- job:
    name: tf-a-unsafe-tfa-next
    node: docker-amd64-tf-a-jammy
    project-type: freestyle
    concurrent: true
    disabled: false
    defaults: global
    description: Check for Unsafe changes in Trusted Firmware Next
    properties:
        - build-discarder:
            days-to-keep: 14
    triggers:
    - gerrit:
        server-name: 'review.trustedfirmware.org'
        projects:
        - branches:
          - branch-compare-type: PLAIN
            branch-pattern: 'main'
          project-compare-type: PLAIN
          project-pattern: 'RF-A/rusted-firmware-a'
        trigger-on:
            - patchset-created-event:
                exclude-drafts: true
                exclude-trivial-rebase: false
                exclude-no-code-change: true
                exclude-private: true
                exclude-wip: true
            - comment-added-contains-event:
                comment-contains-value: '^RUN_UNSAFE_CI$'
        override-votes: true
        # without explicitly setting these values to 0, the plugin will by
        # default leave Code Review votes
        gerrit-build-started-codereview-value: 0
        gerrit-build-successful-codereview-value: 0
        gerrit-build-failed-codereview-value: 0
        gerrit-build-unstable-codereview-value: 0
        gerrit-build-notbuilt-codereview-value: 0
        silent: false
        silent-start: false
    parameters:
        # GERRIT_{PROJECT,BRANCH,REFSPEC} are set when triggered by a Gerrit
        # patchset - defaults below are for manual triggers
        - string:
            name: GERRIT_PROJECT
            default: 'RF-A/rusted-firmware-a'
        - string:
            name: GERRIT_BRANCH
            default: 'refs/heads/main'
        - string:
            name: GERRIT_REFSPEC
            default: '+refs/heads/main:refs/remotes/origin/main'
            description: |
              'e.g. refs/changes/13/31138/1'
        - string:
            name: RF_GERRIT_REFSPEC
            default: ${GERRIT_REFSPEC}
            description: |
              'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
        - string:
            name: CI_REFSPEC
            default: '+refs/heads/tfa-next:refs/remotes/origin/tfa-next'
            description: |
              'Refs to fetch for the tf-a-ci-scripts repo e.g. refs/changes/13/31138/1'
        - string:
            name: JOBS_REFSPEC
            default: 'refs/heads/master'
            description: |
              tf-a-job-configs refspec to use. The master branch is used by default.
        - string:
            name: SHARE_FOLDER
            default: '/srv/shared/${JOB_NAME}/${BUILD_NUMBER}'
            description: 'Folder containing shared repositories for downstream pipeline jobs'
        - string:
            name: CLONE_REPOS
            default: "rusted-firmware-a"
            description: |
              Optional arg to clone only specific projects from default list (tf-a-ci-scripts,rusted-firmware-a,tf-a-tests,spm,tf-m-tests,tf-m-extras)
        - string:
            name: FETCH_SSH
            default: 1
            description: |
              Fetch branches with authenticated SSH instead of anonymous HTTPS
    wrappers:
        - credentials-binding:
            - ssh-user-private-key:
                credential-id: TFA_CI_BOT_USER_SSH_KEY
                key-file-variable: CI_BOT_KEY
                username-variable: CI_BOT_USERNAME
                passphrase-variable: ''
        - timestamps
        - timeout:
            timeout: 240
            fail: true
    builders:
    - shell:
        !include-raw: scripts/clone.sh
    - shell: |
        #!/bin/bash
        set -ex
        cat << EOF > tf-a-env.param
        RF_GERRIT_PROJECT=${GERRIT_PROJECT}
        RF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
        SHARE_FOLDER=${SHARE_FOLDER}
        EOF

        cd ${WORKSPACE}/rusted-firmware-a

        # Vote Unsafe-Review+1 on patches not touching any unsafe code

        # 1. Check if the patch touches unsafe code:

        # if the grep command finds nothing, it will exit 1 and because we have set -e the program
        # will fail. Doing || true makes it so that the final exit command is always 0 so the flow is not
        # interrupted and we can check `diff` to know if the program was successful or not.
        diff=$(echo $(git show -U10 --format=) | grep "unsafe" || true)
        if [ "$diff" != "" ]; then
            exit 1
        fi

        # 2. Cast the Unsafe-Review +1 vote if the patch does NOT touch unsafe code:

        SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${CI_BOT_KEY}"
        GERRIT_URL="review.trustedfirmware.org"
        SET_SAFE_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit review --label Unsafe-Review=1 -m Safe"
        ssh ${SET_SAFE_CMD} ${GERRIT_CHANGE_NUMBER},${GERRIT_PATCHSET_NUMBER}