def create_approval(project_config_file, env):
env = create_approval_environment_variables(env)
with open(project_config_file) as json_data_file:
project_data = load_project_configuration(json_data_file)
if env["artifact_sha256"] is None:
src_commit = commit_for_commitish(repo_at(env["repo_path"]),
env["target_src_commit"])
response = get_artifacts_for_commit(env["host"], env["api_token"],
project_data, src_commit)
env["artifact_sha256"] = latest_artifact_for_commit(response)
print(
f"Found artifact {env['artifact_sha256']} as latest artifact for source commit {env['target_src_commit']}"
)
commit_list = list_commits_between(
repo_at(env["repo_path"]),
target_commit=env["target_src_commit"],
base_commit=env["base_src_commit"])
approval_json = build_approval_json(
artifact_sha256=env["artifact_sha256"],
description=env["description"],
is_approved=env["is_externally_approved"],
src_commit_list=commit_list)
url = ApiSchema.url_for_approvals(env["host"], project_data)
http_post_payload(url, approval_json, env["api_token"])
def create_deployment(project_file):
# Todo: make this smoother
set_artifact_sha_env_variable_from_file_or_image()
payload = create_deployment_payload()
with open(project_file) as json_data_file:
project_data = load_project_configuration(json_data_file)
url = ApiSchema.url_for_deployments(get_host(), project_data)
http_post_payload(url, payload, get_api_token())
def __call__(self):
url = ApiSchema.url_for_artifact_approvals(self.host.value,
self.merkelypipe,
self.fingerprint.sha)
approvals = http_get_json(url, self.api_token.value)
is_approved = control_deployment_approved(approvals)
if not is_approved:
raise ChangeError(
f"Artifact with sha {self.fingerprint.sha} is not approved.")
return 'Getting', url, approvals
def __call__(self):
payload = {
"artifact_sha256": self.fingerprint.sha,
"build_url": self.ci_build_url.value,
"description": self.description.value,
"environment": self.environment.value,
"user_data": self.user_data.value
}
url = ApiSchema.url_for_deployments(self.host.value, self.merkelypipe)
http_post_payload(url, payload, self.api_token.value)
return 'Posting', url, payload
def put_pipeline(project_file, env=os.environ):
print("Ensure Project - loading " + project_file)
with open(project_file) as json_data_file:
project_data = load_project_configuration(json_data_file)
host = env.get('CDB_HOST', CDB_SERVER)
projects_url = ApiSchema.url_for_owner_projects(host, project_data)
api_token = env.get('CDB_API_TOKEN', 'NO_API_TOKEN_DEFINED')
print("Put pipeline")
create_response = http_put_payload(url=projects_url,
payload=project_data,
api_token=api_token)
def __call__(self):
self._print_compliance()
payload = {
"sha256": self.fingerprint.sha,
"filename": self.fingerprint.artifact_basename,
"description": f"Created by build {self.ci_build_number.value}",
"git_commit": self.artifact_git_commit.value,
"commit_url": self.artifact_git_url.value,
"build_url": self.ci_build_url.value,
"is_compliant": self.is_compliant.value == 'TRUE',
"user_data": self.user_data.value
}
url = ApiSchema.url_for_artifacts(self.host.value, self.merkelypipe)
http_put_payload(url, payload, self.api_token.value)
return 'Putting', url, payload
def __call__(self):
self._print_compliance()
payload = {
"evidence_type": self.evidence_type.value,
"user_data": self.user_data.value,
"contents": {
"is_compliant": self.is_compliant.value == "TRUE",
"url": self.ci_build_url.value,
"description": self.description.value
}
}
url = ApiSchema.url_for_artifact(self.host.value, self.merkelypipe,
self.fingerprint.sha)
http_put_payload(url, payload, self.api_token.value)
return 'Putting', url, payload
def create_artifact(api_token, host, project_config_file,
sha256, filename, description, git_commit, commit_url, build_url,
is_compliant):
project_data = load_project_configuration(project_config_file)
create_artifact_payload = {
"sha256": sha256,
"filename": filename,
"description": description,
"git_commit": git_commit,
"commit_url": commit_url,
"build_url": build_url,
"is_compliant": is_compliant
}
url = ApiSchema.url_for_artifacts(host, project_data)
http_put_payload(url, create_artifact_payload, api_token)
def __call__(self):
is_compliant, pull_requests = get_pull_request_for_current_commit(self.env)
payload = {
"evidence_type": self.evidence_type.value,
"contents": {
"is_compliant": is_compliant,
"description": self.description.value,
"url": self.ci_build_url.value,
"source": pull_requests,
}
}
url = ApiSchema.url_for_artifact(self.host.value, self.merkelypipe, self.fingerprint.sha)
http_put_payload(url, payload, self.api_token.value)
if not is_compliant:
raise ChangeError(f"Artifact with sha {self.fingerprint.sha} is not compliant")
return 'Putting', url, payload
def __call__(self):
junit_results_dir = self.test_results_dir.value
is_compliant, message = is_compliant_tests_directory(junit_results_dir)
description = "JUnit results xml verified by merkely/change: " + message
payload = {
"evidence_type": self.evidence_type.value,
"user_data": self.user_data.value,
"contents": {
"is_compliant": is_compliant,
"url": self.ci_build_url.value,
"description": description
}
}
url = ApiSchema.url_for_artifact(self.host.value, self.merkelypipe,
self.fingerprint.sha)
http_put_payload(url, payload, self.api_token.value)
return 'Putting', url, payload
def control_latest_release():
host = get_host()
api_token = get_api_token()
artifact_sha = get_artifact_sha()
project_config_file = parse_cmd_line()
with open(project_config_file) as json_data_file:
project_data = load_project_configuration(json_data_file)
url = ApiSchema.url_for_release(host, project_data, "latest")
release = http_get_json(url, api_token)
if release["target_artifact"] != artifact_sha:
print(f"INCOMPLIANT: latest release {release['release_number']}")
print(f" released sha: {release['target_artifact']} ")
print(f" expected sha: {artifact_sha} ")
sys.exit(1)
else:
print(f"COMPLIANT: latest release {release['release_number']}")
print(f" released sha: {release['target_artifact']} ")
print(f" expected sha: {artifact_sha} ")
def create_release(project_config_file):
env = create_release_environment_variables()
with open(project_config_file) as json_data_file:
project_data = load_project_configuration(json_data_file)
if env["artifact_sha"] is None:
src_commit = commit_for_commitish(repo_at(env["repo_path"]),
env["target_src_commit"])
response = get_artifacts_for_commit(env["host"], env["api_token"],
project_data, src_commit)
env["artifact_sha"] = latest_artifact_for_commit(response)
print(
f"Found artifact {env['artifact_sha']} as latest artifact for source commit {env['target_src_commit']}"
)
commit_list = list_commits_between(repo_at(env["repo_path"]),
env["target_src_commit"],
env["base_src_commit"])
release_json = build_release_json(env["artifact_sha"],
env["description"], commit_list)
url = ApiSchema.url_for_releases(env["host"], project_data)
http_post_payload(url, release_json, env["api_token"])
def __call__(self):
commit_list = list_commits_between(repo_at(self.src_repo_root.value),
self.newest_src_commitish.value,
self.oldest_src_commitish.value)
payload = {
"artifact_sha256":
self.fingerprint.sha,
"description":
self.description.value,
"src_commit_list":
commit_list,
"user_data":
self.user_data.value,
"approvals": [{
"state": self.approval_state(),
"comment": self.description.value,
"approved_by": "External",
"approval_url": "undefined"
}]
}
url = ApiSchema.url_for_approvals(self.host.value, self.merkelypipe)
http_post_payload(url, payload, self.api_token.value)
return 'Posting', url, payload
def add_evidence(api_token, host, project_file_contents, sha256_digest,
evidence):
project_data = load_project_configuration(project_file_contents)
url = ApiSchema.url_for_artifact(host, project_data, sha256_digest)
http_put_payload(url, evidence, api_token)
def test_url_for_release():
partial_project_data = {"name": "hadroncollider", "owner": "cern"}
url = ApiSchema.url_for_release(host="http://localhost",
project_data=partial_project_data,
release_number="12")
assert url == "http://localhost/api/v1/projects/cern/hadroncollider/releases/12"
def test_url_for_approvals():
partial_project_data = {"name": "hadroncollider", "owner": "cern"}
url = ApiSchema.url_for_approvals(host="http://localhost",
project_data=partial_project_data)
assert url == "http://localhost/api/v1/projects/cern/hadroncollider/approvals/"
def __call__(self):
url = ApiSchema.url_for_pipelines(self.host.value, self.merkelypipe)
payload = self.merkelypipe
http_put_payload(url, payload, self.api_token.value)
return 'Putting', url, payload
def get_artifacts_for_commit(host, api_token, project_config_file, commit):
url = ApiSchema.url_for_commit(host, project_config_file, commit)
artifact_list = http_get_json(url, api_token)
return artifact_list
def test_url_for_commit():
partial_project_data = {"name": "hadroncollider", "owner": "cern"}
url = ApiSchema.url_for_commit(host="http://localhost",
project_data=partial_project_data,
commit="12345678")
assert url == "http://localhost/api/v1/projects/cern/hadroncollider/commits/12345678"