blob: 808110076e62c2b4680193d843ebde09944f15a8 [file] [log] [blame]
// Copyright 2024 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package task
import (
"bytes"
"errors"
"fmt"
"net/mail"
"regexp"
"slices"
"text/template"
"time"
"golang.org/x/build/gerrit"
wf "golang.org/x/build/internal/workflow"
)
type PrivXPatch struct {
PublicGerrit GerritClient
PrivateGerrit GerritClient
// PublicRepoURL returns a git clone URL for repo
PublicRepoURL func(repo string) string
ApproveAction func(*wf.TaskContext) error
SendMail func(MailHeader, MailContent) error
AnnounceMailHeader MailHeader
}
func (x *PrivXPatch) NewDefinition(tagx *TagXReposTasks) *wf.Definition {
wd := wf.New()
// TODO: this should be simpler, CL number + patchset?
clNumber := wf.Param(wd, wf.ParamDef[string]{Name: "go-internal CL number", Example: "536316"})
reviewers := wf.Param(wd, reviewersParam)
repoName := wf.Param(wd, wf.ParamDef[string]{Name: "Repository name", Example: "net"})
// TODO: probably always want to skip, might make sense to not include this
skipPostSubmit := wf.Param(wd, wf.ParamDef[bool]{Name: "Skip post submit result (optional)", ParamType: wf.Bool})
cve := wf.Param(wd, wf.ParamDef[string]{Name: "CVE"})
githubIssue := wf.Param(wd, wf.ParamDef[string]{Name: "GitHub issue", Doc: "The GitHub issue number of the report.", Example: "#12345"})
relNote := wf.Param(wd, wf.ParamDef[string]{Name: "Release note", ParamType: wf.LongString})
acknowledgement := wf.Param(wd, wf.ParamDef[string]{Name: "Acknowledgement"})
repos := wf.Task0(wd, "Load all repositories", tagx.SelectRepos)
repos = wf.Task4(wd, "Publish change", func(ctx *wf.TaskContext, clNumber string, reviewers []string, repos []TagRepo, repoName string) ([]TagRepo, error) {
if !slices.ContainsFunc(repos, func(r TagRepo) bool { return r.Name == repoName }) {
return nil, fmt.Errorf("no repository %q", repoName)
}
changeInfo, err := x.PrivateGerrit.GetChange(ctx, clNumber, gerrit.QueryChangesOpt{Fields: []string{"CURRENT_REVISION"}})
if err != nil {
return nil, err
}
if changeInfo.Project != repoName {
return nil, fmt.Errorf("CL is for unexpected project, got: %s, want %s", changeInfo.Project, repoName)
}
if changeInfo.Status != gerrit.ChangeStatusMerged {
return nil, fmt.Errorf("CL %s not merged, status is %s", clNumber, changeInfo.Status)
}
rev, ok := changeInfo.Revisions[changeInfo.CurrentRevision]
if !ok {
return nil, errors.New("current revision not found")
}
fetch, ok := rev.Fetch["http"]
if !ok {
return nil, errors.New("fetch info not found")
}
origin, ref := fetch.URL, fetch.Ref
// We directly use Git here, rather than the Gerrit API, as there are
// limitations to the types of patches which you can create using said
// API. In particular patches which contain any binary content are hard
// to replicate from one instance to another using the API alone. Rather
// than adding workarounds for those edge cases, we just use Git
// directly, which makes the process extremely simple.
git := &Git{}
repo, err := git.Clone(ctx, x.PublicRepoURL(repoName))
if err != nil {
return nil, err
}
ctx.Printf("cloned repo into %s", repo.dir)
ctx.Printf("fetching %s from %s", ref, origin)
if _, err := repo.RunCommand(ctx.Context, "fetch", origin, ref); err != nil {
return nil, err
}
ctx.Printf("fetched")
if _, err := repo.RunCommand(ctx.Context, "cherry-pick", "FETCH_HEAD"); err != nil {
return nil, err
}
ctx.Printf("cherry-picked")
refspec := "HEAD:refs/for/master%l=Auto-Submit,l=Commit-Queue+1"
for _, reviewer := range reviewers {
refspec += ",r=" + reviewer
}
// Beyond this point we don't want to retry any of the following steps.
ctx.DisableRetries()
ctx.Printf("pusing to %s", x.PublicRepoURL(repoName))
// We are unable to use repo.RunCommand here, because of strange i/o
// changes that git made. The messages sent by the remote are printed by
// git to stderr, and no matter what combination of options you pass it
// (--verbose, --porcelain, etc), you cannot reasonably convince it to
// print those messages to stdout. Because of this we need to use the
// underlying repo.git.runGitStreamed method, so that we can inspect
// stderr in order to extract the new CL number that gerrit sends us.
var stdout, stderr bytes.Buffer
err = repo.git.runGitStreamed(ctx.Context, &stdout, &stderr, repo.dir, "push", x.PublicRepoURL(repoName), refspec)
if err != nil {
return nil, err
}
// Extract the CL number from the output using a quick and dirty regex.
re, err := regexp.Compile(fmt.Sprintf(`https:\/\/go-review.googlesource.com\/c\/%s\/\+\/(\d+)`, regexp.QuoteMeta(repoName)))
if err != nil {
return nil, err
}
matches := re.FindSubmatch(stderr.Bytes())
if len(matches) != 2 {
return nil, errors.New("unable to find CL number")
}
changeID := string(matches[1])
ctx.Printf("Awaiting review/submit of %v", changeID)
_, err = AwaitCondition(ctx, 10*time.Second, func() (string, bool, error) {
return x.PublicGerrit.Submitted(ctx, changeID, "")
})
if err != nil {
return nil, err
}
return repos, nil
}, clNumber, reviewers, repos, repoName)
tagged := wf.Expand4(wd, "Create single-repo plan", tagx.BuildSingleRepoPlan, repos, repoName, skipPostSubmit, reviewers)
okayToAnnoucne := wf.Action0(wd, "Wait to Announce", x.ApproveAction, wf.After(tagged))
wf.Task5(wd, "Mail announcement", func(ctx *wf.TaskContext, tagged TagRepo, cve string, githubIssue string, relNote string, acknowledgement string) (string, error) {
var buf bytes.Buffer
if err := privXPatchAnnouncementTmpl.Execute(&buf, map[string]string{
"Module": tagged.ModPath,
"Version": tagged.NewerVersion,
"RelNote": relNote,
"Acknowledgement": acknowledgement,
"CVE": cve,
"GithubIssue": githubIssue,
}); err != nil {
return "", err
}
m, err := mail.ReadMessage(&buf)
if err != nil {
return "", err
}
html, text, err := renderMarkdown(m.Body)
if err != nil {
return "", err
}
mc := MailContent{m.Header.Get("Subject"), html, text}
ctx.Printf("announcement subject: %s\n\n", mc.Subject)
ctx.Printf("announcement body HTML:\n%s\n", mc.BodyHTML)
ctx.Printf("announcement body text:\n%s", mc.BodyText)
ctx.DisableRetries()
err = x.SendMail(x.AnnounceMailHeader, mc)
if err != nil {
return "", err
}
return "", nil
}, tagged, cve, githubIssue, relNote, acknowledgement, wf.After(okayToAnnoucne))
wf.Output(wd, "done", tagged)
return wd
}
var privXPatchAnnouncementTmpl = template.Must(template.New("").Parse(`Subject: [security] Vulnerability in {{.Module}}
Hello gophers,
We have tagged version {{.Version}} of {{.Module}} in order to address a security issue.
{{.RelNote}}
Thanks to {{.Acknowledgement}} for reporting this issue.
This is {{.CVE}} and Go issue {{.GithubIssue}}.
Cheers,
Go Security team`))