AMP-31085: Update TruBudget Branch with latest develolp

.github/workflows/build-push-ecr.yml

@@ -0,0 +1,109 @@
+name: Build & Push AMP image to ECR
+
+on:
+  push:
+    branches:
+      - "**"          # all branches
+  workflow_dispatch:  # allow manual trigger
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      # ── Load SSH key (needed for submodule checkout AND private npm packages) ─
+      - name: Start SSH agent
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
+
+      - name: Configure git to use SSH for submodules
+        run: |
+          git config --global url."git@github.com:".insteadOf "https://github.com/"
+          mkdir -p ~/.ssh
+          ssh-keyscan -H github.com >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      # ── Checkout (with submodules — Dockerfile COPYs .git dirs from them) ───
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+          ssh-key: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
+
+      # ── Derive the Docker tag from the branch name ─────────────────────────
+      # Sanitise: replace / with - and strip other unsafe chars (Docker tag rules).
+      - name: Set image tag
+        id: tag
+        run: |
+          RAW="${{ github.ref_name }}"
+          TAG="${RAW//\//-}"
+          TAG="${TAG//[^a-zA-Z0-9._-]/-}"
+          echo "value=${TAG}" >> "$GITHUB_OUTPUT"
+
+      # ── Configure AWS credentials ─────────────────────────────────────────
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id:     ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region:            us-east-1
+
+      # ── Log in to Amazon ECR ──────────────────────────────────────────────
+      - name: Login to Amazon ECR
+        id: ecr-login
+        run: |
+          set +x
+          PASSWORD=$(aws ecr get-login-password --region us-east-1)
+          echo "::add-mask::$PASSWORD"
+          echo "$PASSWORD" | docker login --username AWS --password-stdin ${{ secrets.ECR_REGISTRY }}
+          echo "✅ Logged in to ECR"
+
+      # ── Set up Docker Buildx ─────────────────────────────────────────────
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: |
+            image=moby/buildkit:latest
+            network=host
+
+      # ── Build & push ──────────────────────────────────────────────────────
+      # ECR_REGISTRY → e.g. 798366298150.dkr.ecr.us-east-1.amazonaws.com
+      # Image repo path is hardcoded to amp/webapp (matching deploy.yml convention)
+      - name: Build and push AMP image
+        env:
+          DOCKER_BUILDKIT: 1
+          BUILDKIT_PROGRESS: plain
+        run: |
+          TAG="${{ steps.tag.outputs.value }}"
+          IMAGE="${{ secrets.ECR_REGISTRY }}/amp/webapp"
+
+          docker buildx build \
+            --progress=plain \
+            --ssh default \
+            --build-arg SKIP_TESTS=true \
+            --build-arg BUILD_SOURCE="${TAG}" \
+            --build-arg AMP_BRANCH="${{ github.ref_name }}" \
+            --cache-from type=registry,ref="${IMAGE}:${TAG}" \
+            --cache-from type=registry,ref="${IMAGE}:latest" \
+            --cache-to type=inline \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            -t "${IMAGE}:${TAG}" \
+            -t "${IMAGE}:latest" \
+            --push \
+            amp
+
+      # ── Output ────────────────────────────────────────────────────────────
+      - name: Print image reference
+        run: |
+          echo "Image pushed:"
+          echo "  ${{ secrets.ECR_REGISTRY }}/amp/webapp:${{ steps.tag.outputs.value }}"
+          echo ""
+          echo "Set in deployment .env:"
+          echo "  AMP_IMAGE=${{ secrets.ECR_REGISTRY }}/amp/webapp"
+          echo "  AMP_TAG=${{ steps.tag.outputs.value }}"
+
+      # ── Logout ───────────────────────────────────────────────────────────
+      - name: Logout from ECR
+        if: always()
+        run: docker logout ${{ secrets.ECR_REGISTRY }} || true

.github/workflows/deploy.yml

@@ -17,6 +17,8 @@ on:
         options:
           - bfaso
           - boad
+          - cameroon
+          - cameroontrubudget
           - chad
           - civ
           - drc

amp/.env.example

@@ -0,0 +1,68 @@
+# AMP + TruBudget Docker environment
+# Copy this file to .env in the repo root, fill in values, then run ./setup.sh
+# Do NOT commit .env to version control.
+
+# ── Server ─────────────────────────────────────────────────────────────────
+# The private IP of this server
+SERVER_IP=192.168.1.100
+
+# ── Ports (host-side) ──────────────────────────────────────────────────────
+AMP_PORT=8080
+TRUBUDGET_UI_PORT=3000
+TRUBUDGET_API_PORT=8081
+
+# ── AMP ────────────────────────────────────────────────────────────────────
+# Docker image produced by the GitHub Actions CI pipeline (build-push-ecr.yml).
+# AMP_IMAGE → ECR repository URL (no tag)
+# AMP_TAG   → branch or release tag built by CI (e.g. develop, main, v1.2.0)
+AMP_IMAGE=798366298150.dkr.ecr.us-east-1.amazonaws.com/amp/webapp
+AMP_TAG=task/AMP-31085/Update-TruBudget-Branch-with-latest-develolp
+
+# AWS credentials used by setup.sh to authenticate to ECR before pulling
+AWS_ACCESS_KEY_ID=your_access_key_id
+AWS_SECRET_ACCESS_KEY=your_secret_access_key
+AWS_DEFAULT_REGION=us-east-1
+
+AMP_DB_NAME=amp
+AMP_DB_USER=amp
+AMP_DB_PASSWORD=change_me_amp_db_pass
+
+# Optional: label shown in the AMP footer next to the version number.
+# Replaces the raw CI branch/tag name (e.g. task-AMP-31085-...) with something readable.
+# Leave empty to show the branch name as-is.
+AMP_BUILD_LABEL=v4.0
+
+# Optional: full footer text shown below the version line.
+# Replaces whatever is stored in the DB for the footer key.
+# Example: "AMP Senegal — Developed by Development Gateway"
+# Leave empty to keep the DB value unchanged.
+AMP_FOOTER_TEXT=TruBudget Enabled AMP Cameroon Developed by Development Gateway with the support of the European Union, GIZ and UNDP
+
+# Tomcat JVM heap (e.g. 8g for a 16 GB instance)
+AMP_JVM_HEAP=2g
+
+# SMTP relay for AMP outbound mail (optional)
+SMTP_HOST=smtp.example.org
+SMTP_FROM=noreply@example.org
+
+# Docker-internal URL the AMP JVM uses to reach TruBudget API.
+TRUBUDGET_BASE_URL=http://host.docker.internal:8081/
+TRUBUDGET_ENABLED=false
+
+# ── TruBudget (cloned from official repo) ─────────────────────────────────
+# Git tag or branch — use a specific tag like v2.10.0 for production stability
+TRUBUDGET_TAG=main
+# Docker image tag used inside TruBudget's own compose (latest, main, or v2.x.x)
+TRUBUDGET_VERSION=latest
+
+# Organisation name on the blockchain (no spaces)
+TRUBUDGET_ORG=AMP_ORG
+
+# Vault secret used to encrypt private keys — keep this safe
+TRUBUDGET_VAULT_SECRET=change_me_vault_secret
+
+# Root admin password for first-time TruBudget login (username: root)
+TRUBUDGET_ROOT_SECRET=change_me_root_secret
+
+# Blockchain internal RPC password
+TRUBUDGET_RPC_PASSWORD=change_me_rpc_password

amp/Dockerfile

@@ -191,6 +191,14 @@ RUN npm run build \
     && rm -rf node_modules
 FROM maven:3.8.4-jdk-8 as compile-mvn
 WORKDIR /tmp/amp
+
+# JDBC credentials passed in from docker-compose build args (see docker-compose.yml)
+ARG JDBC_USER=amp
+ARG JDBC_PASSWORD=amp
+ARG JDBC_DB=amp
+ARG JDBC_HOST=db
+ARG JDBC_PORT=5432
+
 # Copy pom.xml first for better Maven caching
 COPY pom.xml .
 #COPY amp/pom.xml amp/
@@ -206,24 +214,26 @@ COPY --from=compile-reampv2 /tmp/amp/TEMPLATE/reampv2 TEMPLATE/reampv2
 # Download Maven dependencies (this layer will be cached if pom.xml doesn't change)
 ARG BUILD_SOURCE
 RUN --mount=type=cache,target=/root/.m2 \
-    mvn -B dependency:go-offline -f pom.xml || true
+    mvn -B org.apache.maven.plugins:maven-dependency-plugin:3.1.2:go-offline -f pom.xml || true
 # Copy source code after dependencies are downloaded
 COPY . .
 ARG SKIP_TESTS=false
 RUN --mount=type=cache,target=/root/.m2 \
     if [ "$SKIP_TESTS" = "true" ]; then \
-      mvn -B clean compile war:exploded \
+      mvn -B clean compile org.apache.maven.plugins:maven-war-plugin:2.3:exploded \
         -DbuildSource=$BUILD_SOURCE \
-        -Djdbc.user=amp -Djdbc.password=amp122006 -Djdbc.db=amp -Djdbc.host=db \
-        -Djdbc.port=5432 -DdbName=postgresql -Djdbc.driverClassName=org.postgresql.Driver \
+        -Djdbc.user=$JDBC_USER -Djdbc.password=$JDBC_PASSWORD \
+        -Djdbc.db=$JDBC_DB -Djdbc.host=$JDBC_HOST -Djdbc.port=$JDBC_PORT \
+        -DdbName=postgresql -Djdbc.driverClassName=org.postgresql.Driver \
         -Dskip.npm -Dskip.installnodenpm -DskipTests \
         && mv target/amp exploded \
         && rm -rf target; \
     else \
-      mvn -B test war:exploded \
+      mvn -B test org.apache.maven.plugins:maven-war-plugin:2.3:exploded \
         -DbuildSource=$BUILD_SOURCE \
-        -Djdbc.user=amp -Djdbc.password=amp122006 -Djdbc.db=amp -Djdbc.host=db \
-        -Djdbc.port=5432 -DdbName=postgresql -Djdbc.driverClassName=org.postgresql.Driver \
+        -Djdbc.user=$JDBC_USER -Djdbc.password=$JDBC_PASSWORD \
+        -Djdbc.db=$JDBC_DB -Djdbc.host=$JDBC_HOST -Djdbc.port=$JDBC_PORT \
+        -DdbName=postgresql -Djdbc.driverClassName=org.postgresql.Driver \
         -Dskip.npm -Dskip.installnodenpm \
         && mv target/amp exploded \
         && rm -rf target; \
@@ -232,7 +242,7 @@ RUN --mount=type=cache,target=/root/.m2 \
 FROM tomcat:8.5.79-jdk8
 
 RUN apt-get update \
-    && apt-get install -y apt-transport-https ca-certificates curl gnupg --no-install-recommends \
+    && apt-get install -y apt-transport-https ca-certificates curl gnupg postgresql-client --no-install-recommends \
     && curl -sSL https://dl.google.com/linux/linux_signing_key.pub | apt-key add - \
     && echo "deb https://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
     && apt-get update \
@@ -256,4 +266,11 @@ LABEL "branch"=$AMP_BRANCH
 ENV AMP_REGISTRY_PRIVATE_KEY $AMP_REGISTRY_PRIVATE_KEY
 
 RUN rm -fr /usr/local/tomcat/webapps/ROOT
-COPY --from=compile-mvn /tmp/amp/exploded /usr/local/tomcat/webapps/ROOT/
+COPY --from=compile-mvn /tmp/amp/exploded /usr/local/tomcat/webapps/ROOT/
+
+# Entrypoint patches context.xml with runtime JDBC env vars before Tomcat starts,
+# so the same image works with any DB password without a rebuild.
+COPY docker/entrypoint.sh bin/entrypoint.sh
+RUN chmod +x /usr/local/tomcat/bin/entrypoint.sh
+
+ENTRYPOINT ["/usr/local/tomcat/bin/entrypoint.sh"]

amp/docker/entrypoint.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# entrypoint.sh — Patch config files with runtime env vars before Tomcat starts.
+#
+# Patches performed:
+#   1. context.xml  — JDBC credentials (user, password, URL) from JDBC_* env vars
+#   2. site-config.xml — buildSource entity from AMP_BUILD_LABEL env var (optional)
+#
+# Footer text ("AMP Togo...") is stored in the DB (DG_MESSAGE table).
+# It is patched at container startup via psql if AMP_FOOTER_TEXT is set.
+# The DB patch is done here via a background wait-and-patch so Tomcat can start
+# while we wait for the DB to accept connections.
+#
+# Expected env vars:
+#   JDBC_USER, JDBC_PASSWORD, JDBC_DB, JDBC_HOST, JDBC_PORT
+#   AMP_BUILD_LABEL   (optional) — replaces the branch-name build tag in the footer
+#   AMP_FOOTER_TEXT   (optional) — replaces the full footer text in the DB
+
+set -euo pipefail
+
+CONTEXT_XML="/usr/local/tomcat/webapps/ROOT/META-INF/context.xml"
+SITE_CONFIG="/usr/local/tomcat/webapps/ROOT/TEMPLATE/ampTemplate/site-config.xml"
+
+# ── 1. Patch context.xml (JDBC credentials) ──────────────────────────────────
+if [[ -f "${CONTEXT_XML}" ]]; then
+  echo "[entrypoint] Patching context.xml with runtime JDBC credentials..."
+  sed -i \
+    -e "s|username=\"[^\"]*\"|username=\"${JDBC_USER:-amp}\"|g" \
+    -e "s|password=\"[^\"]*\"|password=\"${JDBC_PASSWORD:-amp}\"|g" \
+    "${CONTEXT_XML}"
+  sed -i \
+    -e "s|jdbc:postgresql://[^/]*/[^\"]*|jdbc:postgresql://${JDBC_HOST:-db}:${JDBC_PORT:-5432}/${JDBC_DB:-amp}|g" \
+    "${CONTEXT_XML}"
+  echo "[entrypoint] context.xml patched."
+else
+  echo "[entrypoint] WARNING: ${CONTEXT_XML} not found — skipping JDBC patch."
+fi
+
+# ── 2. Patch site-config.xml (build label) ───────────────────────────────────
+if [[ -n "${AMP_BUILD_LABEL:-}" ]] && [[ -f "${SITE_CONFIG}" ]]; then
+  echo "[entrypoint] Setting buildSource to: ${AMP_BUILD_LABEL}"
+  sed -i "s|<!ENTITY buildSource \"[^\"]*\">|<!ENTITY buildSource \"${AMP_BUILD_LABEL}\">|" "${SITE_CONFIG}"
+  echo "[entrypoint] site-config.xml patched."
+fi
+
+# ── 3. Patch footer text in DB (background — waits for DB to be ready) ───────
+if [[ -n "${AMP_FOOTER_TEXT:-}" ]]; then
+  (
+    DB_HOST="${JDBC_HOST:-db}"
+    DB_PORT="${JDBC_PORT:-5432}"
+    DB_NAME="${JDBC_DB:-amp}"
+    DB_USER="${JDBC_USER:-amp}"
+    PGPASSWORD="${JDBC_PASSWORD:-amp}"
+    export PGPASSWORD
+
+    echo "[entrypoint] Waiting for DB to accept connections before patching footer text..."
+    for i in $(seq 1 30); do
+      if psql -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" -c "SELECT 1" &>/dev/null; then
+        echo "[entrypoint] DB ready. Updating footer text in DG_MESSAGE..."
+        # Update all locales for the footer key. Uses DO ... to upsert cleanly.
+        psql -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" <<SQL
+UPDATE dg_message
+  SET message_utf8 = '${AMP_FOOTER_TEXT}',
+      orig_message = '${AMP_FOOTER_TEXT}'
+WHERE message_key = 'Developed in partnership with OECD, UNDP, WB, Government of Ethiopia and DG';
+SQL
+        echo "[entrypoint] Footer text updated."
+        break
+      fi
+      sleep 2
+    done
+  ) &
+fi
+
+# ── Hand off to Tomcat ────────────────────────────────────────────────────────
+exec catalina.sh run

amp/pom.xml

@@ -617,6 +617,16 @@
             <artifactId>jackson-databind</artifactId>
             <version>${jackson.version}</version>
         </dependency>
+        <dependency>
+            <groupId>io.projectreactor.netty</groupId>
+            <artifactId>reactor-netty</artifactId>
+            <version>1.0.35</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-webflux</artifactId>
+            <version>5.3.28</version>
+        </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.jaxrs</groupId>
             <artifactId>jackson-jaxrs-json-provider</artifactId>