCI orb commands (YAML) +- `src/jobs/` - CircleCI orb jobs (YAML) +- `src/scripts/` - Shell scripts included by commands/jobs +- `src/scripts/templates/` - Pipeline config templates (`.yml.tpl`) +- `src/scripts/templates/partials/` - Include partials for templates +- `tests/` - BATS test files +- `tests/fixtures/` - Test fixture `.munitor.yml` files + +## Issue Tracker + +GitHub Issues (org: KofTwentyTwo). Commit format: `feat(#N): description` or `Closes #N` in body. + +## CircleCI Orb + +- Namespace: `kof22` +- Orb: `kof22/munitor` +- Latest stable: `kof22/munitor@0.2.0` +- Dev snapshot: `kof22/munitor@dev:snapshot` + +## Session Continuity + +- Session state: `docs/SESSION-STATE.md` +- Active tasks: `docs/TODO.md` +- Plans: `docs/PLAN-*.md` diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f3ad0ee..8152d4d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,7 +66,7 @@ tests/fixtures/ g. Validates output YAML 3. CircleCI continuation runs the generated pipeline, which references - munitor orb jobs/commands by name (e.g., munitor/npm_build_and_test) + munitor orb jobs/commands by name (e.g., munitor/node_build_and_test) ``` ## Adding a New Module diff --git a/docs/SESSION-STATE.md b/docs/SESSION-STATE.md new file mode 100644 index 0000000..1ca4067 --- /dev/null +++ b/docs/SESSION-STATE.md @@ -0,0 +1,83 @@ +# Munitor Session State + +## Last Updated +2026-03-27 + +## Current Status +Feature branch `feature/GH-5-pnpm-support` is at `7519d62`, pushed to origin. 17 commits ahead of `develop`. Dev snapshot published: `kof22/munitor@dev:snapshot`. All 219 tests pass. Ready for PR to develop when consumer repo validation confirms the fixes work. + +## Branch +- `feature/GH-5-pnpm-support` at `7519d62` (pushed, 17 commits ahead of develop) +- `develop` at `af15015` +- `main` at `1e558c1` (2 commits ahead of develop) + +## Tags / Releases +- `v0.1.0` at `9247dcc` - Initial stable release (7 pipeline types, 362+ tests) +- `v0.1.1` at `5f70823` - Supplemental images, health check, Trivy bump (505+ tests) +- `v0.1.2` at `d766747` - Overridable org defaults (PR #1) +- `v0.2.0` at `af15015` - Gradle-webapp pipeline type (PR #2), marked as Latest + +All four have GitHub Releases. + +## Key Facts +- GitHub org: KofTwentyTwo (repo: KofTwentyTwo/Munitor) +- CircleCI namespace: kof22 (orb: kof22/munitor) +- Latest stable orb: kof22/munitor@0.2.0 +- Dev snapshot: kof22/munitor@dev:snapshot (pnpm support, 2026-03-27) +- Pipeline types (8): java-webapp, gradle-webapp, node-api, node-webapp, terraform, validate-cd-repo, sdk-distribution, argocd-apps +- CI workflows: lint-pack (all), snapshot (develop/feature), test-deploy (tags only) +- Default branch: develop (main is release-only) +- Test count: 219 assertions passing (across 7 test files) +- GitHub Issue: #5 (first-class pnpm support) + +## pnpm Support (GH-5) Implementation Summary + +### What was done (17 commits on feature/GH-5-pnpm-support) + +**Phase 1 - Mechanical rename:** +- Renamed all `npm_*` jobs/commands/scripts to `node_*` (except `npm_auth` which stays) +- Updated all templates, tests, and CONTRIBUTING.md references + +**Phase 2 - Package manager threading:** +- `package_manager` parameter threaded through: `install_node` -> `node_install_deps` -> `node_test` -> cache commands -> `node_build_and_test` job -> all templates +- Corepack activation in `install_node.sh` for pnpm/yarn (version detection from `packageManager` field or `engines`) +- `node_install_deps.sh` rewritten with npm/pnpm branching + Prisma auto-detection +- `node_test.sh` falls back to `pnpm test` for pnpm (instead of `npx jest`) +- Cache commands use PM-specific lockfile checksums and cache paths + +**Phase 3 - Supplemental features:** +- `run_test_setup.sh` supports inline commands (not just file paths) +- `generate_dockerfile.sh` has pnpm Dockerfile variants for node-api (nextjs + express) and node-webapp +- Prisma auto-detection runs `prisma generate` after install for all PMs + +**Phase 4 - Secondary job fixes (latest commit):** +- All secondary jobs (code-quality, coverage, e2e, security-scan, sonar, sbom) now run `install_node` with `node_version` + `package_manager` to bootstrap corepack/pnpm in their executors +- `node_coverage_check` supports configurable `coverage_summary_path` with glob patterns for monorepo weighted-average aggregation +- New `.munitor.yml` config: `test.coverage.summary_path` (default: `coverage/coverage-summary.json`) + +### Design decisions +- Spec: `ClaudeCode/Munitor/docs/2026-03-27-pnpm-support-design.md` +- Plan: `ClaudeCode/Munitor/docs/2026-03-27-pnpm-support-plan.md` +- `npm_auth` NOT renamed (genuinely npm-registry-specific, .npmrc auth works for pnpm too) +- Monorepo Dockerfile generation out of scope (user provides custom Dockerfile) +- Yarn support limited to corepack plumbing (no yarn-specific testing) +- Coverage monorepo: glob + weighted average rather than auto-search + +## Consumer Repos - Orb Version Status (updated 2026-03-27) +- `KofTwentyTwo/Concilium` - gradle-webapp, develop, **@0.2**, green (PR #41 merged) +- `KofTwentyTwo/Website-Backend` - java-webapp, develop, **@0.2** (PR #44 merged) +- `KofTwentyTwo/Website-Frontend` - node-webapp, develop, **@0.2** (PR #6 merged) - testing pnpm support via dev:snapshot +- `KofTwentyTwo/k8s-app-of-apps` - argocd-apps, develop, green (still on @0.1, compatible) +- `KofTwentyTwo/Website-CD` - validate-cd-repo, main, green (still on @0.1, compatible) +- `KofTwentyTwo/makers4` - java-webapp, main, **needs CircleCI follow** +- `KofTwentyTwo/terraform-proxmox-talos` - terraform, develop, **needs CircleCI follow** + +## Next Steps +- Validate dev:snapshot on Website-Frontend (pnpm consumer) - confirm coverage job now works without corepack workaround +- Test `coverage_summary_path` glob if Website-Frontend is a monorepo +- Create PR #3 targeting develop once consumer validation passes +- Merge and release v0.3.0 +- Bump consumer repos to @0.3 +- Follow makers4 and terraform-proxmox-talos on CircleCI (manual UI step) +- Fix Website-Frontend ESLint error (DebugPanel.tsx:73 setState in effect, pre-existing) +- Adopt supplemental images on a consumer repo (e.g., me-health-portal with Liquibase) diff --git a/docs/TODO.md b/docs/TODO.md new file mode 100644 index 0000000..a687d8e --- /dev/null +++ b/docs/TODO.md @@ -0,0 +1,42 @@ +# TODO: Munitor + +## Pending + +- [ ] Validate dev:snapshot on Website-Frontend (confirm pnpm coverage job fix) +- [ ] Create PR #3 for pnpm support (feature/GH-5-pnpm-support -> develop) +- [ ] Release v0.3.0 after PR merge +- [ ] Bump consumer repos to @0.3 +- [ ] Follow makers4 and terraform-proxmox-talos on CircleCI (manual step) +- [ ] Fix Website-Frontend ESLint error (DebugPanel.tsx:73 setState in effect) +- [ ] Adopt supplemental images on a consumer repo (e.g., me-health-portal with Liquibase) +- [ ] Bump k8s-app-of-apps and Website-CD to @0.2+ (optional, @0.1 still compatible) + +## Completed + +- [x] Implement first-class pnpm support (GH-5, 17 commits, 219 tests) +- [x] Rename all npm_* orb components to node_* (backward-incompatible, pre-1.0) +- [x] Thread package_manager through full job/command/script chain +- [x] Add corepack activation for pnpm/yarn in install_node +- [x] Add pnpm Dockerfile variants for node-api and node-webapp +- [x] Add Prisma auto-detection after dependency install +- [x] Support inline commands in test.setup +- [x] Bootstrap pnpm in secondary jobs (code-quality, coverage, e2e, security-scan, sonar, sbom) +- [x] Add configurable coverage_summary_path with monorepo glob support +- [x] Publish dev:snapshot with pnpm support +- [x] Implement gradle-webapp pipeline type (20 new files, 7 modified, 605+ tests) +- [x] Fix pack_generate_config.sh to embed gradle templates +- [x] Fix RC009 orb review (extract inline commands to included script) +- [x] Fix SC2155 shellcheck warnings in extract_munitor_vars.sh +- [x] Add JaCoCo diagnostic output to gradle_jacoco.sh +- [x] Merge gradle-webapp PR #2 to develop +- [x] Release v0.2.0 and publish kof22/munitor@0.2.0 +- [x] Create GitHub Release for v0.2.0 +- [x] Bump Concilium from dev:snapshot to @0.2 (PR #41) +- [x] Bump Website-Backend from @0.1 to @0.2 (PR #44) +- [x] Bump Website-Frontend from @0.1 to @0.2 (PR #6) +- [x] Onboard Concilium as first gradle-webapp consumer +- [x] Create GitHub Releases for v0.1.0, v0.1.1, v0.1.2 +- [x] Publish orb kof22/munitor@0.1.2 (overridable org defaults) +- [x] Implement supplemental Docker image support +- [x] All 8 pipeline types implemented and tested +- [x] Full rebrand from Faber to Munitor diff --git a/docs/reference/2026-03-27-pnpm-support-design.md b/docs/reference/2026-03-27-pnpm-support-design.md new file mode 100644 index 0000000..d6bab59 --- /dev/null +++ b/docs/reference/2026-03-27-pnpm-support-design.md @@ -0,0 +1,174 @@ +# Spec: First-Class Package Manager Support (Issue #5) + +## Goal + +Make `package_manager` a first-class config in Munitor that drives behavior across the full Node.js lifecycle: dependency install, test execution, caching, Dockerfile generation, and post-install hooks (Prisma). Rename all `npm_*` orb jobs/commands to `node_*` to reflect multi-PM support. Release as v0.3.0. + +## Context + +`MUNITOR_PACKAGE_MANAGER` is parsed from `.munitor.yml` and available at config-generation time via envsubst, but no runtime script uses it. All scripts hardcode npm commands. Projects using `package_manager: pnpm` hit `pnpm: command not found` and must work around it with custom test commands. + +## Scope + +### In scope +- Rename `npm_*` jobs/commands/scripts to `node_*` (except `npm_auth`) +- Thread `package_manager` parameter through job -> command -> script chain +- Corepack activation for pnpm (and yarn) in `install_node.sh` +- Package-manager-aware dependency install, test fallback, cache, Dockerfile generation +- Prisma schema auto-detection and `prisma generate` after install +- Fix `test.setup` to support inline commands (not just file paths) +- Update all templates, packed scripts, and tests +- v0.3.0 release + +### Out of scope +- Yarn support beyond basic corepack plumbing (no yarn-specific testing or validation) +- Monorepo-aware Dockerfile generation (user provides custom Dockerfile for complex monorepos) +- Changes to `npm_auth` (works for all PMs via `.npmrc`) + +## Design + +### 1. Rename Map + +Keep `npm_auth` as-is (genuinely npm-registry-specific; `.npmrc` auth works for pnpm too). Everything else: + +**Jobs:** +| Old | New | +|---|---| +| `npm_build_and_test` | `node_build_and_test` | +| `npm_code_quality` | `node_code_quality` | +| `npm_coverage` | `node_coverage` | +| `npm_security_scan` | `node_security_scan` | +| `npm_e2e_test` | `node_e2e_test` | +| `npm_sonar_scan` | `node_sonar_scan` | +| `npm_sbom` | `node_sbom` | + +**Commands:** +| Old | New | +|---|---| +| `npm_install` | `node_install_deps` | +| `npm_test` | `node_test` | +| `npm_lint` | `node_lint` | +| `npm_audit` | `node_audit` | +| `npm_coverage_check` | `node_coverage_check` | +| `npm_sonar` | `node_sonar` | +| `npm_sbom` (cmd) | `node_sbom` (cmd) | +| `restore_npm_cache` | `restore_node_cache` | +| `save_npm_cache` | `save_node_cache` | + +**Scripts:** Same pattern, `.sh` suffix (e.g., `npm_install.sh` -> `node_install_deps.sh`). + +### 2. Parameter Threading + +Add `package_manager` (type: string, default: `"npm"`) to: +- `node_build_and_test` job +- `install_node` command +- `node_install_deps` command +- `node_test` command +- `restore_node_cache` / `save_node_cache` commands + +Templates pass it: `package_manager: "${MUNITOR_PACKAGE_MANAGER}"`. + +At runtime, each command sets `MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >>` in the step's `environment` block, making it available to the included script. + +### 3. Corepack Activation (`install_node.sh`) + +After nvm install/use, when `MUNITOR_PACKAGE_MANAGER != npm`: + +1. Run `corepack enable` +2. Detect version from `package.json` with this priority: + - `packageManager` field (e.g., `"pnpm@9.15.9"`) -- corepack-native declaration + - `engines.` field (e.g., `"engines": {"pnpm": ">=9"}`) + - Fallback: no version specified (corepack uses latest) +3. If version found: `corepack prepare @ --activate` +4. Print version to build output +5. Export PM binary path to `BASH_ENV` so downstream steps have it on PATH + +### 4. Dependency Install (`node_install_deps.sh`, was `npm_install.sh`) + +Branch on `MUNITOR_PACKAGE_MANAGER`: + +**npm (default):** Current behavior unchanged. Check `package-lock.json`, run `npm ci`, lockfile version warning. + +**pnpm:** Check `pnpm-lock.yaml` exists (error message should suggest `pnpm install` to create it, not `npm install`). Run `pnpm install --frozen-lockfile`. Note: `pnpm install` at the repo root handles workspaces natively; `pnpm -r` is NOT needed. + +After install (all PMs): Prisma auto-detection (see section 7). + +### 5. Test Execution (`node_test.sh`, was `npm_test.sh`) + +**Custom commands path:** Unchanged. Already runs arbitrary commands via `bash -c`. + +**Default fallback (no custom commands):** +- npm: `npx jest` (current behavior) +- pnpm: `pnpm test` (delegates to package.json scripts, where Jest or Vitest is typically configured) + +### 6. Cache (`restore_node_cache.yml` / `save_node_cache.yml`) + +Use CircleCI `when/equal` conditions on `package_manager` parameter: + +**npm:** Checksum `package-lock.json`, cache `~/.npm`. +**pnpm:** Checksum `pnpm-lock.yaml`, cache pnpm store (get path via `pnpm store path` at save time, use `~/.local/share/pnpm/store` as restore default). + +Cache key prefix changes per PM to avoid collisions: `npm-v1-` vs `pnpm-v1-`. + +### 7. Prisma Auto-Detection + +Added to `node_install_deps.sh` after the dependency install step: + +1. `find . -path "*/prisma/schema.prisma" -not -path "*/node_modules/*" -not -path "*/dist/*" -not -path "*/build/*"` +2. For each found schema, run ` prisma generate --schema=`: + - npm: `npx prisma generate --schema=` + - pnpm: `pnpm exec prisma generate --schema=` +3. If no schemas found, skip silently (no output). +4. If schemas found but `prisma` is not in dependencies, log a warning and continue (don't fail the build). + +This is not pnpm-specific; it helps any monorepo where Prisma's postinstall hook can't find the schema at the default location. + +### 8. Dockerfile Generation (`generate_dockerfile.sh`) + +Already has `MUNITOR_PACKAGE_MANAGER` via `extract_munitor_vars.sh`. Changes needed in node-api and node-webapp Dockerfile templates: + +**npm (default):** No change. `COPY package*.json` / `npm ci` / `npm run build`. + +**pnpm:** In builder stage: +```dockerfile +RUN corepack enable +COPY package.json pnpm-lock.yaml ./ +RUN pnpm install --frozen-lockfile +COPY . . +RUN pnpm run build +``` + +Runner stage: strip pnpm (same pattern as stripping npm). For distroless images (node-webapp), pnpm isn't present in the runner anyway since only standalone output is copied. + +**Monorepo note:** Generated Dockerfiles assume single-package or standalone-output builds. Complex monorepo setups should provide a custom Dockerfile (existing escape hatch: place a `Dockerfile` in the repo and Munitor skips generation). + +### 9. test.setup Fix (`run_test_setup.sh`) + +Current behavior: if the value doesn't point to an existing file, exit with "script not found." This silently confuses users who pass command strings. + +Fix: if the value is not a file path, treat it as an inline shell command and run it via `bash -c`. Log clearly which mode was used: +- File: `"Running test setup script: ./scripts/setup.sh"` +- Inline: `"Running test setup command: corepack enable && ..."` + +This reduces the need for the inline workaround now that pnpm is auto-handled, but prevents future confusion. + +### 10. Template Updates + +All 4 templates (`node-webapp.yml.tpl`, `node-api.yml.tpl`) and 2 deploy partials (`node-webapp-deploy.yml.tpl`, `node-api-deploy.yml.tpl`): +- Replace all `munitor/npm_*` references with `munitor/node_*` +- Add `package_manager: "${MUNITOR_PACKAGE_MANAGER}"` to `node_build_and_test` invocations + +`packed_generate_config.sh` and `packed_generate_dockerfile.sh`: Regenerated from source (these embed templates). + +### 11. Test Updates + +- `test_generate_config.sh`: Update all `npm_*` assertions to `node_*`. Add pnpm fixture and tests. +- `test_extract_munitor_vars.sh`: Already tests `MUNITOR_PACKAGE_MANAGER`. Add pnpm-specific fixture. +- `test_scripts.sh`: Update script path references. Add tests for pnpm branching in `node_install_deps.sh` and Prisma detection. +- New fixture: `.munitor.yml` with `package_manager: pnpm` for generate_config tests. + +### 12. Version and Release + +- Version: **0.3.0** (breaking rename, pre-1.0) +- Consumer repos must regenerate `.circleci/config.yml` after bumping orb version +- `generate_config.sh` output automatically uses new job names diff --git a/docs/reference/2026-03-27-pnpm-support-plan.md b/docs/reference/2026-03-27-pnpm-support-plan.md new file mode 100644 index 0000000..c123a6e --- /dev/null +++ b/docs/reference/2026-03-27-pnpm-support-plan.md @@ -0,0 +1,1456 @@ +# First-Class Package Manager Support Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Make `package_manager` in `.munitor.yml` drive behavior across the full Node.js lifecycle (install, test, cache, Dockerfile, Prisma), rename `npm_*` orb components to `node_*`, and release as v0.3.0. + +**Architecture:** Three phases: (1) mechanical rename of all `npm_*` files to `node_*` with no behavior change, (2) thread `package_manager` parameter through the orb's job/command/script chain and add pnpm-aware branching, (3) supplemental features (Prisma auto-detection, test.setup inline commands, Dockerfile pnpm support). Each phase ends with `make all` passing. + +**Tech Stack:** Bash, CircleCI orb YAML, shellcheck, yamllint, bats-style test assertions + +**Spec:** `ClaudeCode/Munitor/docs/2026-03-27-pnpm-support-design.md` + +--- + +## File Map + +### Renames (old -> new) + +**Scripts:** +- `src/scripts/npm_install.sh` -> `src/scripts/node_install_deps.sh` +- `src/scripts/npm_test.sh` -> `src/scripts/node_test.sh` +- `src/scripts/npm_lint.sh` -> `src/scripts/node_lint.sh` +- `src/scripts/npm_audit.sh` -> `src/scripts/node_audit.sh` +- `src/scripts/npm_coverage_check.sh` -> `src/scripts/node_coverage_check.sh` +- `src/scripts/npm_sonar.sh` -> `src/scripts/node_sonar.sh` +- `src/scripts/npm_sbom.sh` -> `src/scripts/node_sbom.sh` + +**Commands:** +- `src/commands/npm_install.yml` -> `src/commands/node_install_deps.yml` +- `src/commands/npm_test.yml` -> `src/commands/node_test.yml` +- `src/commands/npm_lint.yml` -> `src/commands/node_lint.yml` +- `src/commands/npm_audit.yml` -> `src/commands/node_audit.yml` +- `src/commands/npm_coverage_check.yml` -> `src/commands/node_coverage_check.yml` +- `src/commands/npm_sonar.yml` -> `src/commands/node_sonar.yml` +- `src/commands/npm_sbom.yml` -> `src/commands/node_sbom.yml` +- `src/commands/restore_npm_cache.yml` -> `src/commands/restore_node_cache.yml` +- `src/commands/save_npm_cache.yml` -> `src/commands/save_node_cache.yml` + +**Jobs:** +- `src/jobs/npm_build_and_test.yml` -> `src/jobs/node_build_and_test.yml` +- `src/jobs/npm_code_quality.yml` -> `src/jobs/node_code_quality.yml` +- `src/jobs/npm_coverage.yml` -> `src/jobs/node_coverage.yml` +- `src/jobs/npm_security_scan.yml` -> `src/jobs/node_security_scan.yml` +- `src/jobs/npm_e2e_test.yml` -> `src/jobs/node_e2e_test.yml` +- `src/jobs/npm_sonar_scan.yml` -> `src/jobs/node_sonar_scan.yml` +- `src/jobs/npm_sbom.yml` -> `src/jobs/node_sbom.yml` + +**NOT renamed (npm-specific):** +- `src/scripts/npm_auth.sh` - stays +- `src/commands/npm_auth.yml` - stays + +### Modified (content changes, no rename) + +- `src/scripts/install_node.sh` - add corepack activation +- `src/scripts/run_test_setup.sh` - add inline command support +- `src/scripts/generate_dockerfile.sh` - add pnpm Dockerfile variants +- `src/scripts/templates/node-webapp.yml.tpl` - rename refs + add package_manager param +- `src/scripts/templates/node-api.yml.tpl` - rename refs + add package_manager param +- `src/scripts/templates/partials/node-webapp-deploy.yml.tpl` - rename refs + add package_manager param +- `src/scripts/templates/partials/node-api-deploy.yml.tpl` - rename refs + add package_manager param +- `src/scripts/packed_generate_config.sh` - regenerated +- `src/scripts/packed_generate_dockerfile.sh` - regenerated +- `tests/test_generate_config.sh` - update assertions + add pnpm tests +- `tests/test_scripts.sh` - update script refs + add pnpm tests +- `tests/test_extract_munitor_vars.sh` - add pnpm fixture +- `CONTRIBUTING.md` - update job name reference + +### New files + +- `tests/fixtures/pnpm-webapp.munitor.yml` - test fixture for pnpm config + +--- + +## Phase 1: Mechanical Rename + +### Task 1: Create feature branch + +**Files:** None + +- [ ] **Step 1: Create branch from develop** + +```bash +cd /Users/james.maes/Git.Local/Kof22/Munitor +git checkout develop +git pull origin develop +git checkout -b feature/GH-5-pnpm-support +``` + +- [ ] **Step 2: Verify clean state** + +```bash +git status +``` + +Expected: clean working tree on `feature/GH-5-pnpm-support` + +--- + +### Task 2: Rename script files + +**Files:** +- Rename: `src/scripts/npm_install.sh` -> `src/scripts/node_install_deps.sh` +- Rename: `src/scripts/npm_test.sh` -> `src/scripts/node_test.sh` +- Rename: `src/scripts/npm_lint.sh` -> `src/scripts/node_lint.sh` +- Rename: `src/scripts/npm_audit.sh` -> `src/scripts/node_audit.sh` +- Rename: `src/scripts/npm_coverage_check.sh` -> `src/scripts/node_coverage_check.sh` +- Rename: `src/scripts/npm_sonar.sh` -> `src/scripts/node_sonar.sh` +- Rename: `src/scripts/npm_sbom.sh` -> `src/scripts/node_sbom.sh` + +- [ ] **Step 1: Rename all script files** + +```bash +cd /Users/james.maes/Git.Local/Kof22/Munitor +git mv src/scripts/npm_install.sh src/scripts/node_install_deps.sh +git mv src/scripts/npm_test.sh src/scripts/node_test.sh +git mv src/scripts/npm_lint.sh src/scripts/node_lint.sh +git mv src/scripts/npm_audit.sh src/scripts/node_audit.sh +git mv src/scripts/npm_coverage_check.sh src/scripts/node_coverage_check.sh +git mv src/scripts/npm_sonar.sh src/scripts/node_sonar.sh +git mv src/scripts/npm_sbom.sh src/scripts/node_sbom.sh +``` + +- [ ] **Step 2: Update munitor_header calls inside each renamed script** + +In each renamed script, update the `munitor_header` call to match the new name. For example, in `node_install_deps.sh`: + +```bash +# Change: +munitor_header "npm_install" +# To: +munitor_header "node_install_deps" +``` + +Apply the same pattern to all 7 renamed scripts: +- `node_install_deps.sh`: `munitor_header "node_install_deps"` +- `node_test.sh`: `munitor_header "node_test"` +- `node_lint.sh`: `munitor_header "node_lint"` +- `node_audit.sh`: `munitor_header "node_audit"` +- `node_coverage_check.sh`: `munitor_header "node_coverage_check"` +- `node_sonar.sh`: `munitor_header "node_sonar"` +- `node_sbom.sh`: `munitor_header "node_sbom"` + +- [ ] **Step 3: Verify shellcheck passes on renamed scripts** + +```bash +shellcheck --severity=warning src/scripts/node_install_deps.sh src/scripts/node_test.sh src/scripts/node_lint.sh src/scripts/node_audit.sh src/scripts/node_coverage_check.sh src/scripts/node_sonar.sh src/scripts/node_sbom.sh +``` + +Expected: no warnings + +- [ ] **Step 4: Commit** + +```bash +git add -A +git commit -m "refactor: rename npm_* scripts to node_*" +``` + +--- + +### Task 3: Rename command files and update script references + +**Files:** +- Rename: all 9 command files (see File Map above) +- Modify: each renamed command file's `<< include() >>` directive and `name:` field + +- [ ] **Step 1: Rename all command files** + +```bash +cd /Users/james.maes/Git.Local/Kof22/Munitor +git mv src/commands/npm_install.yml src/commands/node_install_deps.yml +git mv src/commands/npm_test.yml src/commands/node_test.yml +git mv src/commands/npm_lint.yml src/commands/node_lint.yml +git mv src/commands/npm_audit.yml src/commands/node_audit.yml +git mv src/commands/npm_coverage_check.yml src/commands/node_coverage_check.yml +git mv src/commands/npm_sonar.yml src/commands/node_sonar.yml +git mv src/commands/npm_sbom.yml src/commands/node_sbom.yml +git mv src/commands/restore_npm_cache.yml src/commands/restore_node_cache.yml +git mv src/commands/save_npm_cache.yml src/commands/save_node_cache.yml +``` + +- [ ] **Step 2: Update include paths in renamed command files** + +Each command file uses `<< include(scripts/npm_*.sh) >>`. Update to reference the new script names: + +`src/commands/node_install_deps.yml`: +```yaml +description: > + Install project dependencies using the configured package manager. +steps: + - run: + name: Install dependencies + command: << include(scripts/node_install_deps.sh) >> +``` + +`src/commands/node_test.yml`: +```yaml +description: > + Run tests with CI flags, coverage, and JUnit reporter. Supports custom + test commands via JSON array or falls back to package manager defaults. +parameters: + test_commands: + type: string + default: "" + description: JSON array of custom test commands to run instead of defaults. +steps: + - run: + name: Run tests + environment: + MUNITOR_TEST_COMMANDS_JSON: << parameters.test_commands >> + command: << include(scripts/node_test.sh) >> + - store_test_results: + path: reports/junit + - store_artifacts: + path: reports/junit + destination: test-results + - store_artifacts: + path: coverage + destination: coverage +``` + +`src/commands/node_lint.yml`: +```yaml +description: > + Run ESLint on the project source. +steps: + - run: + name: ESLint + command: << include(scripts/node_lint.sh) >> +``` + +`src/commands/node_audit.yml`: +```yaml +description: > + Run npm audit to check for known vulnerabilities in dependencies. +steps: + - run: + name: Security audit + command: << include(scripts/node_audit.sh) >> +``` + +`src/commands/node_coverage_check.yml`: +```yaml +description: > + Enforce minimum coverage threshold from coverage-summary.json. + Supports Jest (default) and NYC coverage tools. +parameters: + min_coverage: + type: string + default: "70" + description: Minimum line coverage percentage. + coverage_tool: + type: string + default: "jest" + description: Coverage tool (jest or nyc). + coverage_command: + type: string + default: "" + description: Custom command to generate coverage report before threshold check. +steps: + - run: + name: Coverage threshold check + environment: + MIN_COVERAGE: << parameters.min_coverage >> + MUNITOR_COVERAGE_TOOL: << parameters.coverage_tool >> + MUNITOR_COVERAGE_COMMAND: << parameters.coverage_command >> + command: << include(scripts/node_coverage_check.sh) >> +``` + +`src/commands/node_sonar.yml`: +```yaml +description: > + Run SonarCloud analysis via sonar-scanner CLI for Node.js projects. +parameters: + sonar_project_key: + type: string + description: SonarCloud project key. + sonar_org: + type: string + default: KofTwentyTwo + description: SonarCloud organization. + sonar_token_env: + type: env_var_name + default: SONAR_TOKEN + description: Environment variable containing the SonarCloud token. +steps: + - run: + name: SonarCloud analysis + environment: + SONAR_PROJECT_KEY: << parameters.sonar_project_key >> + SONAR_ORG: << parameters.sonar_org >> + SONAR_TOKEN_VAR: << parameters.sonar_token_env >> + command: << include(scripts/node_sonar.sh) >> +``` + +`src/commands/node_sbom.yml`: +```yaml +description: > + Generate a CycloneDX SBOM from a Node.js project. +steps: + - run: + name: Generate SBOM + command: << include(scripts/node_sbom.sh) >> +``` + +`src/commands/restore_node_cache.yml` and `src/commands/save_node_cache.yml`: No include path changes needed (these use CircleCI native `restore_cache`/`save_cache`, not script includes). Update descriptions only: + +`src/commands/restore_node_cache.yml`: +```yaml +description: > + Restore the dependency cache based on lockfile checksum. +steps: + - restore_cache: + keys: + - npm-v1-{{ checksum "package-lock.json" }} + - npm-v1- +``` + +`src/commands/save_node_cache.yml`: +```yaml +description: > + Save the dependency cache for future builds. +steps: + - save_cache: + key: npm-v1-{{ checksum "package-lock.json" }} + paths: + - ~/.npm +``` + +- [ ] **Step 3: Verify yamllint passes** + +```bash +yamllint -c .yamllint src/commands/node_install_deps.yml src/commands/node_test.yml src/commands/node_lint.yml src/commands/node_audit.yml src/commands/node_coverage_check.yml src/commands/node_sonar.yml src/commands/node_sbom.yml src/commands/restore_node_cache.yml src/commands/save_node_cache.yml +``` + +Expected: no errors + +- [ ] **Step 4: Commit** + +```bash +git add -A +git commit -m "refactor: rename npm_* commands to node_*" +``` + +--- + +### Task 4: Rename job files and update command references + +**Files:** +- Rename: all 7 job files (see File Map above) +- Modify: each renamed job file's internal command references + +- [ ] **Step 1: Rename all job files** + +```bash +cd /Users/james.maes/Git.Local/Kof22/Munitor +git mv src/jobs/npm_build_and_test.yml src/jobs/node_build_and_test.yml +git mv src/jobs/npm_code_quality.yml src/jobs/node_code_quality.yml +git mv src/jobs/npm_coverage.yml src/jobs/node_coverage.yml +git mv src/jobs/npm_security_scan.yml src/jobs/node_security_scan.yml +git mv src/jobs/npm_e2e_test.yml src/jobs/node_e2e_test.yml +git mv src/jobs/npm_sonar_scan.yml src/jobs/node_sonar_scan.yml +git mv src/jobs/npm_sbom.yml src/jobs/node_sbom.yml +``` + +- [ ] **Step 2: Update command references in node_build_and_test.yml** + +Replace command references inside `src/jobs/node_build_and_test.yml`: + +```yaml +description: > + Full Node.js build and test job. Installs Node.js, restores cache, runs + dependency install, calculates version, tests with coverage, saves cache, + and persists the workspace for downstream jobs. +parameters: + node_version: + type: string + default: "20" + description: Node.js major version to install. + npm_auth: + type: boolean + default: false + description: Configure private npm registry authentication before install. + npm_scopes: + type: string + default: "[]" + description: JSON array of additional npm scopes (e.g. '["@greatergoods"]'). + npm_default_scope: + type: string + default: "@koftwentytwo" + description: Default npm scope for the organization. + services: + type: string + default: "" + description: JSON array of service container definitions to start before tests. + test_setup: + type: string + default: "" + description: Path to a setup script to run before tests. + test_commands: + type: string + default: "" + description: JSON array of custom test commands to run instead of defaults. + resource_class: + type: enum + enum: + - medium + - large + - xlarge + default: large + description: Machine resource class. +executor: + name: machine + resource_class: << parameters.resource_class >> +steps: + - checkout + - install_node: + version: << parameters.node_version >> + - when: + condition: << parameters.npm_auth >> + steps: + - npm_auth: + npm_scopes: << parameters.npm_scopes >> + npm_default_scope: << parameters.npm_default_scope >> + - restore_node_cache + - node_install_deps + - when: + condition: << parameters.services >> + steps: + - start_services: + services: << parameters.services >> + - when: + condition: << parameters.test_setup >> + steps: + - run_test_setup: + test_setup: << parameters.test_setup >> + - calculate_version + - export_version_vars + - run: + name: Persist version metadata + command: <> + - node_test: + test_commands: << parameters.test_commands >> + - store_test_results: + path: reports/junit + - save_node_cache + - persist_to_workspace: + root: . + paths: + - "." +``` + +- [ ] **Step 3: Update command references in remaining job files** + +`src/jobs/node_code_quality.yml`: Change `- npm_lint` to `- node_lint` + +`src/jobs/node_coverage.yml`: Change `npm_coverage_check` to `node_coverage_check` (3 occurrences in the parameters pass-through) + +`src/jobs/node_security_scan.yml`: Change `- npm_audit` to `- node_audit` + +`src/jobs/node_sonar_scan.yml`: Change `- npm_sonar:` to `- node_sonar:` + +`src/jobs/node_sbom.yml`: Change `- npm_sbom` to `- node_sbom` + +- [ ] **Step 4: Verify yamllint passes on all renamed jobs** + +```bash +yamllint -c .yamllint src/jobs/node_build_and_test.yml src/jobs/node_code_quality.yml src/jobs/node_coverage.yml src/jobs/node_security_scan.yml src/jobs/node_e2e_test.yml src/jobs/node_sonar_scan.yml src/jobs/node_sbom.yml +``` + +Expected: no errors + +- [ ] **Step 5: Commit** + +```bash +git add -A +git commit -m "refactor: rename npm_* jobs to node_*" +``` + +--- + +### Task 5: Update templates to use new names + +**Files:** +- Modify: `src/scripts/templates/node-webapp.yml.tpl` +- Modify: `src/scripts/templates/node-api.yml.tpl` +- Modify: `src/scripts/templates/partials/node-webapp-deploy.yml.tpl` +- Modify: `src/scripts/templates/partials/node-api-deploy.yml.tpl` + +- [ ] **Step 1: Replace all `munitor/npm_` references with `munitor/node_` in templates** + +In all 4 template files, perform these replacements: + +| Old | New | +|---|---| +| `munitor/npm_build_and_test` | `munitor/node_build_and_test` | +| `munitor/npm_code_quality` | `munitor/node_code_quality` | +| `munitor/npm_coverage` | `munitor/node_coverage` | +| `munitor/npm_security_scan` | `munitor/node_security_scan` | +| `munitor/npm_e2e_test` | `munitor/node_e2e_test` | +| `munitor/npm_sonar_scan` | `munitor/node_sonar_scan` | +| `munitor/npm_sbom` | `munitor/node_sbom` | + +Do NOT change `npm_auth`, `npm_scopes`, or `npm_default_scope` (these are npm-specific and stay). + +- [ ] **Step 2: Verify no stale `munitor/npm_` references remain (excluding npm_auth)** + +```bash +grep -r 'munitor/npm_' src/scripts/templates/ | grep -v npm_auth +``` + +Expected: no output + +- [ ] **Step 3: Commit** + +```bash +git add -A +git commit -m "refactor: update templates to use node_* job names" +``` + +--- + +### Task 6: Update tests for rename + +**Files:** +- Modify: `tests/test_generate_config.sh` +- Modify: `tests/test_scripts.sh` + +- [ ] **Step 1: Update test_generate_config.sh** + +Replace all `npm_build_and_test` with `node_build_and_test`, `npm_code_quality` with `node_code_quality`, `npm_coverage` with `node_coverage`, `npm_security_scan` with `node_security_scan`, `npm_e2e_test` with `node_e2e_test`, `npm_sonar_scan` with `node_sonar_scan`, `npm_sbom` with `node_sbom` in test assertions and descriptions. + +Also update test descriptions like `"uses npm_sonar_scan"` to `"uses node_sonar_scan"`. + +Do NOT change references to `npm_auth` or `npm_scopes` or `npm_default_scope`. + +- [ ] **Step 2: Update test_scripts.sh** + +Replace references to old script file names: +- `npm_coverage_check.sh` -> `node_coverage_check.sh` +- Any other `npm_*.sh` references -> corresponding `node_*.sh` + +- [ ] **Step 3: Update CONTRIBUTING.md** + +Replace the reference to `munitor/npm_build_and_test` with `munitor/node_build_and_test`. + +- [ ] **Step 4: Regenerate packed scripts and validate** + +```bash +make pack-scripts +make all +``` + +Expected: all lint, validation, and tests pass. + +- [ ] **Step 5: Commit** + +```bash +git add -A +git commit -m "refactor: update tests and docs for node_* rename" +``` + +--- + +## Phase 2: Package Manager Support + +### Task 7: Add corepack activation to install_node.sh + +**Files:** +- Modify: `src/scripts/install_node.sh` +- Modify: `src/commands/install_node.yml` + +- [ ] **Step 1: Add package_manager parameter to install_node.yml** + +```yaml +description: > + Install the specified Node.js version using nvm (pre-installed on CircleCI ubuntu-2204). + Activates corepack for non-npm package managers. +parameters: + version: + type: string + default: "20" + description: Node.js major version to install (e.g., 20, 22). + package_manager: + type: string + default: "npm" + description: Package manager to activate (npm, pnpm, yarn). +steps: + - run: + name: Install Node.js << parameters.version >> + environment: + NODE_VERSION: << parameters.version >> + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> + command: << include(scripts/install_node.sh) >> +``` + +- [ ] **Step 2: Add corepack activation to install_node.sh** + +After the existing `echo "=== Node Environment ==="` block and before the `.nvmrc` warning, add: + +```bash +# Activate non-npm package managers via corepack +PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" +if [[ "${PACKAGE_MANAGER}" != "npm" ]]; then + echo "" + echo "=== Activating ${PACKAGE_MANAGER} via corepack ===" + corepack enable + + # Detect version: packageManager field (corepack-native) > engines field > latest + PM_VERSION="" + if [[ -f "package.json" ]]; then + # Check packageManager field first (e.g., "pnpm@9.15.9") + PM_FIELD=$(node -e "try{const p=require('./package.json').packageManager||'';console.log(p)}catch{console.log('')}" 2>/dev/null) + if [[ "${PM_FIELD}" == "${PACKAGE_MANAGER}@"* ]]; then + PM_VERSION="${PM_FIELD#*@}" + fi + + # Fall back to engines field (e.g., "engines": {"pnpm": ">=9"}) + if [[ -z "${PM_VERSION}" ]]; then + PM_VERSION=$(node -e "try{console.log(require('./package.json').engines?.['${PACKAGE_MANAGER}']||'')}catch{console.log('')}" 2>/dev/null) + fi + fi + + if [[ -n "${PM_VERSION}" ]]; then + echo " Detected version: ${PM_VERSION}" + corepack prepare "${PACKAGE_MANAGER}@${PM_VERSION}" --activate + else + echo " No version constraint found, using corepack default" + fi + + echo " ${PACKAGE_MANAGER}: $(${PACKAGE_MANAGER} --version)" + + # Export PM binary to BASH_ENV for downstream steps + PM_BIN_DIR="$(dirname "$(command -v "${PACKAGE_MANAGER}")")" + if [[ "${PM_BIN_DIR}" != "${NODE_BIN_DIR}" ]]; then + echo "export PATH=\"${PM_BIN_DIR}:\${PATH}\"" >> "${BASH_ENV}" + echo " BASH_ENV: exported PATH with ${PM_BIN_DIR}" + fi +fi +``` + +- [ ] **Step 3: Verify shellcheck passes** + +```bash +shellcheck --severity=warning src/scripts/install_node.sh +``` + +Expected: no warnings + +- [ ] **Step 4: Commit** + +```bash +git add src/scripts/install_node.sh src/commands/install_node.yml +git commit -m "feat: activate corepack for pnpm/yarn in install_node" +``` + +--- + +### Task 8: Make node_install_deps.sh package-manager-aware + +**Files:** +- Modify: `src/scripts/node_install_deps.sh` +- Modify: `src/commands/node_install_deps.yml` + +- [ ] **Step 1: Add package_manager parameter to node_install_deps.yml** + +```yaml +description: > + Install project dependencies using the configured package manager. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). +steps: + - run: + name: Install dependencies + environment: + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> + command: << include(scripts/node_install_deps.sh) >> +``` + +- [ ] **Step 2: Rewrite node_install_deps.sh with PM branching** + +Replace the entire content of `src/scripts/node_install_deps.sh`: + +```bash +#!/usr/bin/env bash +set -euo pipefail + +# Source shared helpers +MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" +# shellcheck source=munitor_helpers.sh +if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" +elif ! type munitor_header &>/dev/null; then + munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } + munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } + munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } +fi + +PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" + +munitor_header "node_install_deps (${PACKAGE_MANAGER})" +munitor_check_tool node --version + +case "${PACKAGE_MANAGER}" in + npm) + munitor_check_tool npm --version + + if [[ ! -f "package-lock.json" ]]; then + echo "ERROR: package-lock.json not found in $(pwd)" + echo " npm ci requires a lockfile. Run 'npm install' locally and commit the lockfile." + exit 1 + fi + + LOCKFILE_VERSION=$(node -e "console.log(require('./package-lock.json').lockfileVersion || 'unknown')" 2>/dev/null || echo "unknown") + NPM_MAJOR=$(npm --version 2>/dev/null | cut -d. -f1) + echo " lockfileVersion: ${LOCKFILE_VERSION}" + + if [[ "${LOCKFILE_VERSION}" == "3" && -n "${NPM_MAJOR}" && "${NPM_MAJOR}" -lt 11 ]]; then + echo "" + echo "WARNING: package-lock.json uses lockfileVersion 3 (npm 11+)" + echo " but CI is running npm ${NPM_MAJOR} ($(npm --version))." + echo " This will likely cause 'npm ci' to fail." + echo "" + echo " Fix: regenerate your lockfile with the same Node version CI uses." + echo " Add an .nvmrc to your repo to keep local and CI versions in sync." + echo "" + fi + + echo "" + echo "Running npm ci..." + npm ci + + PKG_COUNT=$(find node_modules -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ') + echo "npm ci complete. ${PKG_COUNT} packages installed." + ;; + + pnpm) + munitor_check_tool pnpm --version + + if [[ ! -f "pnpm-lock.yaml" ]]; then + echo "ERROR: pnpm-lock.yaml not found in $(pwd)" + echo " pnpm install --frozen-lockfile requires a lockfile." + echo " Run 'pnpm install' locally and commit pnpm-lock.yaml." + exit 1 + fi + + echo "" + echo "Running pnpm install --frozen-lockfile..." + pnpm install --frozen-lockfile + + echo "pnpm install complete." + ;; + + *) + echo "ERROR: Unsupported package manager '${PACKAGE_MANAGER}'." + echo " Supported values: npm, pnpm" + exit 1 + ;; +esac + +# Prisma auto-detection: generate client if schema files exist +PRISMA_SCHEMAS=$(find . -path "*/prisma/schema.prisma" \ + -not -path "*/node_modules/*" \ + -not -path "*/dist/*" \ + -not -path "*/build/*" \ + 2>/dev/null || true) + +if [[ -n "${PRISMA_SCHEMAS}" ]]; then + echo "" + echo "=== Prisma Auto-Detection ===" + + # Check if prisma CLI is available + PRISMA_EXEC="" + case "${PACKAGE_MANAGER}" in + npm) command -v npx &>/dev/null && npx prisma --version &>/dev/null 2>&1 && PRISMA_EXEC="npx prisma" ;; + pnpm) pnpm exec prisma --version &>/dev/null 2>&1 && PRISMA_EXEC="pnpm exec prisma" ;; + esac + + if [[ -z "${PRISMA_EXEC}" ]]; then + echo "WARNING: Found Prisma schema(s) but prisma is not in dependencies. Skipping generate." + echo " Install prisma as a dev dependency to enable auto-generation." + else + while IFS= read -r schema; do + echo " Generating client for: ${schema}" + ${PRISMA_EXEC} generate --schema="${schema}" + done <<< "${PRISMA_SCHEMAS}" + echo "Prisma client generation complete." + fi +fi +``` + +- [ ] **Step 3: Verify shellcheck passes** + +```bash +shellcheck --severity=warning src/scripts/node_install_deps.sh +``` + +Expected: no warnings + +- [ ] **Step 4: Commit** + +```bash +git add src/scripts/node_install_deps.sh src/commands/node_install_deps.yml +git commit -m "feat: make node_install_deps package-manager-aware with Prisma detection" +``` + +--- + +### Task 9: Make node_test.sh package-manager-aware + +**Files:** +- Modify: `src/scripts/node_test.sh` +- Modify: `src/commands/node_test.yml` + +- [ ] **Step 1: Add package_manager parameter to node_test.yml** + +```yaml +description: > + Run tests with CI flags, coverage, and JUnit reporter. Supports custom + test commands via JSON array or falls back to package manager defaults. +parameters: + test_commands: + type: string + default: "" + description: JSON array of custom test commands to run instead of defaults. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). +steps: + - run: + name: Run tests + environment: + MUNITOR_TEST_COMMANDS_JSON: << parameters.test_commands >> + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> + command: << include(scripts/node_test.sh) >> + - store_test_results: + path: reports/junit + - store_artifacts: + path: reports/junit + destination: test-results + - store_artifacts: + path: coverage + destination: coverage +``` + +- [ ] **Step 2: Update the default fallback in node_test.sh** + +Replace the `else` block (lines 36-69 of the original) that hardcodes `npx jest`: + +```bash +else + PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" + + case "${PACKAGE_MANAGER}" in + pnpm) + echo "Running pnpm test..." + pnpm test + echo "pnpm test complete." + ;; + *) + # Default: Jest with coverage and JUnit reporter + if ! npx jest --version &>/dev/null; then + echo "" + echo "ERROR: Jest is not installed and no custom test commands are configured." + echo "" + echo " Munitor defaults to 'npx jest' but this project doesn't have Jest." + echo " Add custom test commands to your .munitor.yml:" + echo "" + echo " test:" + echo " commands:" + echo " - \"npm test\"" + echo "" + echo " Or install Jest: npm install --save-dev jest" + echo "" + exit 1 + fi + + echo "Running Jest tests..." + + export JEST_JUNIT_OUTPUT_DIR="reports/junit" + export JEST_JUNIT_OUTPUT_NAME="results.xml" + + npx jest \ + --ci \ + --forceExit \ + --coverage \ + --coverageReporters=json-summary \ + --coverageReporters=lcov \ + --reporters=default \ + --reporters=jest-junit + + echo "Jest tests complete." + ;; + esac +fi +``` + +- [ ] **Step 3: Verify shellcheck passes** + +```bash +shellcheck --severity=warning src/scripts/node_test.sh +``` + +- [ ] **Step 4: Commit** + +```bash +git add src/scripts/node_test.sh src/commands/node_test.yml +git commit -m "feat: make node_test package-manager-aware" +``` + +--- + +### Task 10: Make cache commands package-manager-aware + +**Files:** +- Modify: `src/commands/restore_node_cache.yml` +- Modify: `src/commands/save_node_cache.yml` + +- [ ] **Step 1: Rewrite restore_node_cache.yml with PM conditions** + +```yaml +description: > + Restore the dependency cache based on lockfile checksum. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). +steps: + - when: + condition: + equal: ["npm", << parameters.package_manager >>] + steps: + - restore_cache: + keys: + - npm-v1-{{ checksum "package-lock.json" }} + - npm-v1- + - when: + condition: + equal: ["pnpm", << parameters.package_manager >>] + steps: + - restore_cache: + keys: + - pnpm-v1-{{ checksum "pnpm-lock.yaml" }} + - pnpm-v1- +``` + +- [ ] **Step 2: Rewrite save_node_cache.yml with PM conditions** + +```yaml +description: > + Save the dependency cache for future builds. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). +steps: + - when: + condition: + equal: ["npm", << parameters.package_manager >>] + steps: + - save_cache: + key: npm-v1-{{ checksum "package-lock.json" }} + paths: + - ~/.npm + - when: + condition: + equal: ["pnpm", << parameters.package_manager >>] + steps: + - save_cache: + key: pnpm-v1-{{ checksum "pnpm-lock.yaml" }} + paths: + - ~/.local/share/pnpm/store +``` + +- [ ] **Step 3: Verify yamllint passes** + +```bash +yamllint -c .yamllint src/commands/restore_node_cache.yml src/commands/save_node_cache.yml +``` + +- [ ] **Step 4: Commit** + +```bash +git add src/commands/restore_node_cache.yml src/commands/save_node_cache.yml +git commit -m "feat: make cache commands package-manager-aware" +``` + +--- + +### Task 11: Thread package_manager through node_build_and_test job + +**Files:** +- Modify: `src/jobs/node_build_and_test.yml` + +- [ ] **Step 1: Add package_manager parameter and pass to commands** + +Add the parameter to the job's `parameters:` block: + +```yaml + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). +``` + +Update the steps to pass it through: + +```yaml +steps: + - checkout + - install_node: + version: << parameters.node_version >> + package_manager: << parameters.package_manager >> + - when: + condition: << parameters.npm_auth >> + steps: + - npm_auth: + npm_scopes: << parameters.npm_scopes >> + npm_default_scope: << parameters.npm_default_scope >> + - restore_node_cache: + package_manager: << parameters.package_manager >> + - node_install_deps: + package_manager: << parameters.package_manager >> + - when: + condition: << parameters.services >> + steps: + - start_services: + services: << parameters.services >> + - when: + condition: << parameters.test_setup >> + steps: + - run_test_setup: + test_setup: << parameters.test_setup >> + - calculate_version + - export_version_vars + - run: + name: Persist version metadata + command: <> + - node_test: + test_commands: << parameters.test_commands >> + package_manager: << parameters.package_manager >> + - store_test_results: + path: reports/junit + - save_node_cache: + package_manager: << parameters.package_manager >> + - persist_to_workspace: + root: . + paths: + - "." +``` + +- [ ] **Step 2: Verify yamllint passes** + +```bash +yamllint -c .yamllint src/jobs/node_build_and_test.yml +``` + +- [ ] **Step 3: Commit** + +```bash +git add src/jobs/node_build_and_test.yml +git commit -m "feat: thread package_manager through node_build_and_test job" +``` + +--- + +### Task 12: Add package_manager to templates + +**Files:** +- Modify: `src/scripts/templates/node-webapp.yml.tpl` +- Modify: `src/scripts/templates/node-api.yml.tpl` +- Modify: `src/scripts/templates/partials/node-webapp-deploy.yml.tpl` +- Modify: `src/scripts/templates/partials/node-api-deploy.yml.tpl` + +- [ ] **Step 1: Add package_manager to every node_build_and_test invocation** + +In all 4 template files, add `package_manager: "${MUNITOR_PACKAGE_MANAGER}"` to every `munitor/node_build_and_test:` block. Place it after the `node_version:` line: + +```yaml + - munitor/node_build_and_test: + name: build-and-test + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" +``` + +There are multiple `node_build_and_test` invocations per template (pr-checks, release-candidate, production workflows). Add it to ALL of them. + +- [ ] **Step 2: Verify no node_build_and_test invocation is missing package_manager** + +```bash +grep -A2 'node_build_and_test:' src/scripts/templates/*.tpl src/scripts/templates/partials/*.tpl | grep -v package_manager | grep 'node_version' +``` + +Expected: no output (every invocation with node_version should also have package_manager) + +- [ ] **Step 3: Commit** + +```bash +git add src/scripts/templates/ +git commit -m "feat: pass package_manager to node_build_and_test in all templates" +``` + +--- + +## Phase 3: Supplemental Features + +### Task 13: Fix run_test_setup.sh to support inline commands + +**Files:** +- Modify: `src/scripts/run_test_setup.sh` + +- [ ] **Step 1: Update run_test_setup.sh** + +Replace the file-only logic with file-or-inline: + +```bash +#!/usr/bin/env bash +set -euo pipefail + +# Source shared helpers +MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" +# shellcheck source=munitor_helpers.sh +if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" +elif ! type munitor_header &>/dev/null; then + munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } + munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } + munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } +fi + +munitor_header "run_test_setup" + +SETUP_SCRIPT="${MUNITOR_TEST_SETUP_SCRIPT:-}" + +if [[ -z "${SETUP_SCRIPT}" ]]; then + echo "No test setup configured." + exit 0 +fi + +if [[ -f "${SETUP_SCRIPT}" ]]; then + echo "Running test setup script: ${SETUP_SCRIPT}" + chmod +x "${SETUP_SCRIPT}" + "${SETUP_SCRIPT}" +else + echo "Running test setup command: ${SETUP_SCRIPT}" + bash -c "${SETUP_SCRIPT}" +fi + +echo "Test setup complete." +``` + +- [ ] **Step 2: Verify shellcheck passes** + +```bash +shellcheck --severity=warning src/scripts/run_test_setup.sh +``` + +- [ ] **Step 3: Commit** + +```bash +git add src/scripts/run_test_setup.sh +git commit -m "feat: support inline commands in test.setup" +``` + +--- + +### Task 14: Add pnpm support to Dockerfile generation + +**Files:** +- Modify: `src/scripts/generate_dockerfile.sh` + +- [ ] **Step 1: Add pnpm Dockerfile variants for node-api** + +In `generate_dockerfile.sh`, the `node-api)` case has sub-cases for `nextjs` and `express`. Each needs a pnpm variant. Wrap each existing Dockerfile heredoc in a `case "${MUNITOR_PACKAGE_MANAGER}"` block. + +For the **nextjs** sub-case (around line 42-76), replace the Dockerfile heredoc: + +```bash + nextjs) + case "${MUNITOR_PACKAGE_MANAGER}" in + pnpm) + cat > Dockerfile < 64 chars. Must use `<< include() >>` syntax. +3. **Gradle JaCoCo CSV not default** - Gradle's JaCoCo plugin only generates HTML+XML by default. Projects must explicitly enable `csv.required.set(true)`. +4. **orb_version resolution** - `orb_version: "0.1"` in `.munitor.yml` resolves to latest stable `@0.1.x`, not `dev:snapshot`. New features only available via `dev:snapshot` until released. diff --git a/docs/reference/PLAN-supplemental-images.md b/docs/reference/PLAN-supplemental-images.md new file mode 100644 index 0000000..ac8163c --- /dev/null +++ b/docs/reference/PLAN-supplemental-images.md @@ -0,0 +1,120 @@ +# PLAN: Supplemental Images + +## Goal + +Add support for building, scanning, and pushing supplemental Docker images (e.g., Liquibase migrations, database backup containers) alongside the main application image. Each supplemental image shares the same version tag as the app, gets Trivy-scanned, and can update the CD repo. + +## Config Shape + +```yaml +# .munitor.yml +supplemental_images: + - name: migrations + # Option A: auto-generate Dockerfile from base + copy + base: liquibase/liquibase:4.31 + copy: + - src: db/changelog/ + dest: /liquibase/changelog/ + cd: + image_key: migrations.image.tag # Helm mode + # image_name: ghcr.io/org/app-migrations # Kustomize (auto-derived if omitted) + + - name: db-backup + # Option B: use repo-provided Dockerfile + dockerfile: docker/Dockerfile.backup + cd: + image_key: dbBackup.image.tag +``` + +Image name derivation: `{image_name}-{name}` (e.g., `me-health-portal-migrations`). +Version: always same as main app (`PROJECT_VERSION`). +Env tag: same as main app (`DOCKER_ENV_TAG`). + +## Architecture + +``` +docker_build_push job steps: + attach_workspace + restore_version_metadata + generate_dockerfile # Main app Dockerfile + docker_build # Build main app image + health_check # Verify main app boots + restore_trivy_cache + run_trivy_image # Scan main app image + save_trivy_cache + docker_push_ghcr # Push main app (establishes registry auth) + build_push_supplemental [NEW] # For each supplemental: generate Dockerfile, build, scan, push +``` + +CD repo update: `update_cd_repo` receives supplemental_images JSON, updates all tags in a single commit. + +## Files Affected + +### New Files +| File | Purpose | +|------|---------| +| `src/scripts/build_push_supplemental.sh` | Loop: auto-generate Dockerfile, build, Trivy scan, push each supplemental image | +| `src/commands/build_push_supplemental.yml` | Orb command wrapping the script | +| `tests/fixtures/java-webapp-supplemental.munitor.yml` | Test fixture with supplemental_images config | + +### Modified Files +| File | Change | +|------|--------| +| `src/scripts/extract_munitor_vars.sh` | Parse `supplemental_images` array, export `MUNITOR_SUPPLEMENTAL_IMAGES_JSON` + `MUNITOR_SUPPLEMENTAL` flag | +| `src/scripts/generate_config.sh` | Add `SUPPLEMENTAL` to conditional flags, `supplemental_images` to KNOWN_KEYS | +| `src/scripts/update_cd_repo.sh` | Read `SUPPLEMENTAL_IMAGES_JSON`, update all supplemental image tags in same commit | +| `src/commands/update_cd_repo.yml` | Add `supplemental_images` parameter | +| `src/jobs/docker_build_push.yml` | Add `supplemental_images` param + `build_push_supplemental` step | +| `src/scripts/templates/java-webapp.yml.tpl` | `##IF_SUPPLEMENTAL##` blocks on docker_build_push + update_cd_repo (release-candidate + production) | +| `src/scripts/templates/node-api.yml.tpl` | Same | +| `src/scripts/templates/node-webapp.yml.tpl` | Same | +| `src/scripts/templates/partials/java-webapp-deploy.yml.tpl` | `##IF_SUPPLEMENTAL##` blocks on docker_build_push + update_cd_repo | +| `src/scripts/templates/partials/node-api-deploy.yml.tpl` | Same | +| `src/scripts/templates/partials/node-webapp-deploy.yml.tpl` | Same | +| `tests/test_extract_munitor_vars.sh` | Test supplemental_images parsing | +| `tests/test_generate_config.sh` | Test ##IF_SUPPLEMENTAL## rendering | +| `tests/test_scripts.sh` | Test build_push_supplemental.sh structure | + +## Design Decisions + +**Loop in same job, not separate jobs.** Supplemental images are lightweight (FROM base + COPY). Sequential build in the same executor avoids spinning up more machines and reuses Docker auth + Trivy installation. + +**JSON array config.** Variable number of supplemental images (0-N). JSON array parsed with `jq` handles this cleanly. Follows the same pattern as `MUNITOR_SERVICES_JSON`. + +**Auto-generate Dockerfiles.** Most supplemental images are trivial. Auto-generation from `base` + `copy` eliminates boilerplate. Users can still provide custom Dockerfiles. + +**Single CD commit.** All image tags (app + supplemental) are updated atomically so ArgoCD picks them up together. + +**Docker-producing pipelines only.** supplemental_images only applies to java-webapp, node-api, node-webapp. Not terraform, argocd-apps, validate-cd-repo, sdk-distribution. + +## Variable Flow + +``` +.munitor.yml extract_munitor_vars.sh templates +-------------- ----------------------- --------- +supplemental_images: [...] --> MUNITOR_SUPPLEMENTAL="true" --> ##IF_SUPPLEMENTAL## + MUNITOR_SUPPLEMENTAL_IMAGES_JSON --> docker_build_push(supplemental_images=...) + update_cd_repo(supplemental_images=...) +``` + +## Script Details + +### build_push_supplemental.sh + +``` +For each entry in SUPPLEMENTAL_IMAGES_JSON: + 1. Derive image name: {IMAGE_NAME}-{entry.name} + 2. If entry.dockerfile exists: use it + Else: auto-generate Dockerfile.{name} from entry.base + entry.copy + 3. docker build -f {dockerfile} -t {REGISTRY}/{derived_name}:{VERSION} . + 4. If DOCKER_ENV_TAG set: also tag with env tag + 5. trivy image --severity HIGH,CRITICAL --exit-code 1 {full_tag} + 6. docker push {full_tag} + 7. If env tag: docker push {full_tag_env} +``` + +### update_cd_repo.sh changes + +After updating main image tag, if SUPPLEMENTAL_IMAGES_JSON is non-empty: +- Helm: for each entry with cd.image_key, run `yq -i ".{key} = {VERSION}"` +- Kustomize: for each entry, derive image_name as `{CD_IMAGE_NAME}-{name}` (or use cd.image_name), run yq on kustomization.yaml diff --git a/docs/reference/SUPPLEMENTAL-IMAGES-ADOPTION-PROMPT.md b/docs/reference/SUPPLEMENTAL-IMAGES-ADOPTION-PROMPT.md new file mode 100644 index 0000000..370a0aa --- /dev/null +++ b/docs/reference/SUPPLEMENTAL-IMAGES-ADOPTION-PROMPT.md @@ -0,0 +1,126 @@ +## Prompt: Adopting Munitor Supplemental Images for Pre-Rollout Containers + +You are helping a development team configure their `.munitor.yml` file to use the **supplemental images** feature in the Munitor CircleCI orb. This feature builds, Trivy-scans, and pushes additional Docker images (sidecar/init containers) alongside the main application image during CI/CD. + +### When to use supplemental images + +Use this for any container that runs **before or alongside** the main application deployment: +- **Liquibase migrations** — runs DB changelogs before the app starts +- **Database backup** — snapshots the DB before a migration +- **Data seeding** — loads reference data into a fresh environment +- **Schema validation** — validates DB schema compatibility +- Any other init container or Job that needs its own image + +### How it works + +1. Munitor builds the main app image as usual +2. For each entry in `supplemental_images`, it either: + - **Auto-generates a Dockerfile** from `base` + `copy` directives, OR + - **Uses a provided Dockerfile** from the repo +3. Each supplemental image is built, scanned with Trivy (HIGH/CRITICAL), and pushed to the same registry +4. Image naming: `{image_name}-{supplemental_name}` (e.g., `me-health-portal-migrations`) +5. All images share the same version tag +6. The CD repo update commits all image tags (main + supplemental) atomically in a single commit + +### Configuration reference + +Add a `supplemental_images` array to your `.munitor.yml`: + +```yaml +supplemental_images: + - name: # REQUIRED. Suffix appended to image_name (e.g., "migrations") + base: # Option A: base Docker image (e.g., "liquibase/liquibase:4.31") + copy: # Files to COPY into the auto-generated Dockerfile + - src: # Source path relative to repo root + dest: # Destination path in the container + dockerfile: # Option B: path to a Dockerfile in the repo (mutually exclusive with base) + cd: # CD repo tag update config + image_key: # For Helm: dot-path in values.yaml (e.g., "migrations.image.tag") + image_name: # For Kustomize: image name in kustomization.yaml (defaults to {image_name}-{name}) +``` + +Each entry must have either `base` or `dockerfile`, not both. + +### Example: Liquibase migrations + +```yaml +pipeline: java-webapp +image_name: me-health-portal +java_version: "21" + +docker: + registry: ghcr.io/dmdbrands + +cd: + repo: dmdbrands/me-health-portal-cd-pipeline + +supplemental_images: + - name: migrations + base: liquibase/liquibase:4.31 + copy: + - src: db/changelog/ + dest: /liquibase/changelog/ + cd: + image_key: migrations.image.tag +``` + +This produces: +- Main image: `ghcr.io/dmdbrands/me-health-portal:1.2.3` +- Supplemental: `ghcr.io/dmdbrands/me-health-portal-migrations:1.2.3` +- CD repo `values.yaml` gets both `image.tag: "1.2.3"` and `migrations.image.tag: "1.2.3"` in one commit + +### Example: Multiple supplemental images + +```yaml +supplemental_images: + - name: migrations + base: liquibase/liquibase:4.31 + copy: + - src: db/changelog/ + dest: /liquibase/changelog/ + cd: + image_key: migrations.image.tag + + - name: db-backup + dockerfile: docker/Dockerfile.db-backup + cd: + image_key: dbBackup.image.tag +``` + +### Example: Kustomize CD format + +```yaml +supplemental_images: + - name: migrations + base: liquibase/liquibase:4.31 + copy: + - src: db/changelog/ + dest: /liquibase/changelog/ + cd: + image_name: me-health-portal-migrations # optional, defaults to {image_name}-{name} +``` + +This updates `kustomization.yaml`: +```yaml +images: + - name: me-health-portal + newTag: "1.2.3" + - name: me-health-portal-migrations + newTag: "1.2.3" +``` + +### Key constraints + +- The `name` field becomes part of the Docker image name, so use lowercase alphanumeric + hyphens only +- `base` + `copy` auto-generates a simple `FROM` + `COPY` Dockerfile — for anything more complex (RUN commands, ENV, etc.), use `dockerfile` instead +- All supplemental images are Trivy-scanned with `--severity HIGH,CRITICAL --exit-code 1` — the build fails if vulnerabilities are found +- The feature is available on all pipeline types: `java-webapp`, `node-api`, `node-webapp` +- If `supplemental_images` is not present in `.munitor.yml`, no supplemental processing occurs (fully backward compatible) + +### Your task + +Given the team's application context, help them: +1. Identify which pre-rollout tasks need their own container image +2. Determine whether each needs `base` + `copy` (simple) or a custom `dockerfile` (complex) +3. Configure the `supplemental_images` section in their `.munitor.yml` +4. Ensure the CD repo's `values.yaml` or `kustomization.yaml` has matching entries for the supplemental image tags diff --git a/docs/reference/TODO-supplemental-images.md b/docs/reference/TODO-supplemental-images.md new file mode 100644 index 0000000..89c604b --- /dev/null +++ b/docs/reference/TODO-supplemental-images.md @@ -0,0 +1,22 @@ +# TODO: Supplemental Images + +## Implementation Checklist + +- [ ] **Step 1:** `extract_munitor_vars.sh` - Parse `supplemental_images` array, export `MUNITOR_SUPPLEMENTAL` + `MUNITOR_SUPPLEMENTAL_IMAGES_JSON`, add to exports and `get_envsubst_vars()` +- [ ] **Step 2:** `generate_config.sh` - Add `SUPPLEMENTAL` to conditional flags list, add `supplemental_images` to KNOWN_KEYS +- [ ] **Step 3:** `build_push_supplemental.sh` (NEW) - Loop: auto-generate Dockerfile, build, Trivy scan, push each supplemental image +- [ ] **Step 4:** `build_push_supplemental.yml` (NEW) - Orb command wrapping the script +- [ ] **Step 5:** `docker_build_push.yml` - Add `supplemental_images` param + `build_push_supplemental` step after `docker_push_ghcr` +- [ ] **Step 6:** `update_cd_repo.sh` - Read `SUPPLEMENTAL_IMAGES_JSON`, update supplemental image tags in same commit (both Helm + Kustomize) +- [ ] **Step 7:** `update_cd_repo.yml` - Add `supplemental_images` parameter + env var +- [ ] **Step 8a:** `java-webapp.yml.tpl` - Add `##IF_SUPPLEMENTAL##` blocks on docker_build_push + update_cd_repo (release-candidate + production) +- [ ] **Step 8b:** `node-api.yml.tpl` - Same +- [ ] **Step 8c:** `node-webapp.yml.tpl` - Same +- [ ] **Step 8d:** `java-webapp-deploy.yml.tpl` - Add `##IF_SUPPLEMENTAL##` blocks on docker_build_push + update_cd_repo +- [ ] **Step 8e:** `node-api-deploy.yml.tpl` - Same +- [ ] **Step 8f:** `node-webapp-deploy.yml.tpl` - Same +- [ ] **Step 9a:** `java-webapp-supplemental.munitor.yml` (NEW) - Test fixture +- [ ] **Step 9b:** `test_extract_munitor_vars.sh` - Test supplemental_images parsing (enabled + default disabled) +- [ ] **Step 9c:** `test_generate_config.sh` - Test ##IF_SUPPLEMENTAL## conditional rendering +- [ ] **Step 9d:** `test_scripts.sh` - Test build_push_supplemental.sh structure (helpers, error handling, jq usage) +- [ ] **Step 10:** Run `make all` - Validate everything passes diff --git a/docs/superpowers/specs/2026-04-16-obsidian-plugin-pipeline-design.md b/docs/superpowers/specs/2026-04-16-obsidian-plugin-pipeline-design.md new file mode 100644 index 0000000..13880c7 --- /dev/null +++ b/docs/superpowers/specs/2026-04-16-obsidian-plugin-pipeline-design.md @@ -0,0 +1,157 @@ +# Design: obsidian-plugin Pipeline Type + +New Munitor pipeline type for Obsidian plugins. Handles building, testing, quality gating, and releasing TypeScript/esbuild-based Obsidian plugins to GitHub Releases. No Docker, no CD deployment. + +## Decisions + +| Decision | Choice | Rationale | +|----------|--------|-----------| +| Pipeline naming | `obsidian-plugin` (specific) | Bakes in Obsidian conventions (hardcoded artifacts, no Docker) | +| Release model | Branch-based (release-candidate + production) | Aligns with SDLC Section 6.3 and org branching strategy | +| Quality gates | All node gates supported as conditionals | SAST, coverage, SBOM, security-scan enabled for obsidian-penny | +| Artifact handling | Hardcoded `main.js manifest.json styles.css` | Convention over configuration for Obsidian-specific type | +| Artifact upload mechanism | Extend existing `github_release` job | Adds `release_artifacts` parameter; minimal orb changes | +| Build output persistence | Use `test.commands` override to chain build + test | Works today with no orb changes; dedicated `build_command` can come later | + +## Template Structure + +File: `src/scripts/templates/obsidian-plugin.yml.tpl` + +Four workflows matching the SDLC branch model: + +### pr-checks (feature/\*, hotfix/\*) + +Full quality pipeline. Jobs: +- `node_build_and_test` (npm install + build + test via `test.commands`) +- `secrets_scan` +- `sast_scan` (conditional: `##IF_SAST##`) +- `node_code_quality` (requires: build-and-test) +- `node_coverage` (requires: build-and-test) +- `node_security_scan` (requires: build-and-test) +- `node_e2e_test` (conditional: `##IF_E2E##`, requires: build-and-test) + +### develop (develop branch) + +Smoke check only. Jobs: +- `node_build_and_test` + +No deploy partials, no Docker, no CD. This differs from node-api/node-webapp which use `##INCLUDE_DEPLOY##` for develop. + +### release-candidate (release/\*) + +Full quality pipeline gated before release. Jobs: +- All pr-checks jobs +- `node_sonar_scan` (conditional: `##IF_SONAR##`) +- `node_sbom` (conditional: `##IF_SBOM##`, gated on quality gates) +- `github_release` with `release_artifacts: "main.js manifest.json styles.css"` (gated on quality gates, pre-release via RC version detection) + +The `github_release` job requires all quality gate jobs. No Docker gate since there is no Docker job. + +### production (main) + +Fast-path promotion (quality gates already passed on release/\*). Jobs: +- `node_build_and_test` +- `github_release` with `release_artifacts: "main.js manifest.json styles.css"` (requires: build-and-test, full release) + +## Changes to `github_release` Job/Script + +### `src/jobs/github_release.yml` + +Add optional parameter: + +```yaml +parameters: + release_artifacts: + type: string + default: "" + description: "Space-separated list of files to upload to the GitHub Release" +``` + +Pass to script as `MUNITOR_RELEASE_ARTIFACTS` environment variable. + +### `src/scripts/github_release.sh` + +After the `gh release create` block, add artifact upload: + +```bash +if [[ -n "${MUNITOR_RELEASE_ARTIFACTS:-}" ]]; then + echo "Uploading release artifacts: ${MUNITOR_RELEASE_ARTIFACTS}" + # shellcheck disable=SC2086 + gh release upload "${TAG}" ${MUNITOR_RELEASE_ARTIFACTS} +fi +``` + +Uses `gh release upload` (separate from create) so it works whether the release was just created or already existed. Backward compatible -- existing pipelines pass no artifacts. + +## `.munitor.yml` Schema + +obsidian-penny configuration: + +```yaml +pipeline: obsidian-plugin +orb_version: "0.3" +node_version: "20" +sast: true +sbom: true +test: + commands: ["npm run build", "npm test"] + coverage: + tool: vitest + command: npx vitest run --coverage +contexts: + github: github +``` + +No new variables in `extract_munitor_vars.sh`. The template uses a subset of existing `MUNITOR_*` variables: `NODE_VERSION`, `PACKAGE_MANAGER`, `SAST`, `SAST_FAIL_ON_FINDINGS`, `SBOM`, `COVERAGE_MIN`, `COVERAGE_TOOL`, `COVERAGE_COMMAND`, `CONTEXT_GITHUB`, and the node feature flags. + +### `generate_config.sh` validation + +Add `obsidian-plugin` to the pipeline type case statement. Required: `contexts.github`. Not required: `image_name`, `docker.registry`, `cd.repo`. + +### `packed_generate_config.sh` + +Embed `obsidian-plugin.yml.tpl` in the packed script using the same heredoc pattern as other templates. + +## Testing + +### Test fixture + +`tests/fixtures/obsidian-plugin.munitor.yml` -- mirrors the schema above. + +### `tests/test_generate_config.sh` + +Positive tests (patterns present): +- Valid YAML output +- All 4 workflows: `pr-checks`, `develop`, `release-candidate`, `production` +- `build-and-test` in all workflows +- `secrets-scan` and `sast-scan` in pr-checks and release-candidate +- `github-release` in release-candidate and production +- `release_artifacts: "main.js manifest.json styles.css"` on github-release jobs +- `security-scan` present +- `sbom` present +- Correct branch filters + +Negative tests (patterns absent): +- No `docker-build-push` +- No `update-cd-repo` +- No `image_name` or `registry` references +- No `INCLUDE_DEPLOY` partials + +### `tests/test_scripts.sh` + +- `github_release.sh` with `MUNITOR_RELEASE_ARTIFACTS` set -- verify upload behavior +- `github_release.sh` with `MUNITOR_RELEASE_ARTIFACTS` empty -- verify no upload (backward compat) + +## Consumer Repo Changes (obsidian-penny, post-release) + +1. Create `.munitor.yml` (schema above) +2. Bump `.circleci/config.yml` orb version to new release +3. Remove `.github/workflows/release.yml` (redundant) +4. Verify workspace persistence delivers `main.js` to `github_release` job + +## Not Changed + +- `extract_munitor_vars.sh` -- no new variables needed +- `node_build_and_test` job -- works as-is with `test.commands` override +- Other pipeline templates -- no modifications +- `sdk-distribution.yml.tpl` -- remains tag-based, separate use case diff --git a/scripts/pack_generate_config.sh b/scripts/pack_generate_config.sh index e76415f..24b02c9 100755 --- a/scripts/pack_generate_config.sh +++ b/scripts/pack_generate_config.sh @@ -39,7 +39,7 @@ echo "Packing generate_config.sh..." echo '' # Embed each template - for tpl in java-webapp gradle-webapp node-api node-webapp terraform sdk-distribution validate-cd-repo argocd-apps; do + for tpl in java-webapp gradle-webapp node-api node-webapp terraform sdk-distribution validate-cd-repo argocd-apps obsidian-plugin; do echo "cat > /tmp/munitor/templates/${tpl}.yml.tpl << 'MUNITOR_TPL_EOF'" cat "${SRC}/templates/${tpl}.yml.tpl" echo 'MUNITOR_TPL_EOF' diff --git a/src/commands/github_release.yml b/src/commands/github_release.yml index 9b1de61..c66fa73 100644 --- a/src/commands/github_release.yml +++ b/src/commands/github_release.yml @@ -1,7 +1,15 @@ description: > Create an annotated git tag and GitHub Release using the version calculated by GitVersion. Skips if tag or release already exists. + Optionally uploads release artifacts to the created release. +parameters: + release_artifacts: + type: string + default: "" + description: "Space-separated list of files to upload to the GitHub Release." steps: - run: name: Create GitHub Release + environment: + MUNITOR_RELEASE_ARTIFACTS: << parameters.release_artifacts >> command: << include(scripts/github_release.sh) >> diff --git a/src/commands/install_node.yml b/src/commands/install_node.yml index e719d0e..e7f6670 100644 --- a/src/commands/install_node.yml +++ b/src/commands/install_node.yml @@ -5,9 +5,14 @@ parameters: type: string default: "20" description: Node.js major version to install (e.g., 20, 22). + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). steps: - run: name: Install Node.js << parameters.version >> environment: NODE_VERSION: << parameters.version >> + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> command: << include(scripts/install_node.sh) >> diff --git a/src/commands/node_audit.yml b/src/commands/node_audit.yml new file mode 100644 index 0000000..fab812b --- /dev/null +++ b/src/commands/node_audit.yml @@ -0,0 +1,6 @@ +description: > + Run a security audit to check for known vulnerabilities in dependencies. +steps: + - run: + name: Security audit + command: << include(scripts/node_audit.sh) >> diff --git a/src/commands/npm_coverage_check.yml b/src/commands/node_coverage_check.yml similarity index 66% rename from src/commands/npm_coverage_check.yml rename to src/commands/node_coverage_check.yml index aa6ee35..71fdfa1 100644 --- a/src/commands/npm_coverage_check.yml +++ b/src/commands/node_coverage_check.yml @@ -14,6 +14,12 @@ parameters: type: string default: "" description: Custom command to generate coverage report before threshold check. + coverage_summary_path: + type: string + default: "coverage/coverage-summary.json" + description: > + Path to coverage-summary.json. Supports glob patterns for monorepos + (e.g., packages/*/coverage/coverage-summary.json). steps: - run: name: Coverage threshold check @@ -21,4 +27,5 @@ steps: MIN_COVERAGE: << parameters.min_coverage >> MUNITOR_COVERAGE_TOOL: << parameters.coverage_tool >> MUNITOR_COVERAGE_COMMAND: << parameters.coverage_command >> - command: << include(scripts/npm_coverage_check.sh) >> + MUNITOR_COVERAGE_SUMMARY_PATH: << parameters.coverage_summary_path >> + command: << include(scripts/node_coverage_check.sh) >> diff --git a/src/commands/node_install_deps.yml b/src/commands/node_install_deps.yml new file mode 100644 index 0000000..f1f0ac5 --- /dev/null +++ b/src/commands/node_install_deps.yml @@ -0,0 +1,13 @@ +description: > + Install project dependencies using the configured package manager. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). +steps: + - run: + name: Install dependencies + environment: + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> + command: << include(scripts/node_install_deps.sh) >> diff --git a/src/commands/npm_lint.yml b/src/commands/node_lint.yml similarity index 62% rename from src/commands/npm_lint.yml rename to src/commands/node_lint.yml index 4c3e41e..21200aa 100644 --- a/src/commands/npm_lint.yml +++ b/src/commands/node_lint.yml @@ -3,4 +3,4 @@ description: > steps: - run: name: ESLint - command: << include(scripts/npm_lint.sh) >> + command: << include(scripts/node_lint.sh) >> diff --git a/src/commands/node_sbom.yml b/src/commands/node_sbom.yml new file mode 100644 index 0000000..5a1a92e --- /dev/null +++ b/src/commands/node_sbom.yml @@ -0,0 +1,6 @@ +description: > + Generate a CycloneDX SBOM from a Node.js project. +steps: + - run: + name: Generate SBOM + command: << include(scripts/node_sbom.sh) >> diff --git a/src/commands/npm_sonar.yml b/src/commands/node_sonar.yml similarity index 92% rename from src/commands/npm_sonar.yml rename to src/commands/node_sonar.yml index 5f0dcdb..8d54db0 100644 --- a/src/commands/npm_sonar.yml +++ b/src/commands/node_sonar.yml @@ -19,4 +19,4 @@ steps: SONAR_PROJECT_KEY: << parameters.sonar_project_key >> SONAR_ORG: << parameters.sonar_org >> SONAR_TOKEN_VAR: << parameters.sonar_token_env >> - command: << include(scripts/npm_sonar.sh) >> + command: << include(scripts/node_sonar.sh) >> diff --git a/src/commands/npm_test.yml b/src/commands/node_test.yml similarity index 61% rename from src/commands/npm_test.yml rename to src/commands/node_test.yml index a9f37d6..68ed957 100644 --- a/src/commands/npm_test.yml +++ b/src/commands/node_test.yml @@ -1,17 +1,22 @@ description: > Run tests with CI flags, coverage, and JUnit reporter. Supports custom - test commands via JSON array or falls back to Jest defaults. + test commands via JSON array or falls back to package manager defaults. parameters: test_commands: type: string default: "" description: JSON array of custom test commands to run instead of Jest. + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). steps: - run: - name: npm test + name: Run tests environment: MUNITOR_TEST_COMMANDS_JSON: << parameters.test_commands >> - command: << include(scripts/npm_test.sh) >> + MUNITOR_PACKAGE_MANAGER: << parameters.package_manager >> + command: << include(scripts/node_test.sh) >> - store_test_results: path: reports/junit - store_artifacts: diff --git a/src/commands/npm_audit.yml b/src/commands/npm_audit.yml deleted file mode 100644 index 6c738f9..0000000 --- a/src/commands/npm_audit.yml +++ /dev/null @@ -1,6 +0,0 @@ -description: > - Run npm audit to check for known vulnerabilities in dependencies. -steps: - - run: - name: npm audit - command: << include(scripts/npm_audit.sh) >> diff --git a/src/commands/npm_install.yml b/src/commands/npm_install.yml deleted file mode 100644 index 9078c42..0000000 --- a/src/commands/npm_install.yml +++ /dev/null @@ -1,6 +0,0 @@ -description: > - Run npm ci for a clean, reproducible dependency install. -steps: - - run: - name: npm ci - command: << include(scripts/npm_install.sh) >> diff --git a/src/commands/npm_sbom.yml b/src/commands/npm_sbom.yml deleted file mode 100644 index 3ad2a6d..0000000 --- a/src/commands/npm_sbom.yml +++ /dev/null @@ -1,6 +0,0 @@ -description: > - Generate a CycloneDX SBOM from an npm project. -steps: - - run: - name: Generate SBOM (npm) - command: << include(scripts/npm_sbom.sh) >> diff --git a/src/commands/restore_node_cache.yml b/src/commands/restore_node_cache.yml new file mode 100644 index 0000000..49bcbe9 --- /dev/null +++ b/src/commands/restore_node_cache.yml @@ -0,0 +1,24 @@ +description: > + Restore the dependency cache based on lockfile checksum. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). +steps: + - when: + condition: + equal: ["npm", << parameters.package_manager >>] + steps: + - restore_cache: + keys: + - npm-v1-{{ checksum "package-lock.json" }} + - npm-v1- + - when: + condition: + equal: ["pnpm", << parameters.package_manager >>] + steps: + - restore_cache: + keys: + - pnpm-v1-{{ checksum "pnpm-lock.yaml" }} + - pnpm-v1- diff --git a/src/commands/restore_npm_cache.yml b/src/commands/restore_npm_cache.yml deleted file mode 100644 index dd73f50..0000000 --- a/src/commands/restore_npm_cache.yml +++ /dev/null @@ -1,7 +0,0 @@ -description: > - Restore the npm cache based on package-lock.json checksum. -steps: - - restore_cache: - keys: - - npm-v1-{{ checksum "package-lock.json" }} - - npm-v1- diff --git a/src/commands/save_node_cache.yml b/src/commands/save_node_cache.yml new file mode 100644 index 0000000..6b87fa4 --- /dev/null +++ b/src/commands/save_node_cache.yml @@ -0,0 +1,24 @@ +description: > + Save the dependency cache for future builds. +parameters: + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). +steps: + - when: + condition: + equal: ["npm", << parameters.package_manager >>] + steps: + - save_cache: + key: npm-v1-{{ checksum "package-lock.json" }} + paths: + - ~/.npm + - when: + condition: + equal: ["pnpm", << parameters.package_manager >>] + steps: + - save_cache: + key: pnpm-v1-{{ checksum "pnpm-lock.yaml" }} + paths: + - ~/.local/share/pnpm/store diff --git a/src/commands/save_npm_cache.yml b/src/commands/save_npm_cache.yml deleted file mode 100644 index da5ccfd..0000000 --- a/src/commands/save_npm_cache.yml +++ /dev/null @@ -1,7 +0,0 @@ -description: > - Save the npm cache for future builds. -steps: - - save_cache: - key: npm-v1-{{ checksum "package-lock.json" }} - paths: - - ~/.npm diff --git a/src/jobs/github_release.yml b/src/jobs/github_release.yml index 078ccaa..c626659 100644 --- a/src/jobs/github_release.yml +++ b/src/jobs/github_release.yml @@ -1,6 +1,12 @@ description: > Create an annotated git tag and GitHub Release on main branch merges. Uses PROJECT_VERSION from GitVersion (persisted by the build job). + Optionally uploads release artifacts (e.g., main.js, manifest.json). +parameters: + release_artifacts: + type: string + default: "" + description: "Space-separated list of files to upload to the GitHub Release." executor: base steps: - checkout @@ -10,4 +16,5 @@ steps: name: Restore version metadata command: <> - install_gh - - github_release + - github_release: + release_artifacts: << parameters.release_artifacts >> diff --git a/src/jobs/npm_build_and_test.yml b/src/jobs/node_build_and_test.yml similarity index 78% rename from src/jobs/npm_build_and_test.yml rename to src/jobs/node_build_and_test.yml index bce6112..ee85fb6 100644 --- a/src/jobs/npm_build_and_test.yml +++ b/src/jobs/node_build_and_test.yml @@ -1,12 +1,16 @@ description: > Full Node.js build and test job. Installs Node.js, restores cache, runs - npm ci, calculates version, tests with coverage, saves cache, and persists + dependency install, calculates version, tests with coverage, saves cache, and persists the workspace for downstream jobs. parameters: node_version: type: string default: "20" description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager to use (npm, pnpm, yarn). npm_auth: type: boolean default: false @@ -46,14 +50,17 @@ steps: - checkout - install_node: version: << parameters.node_version >> + package_manager: << parameters.package_manager >> - when: condition: << parameters.npm_auth >> steps: - npm_auth: npm_scopes: << parameters.npm_scopes >> npm_default_scope: << parameters.npm_default_scope >> - - restore_npm_cache - - npm_install + - restore_node_cache: + package_manager: << parameters.package_manager >> + - node_install_deps: + package_manager: << parameters.package_manager >> - when: condition: << parameters.services >> steps: @@ -69,11 +76,13 @@ steps: - run: name: Persist version metadata command: <> - - npm_test: + - node_test: test_commands: << parameters.test_commands >> + package_manager: << parameters.package_manager >> - store_test_results: path: reports/junit - - save_npm_cache + - save_node_cache: + package_manager: << parameters.package_manager >> - persist_to_workspace: root: . paths: diff --git a/src/jobs/npm_code_quality.yml b/src/jobs/node_code_quality.yml similarity index 51% rename from src/jobs/npm_code_quality.yml rename to src/jobs/node_code_quality.yml index 80ed6c4..b920a19 100644 --- a/src/jobs/npm_code_quality.yml +++ b/src/jobs/node_code_quality.yml @@ -1,7 +1,15 @@ description: > Run ESLint code quality checks. - Requires workspace from npm_build_and_test. + Requires workspace from node_build_and_test. parameters: + node_version: + type: string + default: "20" + description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). resource_class: type: enum enum: @@ -15,7 +23,10 @@ executor: steps: - attach_workspace: at: . - - npm_lint + - install_node: + version: << parameters.node_version >> + package_manager: << parameters.package_manager >> + - node_lint - store_artifacts: path: /tmp/eslint-report.json destination: eslint-report.json diff --git a/src/jobs/npm_coverage.yml b/src/jobs/node_coverage.yml similarity index 58% rename from src/jobs/npm_coverage.yml rename to src/jobs/node_coverage.yml index a63403a..a9384aa 100644 --- a/src/jobs/npm_coverage.yml +++ b/src/jobs/node_coverage.yml @@ -1,7 +1,15 @@ description: > Enforce minimum coverage threshold from coverage output. - Requires workspace from npm_build_and_test. + Requires workspace from node_build_and_test. parameters: + node_version: + type: string + default: "20" + description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). min_coverage: type: string default: "70" @@ -14,6 +22,11 @@ parameters: type: string default: "" description: Custom command to generate coverage report before threshold check. + coverage_summary_path: + type: string + default: "coverage/coverage-summary.json" + description: > + Path to coverage-summary.json. Supports glob patterns for monorepos. resource_class: type: enum enum: @@ -27,10 +40,14 @@ executor: steps: - attach_workspace: at: . - - npm_coverage_check: + - install_node: + version: << parameters.node_version >> + package_manager: << parameters.package_manager >> + - node_coverage_check: min_coverage: << parameters.min_coverage >> coverage_tool: << parameters.coverage_tool >> coverage_command: << parameters.coverage_command >> + coverage_summary_path: << parameters.coverage_summary_path >> - store_artifacts: path: coverage destination: coverage-report diff --git a/src/jobs/npm_e2e_test.yml b/src/jobs/node_e2e_test.yml similarity index 58% rename from src/jobs/npm_e2e_test.yml rename to src/jobs/node_e2e_test.yml index 0e320c3..53be829 100644 --- a/src/jobs/npm_e2e_test.yml +++ b/src/jobs/node_e2e_test.yml @@ -1,6 +1,14 @@ description: > - Run Playwright E2E tests. Requires workspace from npm_build_and_test. + Run Playwright E2E tests. Requires workspace from node_build_and_test. parameters: + node_version: + type: string + default: "20" + description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). test_dir: type: string default: e2e @@ -18,6 +26,9 @@ executor: steps: - attach_workspace: at: . + - install_node: + version: << parameters.node_version >> + package_manager: << parameters.package_manager >> - run_e2e_playwright: test_dir: << parameters.test_dir >> - store_artifacts: diff --git a/src/jobs/npm_sbom.yml b/src/jobs/node_sbom.yml similarity index 77% rename from src/jobs/npm_sbom.yml rename to src/jobs/node_sbom.yml index ebd0bd0..5cdc7c5 100644 --- a/src/jobs/npm_sbom.yml +++ b/src/jobs/node_sbom.yml @@ -1,11 +1,15 @@ description: > Generate SBOM and submit dependency graph for Node.js projects. - Requires workspace from npm_build_and_test. + Requires workspace from node_build_and_test. parameters: node_version: type: string default: "20" description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). resource_class: type: enum enum: @@ -21,7 +25,8 @@ steps: at: . - install_node: version: << parameters.node_version >> - - npm_sbom + package_manager: << parameters.package_manager >> + - node_sbom - submit_dependency_graph: sbom_path: bom.json detector_name: CycloneDX npm diff --git a/src/jobs/npm_security_scan.yml b/src/jobs/node_security_scan.yml similarity index 54% rename from src/jobs/npm_security_scan.yml rename to src/jobs/node_security_scan.yml index 7d8b4db..34beb26 100644 --- a/src/jobs/npm_security_scan.yml +++ b/src/jobs/node_security_scan.yml @@ -1,7 +1,15 @@ description: > Run npm audit and Trivy filesystem scan. - Requires workspace from npm_build_and_test. + Requires workspace from node_build_and_test. parameters: + node_version: + type: string + default: "20" + description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). resource_class: type: enum enum: @@ -15,7 +23,10 @@ executor: steps: - attach_workspace: at: . - - npm_audit + - install_node: + version: << parameters.node_version >> + package_manager: << parameters.package_manager >> + - node_audit - restore_trivy_cache - run_trivy - save_trivy_cache diff --git a/src/jobs/npm_sonar_scan.yml b/src/jobs/node_sonar_scan.yml similarity index 76% rename from src/jobs/npm_sonar_scan.yml rename to src/jobs/node_sonar_scan.yml index 1122bc5..5531af2 100644 --- a/src/jobs/npm_sonar_scan.yml +++ b/src/jobs/node_sonar_scan.yml @@ -1,11 +1,15 @@ description: > Run SonarCloud analysis for Node.js projects. Attaches workspace from - npm_build_and_test and uses the sonar-scanner CLI with bundled JRE. + node_build_and_test and uses the sonar-scanner CLI with bundled JRE. parameters: node_version: type: string default: "20" description: Node.js major version to install. + package_manager: + type: string + default: "npm" + description: Package manager (npm, pnpm, yarn). sonar_project_key: type: string description: SonarCloud project key. @@ -29,6 +33,7 @@ steps: at: . - install_node: version: << parameters.node_version >> - - npm_sonar: + package_manager: << parameters.package_manager >> + - node_sonar: sonar_project_key: << parameters.sonar_project_key >> sonar_org: << parameters.sonar_org >> diff --git a/src/scripts/extract_munitor_vars.sh b/src/scripts/extract_munitor_vars.sh index 5d0e19c..cc233ec 100644 --- a/src/scripts/extract_munitor_vars.sh +++ b/src/scripts/extract_munitor_vars.sh @@ -96,6 +96,7 @@ extract_munitor_vars() { if [[ -n "${MUNITOR_TEST_COVERAGE_MIN}" ]]; then MUNITOR_COVERAGE_MIN="${MUNITOR_TEST_COVERAGE_MIN}" fi + MUNITOR_COVERAGE_SUMMARY_PATH=$(yq '.test.coverage.summary_path // "coverage/coverage-summary.json"' "${config_file}") # Terraform pipeline settings MUNITOR_TF_PATH=$(yq '.terraform.path // "terraform/"' "${config_file}") @@ -214,7 +215,7 @@ extract_munitor_vars() { export MUNITOR_SERVICES MUNITOR_SERVICES_JSON export MUNITOR_TEST_SETUP MUNITOR_TEST_SETUP_SCRIPT export MUNITOR_CUSTOM_TEST MUNITOR_TEST_COMMANDS_JSON - export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND + export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND MUNITOR_COVERAGE_SUMMARY_PATH export MUNITOR_TF_PATH MUNITOR_TF_LIVE_PATH MUNITOR_TF_ENVIRONMENTS MUNITOR_CHECKOV_SKIP MUNITOR_SAST MUNITOR_SAST_FAIL_ON_FINDINGS export MUNITOR_KUSTOMIZE_VERSION MUNITOR_KUSTOMIZE_BASE_PATH MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR export MUNITOR_KUSTOMIZE_SCAN_OVERLAY MUNITOR_KUSTOMIZE_OVERLAYS MUNITOR_KUSTOMIZE_OVERLAY_DIR @@ -229,5 +230,5 @@ extract_munitor_vars() { # Build the envsubst variable list get_envsubst_vars() { # shellcheck disable=SC2016 - echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE}' + echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE} ${MUNITOR_COVERAGE_SUMMARY_PATH}' } diff --git a/src/scripts/generate_config.sh b/src/scripts/generate_config.sh index 6991086..0b0271f 100755 --- a/src/scripts/generate_config.sh +++ b/src/scripts/generate_config.sh @@ -80,6 +80,9 @@ validate_required_fields() { validate-cd-repo|argocd-apps) # No additional required fields beyond orb_version ;; + obsidian-plugin) + [[ -z "$(yq '.contexts.github // ""' "${config}")" ]] && missing+=("contexts.github") + ;; esac if [[ ${#missing[@]} -gt 0 ]]; then diff --git a/src/scripts/generate_dockerfile.sh b/src/scripts/generate_dockerfile.sh index 14dcae5..f3a5df6 100755 --- a/src/scripts/generate_dockerfile.sh +++ b/src/scripts/generate_dockerfile.sh @@ -42,7 +42,42 @@ case "${MUNITOR_PIPELINE}" in nextjs) # Multi-stage Next.js standalone Dockerfile. # Assumes `output: 'standalone'` in next.config.js. - cat > Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile <> "${BASH_ENV}" echo " BASH_ENV: exported PATH with ${NODE_BIN_DIR}" + +# Activate non-npm package managers via corepack +PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" +if [[ "${PACKAGE_MANAGER}" != "npm" ]]; then + echo "" + echo "=== Activating ${PACKAGE_MANAGER} via corepack ===" + corepack enable + + PM_VERSION="" + if [[ -f "package.json" ]]; then + # Priority 1: packageManager field (corepack-native, e.g. "pnpm@9.15.9") + PM_FIELD=$(node -e "try{const p=require('./package.json').packageManager||'';console.log(p)}catch{console.log('')}" 2>/dev/null) + if [[ "${PM_FIELD}" == "${PACKAGE_MANAGER}@"* ]]; then + PM_VERSION="${PM_FIELD#*@}" + fi + + # Priority 2: engines field (e.g. "engines": {"pnpm": ">=9"}) + if [[ -z "${PM_VERSION}" ]]; then + PM_VERSION=$(node -e "try{console.log(require('./package.json').engines?.['${PACKAGE_MANAGER}']||'')}catch{console.log('')}" 2>/dev/null) + fi + fi + + if [[ -n "${PM_VERSION}" ]]; then + echo " Detected version: ${PM_VERSION}" + corepack prepare "${PACKAGE_MANAGER}@${PM_VERSION}" --activate + else + echo " No version constraint found, using corepack default" + fi + + echo " ${PACKAGE_MANAGER}: $(${PACKAGE_MANAGER} --version)" + + # Export PM binary to BASH_ENV for downstream steps + PM_BIN_DIR="$(dirname "$(command -v "${PACKAGE_MANAGER}")")" + if [[ "${PM_BIN_DIR}" != "${NODE_BIN_DIR}" ]]; then + echo "export PATH=\"${PM_BIN_DIR}:\${PATH}\"" >> "${BASH_ENV}" + echo " BASH_ENV: exported PATH with ${PM_BIN_DIR}" + fi +fi diff --git a/src/scripts/npm_audit.sh b/src/scripts/node_audit.sh similarity index 96% rename from src/scripts/npm_audit.sh rename to src/scripts/node_audit.sh index 51fee0c..6e43d8c 100644 --- a/src/scripts/npm_audit.sh +++ b/src/scripts/node_audit.sh @@ -11,7 +11,7 @@ elif ! type munitor_header &>/dev/null; then munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } fi -munitor_header "npm_audit" +munitor_header "node_audit" echo "Running npm audit..." diff --git a/src/scripts/node_coverage_check.sh b/src/scripts/node_coverage_check.sh new file mode 100644 index 0000000..c242a84 --- /dev/null +++ b/src/scripts/node_coverage_check.sh @@ -0,0 +1,88 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Source shared helpers +MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" +# shellcheck source=munitor_helpers.sh +if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" +elif ! type munitor_header &>/dev/null; then + munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } + munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } + munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } +fi + +MIN="${MIN_COVERAGE:-70}" +COVERAGE_TOOL="${MUNITOR_COVERAGE_TOOL:-jest}" +COVERAGE_COMMAND="${MUNITOR_COVERAGE_COMMAND:-}" +SUMMARY_PATH="${MUNITOR_COVERAGE_SUMMARY_PATH:-coverage/coverage-summary.json}" + +munitor_header "node_coverage_check (min: ${MIN}%)" +munitor_check_tool node --version + +# Validate MIN_COVERAGE is numeric +if ! [[ "${MIN}" =~ ^[0-9]+$ ]]; then + echo "ERROR: MIN_COVERAGE must be a whole number, got '${MIN}'." + exit 1 +fi + +echo "Checking coverage threshold (minimum: ${MIN}%, tool: ${COVERAGE_TOOL})..." + +# Run custom coverage report command if specified +if [[ -n "${COVERAGE_COMMAND}" ]]; then + echo "Running coverage report command: ${COVERAGE_COMMAND}" + bash -c "${COVERAGE_COMMAND}" +fi + +# Resolve summary file(s) - supports glob patterns for monorepos +# shellcheck disable=SC2206 +SUMMARY_FILES=( ${SUMMARY_PATH} ) + +if [[ ${#SUMMARY_FILES[@]} -eq 0 ]] || [[ ! -f "${SUMMARY_FILES[0]}" ]]; then + echo "ERROR: Coverage summary not found at ${SUMMARY_PATH}." + echo "" + echo " Ensure your test runner generates coverage-summary.json." + echo " For monorepos, set test.coverage.summary_path in .munitor.yml:" + echo " test:" + echo " coverage:" + echo " summary_path: \"packages/*/coverage/coverage-summary.json\"" + exit 1 +fi + +if [[ ${#SUMMARY_FILES[@]} -eq 1 ]]; then + # Single file - use directly + SUMMARY_FILE="${SUMMARY_FILES[0]}" + echo "Using coverage summary: ${SUMMARY_FILE}" + + ACTUAL=$(node -e " + const s = require('./${SUMMARY_FILE}'); + console.log(s.total.lines.pct); + ") +else + # Multiple files (monorepo) - compute weighted average + echo "Found ${#SUMMARY_FILES[@]} coverage summaries (monorepo mode):" + for f in "${SUMMARY_FILES[@]}"; do + echo " - ${f}" + done + + ACTUAL=$(node -e " + const files = process.argv.slice(1); + let totalCovered = 0, totalTotal = 0; + for (const f of files) { + const s = require('./' + f); + totalCovered += s.total.lines.covered; + totalTotal += s.total.lines.total; + } + console.log(totalTotal > 0 ? ((totalCovered / totalTotal) * 100).toFixed(2) : '0'); + " "${SUMMARY_FILES[@]}") +fi + +echo "Line coverage: ${ACTUAL}%" + +# Compare as integers (floor) +ACTUAL_INT=${ACTUAL%.*} +if [[ "${ACTUAL_INT}" -lt "${MIN}" ]]; then + echo "FAIL: Coverage ${ACTUAL}% is below minimum ${MIN}%." + exit 1 +fi + +echo "Coverage check passed (${ACTUAL}% >= ${MIN}%)." diff --git a/src/scripts/node_install_deps.sh b/src/scripts/node_install_deps.sh new file mode 100644 index 0000000..adbe112 --- /dev/null +++ b/src/scripts/node_install_deps.sh @@ -0,0 +1,121 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Source shared helpers +MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" +# shellcheck source=munitor_helpers.sh +if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" +elif ! type munitor_header &>/dev/null; then + munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } + munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } + munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } +fi + +PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" + +munitor_header "node_install_deps (${PACKAGE_MANAGER})" +munitor_check_tool node --version + +case "${PACKAGE_MANAGER}" in + npm) + munitor_check_tool npm --version + + # Verify package-lock.json exists + if [[ ! -f "package-lock.json" ]]; then + echo "ERROR: package-lock.json not found in $(pwd)" + echo " npm ci requires a lockfile. Run 'npm install' locally and commit the lockfile." + exit 1 + fi + + # Check lockfile version compatibility + LOCKFILE_VERSION=$(node -e "console.log(require('./package-lock.json').lockfileVersion || 'unknown')" 2>/dev/null || echo "unknown") + NPM_MAJOR=$(npm --version 2>/dev/null | cut -d. -f1) + echo " lockfileVersion: ${LOCKFILE_VERSION}" + + if [[ "${LOCKFILE_VERSION}" == "3" && -n "${NPM_MAJOR}" && "${NPM_MAJOR}" -lt 11 ]]; then + echo "" + echo "WARNING: package-lock.json uses lockfileVersion 3 (npm 11+)" + echo " but CI is running npm ${NPM_MAJOR} ($(npm --version))." + echo " This will likely cause 'npm ci' to fail." + echo "" + echo " Fix: regenerate your lockfile with the same Node version CI uses." + echo " Add an .nvmrc to your repo to keep local and CI versions in sync." + echo "" + fi + + echo "" + echo "Running npm ci..." + npm ci + + PKG_COUNT=$(find node_modules -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ') + echo "npm ci complete. ${PKG_COUNT} packages installed." + ;; + + pnpm) + munitor_check_tool pnpm --version + + # Verify pnpm-lock.yaml exists + if [[ ! -f "pnpm-lock.yaml" ]]; then + echo "ERROR: pnpm-lock.yaml not found in $(pwd)" + echo " pnpm install --frozen-lockfile requires a lockfile. Run 'pnpm install' locally and commit the lockfile." + exit 1 + fi + + echo "" + echo "Running pnpm install --frozen-lockfile..." + pnpm install --frozen-lockfile + + PKG_COUNT=$(find node_modules -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ') + echo "pnpm install complete. ${PKG_COUNT} packages installed." + ;; + + *) + echo "ERROR: Unsupported package manager '${PACKAGE_MANAGER}'" + echo " Supported values: npm, pnpm" + exit 1 + ;; +esac + +# Prisma auto-detection: generate client if schema files are present +PRISMA_SCHEMAS=$(find . -path "*/prisma/schema.prisma" -not -path "*/node_modules/*" -not -path "*/dist/*" -not -path "*/build/*" 2>/dev/null || true) + +if [[ -n "${PRISMA_SCHEMAS}" ]]; then + echo "" + echo "=== Prisma schema(s) detected ===" + + PRISMA_GENERATED=0 + while IFS= read -r SCHEMA_PATH; do + # Resolve the package directory (parent of prisma/) + PKG_DIR=$(dirname "$(dirname "${SCHEMA_PATH}")") + + # Check if prisma CLI is available from the package directory. + # In monorepos, prisma may only be installed in a workspace package, + # not at the root, so we must check from the package's own context. + PRISMA_CMD="" + case "${PACKAGE_MANAGER}" in + npm) + if (cd "${PKG_DIR}" && npx prisma --version) &>/dev/null; then + PRISMA_CMD="npx prisma" + fi + ;; + pnpm) + if (cd "${PKG_DIR}" && pnpm exec prisma --version) &>/dev/null; then + PRISMA_CMD="pnpm exec prisma" + fi + ;; + esac + + if [[ -n "${PRISMA_CMD}" ]]; then + echo " Generating Prisma client for: ${SCHEMA_PATH}" + (cd "${PKG_DIR}" && ${PRISMA_CMD} generate --schema=prisma/schema.prisma) + PRISMA_GENERATED=$((PRISMA_GENERATED + 1)) + else + echo " WARNING: Found ${SCHEMA_PATH} but prisma CLI not available in ${PKG_DIR}." + echo " Add prisma as a dev dependency in that package." + fi + done <<< "${PRISMA_SCHEMAS}" + + if [[ "${PRISMA_GENERATED}" -gt 0 ]]; then + echo "Prisma generate complete (${PRISMA_GENERATED} schema(s))." + fi +fi diff --git a/src/scripts/npm_lint.sh b/src/scripts/node_lint.sh similarity index 96% rename from src/scripts/npm_lint.sh rename to src/scripts/node_lint.sh index 5f3f2f4..186ebda 100644 --- a/src/scripts/npm_lint.sh +++ b/src/scripts/node_lint.sh @@ -11,7 +11,7 @@ elif ! type munitor_header &>/dev/null; then munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } fi -munitor_header "npm_lint" +munitor_header "node_lint" echo "Running ESLint..." diff --git a/src/scripts/npm_sbom.sh b/src/scripts/node_sbom.sh similarity index 97% rename from src/scripts/npm_sbom.sh rename to src/scripts/node_sbom.sh index 75dcdbf..5ca6564 100644 --- a/src/scripts/npm_sbom.sh +++ b/src/scripts/node_sbom.sh @@ -11,7 +11,7 @@ elif ! type munitor_header &>/dev/null; then munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } fi -munitor_header "npm_sbom" +munitor_header "node_sbom" munitor_check_tool node --version munitor_check_tool npx --version diff --git a/src/scripts/npm_sonar.sh b/src/scripts/node_sonar.sh similarity index 99% rename from src/scripts/npm_sonar.sh rename to src/scripts/node_sonar.sh index f82fb89..5ae0013 100644 --- a/src/scripts/npm_sonar.sh +++ b/src/scripts/node_sonar.sh @@ -11,7 +11,7 @@ elif ! type munitor_header &>/dev/null; then munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } fi -munitor_header "npm_sonar" +munitor_header "node_sonar" PROJECT_KEY="${SONAR_PROJECT_KEY:?SONAR_PROJECT_KEY not set}" ORG="${SONAR_ORG:-KofTwentyTwo}" diff --git a/src/scripts/npm_test.sh b/src/scripts/node_test.sh similarity index 52% rename from src/scripts/npm_test.sh rename to src/scripts/node_test.sh index 2e1c9a4..5f0b57e 100644 --- a/src/scripts/npm_test.sh +++ b/src/scripts/node_test.sh @@ -11,7 +11,7 @@ elif ! type munitor_header &>/dev/null; then munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } fi -munitor_header "npm_test" +munitor_header "node_test" # Prevent interactive prompts from apt/dpkg when test commands install system deps export DEBIAN_FRONTEND=noninteractive @@ -34,36 +34,44 @@ if [[ -n "${TEST_COMMANDS_JSON}" && "${TEST_COMMANDS_JSON}" != "[]" && "${TEST_C echo "Custom test commands complete." else - # Default: Jest with coverage and JUnit reporter - if ! npx jest --version &>/dev/null; then - echo "" - echo "ERROR: Jest is not installed and no custom test commands are configured." - echo "" - echo " Munitor defaults to 'npx jest' but this project doesn't have Jest." - echo " Add custom test commands to your .munitor.yml:" - echo "" - echo " test:" - echo " commands:" - echo " - \"npm test\"" - echo "" - echo " Or install Jest: npm install --save-dev jest" - echo "" - exit 1 + PACKAGE_MANAGER="${MUNITOR_PACKAGE_MANAGER:-npm}" + + if [[ "${PACKAGE_MANAGER}" == "pnpm" ]]; then + echo "Running pnpm test..." + pnpm test + echo "pnpm test complete." + else + # Default: Jest with coverage and JUnit reporter + if ! npx jest --version &>/dev/null; then + echo "" + echo "ERROR: Jest is not installed and no custom test commands are configured." + echo "" + echo " Munitor defaults to 'npx jest' but this project doesn't have Jest." + echo " Add custom test commands to your .munitor.yml:" + echo "" + echo " test:" + echo " commands:" + echo " - \"npm test\"" + echo "" + echo " Or install Jest: npm install --save-dev jest" + echo "" + exit 1 + fi + + echo "Running Jest tests..." + + export JEST_JUNIT_OUTPUT_DIR="reports/junit" + export JEST_JUNIT_OUTPUT_NAME="results.xml" + + npx jest \ + --ci \ + --forceExit \ + --coverage \ + --coverageReporters=json-summary \ + --coverageReporters=lcov \ + --reporters=default \ + --reporters=jest-junit + + echo "Jest tests complete." fi - - echo "Running Jest tests..." - - export JEST_JUNIT_OUTPUT_DIR="reports/junit" - export JEST_JUNIT_OUTPUT_NAME="results.xml" - - npx jest \ - --ci \ - --forceExit \ - --coverage \ - --coverageReporters=json-summary \ - --coverageReporters=lcov \ - --reporters=default \ - --reporters=jest-junit - - echo "Jest tests complete." fi diff --git a/src/scripts/npm_coverage_check.sh b/src/scripts/npm_coverage_check.sh deleted file mode 100644 index fee942f..0000000 --- a/src/scripts/npm_coverage_check.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# Source shared helpers -MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" -# shellcheck source=munitor_helpers.sh -if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" -elif ! type munitor_header &>/dev/null; then - munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } - munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } - munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } -fi - -MIN="${MIN_COVERAGE:-70}" -COVERAGE_TOOL="${MUNITOR_COVERAGE_TOOL:-jest}" -COVERAGE_COMMAND="${MUNITOR_COVERAGE_COMMAND:-}" -SUMMARY_FILE="coverage/coverage-summary.json" - -munitor_header "npm_coverage_check (min: ${MIN}%)" -munitor_check_tool node --version - -# Validate MIN_COVERAGE is numeric -if ! [[ "${MIN}" =~ ^[0-9]+$ ]]; then - echo "ERROR: MIN_COVERAGE must be a whole number, got '${MIN}'." - exit 1 -fi - -echo "Checking coverage threshold (minimum: ${MIN}%, tool: ${COVERAGE_TOOL})..." - -# Run custom coverage report command if specified -if [[ -n "${COVERAGE_COMMAND}" ]]; then - echo "Running coverage report command: ${COVERAGE_COMMAND}" - bash -c "${COVERAGE_COMMAND}" -fi - -if [[ ! -f "${SUMMARY_FILE}" ]]; then - echo "ERROR: Coverage summary not found at ${SUMMARY_FILE}." - echo "Ensure your test runner generates coverage/coverage-summary.json." - exit 1 -fi - -# Extract total line coverage percentage from summary (same format for jest and nyc) -ACTUAL=$(node -e " - const s = require('./${SUMMARY_FILE}'); - console.log(s.total.lines.pct); -") - -echo "Line coverage: ${ACTUAL}%" - -# Compare as integers (floor) -ACTUAL_INT=${ACTUAL%.*} -if [[ "${ACTUAL_INT}" -lt "${MIN}" ]]; then - echo "FAIL: Coverage ${ACTUAL}% is below minimum ${MIN}%." - exit 1 -fi - -echo "Coverage check passed (${ACTUAL}% >= ${MIN}%)." diff --git a/src/scripts/npm_install.sh b/src/scripts/npm_install.sh deleted file mode 100644 index 032a861..0000000 --- a/src/scripts/npm_install.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# Source shared helpers -MUNITOR_HELPERS="${MUNITOR_HELPERS:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/munitor_helpers.sh}" -# shellcheck source=munitor_helpers.sh -if [[ -f "${MUNITOR_HELPERS}" ]]; then source "${MUNITOR_HELPERS}" -elif ! type munitor_header &>/dev/null; then - munitor_header() { echo "=== Munitor: ${1:-unknown} ==="; } - munitor_check_tool() { command -v "$1" &>/dev/null || { echo "ERROR: $1 not found"; exit 1; }; } - munitor_download_with_retry() { curl -fsSL --retry 3 "$1" -o "$2"; } -fi - -munitor_header "npm_install" -munitor_check_tool node --version -munitor_check_tool npm --version - -# Verify package-lock.json exists -if [[ ! -f "package-lock.json" ]]; then - echo "ERROR: package-lock.json not found in $(pwd)" - echo " npm ci requires a lockfile. Run 'npm install' locally and commit the lockfile." - exit 1 -fi - -# Check lockfile version compatibility -LOCKFILE_VERSION=$(node -e "console.log(require('./package-lock.json').lockfileVersion || 'unknown')" 2>/dev/null || echo "unknown") -NPM_MAJOR=$(npm --version 2>/dev/null | cut -d. -f1) -echo " lockfileVersion: ${LOCKFILE_VERSION}" - -if [[ "${LOCKFILE_VERSION}" == "3" && -n "${NPM_MAJOR}" && "${NPM_MAJOR}" -lt 11 ]]; then - echo "" - echo "WARNING: package-lock.json uses lockfileVersion 3 (npm 11+)" - echo " but CI is running npm ${NPM_MAJOR} ($(npm --version))." - echo " This will likely cause 'npm ci' to fail." - echo "" - echo " Fix: regenerate your lockfile with the same Node version CI uses." - echo " Add an .nvmrc to your repo to keep local and CI versions in sync." - echo "" -fi - -echo "" -echo "Running npm ci..." -npm ci - -PKG_COUNT=$(find node_modules -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ') -echo "npm ci complete. ${PKG_COUNT} packages installed." diff --git a/src/scripts/packed_generate_config.sh b/src/scripts/packed_generate_config.sh index 914a1a5..2bbe6fb 100755 --- a/src/scripts/packed_generate_config.sh +++ b/src/scripts/packed_generate_config.sh @@ -193,6 +193,7 @@ extract_munitor_vars() { if [[ -n "${MUNITOR_TEST_COVERAGE_MIN}" ]]; then MUNITOR_COVERAGE_MIN="${MUNITOR_TEST_COVERAGE_MIN}" fi + MUNITOR_COVERAGE_SUMMARY_PATH=$(yq '.test.coverage.summary_path // "coverage/coverage-summary.json"' "${config_file}") # Terraform pipeline settings MUNITOR_TF_PATH=$(yq '.terraform.path // "terraform/"' "${config_file}") @@ -311,7 +312,7 @@ extract_munitor_vars() { export MUNITOR_SERVICES MUNITOR_SERVICES_JSON export MUNITOR_TEST_SETUP MUNITOR_TEST_SETUP_SCRIPT export MUNITOR_CUSTOM_TEST MUNITOR_TEST_COMMANDS_JSON - export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND + export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND MUNITOR_COVERAGE_SUMMARY_PATH export MUNITOR_TF_PATH MUNITOR_TF_LIVE_PATH MUNITOR_TF_ENVIRONMENTS MUNITOR_CHECKOV_SKIP MUNITOR_SAST MUNITOR_SAST_FAIL_ON_FINDINGS export MUNITOR_KUSTOMIZE_VERSION MUNITOR_KUSTOMIZE_BASE_PATH MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR export MUNITOR_KUSTOMIZE_SCAN_OVERLAY MUNITOR_KUSTOMIZE_OVERLAYS MUNITOR_KUSTOMIZE_OVERLAY_DIR @@ -326,7 +327,7 @@ extract_munitor_vars() { # Build the envsubst variable list get_envsubst_vars() { # shellcheck disable=SC2016 - echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE}' + echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE} ${MUNITOR_COVERAGE_SUMMARY_PATH}' } MUNITOR_EXTRACT_EOF @@ -983,9 +984,10 @@ orbs: workflows: pr-checks: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -1022,8 +1024,10 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1031,10 +1035,13 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -1045,8 +1052,10 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1055,8 +1064,10 @@ workflows: - /feature\/.*/ - /hotfix\/.*/ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1071,9 +1082,10 @@ workflows: release-candidate: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -1107,18 +1119,23 @@ workflows: branches: only: - /release\/.*/ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: - /release\/.*/ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -1128,8 +1145,10 @@ workflows: branches: only: - /release\/.*/ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1137,8 +1156,10 @@ workflows: only: - /release\/.*/ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1147,9 +1168,10 @@ workflows: - /release\/.*/ ##ENDIF_E2E## ##IF_SONAR## - - munitor/npm_sonar_scan: + - munitor/node_sonar_scan: name: sonar-scan node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" sonar_project_key: ${MUNITOR_SONAR_PROJECT_KEY} requires: - build-and-test @@ -1187,9 +1209,10 @@ workflows: only: - /release\/.*/ ##IF_SBOM## - - munitor/npm_sbom: + - munitor/node_sbom: name: sbom node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" context: - ${MUNITOR_CONTEXT_GITHUB} requires: @@ -1242,9 +1265,10 @@ workflows: production: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -1323,9 +1347,10 @@ orbs: workflows: pr-checks: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -1362,8 +1387,10 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1371,10 +1398,13 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -1385,8 +1415,10 @@ workflows: only: - /feature\/.*/ - /hotfix\/.*/ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1395,8 +1427,10 @@ workflows: - /feature\/.*/ - /hotfix\/.*/ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1411,9 +1445,10 @@ workflows: release-candidate: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -1447,18 +1482,23 @@ workflows: branches: only: - /release\/.*/ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: - /release\/.*/ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -1468,8 +1508,10 @@ workflows: branches: only: - /release\/.*/ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1477,8 +1519,10 @@ workflows: only: - /release\/.*/ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -1487,9 +1531,10 @@ workflows: - /release\/.*/ ##ENDIF_E2E## ##IF_SONAR## - - munitor/npm_sonar_scan: + - munitor/node_sonar_scan: name: sonar-scan node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" sonar_project_key: ${MUNITOR_SONAR_PROJECT_KEY} requires: - build-and-test @@ -1527,9 +1572,10 @@ workflows: only: - /release\/.*/ ##IF_SBOM## - - munitor/npm_sbom: + - munitor/node_sbom: name: sbom node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" context: - ${MUNITOR_CONTEXT_GITHUB} requires: @@ -1582,9 +1628,10 @@ workflows: production: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -2108,6 +2155,322 @@ workflows: only: main MUNITOR_TPL_EOF +cat > /tmp/munitor/templates/obsidian-plugin.yml.tpl << 'MUNITOR_TPL_EOF' +version: 2.1 + +orbs: + munitor: ${MUNITOR_ORB_SLUG}@${MUNITOR_ORB_VERSION} + +workflows: + pr-checks: + jobs: + - munitor/node_build_and_test: + name: build-and-test + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + ##IF_NPM_AUTH## + npm_auth: true + npm_scopes: '${MUNITOR_NPM_SCOPES}' + npm_default_scope: '${MUNITOR_NPM_DEFAULT_SCOPE}' + ##ENDIF_NPM_AUTH## + ##IF_SERVICES## + services: '${MUNITOR_SERVICES_JSON}' + ##ENDIF_SERVICES## + ##IF_TEST_SETUP## + test_setup: ${MUNITOR_TEST_SETUP_SCRIPT} + ##ENDIF_TEST_SETUP## + ##IF_CUSTOM_TEST## + test_commands: '${MUNITOR_TEST_COMMANDS_JSON}' + ##ENDIF_CUSTOM_TEST## + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + - munitor/secrets_scan: + name: secrets-scan + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + ##IF_SAST## + - munitor/sast_scan: + name: sast-scan + fail_on_findings: "${MUNITOR_SAST_FAIL_ON_FINDINGS}" + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + ##ENDIF_SAST## + - munitor/node_code_quality: + name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + - munitor/node_coverage: + name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + min_coverage: "${MUNITOR_COVERAGE_MIN}" + coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" + ##IF_COVERAGE_CMD## + coverage_command: ${MUNITOR_COVERAGE_COMMAND} + ##ENDIF_COVERAGE_CMD## + requires: + - build-and-test + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + - munitor/node_security_scan: + name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + ##IF_E2E## + - munitor/node_e2e_test: + name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /feature\/.*/ + - /hotfix\/.*/ + ##ENDIF_E2E## + + develop: + jobs: + - munitor/node_build_and_test: + name: build-and-test + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + ##IF_NPM_AUTH## + npm_auth: true + npm_scopes: '${MUNITOR_NPM_SCOPES}' + npm_default_scope: '${MUNITOR_NPM_DEFAULT_SCOPE}' + ##ENDIF_NPM_AUTH## + ##IF_SERVICES## + services: '${MUNITOR_SERVICES_JSON}' + ##ENDIF_SERVICES## + ##IF_TEST_SETUP## + test_setup: ${MUNITOR_TEST_SETUP_SCRIPT} + ##ENDIF_TEST_SETUP## + ##IF_CUSTOM_TEST## + test_commands: '${MUNITOR_TEST_COMMANDS_JSON}' + ##ENDIF_CUSTOM_TEST## + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: develop + + release-candidate: + jobs: + - munitor/node_build_and_test: + name: build-and-test + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + ##IF_NPM_AUTH## + npm_auth: true + npm_scopes: '${MUNITOR_NPM_SCOPES}' + npm_default_scope: '${MUNITOR_NPM_DEFAULT_SCOPE}' + ##ENDIF_NPM_AUTH## + ##IF_SERVICES## + services: '${MUNITOR_SERVICES_JSON}' + ##ENDIF_SERVICES## + ##IF_TEST_SETUP## + test_setup: ${MUNITOR_TEST_SETUP_SCRIPT} + ##ENDIF_TEST_SETUP## + ##IF_CUSTOM_TEST## + test_commands: '${MUNITOR_TEST_COMMANDS_JSON}' + ##ENDIF_CUSTOM_TEST## + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: + - /release\/.*/ + - munitor/secrets_scan: + name: secrets-scan + filters: + branches: + only: + - /release\/.*/ + ##IF_SAST## + - munitor/sast_scan: + name: sast-scan + fail_on_findings: "${MUNITOR_SAST_FAIL_ON_FINDINGS}" + filters: + branches: + only: + - /release\/.*/ + ##ENDIF_SAST## + - munitor/node_code_quality: + name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /release\/.*/ + - munitor/node_coverage: + name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + min_coverage: "${MUNITOR_COVERAGE_MIN}" + coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" + ##IF_COVERAGE_CMD## + coverage_command: ${MUNITOR_COVERAGE_COMMAND} + ##ENDIF_COVERAGE_CMD## + requires: + - build-and-test + filters: + branches: + only: + - /release\/.*/ + - munitor/node_security_scan: + name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /release\/.*/ + ##IF_E2E## + - munitor/node_e2e_test: + name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + requires: + - build-and-test + filters: + branches: + only: + - /release\/.*/ + ##ENDIF_E2E## + ##IF_SONAR## + - munitor/node_sonar_scan: + name: sonar-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + sonar_project_key: ${MUNITOR_SONAR_PROJECT_KEY} + requires: + - build-and-test + - coverage + context: + - ${MUNITOR_CONTEXT_SONAR} + filters: + branches: + only: + - /release\/.*/ + ##ENDIF_SONAR## + ##IF_SBOM## + - munitor/node_sbom: + name: sbom + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + context: + - ${MUNITOR_CONTEXT_GITHUB} + requires: + - code-quality + - coverage + - secrets-scan + ##IF_SAST## + - sast-scan + ##ENDIF_SAST## + - security-scan + ##IF_E2E## + - e2e-tests + ##ENDIF_E2E## + filters: + branches: + only: + - /release\/.*/ + ##ENDIF_SBOM## + - munitor/github_release: + name: github-release + release_artifacts: "main.js manifest.json styles.css" + requires: + - code-quality + - coverage + - secrets-scan + ##IF_SAST## + - sast-scan + ##ENDIF_SAST## + - security-scan + ##IF_E2E## + - e2e-tests + ##ENDIF_E2E## + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: + - /release\/.*/ + + production: + jobs: + - munitor/node_build_and_test: + name: build-and-test + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" + ##IF_NPM_AUTH## + npm_auth: true + npm_scopes: '${MUNITOR_NPM_SCOPES}' + npm_default_scope: '${MUNITOR_NPM_DEFAULT_SCOPE}' + ##ENDIF_NPM_AUTH## + ##IF_SERVICES## + services: '${MUNITOR_SERVICES_JSON}' + ##ENDIF_SERVICES## + ##IF_TEST_SETUP## + test_setup: ${MUNITOR_TEST_SETUP_SCRIPT} + ##ENDIF_TEST_SETUP## + ##IF_CUSTOM_TEST## + test_commands: '${MUNITOR_TEST_COMMANDS_JSON}' + ##ENDIF_CUSTOM_TEST## + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: main + - munitor/github_release: + name: github-release + release_artifacts: "main.js manifest.json styles.css" + requires: + - build-and-test + context: + - ${MUNITOR_CONTEXT_GITHUB} + filters: + branches: + only: main +MUNITOR_TPL_EOF + cat > /tmp/munitor/templates/partials/java-webapp-deploy.yml.tpl << 'MUNITOR_PARTIAL_EOF' __WORKFLOW_NAME__: jobs: @@ -2409,9 +2772,10 @@ MUNITOR_PARTIAL_EOF cat > /tmp/munitor/templates/partials/node-api-deploy.yml.tpl << 'MUNITOR_PARTIAL_EOF' __WORKFLOW_NAME__: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -2442,17 +2806,22 @@ cat > /tmp/munitor/templates/partials/node-api-deploy.yml.tpl << 'MUNITOR_PARTIA filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -2461,16 +2830,20 @@ cat > /tmp/munitor/templates/partials/node-api-deploy.yml.tpl << 'MUNITOR_PARTIA filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: __BRANCH_FILTER__ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -2478,9 +2851,10 @@ cat > /tmp/munitor/templates/partials/node-api-deploy.yml.tpl << 'MUNITOR_PARTIA only: __BRANCH_FILTER__ ##ENDIF_E2E## ##IF_SONAR## - - munitor/npm_sonar_scan: + - munitor/node_sonar_scan: name: sonar-scan node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" sonar_project_key: ${MUNITOR_SONAR_PROJECT_KEY} requires: - build-and-test @@ -2516,9 +2890,10 @@ cat > /tmp/munitor/templates/partials/node-api-deploy.yml.tpl << 'MUNITOR_PARTIA branches: only: __BRANCH_FILTER__ ##IF_SBOM## - - munitor/npm_sbom: + - munitor/node_sbom: name: sbom node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" context: - ${MUNITOR_CONTEXT_GITHUB} requires: @@ -2559,9 +2934,10 @@ MUNITOR_PARTIAL_EOF cat > /tmp/munitor/templates/partials/node-webapp-deploy.yml.tpl << 'MUNITOR_PARTIAL_EOF' __WORKFLOW_NAME__: jobs: - - munitor/npm_build_and_test: + - munitor/node_build_and_test: name: build-and-test node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" ##IF_NPM_AUTH## npm_auth: true npm_scopes: '${MUNITOR_NPM_SCOPES}' @@ -2592,17 +2968,22 @@ cat > /tmp/munitor/templates/partials/node-webapp-deploy.yml.tpl << 'MUNITOR_PAR filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_code_quality: + - munitor/node_code_quality: name: code-quality + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_coverage: + - munitor/node_coverage: name: coverage + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" min_coverage: "${MUNITOR_COVERAGE_MIN}" coverage_tool: ${MUNITOR_COVERAGE_TOOL} + coverage_summary_path: "${MUNITOR_COVERAGE_SUMMARY_PATH}" ##IF_COVERAGE_CMD## coverage_command: ${MUNITOR_COVERAGE_COMMAND} ##ENDIF_COVERAGE_CMD## @@ -2611,16 +2992,20 @@ cat > /tmp/munitor/templates/partials/node-webapp-deploy.yml.tpl << 'MUNITOR_PAR filters: branches: only: __BRANCH_FILTER__ - - munitor/npm_security_scan: + - munitor/node_security_scan: name: security-scan + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: branches: only: __BRANCH_FILTER__ ##IF_E2E## - - munitor/npm_e2e_test: + - munitor/node_e2e_test: name: e2e-tests + node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" requires: - build-and-test filters: @@ -2628,9 +3013,10 @@ cat > /tmp/munitor/templates/partials/node-webapp-deploy.yml.tpl << 'MUNITOR_PAR only: __BRANCH_FILTER__ ##ENDIF_E2E## ##IF_SONAR## - - munitor/npm_sonar_scan: + - munitor/node_sonar_scan: name: sonar-scan node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" sonar_project_key: ${MUNITOR_SONAR_PROJECT_KEY} requires: - build-and-test @@ -2666,9 +3052,10 @@ cat > /tmp/munitor/templates/partials/node-webapp-deploy.yml.tpl << 'MUNITOR_PAR branches: only: __BRANCH_FILTER__ ##IF_SBOM## - - munitor/npm_sbom: + - munitor/node_sbom: name: sbom node_version: "${MUNITOR_NODE_VERSION}" + package_manager: "${MUNITOR_PACKAGE_MANAGER}" context: - ${MUNITOR_CONTEXT_GITHUB} requires: @@ -2793,6 +3180,9 @@ validate_required_fields() { validate-cd-repo|argocd-apps) # No additional required fields beyond orb_version ;; + obsidian-plugin) + [[ -z "$(yq '.contexts.github // ""' "${config}")" ]] && missing+=("contexts.github") + ;; esac if [[ ${#missing[@]} -gt 0 ]]; then diff --git a/src/scripts/packed_generate_dockerfile.sh b/src/scripts/packed_generate_dockerfile.sh index 39312ab..3929d68 100755 --- a/src/scripts/packed_generate_dockerfile.sh +++ b/src/scripts/packed_generate_dockerfile.sh @@ -193,6 +193,7 @@ extract_munitor_vars() { if [[ -n "${MUNITOR_TEST_COVERAGE_MIN}" ]]; then MUNITOR_COVERAGE_MIN="${MUNITOR_TEST_COVERAGE_MIN}" fi + MUNITOR_COVERAGE_SUMMARY_PATH=$(yq '.test.coverage.summary_path // "coverage/coverage-summary.json"' "${config_file}") # Terraform pipeline settings MUNITOR_TF_PATH=$(yq '.terraform.path // "terraform/"' "${config_file}") @@ -311,7 +312,7 @@ extract_munitor_vars() { export MUNITOR_SERVICES MUNITOR_SERVICES_JSON export MUNITOR_TEST_SETUP MUNITOR_TEST_SETUP_SCRIPT export MUNITOR_CUSTOM_TEST MUNITOR_TEST_COMMANDS_JSON - export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND + export MUNITOR_COVERAGE_TOOL MUNITOR_COVERAGE_CMD MUNITOR_COVERAGE_COMMAND MUNITOR_COVERAGE_SUMMARY_PATH export MUNITOR_TF_PATH MUNITOR_TF_LIVE_PATH MUNITOR_TF_ENVIRONMENTS MUNITOR_CHECKOV_SKIP MUNITOR_SAST MUNITOR_SAST_FAIL_ON_FINDINGS export MUNITOR_KUSTOMIZE_VERSION MUNITOR_KUSTOMIZE_BASE_PATH MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR export MUNITOR_KUSTOMIZE_SCAN_OVERLAY MUNITOR_KUSTOMIZE_OVERLAYS MUNITOR_KUSTOMIZE_OVERLAY_DIR @@ -326,7 +327,7 @@ extract_munitor_vars() { # Build the envsubst variable list get_envsubst_vars() { # shellcheck disable=SC2016 - echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE}' + echo '${MUNITOR_PIPELINE} ${MUNITOR_ORB_VERSION} ${MUNITOR_IMAGE_NAME} ${MUNITOR_JAVA_VERSION} ${MUNITOR_NODE_VERSION} ${MUNITOR_SONAR_PROJECT_KEY} ${MUNITOR_DOCKER_REGISTRY} ${MUNITOR_CD_REPO} ${MUNITOR_CD_FORMAT} ${MUNITOR_CD_ENV_DEVELOP} ${MUNITOR_CD_ENV_STAGING} ${MUNITOR_CD_ENV_PROD} ${MUNITOR_CD_ENV_RELEASE} ${MUNITOR_COVERAGE_MIN} ${MUNITOR_E2E} ${MUNITOR_SBOM} ${MUNITOR_OWASP} ${MUNITOR_CONTEXT_REGISTRY} ${MUNITOR_CONTEXT_GITHUB} ${MUNITOR_CONTEXT_SONAR} ${MUNITOR_CONTEXT_NVD} ${MUNITOR_NPM_AUTH} ${MUNITOR_NPM_SCOPES} ${MUNITOR_SERVICES_JSON} ${MUNITOR_TEST_SETUP_SCRIPT} ${MUNITOR_TEST_COMMANDS_JSON} ${MUNITOR_COVERAGE_TOOL} ${MUNITOR_COVERAGE_COMMAND} ${MUNITOR_GITHUB_RELEASE} ${MUNITOR_SAST} ${MUNITOR_SAST_FAIL_ON_FINDINGS} ${MUNITOR_HEALTH_PATH} ${MUNITOR_HEALTH_PORT} ${MUNITOR_HEALTH_DB} ${MUNITOR_HEALTH_MIGRATIONS} ${MUNITOR_HEALTH_SMOKE_PATHS} ${MUNITOR_TF_PATH} ${MUNITOR_TF_LIVE_PATH} ${MUNITOR_TF_ENVIRONMENTS} ${MUNITOR_CHECKOV_SKIP} ${MUNITOR_KUSTOMIZE_VERSION} ${MUNITOR_KUSTOMIZE_BASE_PATH} ${MUNITOR_KUSTOMIZE_LOAD_RESTRICTOR} ${MUNITOR_KUSTOMIZE_SCAN_OVERLAY} ${MUNITOR_KUSTOMIZE_OVERLAYS} ${MUNITOR_KUSTOMIZE_OVERLAY_DIR} ${MUNITOR_KUBE_LINTER_CONFIG} ${MUNITOR_YAMLLINT_PATHS} ${MUNITOR_CI_EMAIL} ${MUNITOR_CI_NAME} ${MUNITOR_NPM_DEFAULT_SCOPE} ${MUNITOR_ORB_SLUG} ${MUNITOR_PACKAGE_MANAGER} ${MUNITOR_SUPPLEMENTAL_IMAGES_JSON} ${MUNITOR_SERVER_MODULE} ${MUNITOR_COVERAGE_SUMMARY_PATH}' } MUNITOR_EXTRACT_EOF @@ -377,7 +378,42 @@ case "${MUNITOR_PIPELINE}" in nextjs) # Multi-stage Next.js standalone Dockerfile. # Assumes `output: 'standalone'` in next.config.js. - cat > Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < Dockerfile < "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-webapp +image_name: my-webapp +node_version: "22" +package_manager: pnpm +EOF +run_generate > /dev/null +if grep -q 'corepack enable' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected corepack enable" +fi +teardown + +echo -n " TEST: pnpm node-webapp uses pnpm install --frozen-lockfile... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-webapp +image_name: my-webapp +node_version: "22" +package_manager: pnpm +EOF +run_generate > /dev/null +if grep -q 'pnpm install --frozen-lockfile' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected pnpm install --frozen-lockfile" +fi +teardown + +echo -n " TEST: pnpm node-webapp does not contain npm ci... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-webapp +image_name: my-webapp +node_version: "22" +package_manager: pnpm +EOF +run_generate > /dev/null +if ! grep -q 'npm ci' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected no npm ci" +fi +teardown + +# ============================================================================= +# Test: node-api (nextjs) with pnpm generates correct Dockerfile +# ============================================================================= +echo "" +echo "=== node-api pnpm (nextjs) Dockerfile Generation ===" + +echo -n " TEST: pnpm node-api nextjs includes corepack enable... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +EOF +run_generate > /dev/null +if grep -q 'corepack enable' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected corepack enable" +fi +teardown + +echo -n " TEST: pnpm node-api nextjs uses pnpm install --frozen-lockfile... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +EOF +run_generate > /dev/null +if grep -q 'pnpm install --frozen-lockfile' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected pnpm install --frozen-lockfile" +fi +teardown + +echo -n " TEST: pnpm node-api nextjs does not contain npm ci... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +EOF +run_generate > /dev/null +if ! grep -q 'npm ci' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected no npm ci" +fi +teardown + +# ============================================================================= +# Test: node-api (express) with pnpm generates correct Dockerfile +# ============================================================================= +echo "" +echo "=== node-api pnpm (express) Dockerfile Generation ===" + +echo -n " TEST: pnpm node-api express includes corepack enable... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +node: + framework: express +EOF +run_generate > /dev/null +if grep -q 'corepack enable' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected corepack enable" +fi +teardown + +echo -n " TEST: pnpm node-api express uses pnpm install --frozen-lockfile... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +node: + framework: express +EOF +run_generate > /dev/null +if grep -q 'pnpm install --frozen-lockfile' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected pnpm install --frozen-lockfile" +fi +teardown + +echo -n " TEST: pnpm node-api express does not contain npm ci... " +setup +cat > "${WORK_DIR}/.munitor.yml" <<'EOF' +pipeline: node-api +image_name: my-app +package_manager: pnpm +node: + framework: express +EOF +run_generate > /dev/null +if ! grep -q 'npm ci' "${WORK_DIR}/Dockerfile"; then + pass +else + fail "expected no npm ci" +fi +teardown + # ============================================================================= # Test: unsupported pipeline type # ============================================================================= diff --git a/tests/test_scripts.sh b/tests/test_scripts.sh index 6218cb7..14b8b50 100755 --- a/tests/test_scripts.sh +++ b/tests/test_scripts.sh @@ -20,27 +20,27 @@ fail() { } # ============================================================================= -# Test: npm_test.sh - Custom test commands +# Test: node_test.sh - Custom test commands # ============================================================================= -echo "=== npm_test.sh Tests ===" +echo "=== node_test.sh Tests ===" echo -n " TEST: runs custom test commands via bash -c (not eval)... " # Verify the script uses bash -c, not eval -if grep -q 'bash -c "\${CMD}"' "${SRC_SCRIPTS}/npm_test.sh"; then +if grep -q 'bash -c "\${CMD}"' "${SRC_SCRIPTS}/node_test.sh"; then pass else fail "script should use 'bash -c' not 'eval'" fi echo -n " TEST: creates reports/junit directory... " -if grep -q 'mkdir -p reports/junit' "${SRC_SCRIPTS}/npm_test.sh"; then +if grep -q 'mkdir -p reports/junit' "${SRC_SCRIPTS}/node_test.sh"; then pass else fail "should create reports/junit" fi echo -n " TEST: handles empty TEST_COMMANDS_JSON... " -if grep -q '\[\]' "${SRC_SCRIPTS}/npm_test.sh" && grep -q 'null' "${SRC_SCRIPTS}/npm_test.sh"; then +if grep -q '\[\]' "${SRC_SCRIPTS}/node_test.sh" && grep -q 'null' "${SRC_SCRIPTS}/node_test.sh"; then pass else fail "should handle empty/null JSON" @@ -288,13 +288,13 @@ else fi # ============================================================================= -# Test: npm_coverage_check.sh - Security +# Test: node_coverage_check.sh - Security # ============================================================================= echo "" -echo "=== npm_coverage_check.sh Tests ===" +echo "=== node_coverage_check.sh Tests ===" echo -n " TEST: uses bash -c for coverage command (not eval)... " -if grep -q 'bash -c "\${COVERAGE_COMMAND}"' "${SRC_SCRIPTS}/npm_coverage_check.sh"; then +if grep -q 'bash -c "\${COVERAGE_COMMAND}"' "${SRC_SCRIPTS}/node_coverage_check.sh"; then pass else fail "should use 'bash -c' not 'eval'" @@ -494,6 +494,44 @@ else fail "should use Alpine JRE with non-root user" fi +echo "" +echo "=== node_install_deps.sh pnpm support ===" + +echo -n " TEST: node_install_deps.sh handles pnpm case... " +if grep -q 'pnpm install --frozen-lockfile' "${SRC_SCRIPTS}/node_install_deps.sh"; then + pass +else + fail "missing pnpm install --frozen-lockfile" +fi + +echo -n " TEST: node_install_deps.sh has Prisma auto-detection... " +if grep -q 'prisma/schema.prisma' "${SRC_SCRIPTS}/node_install_deps.sh"; then + pass +else + fail "missing Prisma auto-detection" +fi + +echo -n " TEST: node_test.sh handles pnpm fallback... " +if grep -q 'pnpm test' "${SRC_SCRIPTS}/node_test.sh"; then + pass +else + fail "missing pnpm test fallback" +fi + +echo -n " TEST: run_test_setup.sh supports inline commands... " +if grep -q 'bash -c' "${SRC_SCRIPTS}/run_test_setup.sh"; then + pass +else + fail "missing bash -c inline command support" +fi + +echo -n " TEST: generate_dockerfile.sh has pnpm Dockerfile variant... " +if grep -q 'pnpm install --frozen-lockfile' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then + pass +else + fail "missing pnpm Dockerfile variant" +fi + # ============================================================================= # Test: install_kustomize.sh - Pinned binary install # ============================================================================= @@ -888,7 +926,7 @@ YQ_VER=$(extract_version YQ_VERSION "${SRC_SCRIPTS}/install_yq.sh") KUSTOMIZE_VER=$(extract_version KUSTOMIZE_VERSION "${SRC_SCRIPTS}/install_kustomize.sh") KUBESEC_VER=$(extract_version KUBESEC_VERSION "${SRC_SCRIPTS}/install_kubesec.sh") TFSEC_TRIVY_VER=$(extract_version TRIVY_VERSION "${SRC_SCRIPTS}/install_tfsec.sh") -SONAR_VER=$(extract_version SONAR_SCANNER_VERSION "${SRC_SCRIPTS}/npm_sonar.sh") +SONAR_VER=$(extract_version SONAR_SCANNER_VERSION "${SRC_SCRIPTS}/node_sonar.sh") # All URLs target linux/amd64 -- matches the CI executor URLS=( @@ -1019,6 +1057,47 @@ else fail "should detect pmdMain task" fi +# ============================================================================= +# Test: github_release.sh - Release artifact upload support +# ============================================================================= +echo "" +echo "=== github_release.sh Artifact Upload Tests ===" + +echo -n " TEST: supports MUNITOR_RELEASE_ARTIFACTS env var... " +if grep -q 'MUNITOR_RELEASE_ARTIFACTS' "${SRC_SCRIPTS}/github_release.sh"; then + pass +else + fail "should support MUNITOR_RELEASE_ARTIFACTS" +fi + +echo -n " TEST: uses gh release upload for artifacts... " +if grep -q 'gh release upload' "${SRC_SCRIPTS}/github_release.sh"; then + pass +else + fail "should use gh release upload" +fi + +echo -n " TEST: validates artifact files exist before upload... " +if grep -q 'not found' "${SRC_SCRIPTS}/github_release.sh" && grep -q '! -f' "${SRC_SCRIPTS}/github_release.sh"; then + pass +else + fail "should validate artifact files exist" +fi + +echo -n " TEST: uses --clobber for idempotent uploads... " +if grep -q '\-\-clobber' "${SRC_SCRIPTS}/github_release.sh"; then + pass +else + fail "should use --clobber flag" +fi + +echo -n " TEST: skips upload when MUNITOR_RELEASE_ARTIFACTS is empty... " +if grep -q 'if \[\[ -n "\${MUNITOR_RELEASE_ARTIFACTS:-}"' "${SRC_SCRIPTS}/github_release.sh"; then + pass +else + fail "should skip upload when artifacts is empty" +fi + # ============================================================================= # Summary # =============================================================================