# Pipeline Troubleshooting Guide

Common pipeline issues and their fixes.

---

## Composer Allow-Plugins Error

**Date Fixed**: 2026-03-20
**Service**: tbi-package-travelbrands (dev, uat, prod)
**Pipeline Stage**: `lint-and-test` → `Install Composer dependencies`

### Error

```
Composer Plugin Blocked by Allow-Plugins Configuration
kylekatarnls/update-helper contains a Composer plugin which is blocked by your allow-plugins config
```

### Cause

Composer 2.2+ requires all plugins to be explicitly allowlisted in `composer.json` under `config.allow-plugins`. The `kylekatarnls/update-helper` package (a dependency of `nesbot/carbon`) registers a Composer plugin that was not in the allowlist. With `--no-interaction`, Composer treats unallowed plugins as errors.

### Fix

Add `composer config --no-plugins allow-plugins true` before `composer install` in the CircleCI config:

```yaml
- run:
    name: Install Composer dependencies
    command: |
      composer config --no-plugins allow-plugins true
      composer install --no-interaction --prefer-dist --optimize-autoloader
```

This allows all plugins at the CI level without modifying the application's `composer.json`.

### Affected Services

Any PHP service using Composer may hit this. Apply the same fix to:

| Service | Tech Stack |
|---------|-----------|
| tbi-package-travelbrands | PHP 8.0 + Laravel ✅ Fixed |
| tbi-acc-hotel-service | PHP 8.0 + Lumen |
| tbi-acc-package-service | PHP 8.0 + Lumen |
| tbi-acc-hotel-service-connector | PHP 8.0 + Lumen |
| tbi-acc-travelbrandsagent | PHP 8.0 + Laravel |
| tbi-acc-gimmonix-automation | PHP 8.0 + Laravel |
| tbi-acc-cron-service | PHP 8.0 + Lumen |
| tbi-acc-package-cron | PHP 7.3 + Oracle |

---

**Last Updated**: 2026-03-20

---

## Empty values.yaml Causes Helm Validation Errors

**Date Fixed**: 2026-04-22
**Service**: tbi-acc-ceetiz-connector (dev, uat, prod)
**Pipeline Stage**: `deploy` → `helm secrets upgrade`

### Error

```
Error: UPGRADE FAILED: error validating "": error validating data:
[ValidationError(Service.spec.ports[0]): missing required field "port" in io.k8s.api.core.v1.ServicePort,
unknown object type "nil" in Service.spec.selector.app]
```

### Cause

The chart's `values.yaml` contained only comments and no actual default values. The Helm templates reference `.Values.port`, `.Values.targetPort`, `.Values.service_type`, and `.Values.name`, which all resolved to nil.

### Fix

Add required defaults to `values.yaml` in all environments (dev, uat, prod):

```yaml
image: IMAGE_TO_REPLACE
name: tbi-acc-ceetiz-connector
replicas: 1
service_type: "ClusterIP"
port: "80"
targetPort: "3000"
node_env: "development"  # use "uat" or "production" for other envs
group: "access"
```

### Prevention

When creating new services, always ensure the chart's `values.yaml` includes defaults for all values referenced in templates. Use `dev/tbi-acc-hotel-mapping-service/` as the reference template.

---

## Git Clone Fails: "could not read Username" (Inline Token Stripped on Redirect)

**Date Fixed**: 2026-10-21
**Service**: tbi-rlv-vacations-frontend (dev)
**Pipeline Stage**: `deploy-to-kubernetes` → `deploy-services.sh` → Step 4 (Clone tbi-environments repository)

### Error

```
Cloning into 'tbi-environments'...
warning: redirecting to https://github.com/<org>/tbi-environments.git/
Username for 'https://github.com': fatal: could not read Username for 'https://github.com': Success
fatal: expected flush after ref listing
```

(The same failure also appears earlier, at the config.yml clone step, with `could not read Username for 'https://github.com': terminal prompts disabled`.)

### Cause

The clone URL embedded the token inline, e.g.:

```bash
git clone https://${GITHUB_TOKEN}@github.com/redlabelvacations/tbi-environments.git
```

GitHub redirects the request (trailing-slash / `.git` normalization — note the `warning: redirecting` line). For security, Git **strips inline URL credentials when following a redirect**. After the redirect there are no credentials left, so Git falls back to prompting for a username, which fails in CI because terminal prompts are disabled (`GIT_TERMINAL_PROMPT=0`).

Adding a username to the URL (e.g. `https://x-access-token:${GITHUB_TOKEN}@github.com/...`) does **not** fix it — those credentials are stripped on the same redirect.

### Fix

Authenticate with a credential helper instead of putting the token in the URL. The helper supplies the token at request time and survives the redirect. Use a clean URL and persist the helper on the cloned repo so the later `git push` authenticates too.

In `deploy-services.sh`:

```bash
# Clean URL — no inline token
TBI_ENVIRONMENTS_REPO="https://github.com/redlabelvacations/tbi-environments.git"

clone_tbi_environments() {
    echo "Cloning tbi-environments repository..."
    git -c credential.helper= \
        -c credential.helper='!f() { echo "username=x-access-token"; echo "password=${GITHUB_TOKEN}"; }; f' \
        clone "${TBI_ENVIRONMENTS_REPO}" -b "${TBI_ENVIRONMENTS_BRANCH}"

    # Persist the helper so the later push also authenticates
    git -C tbi-environments config credential.helper \
        '!f() { echo "username=x-access-token"; echo "password=${GITHUB_TOKEN}"; }; f'
}
```

The same pattern applies to CircleCI `config.yml` clone steps:

```yaml
rm -rf tbi-devops-environments
git -c credential.helper= \
    -c credential.helper='!f() { echo "username=x-access-token"; echo "password=${GITHUB_TOKEN}"; }; f' \
    clone https://github.com/redlabelvacations/tbi-devops-environments \
    -b master --single-branch tbi-devops-environments
```

`GITHUB_TOKEN` must be present in the job environment (both stages already guard on it).

### Affected Services

Any service whose `config.yml` or `deploy-services.sh` still clones with an inline `https://${GITHUB_TOKEN}@github.com/...` URL. Confirmed fixed and still-pending copies:

| Location | Status |
|----------|--------|
| dev/tbi-rlv-vacations-frontend/.circleci/config.yml | ✅ Fixed |
| dev/tbi-rlv-vacations-frontend/scripts/deploy-services.sh | ✅ Fixed |
| uat/tbi-rlv-vacations-frontend/.circleci/config.yml | ⏳ Pending |
| uat/tbi-rlv-vacations-frontend/scripts/deploy-services.sh | ⏳ Pending |
| redtag-prod/tbi-rlv-vacations-frontend/.circleci/config.yml | ⏳ Pending |
| redtag-prod/tbi-rlv-vacations-frontend/scripts/deploy-services.sh | ⏳ Pending |

To find other affected files:

```bash
grep -rl 'https://${GITHUB_TOKEN}@github.com' --include=config.yml --include='*.sh' .
```

### Prevention

When scaffolding new services, never embed the token in the clone URL. Use the credential-helper pattern above so clones survive GitHub redirects and later pushes stay authenticated.

---

**Last Updated**: 2026-10-21