go.fuchsia.dev/infra@v0.0.0-20240507153436-9b593402251b/cmd/recipe_wrapper/git/git.go

// Copyright 2023 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

package git

import (
	"context"
	"fmt"
	"net/url"
	"os"

	"go.chromium.org/luci/auth"
	buildbucketpb "go.chromium.org/luci/buildbucket/proto"
	gerritapi "go.chromium.org/luci/common/api/gerrit"
	gitilesapi "go.chromium.org/luci/common/api/gitiles"
	"go.fuchsia.dev/infra/checkout"
	rbc "go.fuchsia.dev/infra/cmd/recipe_wrapper/checkout"
	"go.fuchsia.dev/infra/cmd/recipe_wrapper/props"
	"go.fuchsia.dev/infra/gerrit"
	"go.fuchsia.dev/infra/gitiles"
	"google.golang.org/protobuf/types/known/structpb"
)

const (
	// Fallback ref to fetch, when build has no input, e.g. when the build is manually
	// triggered with LUCI scheduler, or when the recipes_host_override property is set.
	FallbackRef = "refs/heads/main"

	// Default integration.git remote, for when build has no input, e.g. when
	// the build is manually triggered with LUCI scheduler.
	defaultIntegrationRemote = "https://fuchsia.googlesource.com/integration"
)

// resolveRef returns a resolved sha1 from a ref e.g. refs/heads/main.
func resolveRef(ctx context.Context, host, project, ref string) (string, error) {
	authClient, err := auth.NewAuthenticator(ctx, auth.SilentLogin, auth.Options{Scopes: []string{gitilesapi.OAuthScope}}).Client()
	if err != nil {
		return "", fmt.Errorf("could not initialize auth client: %w", err)
	}
	client, err := gitiles.NewClient(host, project, authClient)
	if err != nil {
		return "", fmt.Errorf("could not initialize gitiles client: %w", err)
	}
	return client.LatestCommit(ctx, ref)
}

// resolveGitilesRef returns the ref associated with the build's input.
//
// If the build input has a GitilesCommit, return GitilesCommit.Ref.
//
// If the build input only has a GerritChange, query change info from Gerrit and
// return the ref.
// Note that this is the ref that the change targets i.e. refs/heads/*, not the
// magic change ref, e.g. refs/changes/*.
//
// If the build input has neither, return the FallbackRef.
func resolveGitilesRef(ctx context.Context, buildInput *buildbucketpb.Build_Input, FallbackRef string) (string, error) {
	if buildInput.GitilesCommit != nil {
		return buildInput.GitilesCommit.Ref, nil
	}
	if len(buildInput.GerritChanges) > 0 {
		authClient, err := auth.NewAuthenticator(ctx, auth.SilentLogin, auth.Options{Scopes: []string{gerritapi.OAuthScope}}).Client()
		if err != nil {
			return "", fmt.Errorf("could not initialize auth client: %w", err)
		}
		client, err := gerrit.NewClient(buildInput.GerritChanges[0].Host, buildInput.GerritChanges[0].Project, authClient)
		if err != nil {
			return "", fmt.Errorf("failed to initialize gerrit client: %w", err)
		}
		resp, err := client.GetChange(ctx, buildInput.GerritChanges[0].Change)
		if err != nil {
			return "", err
		}
		return resp.Ref, nil
	}
	return FallbackRef, nil
}

// EnsureGitilesCommit ensures that the incoming build always has an
// Input.GitilesCommit. This ensures that this build and any child builds
// always use a consistent HEAD.
//
// The host and project for the GitilesCommit are determined by the
// `ResolveRepo` strategy, with the fallback remote being either the default
// integration remote set in this file, or the override set by the
// `recipe_integration_remote` property.
func EnsureGitilesCommit(ctx context.Context, build *buildbucketpb.Build) error {
	if build.Input.GitilesCommit != nil {
		return nil
	}
	fallbackRemote, err := props.String(build, "recipe_integration_remote")
	if err != nil {
		return err
	}
	if fallbackRemote == "" {
		fallbackRemote = defaultIntegrationRemote
	}
	host, project, err := rbc.ResolveRepo(build.Input, fallbackRemote)
	if err != nil {
		return fmt.Errorf("failed to resolve host and project: %w", err)
	}
	ref, err := resolveGitilesRef(ctx, build.Input, FallbackRef)
	if err != nil {
		return fmt.Errorf("failed to resolve gitiles ref: %w", err)
	}
	revision, err := resolveRef(ctx, host, project, ref)
	if err != nil {
		return fmt.Errorf("failed to resolve %s HEAD: %w", ref, err)
	}
	build.Input.GitilesCommit = &buildbucketpb.GitilesCommit{
		Host:    host,
		Project: project,
		Id:      revision,
		Ref:     ref,
	}
	return nil
}

// CheckoutIntegration checks out the integration.git repo and returns the path
// to the directory containing the checkout.
func CheckoutIntegration(ctx context.Context, build *buildbucketpb.Build) (string, error) {
	// Do a checkout in a temporary directory to avoid checkout conflicts with
	// the recipe's working directory.
	cwd, err := os.Getwd()
	if err != nil {
		return "", err
	}
	integrationDir, err := os.MkdirTemp(cwd, "integration-checkout")
	if err != nil {
		return integrationDir, err
	}
	integrationURL, integrationBaseRevision, err := resolveIntegration(ctx, build)
	if err != nil {
		return integrationDir, err
	}
	if err := props.SetBuildInputProperty(build, "integration_base_revision", integrationBaseRevision); err != nil {
		return integrationDir, err
	}
	tctx, cancel := context.WithTimeout(ctx, rbc.DefaultCheckoutTimeout)
	defer cancel()
	if err := checkout.Checkout(tctx, build.Input, *integrationURL, integrationBaseRevision, integrationDir); err != nil {
		return integrationDir, fmt.Errorf("failed to checkout integration repo: %w", err)
	}
	return integrationDir, nil
}

// resolveIntegration resolves the integration URL and revision to checkout.
//
// If the `recipes_host_override` property is specified, then override the
// integration host.
//
// If the `recipes_integration_project_override` property is specified, then
// override the integration project.
//
// If the `integration_base_revision` property is set, use this revision.
func resolveIntegration(ctx context.Context, build *buildbucketpb.Build) (*url.URL, string, error) {
	recipesHostOverride, err := props.String(build, "recipes_host_override")
	if err != nil {
		return nil, "", err
	}
	recipesIntegrationProjectOverride, err := props.String(build, "recipes_integration_project_override")
	if err != nil {
		return nil, "", err
	}
	integrationURL, err := rbc.ResolveIntegrationURL(build.Input, recipesHostOverride, recipesIntegrationProjectOverride)
	if err != nil {
		return nil, "", err
	}

	baseRevisionProperty, err := props.String(build, "integration_base_revision")
	if err != nil {
		return nil, "", err
	}
	if baseRevisionProperty != "" {
		// If `integration_base_revision` is set then we're probably running as
		// a subbuild and `integration_base_revision` is the revision resolved
		// by the parent build, so we should use the same revision.
		return integrationURL, baseRevisionProperty, nil
	}

	commit := build.Input.GitilesCommit
	if integrationURL.Host == commit.Host && integrationURL.Path == commit.Project {
		// Either the build was triggered on an integration change and we
		// already resolved a base revision with `ensureGitilesCommit`, or the
		// build was triggered by a specific integration commit.  In either case
		// we want to use that resolved revision to ensure we check out the same
		// version of integration as the recipe.
		return integrationURL, commit.Id, nil
	}

	// Otherwise we haven't yet resolved an integration base revision, so we
	// need to choose the correct integration ref to resolve and then resolve
	// that ref to a revision.
	ref, err := chooseRef(build)
	if err != nil {
		return nil, "", err
	}

	revision, err := resolveRef(ctx, integrationURL.Host, integrationURL.Path, ref)
	if err != nil {
		return nil, "", fmt.Errorf("failed to resolve integration HEAD: %w", err)
	}

	return integrationURL, revision, nil
}

func chooseRef(build *buildbucketpb.Build) (string, error) {
	overrideRef, err := props.String(build, "recipes_integration_ref_override")
	if err != nil {
		return "", err
	}
	var ref string
	if overrideRef != "" {
		ref = overrideRef
	} else if build.Input.GitilesCommit.Ref != "" {
		// This assumes that for every ref `refs/heads/foo` of every repository
		// pinned in integration that we care about submitting changes to, there
		// exists a corresponding ref `refs/heads/foo` in the integration
		// repository.
		ref = build.Input.GitilesCommit.Ref
	} else {
		ref = FallbackRef
	}

	refMapping := &structpb.Struct{}
	if err := props.Proto(build, "recipes_integration_ref_mapping", refMapping); err != nil {
		return "", err
	}

	if rawMappedRef, ok := refMapping.AsMap()[ref]; ok {
		if mappedRef, ok := rawMappedRef.(string); ok {
			ref = mappedRef
		} else {
			return "", fmt.Errorf(
				"invalid type for recipes_integration_ref_mapping value: %+v",
				rawMappedRef)
		}
	}

	return ref, nil
}