Keep tarball and release properties for release

The installer file created by the package role can not be scanned by
JFrog XRAY due to it being an incompatible artifact type. In order for
the artifact to be scanned, it needs to be in one of the supported
formats.

This change updates package role to keep the tarball if the packaging
is run by release job in order to make scanning of artifacts possible.

In addition to keeping the tarball around, release job records release
metadata in release.properties file. This file is needed to be included
in tarball and installer file in order to make the traceability better.

Please note that both of these operations take effect if the release
metadata file /tmp/release.properties exists. This file is only created
by release job on Jenkins and does not exist for manual builds so there
is not change for manual packaging.

Change-Id: I3189806fc7a45b63328dc7236c94119f2ee9e295

diff --git a/playbooks/roles/package/files/build.sh b/playbooks/roles/package/files/build.sh
index c28264decb59146dfe366fda69a79eee4eee4826..fa801b83cbefcfd50deaa750889f37451ff470db 100755 (executable)
--- a/playbooks/roles/package/files/build.sh
+++ b/playbooks/roles/package/files/build.sh
@@ -48,7 +48,13 @@ rm -rf "$OFFLINE_PKG_FOLDER"
 cat /tmp/decompress.sh "$OFFLINE_PKG_FILE" > "$OFFLINE_INSTALLER_FILE"
 chmod +x "$OFFLINE_INSTALLER_FILE"
 
 cat /tmp/decompress.sh "$OFFLINE_PKG_FILE" > "$OFFLINE_INSTALLER_FILE"
 chmod +x "$OFFLINE_INSTALLER_FILE"
 

-# remove intermediate offline pkg file
-rm -rf "$OFFLINE_PKG_FILE"
+# NOTE (fdegir): if the packaging is run by release job, that job stored release
+# metadata in release.properties file. If this file exists, we need to keep tarball
+# as that must be uploaded for further delivery. The reason for this is that the
+# installer can not be scanned by XRAY
+if [[ ! -f "/tmp/release.properties" ]]; then
+  # remove intermediate offline pkg file
+  rm -rf "$OFFLINE_PKG_FILE"
+fi

 
 # vim: set ts=2 sw=2 expandtab:
 
 # vim: set ts=2 sw=2 expandtab:

diff --git a/playbooks/roles/package/tasks/main.yaml b/playbooks/roles/package/tasks/main.yaml
index a1296b1753e2db41b94d42245817de598aaeaa28..8b025b1e2f334fd868dfb2274680afb6e16889f5 100644 (file)
--- a/playbooks/roles/package/tasks/main.yaml
+++ b/playbooks/roles/package/tasks/main.yaml
@@ -75,6 +75,18 @@
     - {src: "install.sh", dest: "{{ offline_pkg_folder }}/install.sh"}
     - {src: "decompress.sh", dest: "/tmp/decompress.sh"}
 
     - {src: "install.sh", dest: "{{ offline_pkg_folder }}/install.sh"}
     - {src: "decompress.sh", dest: "/tmp/decompress.sh"}
 

+# check if the packaging is run by release job by looking at /tmp/release.properties
+- name: Check if /tmp/release.properties file exists
+  stat:
+    path: /tmp/release.properties
+  register: release_properties
+
+# record repo shas in release.properties file if it exists and
+# copy release.properties to tarball
+- name: Record engine repo SHAs in release.properties
+  include_tasks: record-shas.yaml
+  when: release_properties.stat.exists
+

 # create tarball
 - name: Create engine installer file
   script: build.sh
 # create tarball
 - name: Create engine installer file
   script: build.sh

diff --git a/playbooks/roles/package/tasks/record-shas.yaml b/playbooks/roles/package/tasks/record-shas.yaml
new file mode 100644 (file)
index 0000000..36501bd
--- /dev/null
+++ b/playbooks/roles/package/tasks/record-shas.yaml
@@ -0,0 +1,60 @@
+---
+# ============LICENSE_START=======================================================
+#  Copyright (C) 2019 The Nordix Foundation. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+# NOTE (fdegir): ansible-lint complains due to using command module for
+# getting git sha and it is suppressed since it is not possible to get
+# sha using ansible git module
+- name: Fetch commit shas of repos
+  command: git rev-parse HEAD  # noqa 303
+  register: commit_shas
+  with_items:
+    - engine-kubernetes
+    - engine-kubespray
+    - engine-heat
+    - engine-bifrost
+    - engine
+  args:
+    chdir: "/tmp/autorelease/git/{{ item }}"
+  changed_when: false
+
+- name: Populate dictionary to map repos to shas
+  set_fact:
+    repos_shas: "{{ repos_shas|default({}) | combine( {item.item | upper | replace('-', '_') + '_SHA': item.stdout} ) }}"
+  with_items: "{{ commit_shas.results }}"
+
+- name: Log repos and shas to console
+  debug:
+    msg: "{{ item.key }}={{ item.value }}"
+  with_dict: "{{ repos_shas }}"
+
+- name: Record git SHAs to /tmp/release.properties file
+  lineinfile:
+    path: /tmp/release.properties
+    state: present
+    create: true
+    line: "{{ item.key }}={{ item.value }}"
+  with_dict: "{{ repos_shas }}"
+
+- name: Copy /tmp/release.properties into offline package
+  copy:
+    src: /tmp/release.properties
+    dest: "{{ offline_pkg_folder }}/release.properties"
+    force: true
+
+# vim: set ts=2 sw=2 expandtab: