master.cfg

# -*- python -*-
# ex: set filetype=python:

# Copyright 2019 RStudio, Inc.
# All rights reserved.
#
# Use of this source code is governed by a BSD 2-Clause
# license that can be found in the LICENSE_BSD file.

import os
from pathlib import Path

import toolz
from dotenv import load_dotenv
from buildbot.plugins import util
from ursabot.auth import GithubAuth, Authz
from ursabot.hooks import UrsabotHook
from ursabot.secrets import SecretInPass
from ursabot.configs import ProjectConfig, MasterConfig
from ursabot.workers import load_workers_from


load_dotenv()

cwd = projects = Path(__file__).parent.absolute()

workers = load_workers_from(
    cwd / 'workers.yaml',
    auto_pull=True,
    always_pull=True
)

############################# LOAD PROJECTS ###################################

ursabot = ProjectConfig.load_from(
    cwd / 'projects' / 'ursabot' / 'master.cfg',
    variable='ursabot',
    inject_globals=dict(
        workers=workers,
        with_pollers=False,
        with_reporters=True
    )
)

arrow = ProjectConfig.load_from(
    cwd / 'projects' / 'arrow' / 'master.cfg',
    variable='arrow',
    inject_globals=dict(
        workers=workers,
        with_pollers=False,
        with_reporters=True
    )
)

############################# AUTHENTICATION ##################################

auth = GithubAuth(
    clientId=util.Secret('ursabot/github_client_id'),
    clientSecret=util.Secret('ursabot/github_client_secret'),
    apiVersion=4,
    getTeamsMembership=True
)

authz = Authz(
    # 'admin' organization is unavalable on github so it is used to grant
    # access for specific users outside of allowed organizations
    allowRules=[
        util.AnyControlEndpointMatcher(role='ursa-labs'),
        util.AnyControlEndpointMatcher(role='apache'),
        util.AnyControlEndpointMatcher(role='admin')
    ],
    roleMatchers=[
        # github organization names becomes the roles assigned to the user
        util.RolesFromGroups(),
        # explicitly assign admin role to specific users
        util.RolesFromUsername(
            roles=['admin'],
            usernames=['xhochy', 'kou']
        )
    ]
)

secret_providers = [
    SecretInPass(dirname=Path('~/.ursalabs-pass').expanduser())
]

############################## CHANGE HOOK ####################################
# Accept HTTP requests and translate them into changes for buildbot. We use a
# specialized hook which also processes the pull request comments.


class ChangeHook(UrsabotHook):
    # currently there is only a single command, in the future we'll need a
    # combiner which turns multiple callbacks into a single one
    comment_handler = toolz.first(arrow.commands)


change_hook = ChangeHook(
    secret=util.Secret('ursabot/github_hook_secret'),
    tokens=[util.Secret('ursabot/github_token')],
    debug=False,
    strict=True,
    verify=True
)


############################# BUILDMASTER CONFIG ##############################
# MasterConfig is the object that the ursabot pays attention to.
# - `ursabot checkconfig` loads and validates it without actually
#   running the services
# - `ursabot start|stop|restart` also loads this dictionary, indirectly
#   through buildbot.tac

# secret interpolation is not yet available for setting database_url, so
# we read from the environment (can be defined with .env as well)
database_url = os.getenv('DATABASE_URL', default='sqlite:///ursabot.sqlite')

master = MasterConfig(
    # The 'title' string will appear at the top of this buildbot installation's
    # home pages (linked to the 'titleURL').
    title='Ursabot',
    # The 'buildbotURL' string should point to the location where the
    # buildbot's internal web server is visible. This typically uses the port
    # number set in the 'webui_port' entry below, but with an
    # externally-visible host name which the buildbot cannot figure out without
    # some help.
    url='https://ci.ursalabs.org/',
    webui_port=8010,
    worker_port=9989,
    auth=auth,
    authz=authz,
    change_hook=change_hook,
    secret_providers=secret_providers,
    database_url=database_url,
    projects=[
        arrow,
        ursabot
    ]
)