gitlab-triage 1.53.1 → 1.55.0

data/lib/gitlab/triage/action/update.rb

@@ -0,0 +1,454 @@
+# frozen_string_literal: true
+
+require_relative 'base'
+require_relative '../url_builders/url_builder'
+require_relative '../resource/label'
+require_relative '../resource/context'
+require_relative '../policies/base_policy'
+
+module Gitlab
+  module Triage
+    module Action
+      # Updates issues, merge_requests, and epics via direct REST API calls (PUT).
+      # Values for labels:, remove_labels:, due_date:, milestone:, and title:
+      # support Ruby string interpolation in the resource context (#{}), matching comment: bodies.
+      # Missing labels, usernames, or milestone titles raise rather than being silently dropped.
+      class Update < Base
+        ReviewerDoesntExistError = Class.new(StandardError)
+        UpdateNotAppliedError    = Class.new(StandardError)
+
+        VALID_STATUS_VALUES = %w[close reopen].freeze
+        LABEL_PARAMS = { labels: :add_labels, remove_labels: :remove_labels }.freeze
+        USER_PARAMS = {
+          assignees: [:assignee_ids, AssigneeDoesntExistError],
+          reviewers: [:reviewer_ids, ReviewerDoesntExistError]
+        }.freeze
+        REMOVE_USER_PARAMS = {
+          remove_assignees: [:assignee_ids, :assignees],
+          remove_reviewers: [:reviewer_ids, :reviewers]
+        }.freeze
+
+        # The dry run prints the intended changes without touching the network.
+        class Dry < Update
+          def act
+            puts "The following resources would be updated for the rule **#{policy.name}**:\n\n"
+            super
+          end
+
+          private
+
+          def perform(resource)
+            puts "# #{resource[:web_url]}"
+            dry_run_lines(resource).each { |line| puts line }
+            puts "\n"
+          end
+
+          # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+          def dry_run_lines(resource)
+            [
+              ("Would add labels: #{join_labels(eval_labels(actions[:labels], resource))}" if actions[:labels]),
+              ("Would remove labels: #{join_labels(eval_labels(actions[:remove_labels], resource))}" if actions[:remove_labels]),
+              ("Would assign: #{eval_usernames(actions[:assignees], resource).join(', ')}" if actions[:assignees]),
+              ("Would set reviewers: #{eval_usernames(actions[:reviewers], resource).join(', ')}" if actions[:reviewers]),
+              ("Would unassign: #{eval_usernames(actions[:remove_assignees], resource).join(', ')}" if actions[:remove_assignees]),
+              ("Would remove reviewers: #{eval_usernames(actions[:remove_reviewers], resource).join(', ')}" if actions[:remove_reviewers]),
+              interpolated_line(:milestone, resource),
+              interpolated_line(:due_date, resource),
+              ("Would set weight: #{actions[:weight]}" if actions.key?(:weight) && issues_only?),
+              ("Would set health_status: #{actions[:health_status]}" if actions.key?(:health_status) && issues_only?),
+              interpolated_line(:title, resource),
+              ("Would set status: #{actions[:status]}" if actions[:status]),
+              ("Would set discussion_locked: #{actions[:discussion_locked]}" if actions.key?(:discussion_locked)),
+              ("Would move to: #{eval_value(actions[:move], resource)}" if actions[:move] && issues_only?)
+            ].compact
+          end
+          # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+          def interpolated_line(key, resource)
+            value = eval_present_value(key, resource)
+            "Would set #{key}: #{value}" if value
+          end
+        end
+
+        # Action.process calls this before any action writes, so a rule naming a
+        # label, user, milestone, or move destination that no longer exists fails
+        # before Comment posts rather than after. The lookups go through
+        # query_api_cached, so the PUT resolves the same values for free.
+        # The dry run relies on this too, so a typo fails review rather than the
+        # next scheduled run.
+        def verify!
+          return unless update_requested?
+          return if policy.type == 'branches'
+
+          validate_status! if actions[:status]
+
+          policy.resources.each do |resource|
+            verify_resource_labels!(resource)
+            verify_resource_users!(resource)
+            verify_resource_milestone!(resource)
+            verify_resource_destination!(resource)
+          end
+        end
+
+        def act
+          return unless update_requested?
+
+          if policy.type == 'branches'
+            puts Gitlab::Triage::UI.warn "Update actions are not available for branches. They will NOT be performed\n\n"
+            return
+          end
+
+          policy.resources.each do |resource|
+            perform(resource)
+          end
+        end
+
+        private
+
+        def perform(resource)
+          update_health_status(resource) if actions.key?(:health_status)
+
+          body = build_body(resource)
+
+          if body.any?
+            response = network.put_api(resource_url(resource), body)
+            verify_applied!(resource, response)
+          end
+
+          # Moving last keeps the other keys addressing the resource at its original
+          # location. A move gives it a new iid, which would stale the PUT URL.
+          move_resource(resource) if actions[:move]
+        end
+
+        # Health status is not an accepted parameter on PUT /projects/:id/issues/:iid,
+        # so it goes through the work item GraphQL widget instead.
+        def update_health_status(resource)
+          unless issues_only?
+            puts Gitlab::Triage::UI.warn "health_status is only available for issues. It will NOT be set\n\n"
+            return
+          end
+
+          mutation = <<~GRAPHQL
+            mutation($input: WorkItemUpdateInput!) {
+              workItemUpdate(input: $input) {
+                errors
+              }
+            }
+          GRAPHQL
+
+          variables = {
+            input: {
+              id: "gid://gitlab/WorkItem/#{resource[:id]}",
+              healthStatusWidget: { healthStatus: graphql_health_status }
+            }
+          }
+
+          errors = network.mutate_graphql(mutation, variables)&.dig(:work_item_update, :errors)
+          return if errors.nil? || errors.empty?
+
+          raise UpdateNotAppliedError,
+            "Health status was not set for #{resource[:web_url]}: #{errors.join(', ')}"
+        end
+
+        # The GraphQL enum is camelCase (onTrack), the policy value matches the
+        # quick action and the REST filter param (on_track).
+        def graphql_health_status
+          return if actions[:health_status].nil?
+
+          actions[:health_status].to_s.gsub(/_(\w)/) { Regexp.last_match(1).upcase }
+        end
+
+        def build_body(resource)
+          {}.tap do |body|
+            apply_labels!(body, resource)
+            apply_users!(body, resource)
+            apply_user_removals!(body, resource)
+            apply_milestone!(body, resource)
+            apply_simple_fields!(body, resource)
+          end
+        end
+
+        def apply_labels!(body, resource)
+          LABEL_PARAMS.each do |action_key, param|
+            labels = requested_labels(action_key, resource)
+            next if labels.empty?
+
+            ensure_labels_exist!(labels, resource)
+            body[param] = join_labels(labels)
+          end
+        end
+
+        def verify_resource_labels!(resource)
+          LABEL_PARAMS.each_key do |action_key|
+            ensure_labels_exist!(requested_labels(action_key, resource), resource)
+          end
+        end
+
+        # Removals take the ids straight off the resource, so only the set
+        # actions need a lookup here.
+        def verify_resource_users!(resource)
+          USER_PARAMS.each do |action_key, (_param, error_class)|
+            next unless actions[action_key]
+
+            resolve_user_ids(eval_usernames(actions[action_key], resource), error_class)
+          end
+        end
+
+        def verify_resource_milestone!(resource)
+          title = eval_present_value(:milestone, resource)
+          return unless title
+
+          resolve_milestone_id(resource[policy.source_id_sym], title, source: policy.source)
+        end
+
+        # A skipped move warns instead of writing, so there is nothing to check.
+        def verify_resource_destination!(resource)
+          return unless actions[:move] && issues_only?
+
+          resolve_project_id(eval_value(actions[:move], resource))
+        end
+
+        def requested_labels(action_key, resource)
+          return [] unless actions[action_key]
+
+          eval_labels(actions[action_key], resource)
+        end
+
+        def apply_users!(body, resource)
+          USER_PARAMS.each do |action_key, (param, error_class)|
+            next unless actions[action_key]
+
+            usernames = eval_usernames(actions[action_key], resource)
+            next if usernames.empty? && Array(actions[action_key]).any?
+
+            body[param] = resolve_user_ids(usernames, error_class)
+          end
+        end
+
+        # Removals take the ids straight off the resource, so a conditional entry that
+        # evaluates to nothing removes nobody instead of clearing the whole list.
+        # A removal naming nobody on the resource writes nothing at all, rather
+        # than PUTting the list back unchanged.
+        def apply_user_removals!(body, resource)
+          REMOVE_USER_PARAMS.each do |action_key, (param, resource_key)|
+            next unless actions[action_key]
+
+            # assignees: and reviewers: write the whole list, so when the rule
+            # carries one of those too it has already said who ends up on the
+            # resource and there is nothing left to take off.
+            next if body.key?(param)
+
+            current = Array(resource[resource_key])
+            next if current.empty?
+
+            removed = eval_usernames(actions[action_key], resource)
+            remaining = current.reject { |user| removed.include?(user[:username]) }
+            next if remaining.size == current.size
+
+            body[param] = remaining.map { |user| user.fetch(:id) }
+          end
+        end
+
+        # An entry may interpolate to a comma-separated list, so a policy can compute
+        # the whole list from the resource rather than spelling out every username.
+        def eval_usernames(usernames, resource)
+          Array(usernames)
+            .flat_map { |username| eval_value(username, resource).split(',') }
+            .map(&:strip)
+            .reject(&:empty?)
+        end
+
+        def apply_milestone!(body, resource)
+          title = eval_present_value(:milestone, resource)
+          return unless title
+
+          body[:milestone_id] = resolve_milestone_id(
+            resource[policy.source_id_sym],
+            title,
+            source: policy.source
+          )
+        end
+
+        def apply_simple_fields!(body, resource)
+          apply_interpolated_field!(body, :due_date, resource)
+          apply_interpolated_field!(body, :title, resource)
+          apply_weight!(body)
+          body[:state_event]       = actions[:status]              if actions[:status]
+          body[:discussion_locked] = actions[:discussion_locked]   if actions.key?(:discussion_locked)
+        end
+
+        def apply_weight!(body)
+          return unless actions.key?(:weight)
+
+          unless issues_only?
+            puts Gitlab::Triage::UI.warn "weight is only available for issues. It will NOT be set\n\n"
+            return
+          end
+
+          body[:weight] = actions[:weight]
+        end
+
+        def apply_interpolated_field!(body, key, resource)
+          value = eval_present_value(key, resource)
+          body[key] = value if value
+        end
+
+        def actions
+          policy.actions
+        end
+
+        # weight, health_status and move have no counterpart on merge requests or epics.
+        def issues_only?
+          policy.type == 'issues'
+        end
+
+        def update_requested?
+          Policies::BasePolicy::UPDATE_ACTION_KEYS.any? { |k| actions.key?(k) }
+        end
+
+        def validate_status!
+          return if VALID_STATUS_VALUES.include?(actions[:status].to_s)
+
+          raise ArgumentError,
+            "Invalid status value '#{actions[:status]}'. " \
+              "Supported: #{VALID_STATUS_VALUES.join(', ')}."
+        end
+
+        # An entry may interpolate to a comma-separated list, or to nothing so a
+        # policy can make a label conditional on the resource.
+        def eval_labels(labels, resource)
+          Array(labels)
+            .flat_map { |label| eval_value(label, resource).split(',') }
+            .map(&:strip)
+            .reject(&:empty?)
+        end
+
+        def join_labels(labels)
+          labels.join(',')
+        end
+
+        # An entry that interpolates to nothing leaves the field alone, the way
+        # labels and usernames already do. The quick action this replaces ignored
+        # an empty value, while an empty PUT param clears the field instead.
+        def eval_present_value(key, resource)
+          return unless actions[key]
+
+          value = eval_value(actions[key], resource)
+          value unless value.empty?
+        end
+
+        # Without a resource there is nothing to interpolate against, so the raw
+        # template is returned. Dry-run output shows it verbatim.
+        def eval_value(value, resource)
+          return value unless resource
+
+          # rubocop:disable Style/DocumentDynamicEvalDefinition
+          Resource::Context.build(
+            resource,
+            network: network,
+            redact_confidentials: actions.fetch(:redact_confidential_resources, true)
+          ).eval("%Q{#{value}}")
+          # rubocop:enable Style/DocumentDynamicEvalDefinition
+        end
+
+        def ensure_labels_exist!(labels, resource)
+          source_id_key = resource.key?(:group_id) ? :group_id : :project_id
+
+          super(labels, resource[source_id_key], source_id_key: source_id_key)
+        end
+
+        def move_resource(resource)
+          unless issues_only?
+            puts Gitlab::Triage::UI.warn "move is only available for issues. It will NOT be performed\n\n"
+            return
+          end
+
+          destination = eval_value(actions[:move], resource)
+          destination_id = resolve_project_id(destination)
+          network.post_api(resource_url(resource, sub_resource_type: 'move'), { to_project_id: destination_id })
+        end
+
+        def resolve_project_id(path)
+          options = network.options
+          url = "#{options.host_url}/api/#{options.api_version}/projects/#{CGI.escape(path)}"
+          project = network.query_api_cached(url).first
+          raise "Project `#{path}` doesn't exist!" unless project&.dig(:id)
+
+          project[:id]
+        end
+
+        def resource_url(resource, sub_resource_type: nil)
+          UrlBuilders::UrlBuilder.new(
+            network_options: network.options,
+            source: policy.source,
+            source_id: resource[policy.source_id_sym],
+            resource_type: policy.type,
+            resource_id: resource['iid'],
+            sub_resource_type: sub_resource_type
+          ).build
+        end
+
+        # The endpoint can return success without persisting anything when the token
+        # lacks permission, so the echoed resource is checked against what was asked for.
+        def verify_applied!(resource, response)
+          return unless response.is_a?(Hash)
+
+          verify_state!(resource, response) if actions[:status]
+          verify_labels_applied!(resource, response) if actions[:labels]
+          verify_assignees_applied!(resource, response) if actions[:assignees]
+          verify_reviewers_applied!(resource, response) if actions[:reviewers]
+        end
+
+        def verify_labels_applied!(resource, response)
+          return if response[:labels].nil?
+
+          missing = eval_labels(actions[:labels], resource) - response[:labels]
+          return if missing.empty?
+
+          raise UpdateNotAppliedError,
+            "Labels #{missing.join(', ')} were not applied to #{resource[:web_url]}; " \
+              "the token may lack permission."
+        end
+
+        def verify_assignees_applied!(resource, response)
+          return if response[:assignees].nil?
+
+          missing = missing_usernames(actions[:assignees], resource, response[:assignees])
+          return if missing.empty?
+
+          raise UpdateNotAppliedError,
+            "Assignees #{missing.join(', ')} were not assigned to #{resource[:web_url]}; " \
+              "the token may lack permission."
+        end
+
+        def verify_reviewers_applied!(resource, response)
+          return if response[:reviewers].nil?
+
+          missing = missing_usernames(actions[:reviewers], resource, response[:reviewers])
+          return if missing.empty?
+
+          raise UpdateNotAppliedError,
+            "Reviewers #{missing.join(', ')} were not requested on #{resource[:web_url]}; " \
+              "the token may lack permission, or the users may not have access to it."
+        end
+
+        # The users lookup ignores case, so the response can spell a username
+        # differently from the rule.
+        def missing_usernames(requested, resource, returned_users)
+          returned = returned_users.map { |user| user.fetch(:username).downcase }
+          eval_usernames(requested, resource).reject { |username| returned.include?(username.downcase) }
+        end
+
+        def verify_state!(resource, response)
+          expected = actions[:status] == 'close' ? 'closed' : 'opened'
+          actual = response[:state]
+          return if actual.nil? || actual == expected
+
+          raise UpdateNotAppliedError,
+            "State was not updated to '#{expected}' for #{resource[:web_url]}; " \
+              "the token may lack permission."
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/triage/action/work_item.rb

@@ -19,7 +19,6 @@ module Gitlab
       # applying nothing - which is especially important because clearing the
       # assignees array would unassign everyone.
       class WorkItem < Base
-        AssigneeDoesntExistError = Class.new(StandardError)
         UpdateNotAppliedError = Class.new(StandardError)
 
         # The dry run must not touch the network. It prints the requested
@@ -113,26 +112,6 @@ module Gitlab
           end
         end
 
-        # Resolve every requested username to an id. A missing username raises
-        # rather than being dropped, because an empty assignee_ids array would
-        # clear all assignees on the work item.
-        def resolve_assignee_ids(usernames)
-          return [] if usernames.empty?
-
-          usernames.map do |username|
-            id = resolve_user_id(username)
-            raise AssigneeDoesntExistError, "User `#{username}` doesn't exist!" unless id
-
-            id
-          end
-        end
-
-        def resolve_user_id(username)
-          users = network.query_api(users_url(username))
-
-          users.first&.dig(:id)
-        end
-
         # The Work Items REST update endpoint can return success without
         # persisting a change when the token lacks permission. The response
         # echoes the resulting widgets, so confirm the requested ids landed and
@@ -171,12 +150,6 @@ module Gitlab
             params: { per_page: 100 }
           ).build
         end
-
-        def users_url(username)
-          options = network.options
-
-          "#{options.host_url}/api/#{options.api_version}/users?username=#{CGI.escape(username)}"
-        end
       end
     end
   end

data/lib/gitlab/triage/action.rb

@@ -7,6 +7,7 @@ require_relative 'action/issue'
 require_relative 'action/delete'
 require_relative 'action/work_item_status'
 require_relative 'action/work_item'
+require_relative 'action/update'
 
 module Gitlab
   module Triage
@@ -14,8 +15,22 @@ module Gitlab
       def self.process(policy:, **args)
         policy.validate!
 
-        actions_for(policy).each do |action, active|
-          act(action: action, policy: policy, **args) if active
+        actions = actions_for(policy).select { |_action, active| active }.map(&:first)
+
+        verify!(actions, policy: policy, network: args[:network])
+
+        actions.each do |action|
+          act(action: action, policy: policy, **args)
+        end
+      end
+
+      # Comment runs before the actions that write labels, so without this a
+      # rule naming a label, user, milestone, or move destination that no
+      # longer exists posts its note and only then raises, and the next
+      # scheduled run posts it again.
+      def self.verify!(actions, policy:, network:)
+        actions.each do |action|
+          action.new(policy: policy, network: network).verify!
         end
       end
 
@@ -34,6 +49,7 @@ module Gitlab
           [
             [Summarize, policy.summarize?],
             [Comment, policy.comment?],
+            [Update, policy.update?],
             [CommentOnSummary, policy.comment_on_summary?],
             [Issue, policy.issue?],
             [Delete, policy.delete?],

data/lib/gitlab/triage/command_builders/cc_command_builder.rb

@@ -8,10 +8,6 @@ module Gitlab
       class CcCommandBuilder < BaseCommandBuilder
         private
 
-        def slash_command_string
-          "/cc"
-        end
-
         def format_item(item)
           "@#{item}"
         end

data/lib/gitlab/triage/engine.rb

@@ -240,6 +240,10 @@ module Gitlab
         rule.fetch(:conditions) { {} }
       end
 
+      def rule_actions(rule)
+        rule.fetch(:actions) { {} }
+      end
+
       def rule_limits(rule)
         rule.fetch(:limits) { {} }
       end
@@ -456,7 +460,7 @@ module Gitlab
             graphql_query_options[:iids] = expanded_conditions[:iids]
           end
 
-          graphql_query = build_graphql_query(resource_type, expanded_conditions, true)
+          graphql_query = build_graphql_query(resource_type, expanded_conditions, rule_definition, true)
 
           resources = graphql_network.query(graphql_query, **graphql_query_options)
         else
@@ -482,7 +486,7 @@ module Gitlab
           iids = resources.pluck('iid').map(&:to_s)
           expanded_conditions[:iids] = iids
 
-          graphql_query = build_graphql_query(resource_type, expanded_conditions)
+          graphql_query = build_graphql_query(resource_type, expanded_conditions, rule_definition)
           graphql_resources = graphql_network.query(graphql_query, source: source_full_path, iids: iids) if graphql_query.any?
 
           decorate_resources_with_graphql_data(resources, graphql_resources)
@@ -879,9 +883,14 @@ module Gitlab
         status_by_iid
       end
 
-      def build_graphql_query(resource_type, conditions, graphql_only = false)
+      def build_graphql_query(resource_type, conditions, rule_definition, graphql_only = false)
         Gitlab::Triage::GraphqlQueries::QueryBuilder
-          .new(options.source, resource_type, conditions, graphql_only: graphql_only)
+          .new(
+            options.source,
+            resource_type,
+            conditions,
+            graphql_only: graphql_only,
+            actions: rule_actions(rule_definition))
       end
 
       def source_full_path

data/lib/gitlab/triage/entity_builders/issue_builder.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
 require_relative '../command_builders/text_content_builder'
+require_relative 'issue_fields'
 
 module Gitlab
   module Triage
     module EntityBuilders
       class IssueBuilder
+        include IssueFields
+
         attr_reader :destination
 
         def initialize(
@@ -22,6 +25,7 @@ module Gitlab
           @resource = resource
           @network = network
           @separator = separator
+          init_issue_fields(action)
         end
 
         def title
@@ -38,6 +42,10 @@ module Gitlab
 
         private
 
+        def evaluate(template)
+          build_text(template)
+        end
+
         def title_present?
           /\S+/.match?(title)
         end

data/lib/gitlab/triage/entity_builders/issue_fields.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Triage
+    module EntityBuilders
+      module IssueFields
+        def labels
+          evaluate_entries(@labels)
+        end
+
+        def assignee_usernames
+          evaluate_entries(@assignee_usernames)
+        end
+
+        def due_date
+          evaluate_present(@due_date)
+        end
+
+        def milestone_title
+          evaluate_present(@milestone_title)
+        end
+
+        def confidential?
+          return @confidential if @confidential == true || @confidential == false
+          return false unless @confidential
+
+          evaluate(@confidential.to_s).strip == 'true'
+        end
+
+        private
+
+        # Returns one value per label or username. An entry may interpolate to
+        # a comma-separated list so a policy can compute a list whose length
+        # varies, and an entry that comes out empty is dropped. The caller
+        # treats an empty result as "the policy named nothing here", so a
+        # conditional entry leaves the field off the request rather than
+        # clearing it.
+        def evaluate_entries(templates)
+          Array(templates)
+            .flat_map { |template| evaluate(template).split(',') }
+            .map(&:strip)
+            .reject(&:empty?)
+        end
+
+        def init_issue_fields(action)
+          @labels             = action[:labels]
+          @assignee_usernames = action[:assignees]
+          @due_date           = action[:due_date]
+          @milestone_title    = action[:milestone]
+          @confidential       = action[:confidential]
+        end
+
+        # An empty string is truthy, so a template that interpolates to nothing
+        # would pass the caller's guard and write an empty value. Nil leaves the
+        # field alone instead.
+        def evaluate_present(template)
+          return unless template
+
+          value = evaluate(template)
+          value unless value.empty?
+        end
+      end
+    end
+  end
+end