renuo-cli 4.29.1 → 4.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd6c38dab2678be2dd22abe7ce47388faa20efaa270f7e2f2f4e09ef57d62ef4
-  data.tar.gz: 3fc28c5af477aaa418a6c6211531dd29ea4153ce80d7e74f6b70386e0a4ddd71
+  metadata.gz: e403749b46f9d289d45f218209831c68a8c624840f4df20e1315127d4ba2bbac
+  data.tar.gz: 85cd1b725f516ab96fa5da67355c9268d8397eeb3b7db4017263b3583558f4d8
 SHA512:
-  metadata.gz: 4d80152b88e3f9f8f202eb369d396f0c04785be52a4c9799a872a3dbb7d53085ee7ede4caf7264c15c75dbbf84be1510ca570bca105d97160e40617665bd974e
-  data.tar.gz: 3cd1cd4b8699861f309690a82a04d09b9fd53c9587dbb53914dc73d040e4d21cedae12e159db6af167bfafaac2d2939c13efb853bd46c41b4093023d6e40e001
+  metadata.gz: 193344bdebb9952145a2c8e948e04b8ad85f8d04d0d642c8c0f00cd1173639454c7306a7c80665de5bcc68c7e78a5de74f4406012de7e4d61cda5d0a9a173211
+  data.tar.gz: c6bd00ecd6bedcde704ab346dcfa3cdd0affae38a0413c457636c575c561b12432a9a06c1422de2673b0ff0a40bb8c7e03f66626321d7c756eb0e8ca5927ae0a

data/lib/renuo/cli/commands/ci/check_deploio_status.rb

@@ -99,7 +99,7 @@ module Renuo::Cli::Commands::Ci
     end
 
     def succeeded?(type, name, status) # rubocop:disable Metrics/MethodLength
-      time = Time.current.iso8601.to_s
+      time = Time.now.iso8601.to_s
 
       case status
       when "available", "success"

data/lib/renuo/cli/commands/release.rb

@@ -201,7 +201,8 @@ class Renuo::Cli::Commands::Release # rubocop:disable Metrics/ClassLength
       abort(">> Cancelling Release.")
     end
 
-    return unless Time.current.friday? && Time.current.hour >= 16
+    now = Time.now.getlocal
+    return unless now.friday? && now.hour >= 16
 
     unless agree(">> Are you sure you want to deploy on late Friday afternoon? " \
                  "Did you think about your family...waiting for you at home?")

data/lib/renuo/cli/commands/review_app/README.md

@@ -13,6 +13,7 @@ These are the steps of command execution in the happy path:
 1. Create or update `renuo review-app:deploy`
 1. _Intentional gap for configuration. Consider this the wiggle-room for LLMs_
 1. Start the paused app `renuo review-app:start`
+1. Announce it on Slack `renuo review-app:notify`
 1. Cleanup `renuo review-app:purge`
 
 ## Design Choices
@@ -27,3 +28,6 @@ These are the steps of command execution in the happy path:
 * All `nctl` commands are routed through `system!` and are logged in a command trail for auditing.
 * Configuration of system tools like `psql` is intentionally out of scope.
   But CI templating can give you some pointers.
+* `review-app:notify` posts the review app URL (carrying its Deploio-assigned basic auth credentials) and the
+  branch's open pull request to a Slack incoming webhook (`SLACK_WEBHOOK_URL`). The pull request lookup uses
+  bundler's `BUNDLE_GITHUB__COM` (a token or `user:token`) and never fails the pipeline when GitHub refuses it.

data/lib/renuo/cli/commands/review_app/notify.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Notify
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+    include Contracts::Core
+
+    command "review-app:notify" do |c|
+      c.syntax = "renuo review-app:notify [options]"
+      c.summary = "Posts the branch's review app URL (with its basic auth credentials) and pull request to Slack."
+      c.description = "#{c.summary} The Slack incoming webhook is read from SLACK_WEBHOOK_URL, the GitHub " \
+                      "repository from SEMAPHORE_GIT_REPO_SLUG and bundler's GitHub credentials (a token or " \
+                      "user:token) from BUNDLE_GITHUB__COM to link the branch's open pull request."
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.option "--channel <name>", String, "The Slack channel to post to"
+      c.option "--repo <owner/name>", String, "The GitHub repository, defaults to SEMAPHORE_GIT_REPO_SLUG"
+      c.example "renuo review-app:notify -p renuo-acme -b feature/42-migrate-to-deploio " \
+                "--channel '#project-acme-notifications'",
+                "Announces the branch's review app in the project's Slack channel"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      post_to_slack(message_lines.join("\n"))
+      CmdTrail::Print.call
+      puts "\nnotified #{@channel}"
+    end
+
+    private
+
+    def initialize(options)
+      @project = options.project || abort("missing project name")
+      @branch = options.branch || abort("missing branch name")
+      @channel = options.channel || abort("missing Slack channel")
+      @repo = options.repo || ENV.fetch("SEMAPHORE_GIT_REPO_SLUG", nil).presence ||
+              abort("missing GitHub repository, set SEMAPHORE_GIT_REPO_SLUG or pass --repo")
+      @webhook_url = ENV.fetch("SLACK_WEBHOOK_URL", nil).presence || abort("SLACK_WEBHOOK_URL is not set")
+      derive_app_name(@branch)
+    end
+
+    Contract String => SafeReviewAppNameContract
+    def derive_app_name(branch)
+      @app_name = review_app_name(branch)
+    end
+
+    def message_lines
+      credentials = basic_auth_credentials
+      pull_request = fetch_pull_request
+
+      [
+        "Review app is ready: #{app_link(credentials)}",
+        pull_request && pull_request_line(pull_request),
+        "Branch: <https://github.com/#{@repo}/tree/#{@branch}|#{@branch}>"
+      ].compact
+    end
+
+    def pull_request_line(pull_request)
+      "Pull request: <#{pull_request["html_url"]}|##{pull_request["number"]} #{pull_request["title"]}>"
+    end
+
+    def app_link(credentials)
+      url = app_url
+      url.userinfo = userinfo(credentials) if credentials
+      "<#{url}|#{url.host}>"
+    end
+
+    def userinfo(credentials)
+      credentials.values_at("username", "password").map { |value| URI.encode_www_form_component(value) }.join(":")
+    end
+
+    def app_url
+      url = Deploio.fetch_resource("app", @app_name, @project).to_h.dig("status", "atProvider", "defaultURLs", 0)
+      URI(url || abort("#{@app_name} has no URL assigned yet"))
+    end
+
+    # Deploio assigns basic auth credentials per app, so the review app's differ from the origin's.
+    def basic_auth_credentials
+      stdout, = system!("nctl get app #{@app_name} -p #{@project} -o json --basic-auth-credentials", quiet: true)
+      Array(JSON.parse(stdout)).first&.dig("basicauth")
+    end
+
+    def fetch_pull_request
+      credentials = ENV.fetch("BUNDLE_GITHUB__COM", "")
+      return if credentials.empty?
+
+      response = Net::HTTP.start("api.github.com", 443, use_ssl: true) do |http|
+        http.request(pull_request_request(credentials))
+      end
+      return JSON.parse(response.body).first if response.is_a?(Net::HTTPSuccess)
+
+      warn "GitHub pull request lookup failed: #{response.code}"
+      nil
+    end
+
+    def pull_request_request(credentials)
+      query = URI.encode_www_form(state: "open", head: "#{@repo.split("/").first}:#{@branch}")
+      request = Net::HTTP::Get.new("/repos/#{@repo}/pulls?#{query}", "Accept" => "application/vnd.github+json")
+      user, token = credentials.split(":", 2)
+      request.basic_auth(user, token || "x-oauth-basic")
+      request
+    end
+
+    SENDER = { username: "Deploio Review Apps", icon_url: "https://deploio.ch/meta/apple-touch-icon.png" }.freeze
+    DEPLOIO_BLUE = "#141d50"
+
+    # The color bar on the side comes from the (legacy) attachment, which an incoming webhook still renders.
+    def post_to_slack(text)
+      attachment = { color: DEPLOIO_BLUE, text: text, mrkdwn_in: ["text"] }
+      payload = SENDER.merge(channel: @channel, attachments: [attachment]).to_json
+      response = Net::HTTP.post(URI(@webhook_url), payload, "Content-Type" => "application/json")
+      return if response.is_a?(Net::HTTPSuccess)
+
+      abort "Slack refused the notification: #{response.code} #{response.body}"
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/setup_semaphoreci.rb

@@ -8,7 +8,7 @@ module Renuo::Cli::Commands::ReviewApp
     DEPLOY_PIPELINE_TARGET_FILE = ".semaphore/review-app-deploy.yml"
     PURGE_PIPELINE_TARGET_FILE = ".semaphore/review-app-purge.yml"
 
-    attr_reader :project, :origin_pattern
+    attr_reader :project, :origin_pattern, :slack_channel
 
     command "review-app:setup-semaphoreci" do |c|
       c.syntax = "renuo review-app:setup-semaphoreci [options]"
@@ -16,13 +16,15 @@ module Renuo::Cli::Commands::ReviewApp
       c.description = c.summary
       c.option "-p", "--project <name>", String, "The name of the Deploio project"
       c.option "--origin-pattern <pattern>", String, "Name pattern identifying the origin app to copy from"
+      c.option "--slack-channel <name>", String, "The Slack channel notified once a review app is ready"
       c.action { |_args, options| new(options).run }
     end
 
     def run
       FileUtils.mkdir_p File.dirname(DEPLOY_PIPELINE_TARGET_FILE)
       write_or_warn DEPLOY_PIPELINE_TARGET_FILE,
-                    render(DEPLOY_PIPELINE_TEMPLATE_FILE, { project:, origin_pattern:, secret_name: })
+                    render(DEPLOY_PIPELINE_TEMPLATE_FILE,
+                           { project:, origin_pattern:, secret_name:, slack_channel: })
       write_or_warn PURGE_PIPELINE_TARGET_FILE, render(PURGE_PIPELINE_TEMPLATE_FILE, { project:, secret_name: })
       print_instructions
     end
@@ -32,10 +34,11 @@ module Renuo::Cli::Commands::ReviewApp
     def initialize(options)
       @project = options.project || abort("missing project name")
       @origin_pattern = options.origin_pattern || abort("missing origin pattern")
+      @slack_channel = options.slack_channel || abort("missing Slack channel")
     end
 
     def secret_name
-      "nctl-#{project}-review-apps"
+      "review-apps"
     end
 
     # Deploio project names are prefixed with the name of their organization.
@@ -51,12 +54,17 @@ module Renuo::Cli::Commands::ReviewApp
 
           nctl create asa #{service_account_name} --project #{project}
 
-        Register its credentials as the Semaphore secret #{secret_name}, used by both pipelines:
+        Register its credentials and the incoming webhook of the Slack channel #{slack_channel}
+        (https://api.slack.com/messaging/webhooks) as the project secret #{secret_name} of the Semaphore project
+        (assumed to be named #{project} as well), used by both pipelines:
 
-          sem create secret #{secret_name} \\
+          sem create secret -p #{project} #{secret_name} \\
             -e NCTL_API_CLIENT_ID="$(nctl get asa #{service_account_name} --project #{project} --print-client-id)" \\
             -e NCTL_API_CLIENT_SECRET="$(nctl get asa #{service_account_name} --project #{project} --print-client-secret)" \\
-            -e NCTL_ORGANIZATION=#{organization}
+            -e NCTL_ORGANIZATION=#{organization} \\
+            -e SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
+
+        The deploy pipeline also reads the bundle-github secret: its BUNDLE_GITHUB__COM links the branch's pull request.
 
         Add these promotions to .semaphore/semaphore.yml (no auto_promote, so they only run on click):
 

data/lib/renuo/cli/helpers/credentials_helper.rb

@@ -1,14 +1,18 @@
 # frozen_string_literal: true
 
-require "active_support/encrypted_configuration"
-
 module CredentialsHelper
-  CONFIG = ActiveSupport::EncryptedConfiguration.new(
-    config_path: File.expand_path("../credentials.yml.enc", __dir__),
-    key_path: "", env_key: "RENUO_CLI_MASTER_KEY", raise_if_missing_key: true
-  )
+  # required lazily, it takes a large share of the CLI's startup time
+  def self.config
+    @config ||= begin
+      require "active_support/encrypted_configuration"
+      ActiveSupport::EncryptedConfiguration.new(
+        config_path: File.expand_path("../credentials.yml.enc", __dir__),
+        key_path: "", env_key: "RENUO_CLI_MASTER_KEY", raise_if_missing_key: true
+      )
+    end
+  end
 
   def credentials
-    CONFIG.config
+    CredentialsHelper.config.config
   end
 end

data/lib/renuo/cli/templates/semaphore/bin/cache_restore.erb

@@ -20,6 +20,10 @@ do
     cache restore "sprocketscache-$SEMAPHORE_GIT_BRANCH,sprocketscache-develop"
     ;;
 
+  run_times)
+    cache restore "rspec-run-times-$SEMAPHORE_GIT_BRANCH,rspec-run-times-develop,rspec-run-times-main"
+    ;;
+
   *)
     echo "Invalid argument: Cache group $cache_group not found."
     exit 1

data/lib/renuo/cli/templates/semaphore/bin/cache_store.erb

@@ -20,6 +20,15 @@ do
     cache store sprocketscache-$SEMAPHORE_GIT_BRANCH tmp/cache/assets/sprockets
     ;;
 
+  # rspec-core-parallel run times change with every build, so the key is replaced.
+  # Only main and develop store them, the other branches start from theirs.
+  run_times)
+    if [ -f tmp/rspec_parallel_run_times.txt ] && { [ "$SEMAPHORE_GIT_BRANCH" = "main" ] || [ "$SEMAPHORE_GIT_BRANCH" = "develop" ]; }; then
+      cache delete rspec-run-times-$SEMAPHORE_GIT_BRANCH
+      cache store rspec-run-times-$SEMAPHORE_GIT_BRANCH tmp/rspec_parallel_run_times.txt
+    fi
+    ;;
+
   *)
     echo "Invalid argument: Cache group $cache_group not found."
     exit 1

data/lib/renuo/cli/templates/semaphore/review-app-deploy.yml.erb

@@ -13,6 +13,7 @@ blocks:
     task:
       secrets:
         - name: <%= secret_name %>
+        - name: bundle-github
       jobs:
         - name: deploying
           commands:
@@ -42,3 +43,4 @@ blocks:
             # - renuo review-app:deploy --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --origin-pattern <%= origin_pattern %> --keep-envs=build,sensitive-build,runtime,sensitive-runtime --start
             - renuo review-app:start --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH
             - renuo ci check-deploio-status $(renuo review-app:name --branch $SEMAPHORE_GIT_WORKING_BRANCH) --project <%= project %>
+            - renuo review-app:notify --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --channel '<%= slack_channel %>'

data/lib/renuo/cli/templates/semaphore/semaphore.yml.erb

@@ -53,10 +53,12 @@ blocks:
           - sem-service start postgres 18
           - cp .env.example .env
           - bundle exec rails db:create db:schema:load
+          - source .semaphore/bin/cache_restore run_times
       jobs:
         - name: tests
           commands:
             - bin/check
+            - source .semaphore/bin/cache_store run_times
       epilogue:
         always:
           commands:

data/lib/renuo/cli/version.rb

@@ -3,7 +3,7 @@
 # simplecov:disable
 module Renuo
   class Cli
-    VERSION = "4.29.1"
+    VERSION = "4.30.0"
     NAME = "renuo-cli"
   end
 end

data/lib/renuo/cli.rb

@@ -1,18 +1,24 @@
 # frozen_string_literal: true
 
 require "active_support"
-require "active_support/core_ext"
+require "active_support/core_ext/enumerable"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/string/exclude"
+require "active_support/core_ext/string/filters"
+require "active_support/core_ext/string/inflections"
 require "colorize"
 require "fileutils"
 require "highline"
 require "json"
 require "net/http"
 require "open3"
-require "psych"
 require "securerandom"
 require "service_actor"
+require "time"
 require "tmpdir"
 require "uri"
+require "yaml"
 require "renuo/cli/version"
 
 module Renuo

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: renuo-cli
 version: !ruby/object:Gem::Version
-  version: 4.29.1
+  version: 4.30.0
 platform: ruby
 authors:
 - Renuo AG
@@ -120,6 +120,7 @@ files:
 - lib/renuo/cli/commands/review_app/README.md
 - lib/renuo/cli/commands/review_app/deploy.rb
 - lib/renuo/cli/commands/review_app/name.rb
+- lib/renuo/cli/commands/review_app/notify.rb
 - lib/renuo/cli/commands/review_app/purge.rb
 - lib/renuo/cli/commands/review_app/setup_semaphoreci.rb
 - lib/renuo/cli/commands/review_app/start.rb