renuo-cli 4.29.0 → 4.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea0940fbcb4f6adcee05932e3706029dfd00c20aae778925992fd20c4e4122d7
-  data.tar.gz: d00eb2084014053724e2c8dfdc6e4b1595bdf3edbfd7d3185d6edcc628bbfdd1
+  metadata.gz: e403749b46f9d289d45f218209831c68a8c624840f4df20e1315127d4ba2bbac
+  data.tar.gz: 85cd1b725f516ab96fa5da67355c9268d8397eeb3b7db4017263b3583558f4d8
 SHA512:
-  metadata.gz: aee1f47d1bac9b8082fb450f6b14e4225d6af5b30233cc129fa6b1559871d0901b40924ebbbf163ab88ea493a124cddacb3725fb087acdab47b58fd8088906ab
-  data.tar.gz: 672f554707e987a99d6dae554b2585a0bf4e7add4f69187e8a06df303e61e94938d6af17e28a54f2c8aa4624b6bafb3f2a9c2b5d56de06a69b14e7ab7bbe4a64
+  metadata.gz: 193344bdebb9952145a2c8e948e04b8ad85f8d04d0d642c8c0f00cd1173639454c7306a7c80665de5bcc68c7e78a5de74f4406012de7e4d61cda5d0a9a173211
+  data.tar.gz: c6bd00ecd6bedcde704ab346dcfa3cdd0affae38a0413c457636c575c561b12432a9a06c1422de2673b0ff0a40bb8c7e03f66626321d7c756eb0e8ca5927ae0a

data/README.md

@@ -52,25 +52,20 @@ renuo generate-password
 
 To install this gem onto your local machine, run `bundle exec rake install`.
 
-To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`,
- which will create a git tag for the version, push git commits and tags, and push the `.gem` file to
- [rubygems.org](https://rubygems.org).
-
 ## Release
 
-* Bump the version number in `lib/renuo/cli/version.rb`, run `bundle install`
-  to update the `Gemfile.lock` and commit to `main`
-
-### Automatic
+1. Bump the version in `lib/renuo/cli/version.rb`, run `bundle install` and commit to `main`.
+1. Tag the commit with the bare version and push the tag:
 
-* Deploy through Semaphore console by starting a promotion to main
+   ```sh
+   git tag -a 1.2.3 -m 1.2.3
+   git push origin 1.2.3
+   ```
 
-### Manual
+1. Create a GitHub release for the tag with the release notes.
 
-```sh
-gem build renuo-cli.gemspec
-gem push renuo-cli-*.gem
-```
+Semaphore runs the tests on the tag and, when they pass, promotes the `release` pipeline, which pushes the gem to
+[rubygems.org](https://rubygems.org). It fails when the tag does not match the gem version.
 
 ## Contributing
 

data/lib/renuo/cli/commands/ci/check_deploio_status.rb

@@ -99,7 +99,7 @@ module Renuo::Cli::Commands::Ci
     end
 
     def succeeded?(type, name, status) # rubocop:disable Metrics/MethodLength
-      time = Time.current.iso8601.to_s
+      time = Time.now.iso8601.to_s
 
       case status
       when "available", "success"

data/lib/renuo/cli/commands/release.rb

@@ -112,8 +112,9 @@ class Renuo::Cli::Commands::Release # rubocop:disable Metrics/ClassLength
     clone = "git clone --filter=blob:none git@#{@host}:#{@repo_path}.git"
     abort(">> Project not found.") unless system("#{MOVE_TO_TMP_FOLDER} && #{clone}")
 
-    system(cmd_in_folder("git checkout #{main_branch} && git pull origin #{main_branch} &&" \
-                         "git checkout #{develop_branch} && git pull origin #{develop_branch}"))
+    return if system(cmd_in_folder("git checkout #{main_branch} && git checkout #{develop_branch}"))
+
+    abort(">> Unable to check out #{main_branch} and #{develop_branch}.")
   end
 
   def calculate_version
@@ -143,8 +144,9 @@ class Renuo::Cli::Commands::Release # rubocop:disable Metrics/ClassLength
     changed_files = find_and_replace_version
 
     return unless changed_files.any?
+    return if system(cmd_in_folder(%(git add #{changed_files.join(" ")} && git commit -m "Bump version")))
 
-    system(cmd_in_folder(%(git add #{changed_files.join(" ")} && git commit -m "Bump version")))
+    abort(">> Unable to commit the version bump. Cancelling release.")
   end
 
   def find_and_replace_version
@@ -178,8 +180,7 @@ class Renuo::Cli::Commands::Release # rubocop:disable Metrics/ClassLength
   end
 
   def finish_release_branch
-    merge_branches
-    push_branches_and_tags
+    merge_branches && system(cmd_in_folder("git push --atomic origin #{develop_branch} #{main_branch} --tags"))
   end
 
   def merge_branches
@@ -194,23 +195,14 @@ class Renuo::Cli::Commands::Release # rubocop:disable Metrics/ClassLength
     )
   end
 
-  def push_branches_and_tags
-    push_branch(develop_branch)
-    push_branch(main_branch)
-    system(cmd_in_folder("git checkout #{main_branch} && git push origin #{main_branch} --tags"))
-  end
-
-  def push_branch(branch)
-    system(cmd_in_folder("git checkout #{branch} && git push origin #{branch}"))
-  end
-
   def ask_for_final_confirmation
     unless agree(">> Are you sure you wish to deploy '#{@repo_path}' " \
                  "as a #{@update_type} release (#{current_version} => #{@version})?")
       abort(">> Cancelling Release.")
     end
 
-    return unless Time.current.friday? && Time.current.hour >= 16
+    now = Time.now.getlocal
+    return unless now.friday? && now.hour >= 16
 
     unless agree(">> Are you sure you want to deploy on late Friday afternoon? " \
                  "Did you think about your family...waiting for you at home?")

data/lib/renuo/cli/commands/review_app/README.md

@@ -0,0 +1,33 @@
+# Review Apps
+
+Review apps are short-lived deployments driven by the changes on a git branch.
+They can be used for smoke testing during code reviews or to show a feature sketch to
+the customer.
+
+Here we assume that you use Deploio.
+Further we can generate a SemaphoreCI pipeline template for you.
+
+These are the steps of command execution in the happy path:
+
+1. _(Optional)_ `renuo review-app:setup-semaphoreci`
+1. Create or update `renuo review-app:deploy`
+1. _Intentional gap for configuration. Consider this the wiggle-room for LLMs_
+1. Start the paused app `renuo review-app:start`
+1. Announce it on Slack `renuo review-app:notify`
+1. Cleanup `renuo review-app:purge`
+
+## Design Choices
+
+* The git branch determines the lifetime of a review app
+* The branch name **hash** is the only safe identifier.
+  It is being used to purge resources.
+  Connected services do not work across all systems (e.g. Nutanix Object Storage)
+* A dry-run command flag is not easily possible because we rely on generated system output.
+* We use the sunny/actor gem to concentrate reviewability to the command flow
+* There is a special "safeguards" feature test. It covers the safe name contract.
+* All `nctl` commands are routed through `system!` and are logged in a command trail for auditing.
+* Configuration of system tools like `psql` is intentionally out of scope.
+  But CI templating can give you some pointers.
+* `review-app:notify` posts the review app URL (carrying its Deploio-assigned basic auth credentials) and the
+  branch's open pull request to a Slack incoming webhook (`SLACK_WEBHOOK_URL`). The pull request lookup uses
+  bundler's `BUNDLE_GITHUB__COM` (a token or `user:token`) and never fails the pipeline when GitHub refuses it.

data/lib/renuo/cli/commands/review_app/notify.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Notify
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+    include Contracts::Core
+
+    command "review-app:notify" do |c|
+      c.syntax = "renuo review-app:notify [options]"
+      c.summary = "Posts the branch's review app URL (with its basic auth credentials) and pull request to Slack."
+      c.description = "#{c.summary} The Slack incoming webhook is read from SLACK_WEBHOOK_URL, the GitHub " \
+                      "repository from SEMAPHORE_GIT_REPO_SLUG and bundler's GitHub credentials (a token or " \
+                      "user:token) from BUNDLE_GITHUB__COM to link the branch's open pull request."
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.option "--channel <name>", String, "The Slack channel to post to"
+      c.option "--repo <owner/name>", String, "The GitHub repository, defaults to SEMAPHORE_GIT_REPO_SLUG"
+      c.example "renuo review-app:notify -p renuo-acme -b feature/42-migrate-to-deploio " \
+                "--channel '#project-acme-notifications'",
+                "Announces the branch's review app in the project's Slack channel"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      post_to_slack(message_lines.join("\n"))
+      CmdTrail::Print.call
+      puts "\nnotified #{@channel}"
+    end
+
+    private
+
+    def initialize(options)
+      @project = options.project || abort("missing project name")
+      @branch = options.branch || abort("missing branch name")
+      @channel = options.channel || abort("missing Slack channel")
+      @repo = options.repo || ENV.fetch("SEMAPHORE_GIT_REPO_SLUG", nil).presence ||
+              abort("missing GitHub repository, set SEMAPHORE_GIT_REPO_SLUG or pass --repo")
+      @webhook_url = ENV.fetch("SLACK_WEBHOOK_URL", nil).presence || abort("SLACK_WEBHOOK_URL is not set")
+      derive_app_name(@branch)
+    end
+
+    Contract String => SafeReviewAppNameContract
+    def derive_app_name(branch)
+      @app_name = review_app_name(branch)
+    end
+
+    def message_lines
+      credentials = basic_auth_credentials
+      pull_request = fetch_pull_request
+
+      [
+        "Review app is ready: #{app_link(credentials)}",
+        pull_request && pull_request_line(pull_request),
+        "Branch: <https://github.com/#{@repo}/tree/#{@branch}|#{@branch}>"
+      ].compact
+    end
+
+    def pull_request_line(pull_request)
+      "Pull request: <#{pull_request["html_url"]}|##{pull_request["number"]} #{pull_request["title"]}>"
+    end
+
+    def app_link(credentials)
+      url = app_url
+      url.userinfo = userinfo(credentials) if credentials
+      "<#{url}|#{url.host}>"
+    end
+
+    def userinfo(credentials)
+      credentials.values_at("username", "password").map { |value| URI.encode_www_form_component(value) }.join(":")
+    end
+
+    def app_url
+      url = Deploio.fetch_resource("app", @app_name, @project).to_h.dig("status", "atProvider", "defaultURLs", 0)
+      URI(url || abort("#{@app_name} has no URL assigned yet"))
+    end
+
+    # Deploio assigns basic auth credentials per app, so the review app's differ from the origin's.
+    def basic_auth_credentials
+      stdout, = system!("nctl get app #{@app_name} -p #{@project} -o json --basic-auth-credentials", quiet: true)
+      Array(JSON.parse(stdout)).first&.dig("basicauth")
+    end
+
+    def fetch_pull_request
+      credentials = ENV.fetch("BUNDLE_GITHUB__COM", "")
+      return if credentials.empty?
+
+      response = Net::HTTP.start("api.github.com", 443, use_ssl: true) do |http|
+        http.request(pull_request_request(credentials))
+      end
+      return JSON.parse(response.body).first if response.is_a?(Net::HTTPSuccess)
+
+      warn "GitHub pull request lookup failed: #{response.code}"
+      nil
+    end
+
+    def pull_request_request(credentials)
+      query = URI.encode_www_form(state: "open", head: "#{@repo.split("/").first}:#{@branch}")
+      request = Net::HTTP::Get.new("/repos/#{@repo}/pulls?#{query}", "Accept" => "application/vnd.github+json")
+      user, token = credentials.split(":", 2)
+      request.basic_auth(user, token || "x-oauth-basic")
+      request
+    end
+
+    SENDER = { username: "Deploio Review Apps", icon_url: "https://deploio.ch/meta/apple-touch-icon.png" }.freeze
+    DEPLOIO_BLUE = "#141d50"
+
+    # The color bar on the side comes from the (legacy) attachment, which an incoming webhook still renders.
+    def post_to_slack(text)
+      attachment = { color: DEPLOIO_BLUE, text: text, mrkdwn_in: ["text"] }
+      payload = SENDER.merge(channel: @channel, attachments: [attachment]).to_json
+      response = Net::HTTP.post(URI(@webhook_url), payload, "Content-Type" => "application/json")
+      return if response.is_a?(Net::HTTPSuccess)
+
+      abort "Slack refused the notification: #{response.code} #{response.body}"
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/setup_semaphoreci.rb

@@ -8,7 +8,7 @@ module Renuo::Cli::Commands::ReviewApp
     DEPLOY_PIPELINE_TARGET_FILE = ".semaphore/review-app-deploy.yml"
     PURGE_PIPELINE_TARGET_FILE = ".semaphore/review-app-purge.yml"
 
-    attr_reader :project, :origin_pattern
+    attr_reader :project, :origin_pattern, :slack_channel
 
     command "review-app:setup-semaphoreci" do |c|
       c.syntax = "renuo review-app:setup-semaphoreci [options]"
@@ -16,13 +16,15 @@ module Renuo::Cli::Commands::ReviewApp
       c.description = c.summary
       c.option "-p", "--project <name>", String, "The name of the Deploio project"
       c.option "--origin-pattern <pattern>", String, "Name pattern identifying the origin app to copy from"
+      c.option "--slack-channel <name>", String, "The Slack channel notified once a review app is ready"
       c.action { |_args, options| new(options).run }
     end
 
     def run
       FileUtils.mkdir_p File.dirname(DEPLOY_PIPELINE_TARGET_FILE)
       write_or_warn DEPLOY_PIPELINE_TARGET_FILE,
-                    render(DEPLOY_PIPELINE_TEMPLATE_FILE, { project:, origin_pattern:, secret_name: })
+                    render(DEPLOY_PIPELINE_TEMPLATE_FILE,
+                           { project:, origin_pattern:, secret_name:, slack_channel: })
       write_or_warn PURGE_PIPELINE_TARGET_FILE, render(PURGE_PIPELINE_TEMPLATE_FILE, { project:, secret_name: })
       print_instructions
     end
@@ -32,10 +34,11 @@ module Renuo::Cli::Commands::ReviewApp
     def initialize(options)
       @project = options.project || abort("missing project name")
       @origin_pattern = options.origin_pattern || abort("missing origin pattern")
+      @slack_channel = options.slack_channel || abort("missing Slack channel")
     end
 
     def secret_name
-      "nctl-#{project}-review-apps"
+      "review-apps"
     end
 
     # Deploio project names are prefixed with the name of their organization.
@@ -51,12 +54,17 @@ module Renuo::Cli::Commands::ReviewApp
 
           nctl create asa #{service_account_name} --project #{project}
 
-        Register its credentials as the Semaphore secret #{secret_name}, used by both pipelines:
+        Register its credentials and the incoming webhook of the Slack channel #{slack_channel}
+        (https://api.slack.com/messaging/webhooks) as the project secret #{secret_name} of the Semaphore project
+        (assumed to be named #{project} as well), used by both pipelines:
 
-          sem create secret #{secret_name} \\
+          sem create secret -p #{project} #{secret_name} \\
             -e NCTL_API_CLIENT_ID="$(nctl get asa #{service_account_name} --project #{project} --print-client-id)" \\
             -e NCTL_API_CLIENT_SECRET="$(nctl get asa #{service_account_name} --project #{project} --print-client-secret)" \\
-            -e NCTL_ORGANIZATION=#{organization}
+            -e NCTL_ORGANIZATION=#{organization} \\
+            -e SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
+
+        The deploy pipeline also reads the bundle-github secret: its BUNDLE_GITHUB__COM links the branch's pull request.
 
         Add these promotions to .semaphore/semaphore.yml (no auto_promote, so they only run on click):
 

data/lib/renuo/cli/helpers/credentials_helper.rb

@@ -1,14 +1,18 @@
 # frozen_string_literal: true
 
-require "active_support/encrypted_configuration"
-
 module CredentialsHelper
-  CONFIG = ActiveSupport::EncryptedConfiguration.new(
-    config_path: File.expand_path("../credentials.yml.enc", __dir__),
-    key_path: "", env_key: "RENUO_CLI_MASTER_KEY", raise_if_missing_key: true
-  )
+  # required lazily, it takes a large share of the CLI's startup time
+  def self.config
+    @config ||= begin
+      require "active_support/encrypted_configuration"
+      ActiveSupport::EncryptedConfiguration.new(
+        config_path: File.expand_path("../credentials.yml.enc", __dir__),
+        key_path: "", env_key: "RENUO_CLI_MASTER_KEY", raise_if_missing_key: true
+      )
+    end
+  end
 
   def credentials
-    CONFIG.config
+    CredentialsHelper.config.config
   end
 end

data/lib/renuo/cli/templates/semaphore/bin/cache_restore.erb

@@ -20,6 +20,10 @@ do
     cache restore "sprocketscache-$SEMAPHORE_GIT_BRANCH,sprocketscache-develop"
     ;;
 
+  run_times)
+    cache restore "rspec-run-times-$SEMAPHORE_GIT_BRANCH,rspec-run-times-develop,rspec-run-times-main"
+    ;;
+
   *)
     echo "Invalid argument: Cache group $cache_group not found."
     exit 1

data/lib/renuo/cli/templates/semaphore/bin/cache_store.erb

@@ -20,6 +20,15 @@ do
     cache store sprocketscache-$SEMAPHORE_GIT_BRANCH tmp/cache/assets/sprockets
     ;;
 
+  # rspec-core-parallel run times change with every build, so the key is replaced.
+  # Only main and develop store them, the other branches start from theirs.
+  run_times)
+    if [ -f tmp/rspec_parallel_run_times.txt ] && { [ "$SEMAPHORE_GIT_BRANCH" = "main" ] || [ "$SEMAPHORE_GIT_BRANCH" = "develop" ]; }; then
+      cache delete rspec-run-times-$SEMAPHORE_GIT_BRANCH
+      cache store rspec-run-times-$SEMAPHORE_GIT_BRANCH tmp/rspec_parallel_run_times.txt
+    fi
+    ;;
+
   *)
     echo "Invalid argument: Cache group $cache_group not found."
     exit 1

data/lib/renuo/cli/templates/semaphore/review-app-deploy.yml.erb

@@ -13,6 +13,7 @@ blocks:
     task:
       secrets:
         - name: <%= secret_name %>
+        - name: bundle-github
       jobs:
         - name: deploying
           commands:
@@ -42,3 +43,4 @@ blocks:
             # - renuo review-app:deploy --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --origin-pattern <%= origin_pattern %> --keep-envs=build,sensitive-build,runtime,sensitive-runtime --start
             - renuo review-app:start --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH
             - renuo ci check-deploio-status $(renuo review-app:name --branch $SEMAPHORE_GIT_WORKING_BRANCH) --project <%= project %>
+            - renuo review-app:notify --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --channel '<%= slack_channel %>'

data/lib/renuo/cli/templates/semaphore/semaphore.yml.erb

@@ -53,10 +53,12 @@ blocks:
           - sem-service start postgres 18
           - cp .env.example .env
           - bundle exec rails db:create db:schema:load
+          - source .semaphore/bin/cache_restore run_times
       jobs:
         - name: tests
           commands:
             - bin/check
+            - source .semaphore/bin/cache_store run_times
       epilogue:
         always:
           commands:

data/lib/renuo/cli/version.rb

@@ -3,7 +3,7 @@
 # simplecov:disable
 module Renuo
   class Cli
-    VERSION = "4.29.0"
+    VERSION = "4.30.0"
     NAME = "renuo-cli"
   end
 end

data/lib/renuo/cli.rb

@@ -1,18 +1,24 @@
 # frozen_string_literal: true
 
 require "active_support"
-require "active_support/core_ext"
+require "active_support/core_ext/enumerable"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/string/exclude"
+require "active_support/core_ext/string/filters"
+require "active_support/core_ext/string/inflections"
 require "colorize"
 require "fileutils"
 require "highline"
 require "json"
 require "net/http"
 require "open3"
-require "psych"
 require "securerandom"
 require "service_actor"
+require "time"
 require "tmpdir"
 require "uri"
+require "yaml"
 require "renuo/cli/version"
 
 module Renuo

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: renuo-cli
 version: !ruby/object:Gem::Version
-  version: 4.29.0
+  version: 4.30.0
 platform: ruby
 authors:
 - Renuo AG
@@ -117,8 +117,10 @@ files:
 - lib/renuo/cli/commands/heroku_users.rb
 - lib/renuo/cli/commands/list_large_git_files.rb
 - lib/renuo/cli/commands/release.rb
+- lib/renuo/cli/commands/review_app/README.md
 - lib/renuo/cli/commands/review_app/deploy.rb
 - lib/renuo/cli/commands/review_app/name.rb
+- lib/renuo/cli/commands/review_app/notify.rb
 - lib/renuo/cli/commands/review_app/purge.rb
 - lib/renuo/cli/commands/review_app/setup_semaphoreci.rb
 - lib/renuo/cli/commands/review_app/start.rb