rake_dependencies 3.14.0.pre.1 → 3.14.0.pre.1.pr228.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d57cb5d4a16e04571f7990d498de18a873a60bc4cd036f1e0f99fef8481af11
-  data.tar.gz: b94fc3786192e507abed0999b3790cb2e270057d65258009ef90f7607ac3e701
+  metadata.gz: 896ce75eff64aad976e72f15eb66aae855fae3e5715768a7e986b422d33214b7
+  data.tar.gz: 7f36f8599a472a91d3750f89e2e43f1566de940ee27cac87b83320429d1e2aad
 SHA512:
-  metadata.gz: 0df6b5fb832e4d1949c2ece154d896bda2bab5bf138b33af276b1340ced0154758184d0190a4017dd6ff887c14228b4b5f174eea1f77bf5e6e9ab32fa8322799
-  data.tar.gz: bc88f1f80688fb7971ccfcad10b2419306c3a92872b998cdc998b0235601b44b2c99c00e85b2647c86c19fb50fb143c130310c3470c74d3fbedf3062eb91b6fa
+  metadata.gz: fbbd02d4dbce1848a86a7ba9711af58cf947e95bb101d6c49905bdda62614accf00701048c02f474ec4dbc4302f5a417f80d9d4c6f530624e9d423b4561b3bd8
+  data.tar.gz: a15ea14a360137aa61671ec40e2028ec96cdc900ea79897ff5725a92f1dccf622b612f2b904db282f03f1573da68415bdaddb908d7604dc463fad22560e96bc4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rake_dependencies (3.14.0.pre.1)
+    rake_dependencies (3.14.0.pre.1.pr228.3.1)
       down (~> 5.3)
       hamster (~> 3.0)
       minitar (>= 1.0, < 2.0)
@@ -39,7 +39,8 @@ GEM
       addressable (~> 2.8)
       base64 (~> 0.3)
     drb (2.2.3)
-    excon (0.111.0)
+    excon (1.6.0)
+      logger
     fakefs (3.0.1)
     faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
@@ -82,11 +83,6 @@ GEM
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    rake_circle_ci (0.13.0)
-      colored2 (~> 3.1)
-      excon (~> 0.72)
-      rake_factory (~> 0.33)
-      sshkey (~> 2.0)
     rake_factory (0.33.0)
       activesupport (>= 4)
       rake (~> 13.0)
@@ -109,10 +105,9 @@ GEM
     rake_gpg (0.20.0)
       rake_factory (~> 0.33)
       ruby_gpg2 (~> 0.12)
-    rake_ssh (0.12.0)
-      colored2 (~> 3.1)
+    rake_slack (0.3.0)
+      excon (>= 0.72, < 2.0)
       rake_factory (~> 0.33)
-      sshkey (~> 2.0)
     rbnacl (7.1.2)
       ffi (~> 1)
     rchardet (1.8.0)
@@ -183,13 +178,12 @@ DEPENDENCIES
   fakefs
   gem-release
   rake
-  rake_circle_ci
   rake_dependencies!
   rake_git
   rake_git_crypt
   rake_github
   rake_gpg
-  rake_ssh
+  rake_slack
   rspec
   rubocop
   rubocop-rake

data/README.md

@@ -310,16 +310,16 @@ release a new version, update the version number in `version.rb`, and then run
 git commits and tags, and push the `.gem` file to
 [rubygems.org](https://rubygems.org).
 
-### Managing CircleCI keys
+### Managing CI keys
 
-To encrypt a GPG key for use by CircleCI:
+To encrypt a GPG key for use by CI:
 
 ```bash
 openssl aes-256-cbc \
   -e \
   -md sha1 \
   -in ./config/secrets/ci/gpg.private \
-  -out ./.circleci/gpg.private.enc \
+  -out ./.github/gpg.private.enc \
   -k "<passphrase>"
 ```
 
@@ -329,7 +329,7 @@ To check decryption is working correctly:
 openssl aes-256-cbc \
   -d \
   -md sha1 \
-  -in ./.circleci/gpg.private.enc \
+  -in ./.github/gpg.private.enc \
   -k "<passphrase>"
 ```
 

data/Rakefile

@@ -1,15 +1,13 @@
 # frozen_string_literal: true
 
-require 'rake_circle_ci'
 require 'rake_git'
 require 'rake_git_crypt'
 require 'rake_github'
 require 'rake_gpg'
-require 'rake_ssh'
+require 'rake_slack'
 require 'rspec/core/rake_task'
 require 'rubocop/rake_task'
 require 'securerandom'
-require 'yaml'
 
 task default: %i[
   library:fix
@@ -59,13 +57,6 @@ namespace :encryption do
 end
 
 namespace :keys do
-  namespace :deploy do
-    RakeSSH.define_key_tasks(
-      path: 'config/secrets/ci/',
-      comment: 'maintainers@infrablocks.io'
-    )
-  end
-
   namespace :gpg do
     RakeGPG.define_generate_key_task(
       output_directory: 'config/secrets/ci',
@@ -91,7 +82,6 @@ namespace :secrets do
   desc 'Generate all generatable secrets.'
   task generate: %w[
     encryption:passphrase:generate
-    keys:deploy:generate
     keys:gpg:generate
   ]
 
@@ -115,57 +105,106 @@ namespace :library do
 
   desc 'Attempt to automatically fix issues with the library'
   task fix: [:'rubocop:autocorrect_all']
+
+  desc 'Build the library'
+  task :build do
+    sh 'gem build rake_dependencies.gemspec'
+  end
 end
 
 namespace :test do
   RSpec::Core::RakeTask.new(:unit)
 end
 
-RakeCircleCI.define_project_tasks(
-  namespace: :circle_ci,
-  project_slug: 'github/infrablocks/rake_dependencies'
-) do |t|
-  circle_ci_config =
-    YAML.load_file('config/secrets/circle_ci/config.yaml')
-
-  t.api_token = circle_ci_config['circle_ci_api_token']
-  t.environment_variables = {
-    ENCRYPTION_PASSPHRASE:
-        File.read('config/secrets/ci/encryption.passphrase')
-        .chomp
-  }
-  t.checkout_keys = []
-  t.ssh_keys = [
-    {
-      hostname: 'github.com',
-      private_key: File.read('config/secrets/ci/ssh.private')
-    }
-  ]
+namespace :slack do
+  RakeSlack.define_notification_tasks do |t|
+    t.bot_token = ENV.fetch('SLACK_BOT_TOKEN', nil)
+    t.routing_rules = [
+      { when: { type: 'on_hold' },
+        channel: 'C038EDCRSQJ', format: :on_hold },  # release
+      { when: { actor: 'dependabot[bot]', outcome: 'success' },
+        channel: 'C03N711HVDG', format: :success },  # builds-dependabot
+      { when: { actor: 'dependabot[bot]' },
+        channel: 'C03N711HVDG', format: :failure },  # builds-dependabot
+      { when: { outcome: 'success' },
+        channel: 'C023XUE76GH', format: :success },  # builds
+      # Failures go to builds, not team-dev (org default), to keep noise
+      # out of a popular channel while this pipeline beds in.
+      { when: {},
+        channel: 'C023XUE76GH', format: :failure } # builds
+    ]
+  end
+end
+
+namespace :repository do
+  desc 'Set the git author for CI'
+  task :set_ci_author do
+    sh 'git config --global user.name "InfraBlocks CI"'
+    sh 'git config --global user.email "ci@infrablocks.io"'
+  end
+end
+
+# Operator's ambient auth. Resolve once and fail fast: a missing,
+# unauthenticated, or absent gh yields an empty string, which would
+# otherwise surface later as an opaque Octokit 401. An empty or
+# whitespace-only GITHUB_TOKEN is treated as absent so an authenticated
+# operator falls through to `gh auth token` rather than hitting the raise.
+def github_access_token
+  token = ENV['GITHUB_TOKEN'].to_s.strip
+  token = gh_auth_token if token.empty?
+  return token unless token.empty?
+
+  raise 'No GitHub token available: set GITHUB_TOKEN or run `gh auth login`'
+end
+
+def gh_auth_token
+  `gh auth token`.strip
+rescue Errno::ENOENT
+  ''
+end
+
+# Actions store only: dependabot runs never reach the passphrase — the
+# only pr.yaml job that unlocks git-crypt (prerelease) is guarded to
+# same-repo human PRs. Guard against a locked clone: without it, File.read
+# returns git-crypt ciphertext and github:secrets:ensure silently uploads
+# garbage that only surfaces much later as an opaque GPG unlock failure in
+# the release job.
+def ci_encryption_passphrase
+  path = 'config/secrets/ci/encryption.passphrase'
+  unless File.exist?(path)
+    raise "Passphrase file not found: #{path} — expected a " \
+          'git-crypt-unlocked clone with the CI secrets present'
+  end
+
+  ensure_unlocked(File.binread(path)).chomp
+end
+
+def ensure_unlocked(passphrase)
+  return passphrase unless passphrase.start_with?("\x00GITCRYPT")
+
+  raise 'encryption.passphrase is git-crypt ciphertext — unlock the ' \
+        'clone before provisioning'
 end
 
 RakeGithub.define_repository_tasks(
   namespace: :github,
   repository: 'infrablocks/rake_dependencies'
 ) do |t|
-  github_config =
-    YAML.load_file('config/secrets/github/config.yaml')
-
-  t.access_token = github_config['github_personal_access_token']
-  t.deploy_keys = [
-    {
-      title: 'CircleCI',
-      public_key: File.read('config/secrets/ci/ssh.public')
-    }
+  t.access_token = github_access_token
+  t.secrets = [
+    { name: 'ENCRYPTION_PASSPHRASE', value: ci_encryption_passphrase }
+  ]
+  t.environments = [
+    { name: 'release',
+      reviewers: [{ team: 'maintainers' }] }
   ]
 end
 
 namespace :pipeline do
-  desc 'Prepare CircleCI Pipeline'
+  desc 'Prepare GitHub Actions pipeline'
   task prepare: %i[
-    circle_ci:env_vars:ensure
-    circle_ci:checkout_keys:ensure
-    circle_ci:ssh_keys:ensure
-    github:deploy_keys:ensure
+    github:secrets:ensure
+    github:environments:ensure
   ]
 end
 
@@ -176,6 +215,38 @@ namespace :version do
   end
 end
 
+namespace :prerelease do
+  desc 'Build and push a namespaced pre-release to RubyGems ' \
+       '(PR CI only; no bump, no tag, no commit, no push)'
+  task :publish, %i[pr_number run_number run_attempt] do |_, args|
+    %i[pr_number run_number run_attempt].each do |name|
+      raise "Missing task argument: #{name}" if args[name].to_s.empty?
+    end
+
+    version_file = 'lib/rake_dependencies/version.rb'
+    version_pattern = /(VERSION\s*=\s*')([^']+)(')/
+    source = File.read(version_file)
+    base = source[version_pattern, 2]
+    raise "Could not read VERSION from #{version_file}" unless base
+
+    version = "#{base}.pr#{args.pr_number}" \
+              ".#{args.run_number}.#{args.run_attempt}"
+    gem_file = "rake_dependencies-#{version}.gem"
+    begin
+      File.write(version_file,
+                 source.sub(version_pattern, "\\1#{version}\\3"))
+      # Build + push directly: `gem release` aborts on the (deliberately)
+      # uncommitted version rewrite. PR CI must not tag, commit, or push
+      # (contrast the `release` task).
+      sh 'gem build rake_dependencies.gemspec'
+      sh "gem push #{gem_file}"
+    ensure
+      File.write(version_file, source)
+      rm_f gem_file
+    end
+  end
+end
+
 desc 'Release gem'
 task :release do
   sh 'gem release --tag --push'

data/lib/rake_dependencies/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeDependencies
-  VERSION = '3.14.0.pre.1'
+  VERSION = '3.14.0.pre.1.pr228.3.1'
 end

data/rake_dependencies.gemspec

@@ -46,12 +46,11 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'fakefs'
   spec.add_development_dependency 'gem-release'
   spec.add_development_dependency 'rake'
-  spec.add_development_dependency 'rake_circle_ci'
   spec.add_development_dependency 'rake_git'
   spec.add_development_dependency 'rake_git_crypt'
   spec.add_development_dependency 'rake_github'
   spec.add_development_dependency 'rake_gpg'
-  spec.add_development_dependency 'rake_ssh'
+  spec.add_development_dependency 'rake_slack'
   spec.add_development_dependency 'rspec'
   spec.add_development_dependency 'rubocop'
   spec.add_development_dependency 'rubocop-rake'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rake_dependencies
 version: !ruby/object:Gem::Version
-  version: 3.14.0.pre.1
+  version: 3.14.0.pre.1.pr228.3.1
 platform: ruby
 authors:
 - InfraBlocks Maintainers
@@ -141,20 +141,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake_circle_ci
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake_git
   requirement: !ruby/object:Gem::Requirement
@@ -212,7 +198,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake_ssh
+  name: rake_slack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="