From d6bc59df584cff4e38d3df23283dfc6443221b6c Mon Sep 17 00:00:00 2001 From: Martin Pugh Date: Tue, 16 Mar 2021 18:09:24 +0100 Subject: [PATCH] [CI] Require D*-audit labels for any runtime changes (#8345) * add check for audit labels if runtime change * fix shellcheck nits * include lib.sh in check_runtime.sh * fix check_labels.sh * fix check_labels.sh * oops, this is github actions... * why wont this work * fetch all refs * Update check-labels.yml * print env - wtf is happening * checkout the PR... * ffs * fix * REVERT ME: test runtime check * Revert "REVERT ME: test runtime check" This reverts commit 0fd2b04abeeac12dd8ede4c0708cb796f9e3e722. --- substrate/.github/workflows/check-labels.yml | 4 ++++ substrate/.maintain/common/lib.sh | 16 ++++++++++++- substrate/.maintain/github/check_labels.sh | 17 +++++++++++++ substrate/.maintain/gitlab/check_runtime.sh | 25 ++++++++++---------- 4 files changed, 48 insertions(+), 14 deletions(-) diff --git a/substrate/.github/workflows/check-labels.yml b/substrate/.github/workflows/check-labels.yml index ee03075176..062527d311 100644 --- a/substrate/.github/workflows/check-labels.yml +++ b/substrate/.github/workflows/check-labels.yml @@ -9,8 +9,12 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + with: + fetch-depth: 0 + ref: ${{ github.event.pull_request.head.ref }} - name: Check labels run: bash ${{ github.workspace }}/.maintain/github/check_labels.sh env: GITHUB_PR: ${{ github.event.pull_request.number }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} diff --git a/substrate/.maintain/common/lib.sh b/substrate/.maintain/common/lib.sh index 1d4be0ecc7..ce6c566d79 100755 --- a/substrate/.maintain/common/lib.sh +++ b/substrate/.maintain/common/lib.sh @@ -82,7 +82,7 @@ has_label(){ # Formats a message into a JSON string for posting to Matrix # message: 'any plaintext message' -# formatted_message: 'optional message formatted in html' +# formatted_message: 'optional message formatted in html' # Usage: structure_message $content $formatted_content (optional) structure_message() { if [ -z "$2" ]; then @@ -101,3 +101,17 @@ structure_message() { send_message() { curl -XPOST -d "$1" "https://matrix.parity.io/_matrix/client/r0/rooms/$2/send/m.room.message?access_token=$3" } + +# Check for runtime changes between two commits. This is defined as any changes +# to bin/node/src/runtime, frame/ and primitives/sr_* trees. +has_runtime_changes() { + from=$1 + to=$2 + if git diff --name-only "${from}...${to}" \ + | grep -q -e '^frame/' -e '^primitives/' + then + return 0 + else + return 1 + fi +} diff --git a/substrate/.maintain/github/check_labels.sh b/substrate/.maintain/github/check_labels.sh index 75190db668..6f280964fe 100755 --- a/substrate/.maintain/github/check_labels.sh +++ b/substrate/.maintain/github/check_labels.sh @@ -1,4 +1,5 @@ #!/usr/bin/env bash +set -e #shellcheck source=../common/lib.sh source "$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )/../common/lib.sh" @@ -30,6 +31,12 @@ criticality_labels=( 'C9-critical' ) +audit_labels=( + 'D1-audited👍' + 'D5-nicetohaveaudit⚠️' + 'D9-needsaudit👮' +) + echo "[+] Checking release notes (B) labels" if ensure_labels "${releasenotes_labels[@]}"; then echo "[+] Release notes label detected. All is well." @@ -46,4 +53,14 @@ else exit 1 fi +if has_runtime_changes origin/master "${HEAD_SHA}"; then + echo "[+] Runtime changes detected. Checking audit (D) labels" + if ensure_labels "${audit_labels[@]}"; then + echo "[+] Release audit label detected. All is well." + else + echo "[!] Release audit label not detected. Please add one of: ${audit_labels[*]}" + exit 1 + fi +fi + exit 0 diff --git a/substrate/.maintain/gitlab/check_runtime.sh b/substrate/.maintain/gitlab/check_runtime.sh index 6d009c5aaf..3b0b1ad107 100755 --- a/substrate/.maintain/gitlab/check_runtime.sh +++ b/substrate/.maintain/gitlab/check_runtime.sh @@ -8,12 +8,13 @@ set -e # fail on any error - +#shellcheck source=../common/lib.sh +. "$(dirname "${0}")/../common/lib.sh" VERSIONS_FILE="bin/node/runtime/src/lib.rs" -boldprint () { printf "|\n| \033[1m${@}\033[0m\n|\n" ; } -boldcat () { printf "|\n"; while read l; do printf "| \033[1m${l}\033[0m\n"; done; printf "|\n" ; } +boldprint () { printf "|\n| \033[1m%s\033[0m\n|\n" "${@}"; } +boldcat () { printf "|\n"; while read -r l; do printf "| \033[1m%s\033[0m\n" "${l}"; done; printf "|\n" ; } github_label () { echo @@ -23,7 +24,7 @@ github_label () { -F "ref=master" \ -F "variables[LABEL]=${1}" \ -F "variables[PRNO]=${CI_COMMIT_REF_NAME}" \ - ${GITLAB_API}/projects/${GITHUB_API_PROJECT}/trigger/pipeline + "${GITLAB_API}/projects/${GITHUB_API_PROJECT}/trigger/pipeline" } @@ -31,16 +32,14 @@ boldprint "latest 10 commits of ${CI_COMMIT_REF_NAME}" git log --graph --oneline --decorate=short -n 10 boldprint "make sure the master branch and release tag are available in shallow clones" -git fetch --depth=${GIT_DEPTH:-100} origin master -git fetch --depth=${GIT_DEPTH:-100} origin release +git fetch --depth="${GIT_DEPTH:-100}" origin master +git fetch --depth="${GIT_DEPTH:-100}" origin release git tag -f release FETCH_HEAD git log -n1 release boldprint "check if the wasm sources changed" -if ! git diff --name-only origin/master...${CI_COMMIT_SHA} \ - | grep -v -e '^primitives/sr-arithmetic/fuzzer' \ - | grep -q -e '^bin/node/src/runtime' -e '^frame/' -e '^primitives/sr-' +if ! has_runtime_changes origin/master "${CI_COMMIT_SHA}" then boldcat <<-EOT @@ -57,9 +56,9 @@ fi # consensus-critical logic that has changed. the runtime wasm blobs must be # rebuilt. -add_spec_version="$(git diff tags/release...${CI_COMMIT_SHA} ${VERSIONS_FILE} \ +add_spec_version="$(git diff "tags/release...${CI_COMMIT_SHA}" "${VERSIONS_FILE}" \ | sed -n -r "s/^\+[[:space:]]+spec_version: +([0-9]+),$/\1/p")" -sub_spec_version="$(git diff tags/release...${CI_COMMIT_SHA} ${VERSIONS_FILE} \ +sub_spec_version="$(git diff "tags/release...${CI_COMMIT_SHA}" "${VERSIONS_FILE}" \ | sed -n -r "s/^\-[[:space:]]+spec_version: +([0-9]+),$/\1/p")" @@ -82,9 +81,9 @@ else # check for impl_version updates: if only the impl versions changed, we assume # there is no consensus-critical logic that has changed. - add_impl_version="$(git diff tags/release...${CI_COMMIT_SHA} ${VERSIONS_FILE} \ + add_impl_version="$(git diff "tags/release...${CI_COMMIT_SHA}" "${VERSIONS_FILE}" \ | sed -n -r 's/^\+[[:space:]]+impl_version: +([0-9]+),$/\1/p')" - sub_impl_version="$(git diff tags/release...${CI_COMMIT_SHA} ${VERSIONS_FILE} \ + sub_impl_version="$(git diff "tags/release...${CI_COMMIT_SHA}" "${VERSIONS_FILE}" \ | sed -n -r 's/^\-[[:space:]]+impl_version: +([0-9]+),$/\1/p')"