tf-a-lts-verified-propagater.yaml

- job:
    name: tf-a-lts-verified-propagater
    node: docker-amd64-tf-a-jammy
    project-type: freestyle
    concurrent: false
    description: Triggers whenever a patch in the lts branch get a Verified score. It will vote the same score to the dependent patch
    disabled: false
    builders:
      - shell: ""
      - shell: |-
          #!/bin/bash
          # This job is triggered by the label Verified +1 or -1 of the patch
          # it will vote the same score (Verified +1 / Verified -1) to the dependent patch
          # , if there is any.
          # For example, P5 -> P4 -> P3 -> P2 -> P1. P5 dependents on P4, and so on
          # When P5 gets Verified +1, this job will be triggered and set Verified +1 to P4.
          # P4 gets Verified +1 triggers an other job to set Verified +1 to P3, and so on.
          # That is how we propagate the Verified score to the entire patch stack
          set -ex

          echo "########################################################################"
          echo "    Gerrit Environment"
          env |grep '^GERRIT'
          echo "########################################################################"

          SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${CI_BOT_KEY}"
          GERRIT_URL="review.trustedfirmware.org"
          GERRIT_QUERY_PARAMS="--dependencies --submit-records --format=JSON change:"
          QUERY_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit query ${GERRIT_QUERY_PARAMS}"
          QUERY_CHANGE_DEPENDS_CMD="${QUERY_CMD}${GERRIT_CHANGE_NUMBER}"
          REVIEW_MESSAGE="Propagated verified from ${GERRIT_CHANGE_URL}. By ${BUILD_URL}"
          SET_VERIFIED_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit review --verified"

          change_url_base=${GERRIT_CHANGE_URL%/*}
          # Check this example https://ci.trustedfirmware.org/view/TF-A/job/tf-a-lts-verified-propagater/14/console
          # for what we get from gerrit query command
          patch_query=$(ssh ${QUERY_CHANGE_DEPENDS_CMD} | jq .)
          dependsOn=$(echo ${patch_query} | jq -r 'select(.dependsOn)')
          # Normally, there would be just one dependent patch
          # (and that patch would in turn has another dependent patch, that's how a dependency chain is structured)
          # But Gerrit data model has a list of dependent patches, so we process all just in case
          dependsOn_rev=($(echo ${dependsOn} | jq -r '.dependsOn[].revision'))
          dependsOn_no=($(echo ${dependsOn} | jq -r '.dependsOn[].number'))
          verified_status=$(echo ${patch_query} | jq -r 'select(.submitRecords) | .submitRecords[0].labels[] | select(.label == "Verified") | .status')
          # Verified label status and value mapping
          # REJECT: -1
          # OK: 1
          verified_value=0
          if [ "${verified_status}" == "REJECT" ]; then
              verified_value=-1
          elif [ "${verified_status}" == "OK" ]; then
              verified_value=1
          fi
          # Vote the same Verified score to the dependent patch by loop
          for ((i=0; i<${#dependsOn_rev[@]}; i++))
          do
              # Need to check the .status before set verified score
              if [ $(ssh ${QUERY_CMD}${dependsOn_no[$i]} | jq -r 'select(.status)|.status') == "MERGED" ]; then
              	echo "The dependent patch ${change_url_base}${dependsOn_no[$i]} has been merged. Don't set Verified score to it!"
                  continue
              else
              	echo "Set Verified ${verified_value} to: ${change_url_base}/${dependsOn_no[$i]}"
              	ssh ${SET_VERIFIED_CMD} ${verified_value}  -m \'\"${REVIEW_MESSAGE}\"\' ${dependsOn_rev[$i]}
              fi
          done
    properties:
      - build-discarder:
          days-to-keep: 60
          num-to-keep: 10
    triggers:
      - gerrit:
          silent: true
          server-name: review.trustedfirmware.org
          projects:
            - branches:
                - branch-compare-type: REG_EXP
                  branch-pattern: lts-v.*
              project-compare-type: PLAIN
              project-pattern: TF-A/trusted-firmware-a
          trigger-on:
            - comment-added-event:
                approval-category: Verified
                approval-value: 1
            - comment-added-event:
                approval-category: Verified
                approval-value: -1
    wrappers:
      - timestamps
      - credentials-binding:
          - ssh-user-private-key:
              credential-id: TFA_CI_BOT_USER_SSH_KEY
              key-file-variable: CI_BOT_KEY
              username-variable: CI_BOT_USERNAME
              passphrase-variable: ""
    publishers:
      - workspace-cleanup