@ibm-cloud/cd-tools
Advanced tools
Tools and utilities for the IBM Cloud Continuous Delivery service and resources
Provides tools to work with IBM Cloud Continuous Delivery resources, including Toolchains, Delivery Pipelines, and Git Repos and Issue Tracking projects.
| Resource | Supported |
|---|---|
| Toolchains | Yes 1 |
| Git Repos and Issue Tracking | Yes 2 |
| Delivery Pipelines (Tekton) | Yes 3 |
| Delivery Pipelines (Classic) | No |
| DevOps Insights | No |
| Other Tool Integrations | Yes |
brew install node
brew tap hashicorp/tap
brew install hashicorp/tap/terraform
The tools are provided as an npx command. npx (Node Package Execute) is a utility provided with Node.js which automatically downloads a module and its dependencies, and runs it. To see the available commands, run npx @ibm-cloud/cd-tools on your command line.
$ npx @ibm-cloud/cd-tools -h
Usage: @ibm-cloud/cd-tools [options] [command]
Tools and utilities for the IBM Cloud Continuous Delivery service and resources.
Options:
-V, --version output the version number
-h, --help display help for command
Commands:
copy-project-group [options] Copies all Git Repos and Issue Tracking projects in a group to another region.
copy-toolchain [options] Copies a toolchain, including tool integrations and Tekton pipelines, to another region or resource group.
export-secrets [options] Exports Toolchain stored secrets to a Secrets Manager instance
help [command] display help for command
The copy-project-group command copies a group of projects in IBM Cloud Continuous Delivery's Git Repos and Issue Tracking from one region to another. This includes the project group, projects, Git repositories, issues, merge requests, wiki, and most other resources. See the full list of items included in the copy. In addition to copying the project group, the command will also ensure that project members exist in the destination region and are added to the newly copied project group, preserving existing permissions.
copy-project-group will ensure that the users exist in the new region, however there may be user name conflicts with other users in the destination region. In the event of a user name conflict, the user name in the destination region may be changed slightly by adding a suffix.api scope.$ npx @ibm-cloud/cd-tools copy-project-group -h
Usage: @ibm-cloud/cd-tools copy-project-group [options]
Copies all Git Repos and Issue Tracking projects in a group to another region.
Examples:
npx @ibm-cloud/cd-tools copy-project-group -g "1796019" -s ca-tor -d us-south --st ${PAT_CA_TOR} --dt ${PAT_US_SOUTH}
Copy all the Git Repos and Issue Tracking projects in the group "mygroup" from the Toronto region to the Dallas, with the same group name.
Options:
-s, --source-region <region> The source region from which to copy the project group (choices: "au-syd", "br-sao", "ca-mon", "ca-tor", "eu-de", "eu-es", "eu-gb", "jp-osa", "jp-tok", "us-east", "us-south")
-d, --dest-region <region> The destination region to copy the projects to (choices: "au-syd", "br-sao", "ca-mon", "ca-tor", "eu-de", "eu-es", "eu-gb", "jp-osa", "jp-tok", "us-east", "us-south")
--st, --source-token <token> A Git Repos and Issue Tracking personal access token from the source region. The api scope is required on the token.
--dt, --dest-token <token> A Git Repos and Issue Tracking personal access token from the target region. The api scope is required on the token.
-g, --group-id <id> The id of the group to copy from the source region (e.g. "1796019"), or the group name (e.g. "mygroup") for top-level groups. For sub-groups, a path
is also allowed, e.g. "mygroup/subgroup"
-n, --new-group-slug <slug> (Optional) Destination group URL slug (single path segment, e.g. "mygroup-copy"). Must be unique. Group display name remains the same as source.
-v, --verbose Enable verbose output (debug logs + wait details)
-h, --help display help for command
The copy-toolchain command copies a toolchain, including tool integrations and Tekton pipelines, to another region or resource group, in the same account. The copy works by first serializing the existing toolchain into Terraform (.tf) files, then applying the Terraform on the destination.
export-secrets command is provided to export secrets into a Secrets Manager instance, replacing the stored secrets with secret references. Secret references are supported. It is recommended to store secrets in Secrets Manager.IBM Cloud resources are uniquely identified by a Cloud Resource Name (CRN). You will need the CRN of the toolchain you want to copy. You can get the CRN of a toolchain a few ways:
$ ibmcloud resource service-instances --service-name toolchain --long
$ npx @ibm-cloud/cd-tools copy-toolchain -h
Usage: @ibm-cloud/cd-tools copy-toolchain [options]
Copies a toolchain, including tool integrations and Tekton pipelines, to another region or resource group.
Examples:
export IBMCLOUD_API_KEY='...'
npx @ibm-cloud/cd-tools copy-toolchain -c ${TOOLCHAIN_CRN} -r us-south
Copy a toolchain to the Dallas region with the same name, in the same resource group.
npx @ibm-cloud/cd-tools copy-toolchain -c ${TOOLCHAIN_CRN} -r eu-de -n new-toolchain-name -g new-resource-group --apikey ${APIKEY}
Copy a toolchain to the Frankfurt region with the specified name and target resource group, using the given API key
Environment Variables:
IBMCLOUD_API_KEY API key used to authenticate. Must be a user API key, with IAM permission to read and create toolchains and service-to-service authorizations in source and target region / resource group
Basic options:
-c, --toolchain-crn <crn> The CRN of the source toolchain to copy
-r, --region <region> The destination region of the copied toolchain (choices: "au-syd", "br-sao", "ca-mon", "ca-tor", "eu-de", "eu-es", "eu-gb", "jp-osa", "jp-tok", "us-east", "us-south")
-a, --apikey <api_key> API key used to authenticate. Must be a user API key, with IAM permission to read and create toolchains and service-to-service authorizations in source and target region / resource group
-n, --name <name> (Optional) The name of the copied toolchain (default: same name as original)
-g, --resource-group <resource_group> (Optional) The name or ID of destination resource group of the copied toolchain (default: same resource group as original)
-t, --tag <tag> (Optional) The tag to add to the copied toolchain
-h, --help Display help for command
Advanced options:
-d, --terraform-dir <path> (Optional) The target local directory to store the generated Terraform (.tf) files
-D, --dry-run (Optional) Skip running terraform apply; only generate the Terraform (.tf) files
-f, --force (Optional) Force the copy toolchain command to run without user confirmation
-S, --skip-s2s (Optional) Skip creating toolchain-generated service-to-service authorizations
-T, --skip-disable-triggers (Optional) Skip disabling Tekton pipeline Git or timed triggers. Note: This may result in duplicate pipeline runs
-C, --compact (Optional) Generate all resources in a single resources.tf file
-v, --verbose (Optional) Increase log output
-q, --quiet (Optional) Suppress non-essential output, only errors and critical warnings are displayed
If an error occurs while copying the toolchain, the copied toolchain may be incomplete. You may need to try the command again. To try again, you can either:
copy-toolchain command again.terraform apply command.copy-toolchain first serializes the source toolchain into Terraform (.tf) files. If you don't specify the -d, --terraform-dir <path>, the Terraform files will be placed in a folder in the current working directory named output-{id}, e.g. output-1764100766410. You can locate the most recent output folder and re-run terraform apply. This will continue where the previous command left off. When prompted for an API key, specify the same API key you used to run the copy-toolchain command.$ cd output-1764102115772
$ terraform apply
var.ibmcloud_api_key
Enter a value: {api_key}
...
You can get the Terraform (.tf) files for a toolchain by running the copy-toolchain command with the -D, --dry-run option, and specifying the directory to store the Terraform files with the -d, --terraform-dir <path> option.
$ npx @ibm-cloud/cd-tools copy-toolchain -c ${CRN} -r us-south --dry-run --terraform-dir ./terraform
The command will output a collection of .tf files in the terraform directory. If you prefer to have a single file containing all the Terraform source, you can also specify the -C, --compact option.
The copy-toolchain command copies a toolchain within an IBM Cloud account. However it is possible to copy a toolchain to a different account with a few extra steps. Note that any tool integrations that access services in the source account, such as Secrets Manager, Event Notifications, etc. are not supported for cross-account copying.
copy-toolchain command with the -D, --dry-run option to first generate the Terraform (.tf) files to a directory (See Getting the Terraform code for a toolchain).cd_toolchain.tf file, replacing the resource_group_id with a valid resource group id in the target account. You can find the resource group id in the IBM Cloud console under Manage > Account > Resource groups.terraform init, then terraform apply.The export-secrets command copies secrets stored directly in your toolchain or Tekton pipeline into Secrets Manager, and then updates the toolchain and pipeline to reference the secrets in Secrets Manager. The copy-toolchain command does not copy secrets stored directly in the toolchain or its Tekton pipeline environment properties or trigger properties, however secret references to secrets in a secret store such as Secrets Manager or Key Protect can be copied. The export-secrets command is useful for moving your secrets out before copying a toolchain. You can also use it to check whether a toolchain or its Tekton pipeline(s) contain any stored secrets. Storing secrets in a proper secret store like Secrets Manager is a recommended practice for added security.
$ npx @ibm-cloud/cd-tools export-secrets -h
Usage: @ibm-cloud/cd-tools export-secrets [options]
Exports Toolchain stored secrets to a Secrets Manager instance
Options:
-c, --toolchain-crn <crn> The CRN of the toolchain to check
-a, --apikey <api_key> API key used to authenticate. Must have IAM permission to read toolchains and create secrets in Secrets Manager
--check (Optional) Checks and lists any stored secrets in your toolchain
-v, --verbose (Optional) Increase log output
-h, --help display help for command
All test setup and usage instructions are documented in test/README.md.
FAQs
Tools and utilities for the IBM Cloud Continuous Delivery service and resources
The npm package @ibm-cloud/cd-tools receives a total of 83 weekly downloads. As such, @ibm-cloud/cd-tools popularity was classified as not popular.
We found that @ibm-cloud/cd-tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 18 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.