shipit-engine 0.30.0 → 0.34.0

data/lib/shipit/command.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'pty'
 require 'shellwords'
 require 'fileutils'
@@ -12,7 +13,8 @@ module Shipit
     Denied = Class.new(Error)
     TimedOut = Class.new(Error)
 
-    BASE_ENV = Bundler.clean_env.merge((ENV.keys - Bundler.clean_env.keys).map { |k| [k, nil] }.to_h)
+    unbundled_env = Bundler.respond_to?(:unbundled_env) ? Bundler.unbundled_env : Bundler.clean_env
+    BASE_ENV = unbundled_env.merge((ENV.keys - unbundled_env.keys).map { |k| [k, nil] }.to_h)
 
     class Failed < Error
       attr_reader :exit_code
@@ -27,8 +29,8 @@ module Shipit
 
     def initialize(*args, default_timeout: Shipit.default_inactivity_timeout, env: {}, chdir:)
       @args, options = parse_arguments(args)
-      @timeout = options['timeout'.freeze] || options[:timeout] || default_timeout
-      @env = env
+      @timeout = options['timeout'] || options[:timeout] || default_timeout
+      @env = env.transform_values { |v| v&.to_s }
       @chdir = chdir.to_s
       @timed_out = false
     end
@@ -48,10 +50,7 @@ module Shipit
     def interpolate_environment_variables(argument)
       return argument.map { |a| interpolate_environment_variables(a) } if argument.is_a?(Array)
 
-      argument.gsub(/(\$\w+)/) do |variable|
-        variable.sub!('$', '')
-        Shellwords.escape(@env.fetch(variable) { ENV[variable] })
-      end
+      EnvironmentVariables.with(env).interpolate(argument)
     end
 
     def success?
@@ -88,7 +87,7 @@ module Shipit
       @out = @pid = nil
       FileUtils.mkdir_p(@chdir)
       begin
-        @out, child_in, @pid = PTY.spawn(clean_env, *interpolated_arguments, chdir: @chdir)
+        @out, child_in, @pid = PTY.spawn(unbundled_env, *interpolated_arguments, chdir: @chdir)
         child_in.close
       rescue Errno::ENOENT
         raise NotFound, "#{Shellwords.split(interpolated_arguments.first).first}: command not found"
@@ -99,8 +98,8 @@ module Shipit
       self
     end
 
-    def clean_env
-      BASE_ENV.merge('PATH' => "#{ENV['PATH']}:#{Shipit.shell_paths.join(':')}").merge(@env.stringify_keys)
+    def unbundled_env
+      BASE_ENV.merge('PATH' => "#{Shipit.shell_paths.join(':')}:#{ENV['PATH']}").merge(@env.stringify_keys)
     end
 
     def stream(&block)
@@ -149,16 +148,16 @@ module Shipit
     def read_stream(io)
       touch_last_output_at
       loop do
-          yield_control
-          yield io.read_nonblock(MAX_READ)
-          touch_last_output_at
+        yield_control
+        yield io.read_nonblock(MAX_READ)
+        touch_last_output_at
       rescue IO::WaitReadable
-          if output_timed_out?
-            @timed_out = true
-            raise TimedOut
-          end
-          IO.select([io], nil, nil, 1)
-          retry
+        if output_timed_out?
+          @timed_out = true
+          raise TimedOut
+        end
+        IO.select([io], nil, nil, 1)
+        retry
       end
     rescue EOFError
     end
@@ -194,7 +193,7 @@ module Shipit
         # If we let the child a little bit of time, it solves it.
         retry_count -= 1
         if retry_count > 0
-          sleep 0.05
+          sleep(0.05)
           retry
         end
       end
@@ -218,7 +217,7 @@ module Shipit
           argument
         end
       end
-      return args, options
+      [args.map(&:to_s), options]
     end
 
     def running?

data/lib/shipit/commands.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class Commands
     class << self
@@ -6,13 +7,13 @@ module Shipit
       end
 
       def git_version
-        @git_version ||= parse_git_version(`git --version`)
+        @git_version ||= parse_git_version(%x(git --version))
       end
 
       def parse_git_version(raw_git_version)
-        raw_git_version =~ /(\d+\.\d+\.\d+)/
-        raise 'git command not found' unless $1
-        Gem::Version.new($1)
+        match_info = raw_git_version.match(/(\d+\.\d+\.\d+)/)
+        raise 'git command not found' unless match_info
+        Gem::Version.new(match_info[1])
       end
     end
 
@@ -20,8 +21,8 @@ module Shipit
 
     def env
       @env ||= Shipit.env.merge(
-        'GITHUB_DOMAIN' => Shipit.github.domain,
-        'GITHUB_TOKEN' => Shipit.github.token,
+        'GITHUB_DOMAIN' => github.domain,
+        'GITHUB_TOKEN' => github.token,
         'GIT_ASKPASS' => Shipit::Engine.root.join('lib', 'snippets', 'git-askpass').realpath.to_s,
       )
     end
@@ -29,5 +30,12 @@ module Shipit
     def git(*args)
       Command.new("git", *args)
     end
+    ruby2_keywords :git if respond_to?(:ruby2_keywords, true)
+
+    private
+
+    def github
+      Shipit.github
+    end
   end
 end

data/lib/shipit/csv_serializer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   module CSVSerializer
     extend self

data/lib/shipit/deploy_commands.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class DeployCommands < TaskCommands
     def steps

data/lib/shipit/engine.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class Engine < ::Rails::Engine
     isolate_namespace Shipit
@@ -9,6 +10,8 @@ module Shipit
       Shipit::Engine.routes.default_url_options[:host] = Shipit.host
       Pubsubstub.redis_url = Shipit.redis_url.to_s
 
+      Rails.application.secrets.deep_symbolize_keys!
+
       app.config.assets.paths << Emoji.images_path
       app.config.assets.precompile += %w(
         favicon.ico
@@ -32,12 +35,16 @@ module Shipit
       ActiveModel::Serializer.include(Engine.routes.url_helpers)
 
       if Shipit.github.oauth?
-        OmniAuth::Strategies::GitHub.configure path_prefix: '/github/auth'
-        app.middleware.use OmniAuth::Builder do
+        OmniAuth::Strategies::GitHub.configure(path_prefix: '/github/auth')
+        app.middleware.use(OmniAuth::Builder) do
           provider(:github, *Shipit.github.oauth_config)
         end
       end
 
+      if Shipit.enable_samesite_middleware?
+        app.config.middleware.insert_after(::Rack::Runtime, Shipit::SameSiteCookieMiddleware)
+      end
+
       app.config.after_initialize do
         ActionController::Base.include(Shipit::ActiveModelSerializersPatch)
       end

data/lib/shipit/environment_variables.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class EnvironmentVariables
     NotPermitted = Class.new(StandardError)
@@ -14,6 +15,15 @@ module Shipit
       sanitize_env_vars(variable_definitions)
     end
 
+    def interpolate(argument)
+      return argument unless @env
+
+      argument.gsub(/(\$\w+)/) do |variable|
+        variable.sub!('$', '')
+        Shellwords.escape(@env.fetch(variable) { ENV[variable] })
+      end
+    end
+
     private
 
     def initialize(env)
@@ -26,7 +36,7 @@ module Shipit
       allowed, disallowed = @env.partition { |k, _| allowed_variables.include?(k) }.map(&:to_h)
 
       error_message = "Variables #{disallowed.keys.to_sentence} have not been whitelisted"
-      raise NotPermitted.new(error_message) unless disallowed.empty?
+      raise NotPermitted, error_message unless disallowed.empty?
 
       allowed
     end

data/lib/shipit/first_parent_commits_iterator.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class FirstParentCommitsIterator < OctokitIterator
     def each

data/lib/shipit/flock.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'English'
 require 'timeout'
 require 'pathname'
@@ -10,14 +11,21 @@ module Shipit
 
     def initialize(path)
       @path = Pathname.new(path)
+      @acquired = false
     end
 
     def lock(timeout:)
+      return yield if @acquired
       path.parent.mkpath
       path.open('w') do |file|
         if retrying(timeout: timeout) { file.flock(File::LOCK_EX | File::LOCK_NB) }
           file.write($PROCESS_ID.to_s)
-          return yield
+          @acquired = true
+          begin
+            yield
+          ensure
+            @acquired = false
+          end
         else
           raise TimeoutError, "Couldn't acquire lock for #{path} in #{timeout} seconds"
         end

data/lib/shipit/github_app.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class GitHubApp
     include Mutex_m
@@ -31,9 +32,9 @@ module Shipit
       end
     end
 
-    DOMAIN = 'github.com'.freeze
+    DOMAIN = 'github.com'
     AuthenticationFailed = Class.new(StandardError)
-    API_STATUS_ID = 'brv1bkgrwx7q'.freeze
+    API_STATUS_ID = 'brv1bkgrwx7q'
 
     GITHUB_EXPECTED_TOKEN_LIFETIME = 60.minutes
     GITHUB_TOKEN_RAILS_CACHE_LIFETIME = 50.minutes
@@ -41,8 +42,9 @@ module Shipit
 
     attr_reader :oauth_teams, :domain, :bot_login
 
-    def initialize(config)
+    def initialize(organization, config)
       super()
+      @organization = organization
       @config = (config || {}).with_indifferent_access
       @domain = @config[:domain] || DOMAIN
       @webhook_secret = @config[:webhook_secret].presence
@@ -51,7 +53,7 @@ module Shipit
       oauth = (@config[:oauth] || {}).with_indifferent_access
       @oauth_id = oauth[:id]
       @oauth_secret = oauth[:secret]
-      @oauth_teams = Array.wrap(oauth[:teams] || oauth[:teams])
+      @oauth_teams = Array.wrap(oauth[:teams])
     end
 
     def login
@@ -91,10 +93,11 @@ module Shipit
     end
 
     def fetch_new_token
+      cache_key = @organization.nil? ? '' : "#{@organization.downcase}:"
       # Rails can add 5 minutes to the cache entry expiration time when any TTL is provided,
       # so our TTL setting can be lower, and TTL + expires_in should be lower than the GitHub token expiration.
       Rails.cache.fetch(
-        'github:integration:access-token',
+        "github:integration:#{cache_key}access-token",
         expires_in: GITHUB_TOKEN_RAILS_CACHE_LIFETIME,
         race_condition_ttl: 4.minutes,
       ) do
@@ -132,7 +135,7 @@ module Shipit
     end
 
     def url(*path)
-      @url ||= "https://#{domain}".freeze
+      @url ||= "https://#{domain}"
       path.empty? ? @url : File.join(@url, *path.map(&:to_s))
     end
 
@@ -173,22 +176,22 @@ module Shipit
           logger: Rails.logger,
           serializer: NullSerializer,
         )
-        builder.use GitHubHTTPCacheMiddleware
-        builder.use Octokit::Response::RaiseError
-        builder.adapter Faraday.default_adapter
+        builder.use(GitHubHTTPCacheMiddleware)
+        builder.use(Octokit::Response::RaiseError)
+        builder.adapter(Faraday.default_adapter)
       end
     end
 
     def app_id
-      @app_id ||= @config.fetch(:app_id)
+      @config.fetch(:app_id)
     end
 
     def installation_id
-      @installation_id ||= @config.fetch(:installation_id)
+      @config.fetch(:installation_id)
     end
 
     def private_key
-      @private_key ||= @config.fetch(:private_key)
+      @config.fetch(:private_key)
     end
 
     def authentication_payload

data/lib/shipit/github_http_cache_middleware.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class GitHubHTTPCacheMiddleware < Faraday::Middleware
     def call(request_env)

data/lib/shipit/null_serializer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   module NullSerializer
     extend self

data/lib/shipit/octokit_check_runs.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
 module OctokitCheckRuns
   def check_runs(repo, sha, options = {})
-    paginate "#{Octokit::Repository.path repo}/commits/#{sha}/check-runs", options.reverse_merge(
+    paginate("#{Octokit::Repository.path(repo)}/commits/#{sha}/check-runs", options.reverse_merge(
       accept: 'application/vnd.github.antiope-preview+json',
-    )
+    ))
   end
 end
 

data/lib/shipit/octokit_iterator.rb

@@ -1,13 +1,14 @@
+# frozen_string_literal: true
 module Shipit
   class OctokitIterator
     include Enumerable
 
-    def initialize(relation = nil)
+    def initialize(relation = nil, github_api: nil)
       if relation
         @response = relation.get(per_page: 100)
       else
-        yield Shipit.github.api
-        @response = Shipit.github.api.last_response
+        data = yield github_api
+        @response = github_api.last_response if data.present?
       end
     end
 

data/lib/shipit/paginator.rb

@@ -1,6 +1,7 @@
+# frozen_string_literal: true
 module Shipit
   class Paginator
-    def initialize(resources, controller, order: {id: :desc}, max_page_size: 100, default_page_size: 30)
+    def initialize(resources, controller, order: { id: :desc }, max_page_size: 100, default_page_size: 30)
       @order = order
       @controller = controller
       @since = controller.params[:since].presence
@@ -15,7 +16,7 @@ module Shipit
     end
 
     def links
-      links = {first: link_to(since: nil, page_size: (page_size if page_size != @default_page_size))}
+      links = { first: link_to(since: nil, page_size: (page_size if page_size != @default_page_size)) }
       links[:next] = link_to(since: to_a.last.id) unless last_page?
       links
     end

data/lib/shipit/review_stack_commands.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require 'shipit/stack_commands'
+
+module Shipit
+  class ReviewStackCommands < Shipit::StackCommands
+  end
+end

data/lib/shipit/rollback_commands.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Shipit
   class RollbackCommands < DeployCommands
     def steps

data/lib/shipit/same_site_cookie_middleware.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+module Shipit
+  class SameSiteCookieMiddleware
+    COOKIE_SEPARATOR = "\n"
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+
+      if headers && headers['Set-Cookie'] &&
+         Rack::Request.new(env).ssl?
+
+        set_cookies = headers['Set-Cookie'].split(COOKIE_SEPARATOR).compact
+        set_cookies.map! do |cookie|
+          cookie << '; Secure' if cookie !~ /;\s*secure/i
+          cookie << '; SameSite=None' unless cookie.match?(/;\s*samesite=/i)
+          cookie
+        end
+
+        headers['Set-Cookie'] = set_cookies.join(COOKIE_SEPARATOR)
+      end
+
+      [status, headers, body]
+    end
+  end
+end