shipit-engine 0.45.1 → 0.45.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 391e77ca5abe04617e4a8516804feb802778b777a37fe3797f37986d9344838d
-  data.tar.gz: 7cbf010614b60f11a67ca39c25d3a5c3a15a404f59160566989b705690fa652f
+  metadata.gz: afae76c5544a76b67f5b809fcd76784ba9a24cdbfe2a38d3b6ac646e618e535a
+  data.tar.gz: f7756ed9a71bfb8c9b138206ea830a8d0d972e7e5cd3284b2b7a880afdb7112b
 SHA512:
-  metadata.gz: be5fe9aba69281bef4a301180f0814c16e6094b1a3949f1903ae3e10bb2f8cd5375d9078994f210d8337eb30a84ae8afb585d838dd99d727ec9abb112df50677
-  data.tar.gz: 9e64330a930d8cd30599196a750ee5eb8ed73c310dcbf76752307c10991c61198ae11ce063ab2831daa537318b9f332eede5f1d6455e07c295daba30e3c56cd7
+  metadata.gz: 45ad16450ce9f7f4cd94af2f109362b9da7fa74a02b54b017098f615c647711681c8b8f2ebc44b0bef6f8e5e03d0d415faf05191d377c6af8aab6e8cefe08b01
+  data.tar.gz: 881b0fb03c78cd01d7c25e8de9cf9421e74cb7abbd7855ecb8b7de5024364323b8ba531362c083d3019fa60dbd2075b34fd0fba2aa6e3141d10b7ce21ae6324d

data/app/controllers/shipit/api/stacks_controller.rb

@@ -69,7 +69,12 @@ module Shipit
       def refresh
         RefreshStatusesJob.perform_later(stack_id: stack.id)
         RefreshCheckRunsJob.perform_later(stack_id: stack.id)
-        GithubSyncJob.perform_later(stack_id: stack.id)
+        # force_spec_cache: explicit refreshes always recompute the cached deploy
+        # spec, even when the head hasn't moved: refreshing is how a stale or
+        # broken cached spec is fixed. Threading it through the sync job (rather
+        # than enqueuing CacheDeploySpecJob directly) guarantees the spec is
+        # computed from the post-sync head.
+        GithubSyncJob.perform_later(stack_id: stack.id, force_spec_cache: true)
         render_resource(stack, status: :accepted)
       end
 

data/app/controllers/shipit/api_clients_controller.rb

@@ -43,7 +43,9 @@ module Shipit
     end
 
     def update_params
-      params.require(:api_client).permit(permissions: [])
+      permitted = params.require(:api_client).permit(permissions: [])
+      permitted[:permissions] = permitted[:permissions].reject(&:blank?)
+      permitted
     end
   end
 end

data/app/controllers/shipit/stacks_controller.rb

@@ -94,7 +94,12 @@ module Shipit
     def refresh
       RefreshStatusesJob.perform_later(stack_id: @stack.id)
       RefreshCheckRunsJob.perform_later(stack_id: @stack.id)
-      GithubSyncJob.perform_later(stack_id: @stack.id)
+      # force_spec_cache: explicit refreshes always recompute the cached deploy
+      # spec, even when the head hasn't moved: refreshing is how a stale or
+      # broken cached spec is fixed. Threading it through the sync job (rather
+      # than enqueuing CacheDeploySpecJob directly) guarantees the spec is
+      # computed from the post-sync head.
+      GithubSyncJob.perform_later(stack_id: @stack.id, force_spec_cache: true)
       flash[:success] = 'Refresh scheduled'
       redirect_to(request.referer.presence || stack_path(@stack))
     end

data/app/jobs/shipit/cache_deploy_spec_job.rb

@@ -7,13 +7,25 @@ module Shipit
 
     queue_as :deploys
 
+    # Caps job execution AND sets the dedupe lock expiration to match.
+    # Without it the lock falls back to Unique::DEFAULT_TIMEOUT (10s), which is
+    # far shorter than the job's runtime, letting duplicate jobs for the same
+    # stack run concurrently once the lock expires mid-run.
+    self.timeout = 15.minutes.to_i
+
     def perform(stack)
       return if stack.inaccessible?
 
+      commit = stack.commits.reachable.last
       commands = Commands.for(stack)
-      commands.with_temporary_working_directory(commit: stack.commits.reachable.last) do |path|
+      commands.with_temporary_working_directory(commit:, recursive: false) do |path|
         stack.update!(cached_deploy_spec: DeploySpec::FileSystem.new(path, stack))
       end
+
+      # A duplicate enqueued while this job held the dedupe lock was dropped;
+      # if the head moved under us, that dropped job's work is still
+      # outstanding, so hand it off rather than leaving the spec stale.
+      CacheDeploySpecJob.perform_later(stack) if stack.commits.reachable.last&.id != commit&.id
     end
   end
 end

data/app/jobs/shipit/create_on_github_job.rb

@@ -7,6 +7,17 @@ module Shipit
     queue_as :default
     on_duplicate :drop
 
+    # Transient Octokit::Unauthorized = GitHub installation-token propagation lag.
+    # attempts: 14 (~24h) outlasts the 50m token cache (GITHUB_TOKEN_RAILS_CACHE_LIFETIME).
+    # No token eviction here to avoid a remint storm across workers.
+    retry_on Octokit::Unauthorized, wait: :polynomially_longer, attempts: 14 do |job, exception|
+      record = job.arguments.first
+      Rails.logger.warn(
+        "[CreateOnGithubJob] Giving up on #{record.class.name} #{record.id} " \
+          "after GitHub authentication failures: #{exception.class} #{exception.message}"
+      )
+    end
+
     # We observe that some objects regularly take longer than the default 10 seconds to create, e.g. deployments
     self.timeout = 40
     self.lock_timeout = 20

data/app/jobs/shipit/github_sync_job.rb

@@ -19,6 +19,8 @@ module Shipit
       @stack = Stack.find(params[:stack_id])
       expected_head_sha = params[:expected_head_sha]
       retry_count = params[:retry_count] || 0
+      head_before_sync = spec_cache_target
+      appended_commits = []
 
       handle_github_errors do
         new_commits, shared_parent = fetch_missing_commits { stack.github_commits }
@@ -38,6 +40,11 @@ module Shipit
           stack.lock_reverted_commits! if appended_commits.any?(&:revert?)
         end
       end
+      sync_changed_nothing = appended_commits.empty? &&
+                             spec_cache_target == head_before_sync &&
+                             stack.cached_deploy_spec.present?
+      return if sync_changed_nothing && !params[:force_spec_cache]
+
       CacheDeploySpecJob.perform_later(stack)
     end
 
@@ -63,6 +70,13 @@ module Shipit
 
     protected
 
+    # The commit CacheDeploySpecJob would check out: the newest reachable one.
+    # If it didn't change during the sync (no appends, no detaches), the cached
+    # spec is still accurate and doesn't need to be recomputed.
+    def spec_cache_target
+      stack.commits.reachable.last&.sha
+    end
+
     def handle_github_errors
       yield
     rescue Octokit::NotFound

data/app/models/shipit/deploy_spec/file_system.rb

@@ -106,24 +106,30 @@ module Shipit
         build_config(config_file_path, config_obj)
       end
 
+      YAML_EXTENSIONS = ["yml", "yaml"].freeze
+
       def shipit_file_names_in_priority_order
-        [
-          "#{app_name}.#{@env}.yml",
-          ".shipit/#{app_name}.#{@env}.yml",
+        YAML_EXTENSIONS.flat_map do |ext|
+          [
+            "#{app_name}.#{@env}.#{ext}",
+            ".shipit/#{app_name}.#{@env}.#{ext}",
 
-          "#{app_name}.yml",
-          ".shipit/#{app_name}.yml",
+            "#{app_name}.#{ext}",
+            ".shipit/#{app_name}.#{ext}",
 
-          "shipit.#{@env}.yml",
-          ".shipit/#{@env}.yml",
+            "shipit.#{@env}.#{ext}",
+            ".shipit/#{@env}.#{ext}",
 
-          "shipit.yml",
-          ".shipit/shipit.yml"
-        ].uniq
+            "shipit.#{ext}",
+            ".shipit/shipit.#{ext}"
+          ]
+        end.uniq
       end
 
       def bare_shipit_filenames
-        ["#{app_name}.yml", "shipit.yml", ".shipit/#{app_name}.yml", ".shipit/shipit.yml"].uniq
+        YAML_EXTENSIONS.flat_map do |ext|
+          ["#{app_name}.#{ext}", "shipit.#{ext}", ".shipit/#{app_name}.#{ext}", ".shipit/shipit.#{ext}"]
+        end.uniq
       end
 
       def config_file_path

data/app/models/shipit/stack.rb

@@ -117,11 +117,17 @@ module Shipit
     )
 
     def self.refresh_deployed_revisions
-      find_each.select(&:supports_fetch_deployed_revision?).each(&:async_refresh_deployed_revision)
+      # where.not avoids deserializing every stack's cached_deploy_spec each
+      # minute: a stack without a cached spec cannot have fetch steps.
+      not_archived
+        .where.not(cached_deploy_spec: nil)
+        .find_each
+        .select(&:supports_fetch_deployed_revision?)
+        .each(&:async_refresh_deployed_revision)
     end
 
     def self.schedule_continuous_delivery
-      where(continuous_deployment: true).find_each do |stack|
+      not_archived.where(continuous_deployment: true).find_each do |stack|
         ContinuousDeliveryJob.perform_later(stack)
       end
     end

data/app/views/shipit/api_clients/show.html.erb

@@ -17,6 +17,7 @@
   <section>
     <%= form_for @api_client, url: api_client_path(@api_client) do |f| %>
       <h3> Permissions </h3>
+      <%= hidden_field_tag 'api_client[permissions][]', '' %>
       <ul class="deploy-checklist">
         <% Shipit::ApiClient::PERMISSIONS.each do |permission| %>
           <li class="deploy-checklist__item">

data/lib/shipit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shipit
-  VERSION = '0.45.1'
+  VERSION = '0.45.3'
 end

data/test/controllers/api/stacks_controller_test.rb

@@ -260,8 +260,8 @@ module Shipit
         assert_json 'message', 'This operation requires the `write:stack` permission'
       end
 
-      test "#refresh queues a GithubSyncJob" do
-        assert_enqueued_with(job: GithubSyncJob, args: [stack_id: @stack.id]) do
+      test "#refresh queues a GithubSyncJob with force_spec_cache" do
+        assert_enqueued_with(job: GithubSyncJob, args: [stack_id: @stack.id, force_spec_cache: true]) do
           post :refresh, params: { id: @stack.to_param }
         end
         assert_response :accepted

data/test/controllers/stacks_controller_test.rb

@@ -204,7 +204,7 @@ module Shipit
 
       assert_enqueued_with(job: RefreshStatusesJob, args: [stack_id: @stack.id]) do
         assert_enqueued_with(job: RefreshCheckRunsJob, args: [stack_id: @stack.id]) do
-          assert_enqueued_with(job: GithubSyncJob, args: [stack_id: @stack.id]) do
+          assert_enqueued_with(job: GithubSyncJob, args: [stack_id: @stack.id, force_spec_cache: true]) do
             post :refresh, params: { id: @stack.to_param }
           end
         end

data/test/jobs/cache_deploy_spec_job_test.rb

@@ -14,11 +14,67 @@ module Shipit
       @stack.update!(cached_deploy_spec: DeploySpec.new('review' => { 'checklist' => %w[foo bar] }))
 
       dir = Pathname(Dir.tmpdir)
-      StackCommands.any_instance.expects(:with_temporary_working_directory).with(commit: @last_commit).yields(dir)
+      StackCommands.any_instance.expects(:with_temporary_working_directory)
+                   .with(commit: @last_commit, recursive: false).yields(dir)
 
       assert_equal %w[foo bar], @stack.checklist
       @job.perform(@stack)
       assert_equal [], @stack.reload.checklist
     end
+
+    test "the dedupe lock expiration covers the job runtime" do
+      assert_operator CacheDeploySpecJob.timeout, :>, BackgroundJob::Unique::DEFAULT_TIMEOUT
+      assert_equal 15.minutes.to_i, CacheDeploySpecJob.timeout
+    end
+
+    test "the redis lock is created with the job timeout as its expiration" do
+      mutex = mock
+      mutex.expects(:lock).yields
+      Redis::Lock.expects(:new)
+                 .with(anything, anything, expiration: 15.minutes.to_i, timeout: 0)
+                 .returns(mutex)
+
+      executed = false
+      CacheDeploySpecJob.new(@stack).acquire_lock { executed = true }
+      assert executed
+    end
+
+    test "#perform re-enqueues itself when the head moves during the run" do
+      moved_head = @stack.commits.reachable.first
+      reachable = mock
+      reachable.stubs(:last).returns(@last_commit, moved_head)
+      @stack.stubs(:commits).returns(stub(reachable:))
+      @stack.stubs(:update!) # side-effect callbacks are irrelevant to this test
+
+      StackCommands.any_instance.expects(:with_temporary_working_directory)
+                   .with(commit: @last_commit, recursive: false).yields(Pathname(Dir.tmpdir))
+
+      assert_enqueued_with(job: CacheDeploySpecJob, args: [@stack]) do
+        @job.perform(@stack)
+      end
+    end
+
+    test "#perform does not re-enqueue itself when the head is unchanged" do
+      StackCommands.any_instance.expects(:with_temporary_working_directory)
+                   .with(commit: @last_commit, recursive: false).yields(Pathname(Dir.tmpdir))
+
+      assert_no_enqueued_jobs(only: CacheDeploySpecJob) do
+        @job.perform(@stack)
+      end
+    end
+
+    test "a duplicate job for the same stack is dropped while the lock is held" do
+      job = CacheDeploySpecJob.new(@stack)
+      duplicate = CacheDeploySpecJob.new(@stack)
+      duplicate_ran = false
+
+      job.acquire_lock do
+        duplicate.acquire_lock do
+          duplicate_ran = true
+        end
+      end
+
+      refute duplicate_ran, "duplicate should have been dropped, not executed"
+    end
   end
 end

data/test/jobs/github_sync_job_test.rb

@@ -16,10 +16,50 @@ module Shipit
       @job.perform(stack_id: @stack.id)
     end
 
-    test "#perform finally enqueue a CacheDeploySpecJob" do
+    test "#perform does not enqueue a CacheDeploySpecJob when the sync found nothing new" do
+      Stack.any_instance.stubs(:github_commits).returns(@github_commits)
+      @job.stubs(:fetch_missing_commits).yields.returns([[], nil])
+
+      assert_no_enqueued_jobs(only: CacheDeploySpecJob) do
+        @job.perform(stack_id: @stack.id)
+      end
+    end
+
+    test "#perform enqueues a CacheDeploySpecJob when the cached spec is missing" do
+      @stack.update!(cached_deploy_spec: nil)
+      Stack.any_instance.stubs(:github_commits).returns(@github_commits)
+      @job.stubs(:fetch_missing_commits).yields.returns([[], nil])
+
+      assert_enqueued_with(job: CacheDeploySpecJob, args: [@stack]) do
+        @job.perform(stack_id: @stack.id)
+      end
+    end
+
+    test "#perform enqueues a CacheDeploySpecJob when nothing changed but force_spec_cache is set" do
       Stack.any_instance.stubs(:github_commits).returns(@github_commits)
       @job.stubs(:fetch_missing_commits).yields.returns([[], nil])
 
+      assert_enqueued_with(job: CacheDeploySpecJob, args: [@stack]) do
+        @job.perform(stack_id: @stack.id, force_spec_cache: true)
+      end
+    end
+
+    test "#perform preserves force_spec_cache across eventual-consistency retries" do
+      expected_sha = "abcd1234"
+      Stack.any_instance.expects(:github_commits).returns(@github_commits)
+      @job.expects(:fetch_missing_commits).yields.returns([[], nil])
+      @job.expects(:commit_exists?).with(expected_sha).returns(false)
+
+      expected_args = { stack_id: @stack.id, expected_head_sha: expected_sha, force_spec_cache: true, retry_count: 1 }
+      assert_enqueued_with(job: GithubSyncJob, args: [expected_args]) do
+        @job.perform(stack_id: @stack.id, expected_head_sha: expected_sha, force_spec_cache: true)
+      end
+    end
+
+    test "#perform enqueues a CacheDeploySpecJob when commits are detached without new commits" do
+      Stack.any_instance.stubs(:github_commits).returns(@github_commits)
+      @job.stubs(:fetch_missing_commits).yields.returns([[], shipit_commits(:third)])
+
       assert_enqueued_with(job: CacheDeploySpecJob, args: [@stack]) do
         @job.perform(stack_id: @stack.id)
       end
@@ -155,7 +195,9 @@ module Shipit
       @job.expects(:fetch_missing_commits).yields.returns([[], nil])
       @job.expects(:commit_exists?).with(expected_sha).returns(true)
 
-      assert_enqueued_with(job: CacheDeploySpecJob, args: [@stack]) do
+      # No retry is scheduled, and since the sync found nothing new,
+      # no spec re-cache is needed either.
+      assert_no_enqueued_jobs(only: [GithubSyncJob, CacheDeploySpecJob]) do
         @job.perform(stack_id: @stack.id, expected_head_sha: expected_sha)
       end
     end

data/test/jobs/perform_task_job_test.rb

@@ -107,7 +107,7 @@ module Shipit
     end
 
     test "mark deploy as error an unexpected exception is raised" do
-      Command.any_instance.expects(:stream!).at_least_once.raises(Command::Denied)
+      Shipit::TaskExecutionStrategy::Default.any_instance.expects(:capture!).at_least_once.raises(Command::Denied)
 
       @job.perform(@deploy)
 
@@ -116,7 +116,7 @@ module Shipit
     end
 
     test "mark deploy as timedout if a command timeout" do
-      Command.any_instance.expects(:stream!).at_least_once.raises(Command::TimedOut)
+      Shipit::TaskExecutionStrategy::Default.any_instance.expects(:capture!).at_least_once.raises(Command::TimedOut)
 
       @job.perform(@deploy)
 
@@ -129,7 +129,7 @@ module Shipit
       begin
         Shipit.timeout_exit_codes = [70].freeze
 
-        Command.any_instance.expects(:stream!).at_least_once.raises(Command::Failed.new('Blah', 70))
+        Shipit::TaskExecutionStrategy::Default.any_instance.expects(:capture!).at_least_once.raises(Command::Failed.new('Blah', 70))
 
         @job.perform(@deploy)
 

data/test/jobs/shipit/create_on_github_job_test.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+module Shipit
+  class CreateOnGithubJobTest < ActiveSupport::TestCase
+    setup do
+      @deployment = shipit_commit_deployments(:shipit_pending_fourth)
+    end
+
+    test "#perform retries on GitHub authentication errors" do
+      CommitDeployment.any_instance.stubs(:create_on_github!).raises(Octokit::Unauthorized)
+
+      assert_enqueued_with(job: CreateOnGithubJob) do
+        CreateOnGithubJob.perform_now(@deployment)
+      end
+    end
+
+    test "#perform gives up without re-raising after exhausting authentication retries" do
+      CommitDeployment.any_instance.stubs(:create_on_github!).raises(Octokit::Unauthorized)
+      Rails.logger.stubs(:warn)
+
+      job = CreateOnGithubJob.new(@deployment)
+      job.exception_executions = { "[Octokit::Unauthorized]" => 13 }
+
+      assert_nothing_raised { job.perform_now }
+    end
+  end
+end

data/test/models/shipit/stack_test.rb

@@ -11,6 +11,38 @@ module Shipit
       GithubHook.any_instance.stubs(:teardown!)
     end
 
+    test ".schedule_continuous_delivery skips archived stacks" do
+      archived = shipit_stacks(:archived_6hours_ago)
+      archived.update!(continuous_deployment: true)
+      @stack.update!(continuous_deployment: true)
+
+      Stack.schedule_continuous_delivery
+
+      enqueued_args = enqueued_jobs
+                      .select { |job| job[:job] == ContinuousDeliveryJob }
+                      .map { |job| job[:args].to_s }
+      assert enqueued_args.any? { |args| args.include?("Stack/#{@stack.id}") },
+             "expected a ContinuousDeliveryJob for the active stack"
+      refute enqueued_args.any? { |args| args.include?("Stack/#{archived.id}") },
+             "archived stacks must not trigger continuous delivery"
+    end
+
+    test ".refresh_deployed_revisions skips archived stacks" do
+      archived = shipit_stacks(:archived_6hours_ago)
+      archived.update!(cached_deploy_spec: DeploySpec.new('fetch' => ['echo 1']))
+      @stack.update!(cached_deploy_spec: DeploySpec.new('fetch' => ['echo 1']))
+
+      Stack.refresh_deployed_revisions
+
+      enqueued_args = enqueued_jobs
+                      .select { |job| job[:job] == FetchDeployedRevisionJob }
+                      .map { |job| job[:args].to_s }
+      assert enqueued_args.any? { |args| args.include?("Stack/#{@stack.id}") },
+             "expected a FetchDeployedRevisionJob for the active stack with fetch steps"
+      refute enqueued_args.any? { |args| args.include?("Stack/#{archived.id}") },
+             "archived stacks must not refresh deployed revisions"
+    end
+
     test "branch defaults to default branch name" do
       @stack.branch = ""
       Shipit.github.api.expects(:repo).with("shopify/shipit-engine").returns(

data/vendor/assets/javascripts/clusterize.js

@@ -251,7 +251,12 @@
       var tag = document.createElement(this.options.tag),
         clusterize_prefix = 'clusterize-';
       tag.className = [clusterize_prefix + 'extra-row', clusterize_prefix + class_name].join(' ');
-      height && (tag.style.height = height + 'px');
+      // CSP FIX: this element is serialized to markup via outerHTML and re-parsed by
+      // innerHTML below. Under a `style-src` policy without 'unsafe-inline', the browser
+      // refuses to apply a style ATTRIBUTE that came from parsed markup, so the spacer
+      // renders at height 0 and virtual scrolling collapses. Carry the height in a data
+      // attribute instead and apply it through CSSOM after insertion, which CSP allows.
+      height && tag.setAttribute('data-clusterize-height', height);
       return tag.outerHTML;
     },
     // if necessary verify data changed and insert to DOM
@@ -279,6 +284,14 @@
       }
     },
     // unfortunately ie <= 9 does not allow to use innerHTML for table elements, so make a workaround
+    // CSP FIX: apply spacer heights via CSSOM once the nodes are live in the document.
+    applyExtraRowHeights: function() {
+      var rows = this.content_elem.getElementsByClassName('clusterize-extra-row');
+      for(var i = 0; i < rows.length; i++) {
+        var h = rows[i].getAttribute('data-clusterize-height');
+        if(h) rows[i].style.height = h + 'px';
+      }
+    },
     html: function(data) {
       var content_elem = this.content_elem;
       if(ie && ie <= 9 && this.options.tag == 'tr') {
@@ -294,6 +307,7 @@
       } else {
         content_elem.innerHTML = data;
       }
+      this.applyExtraRowHeights();
     },
     getChildNodes: function(tag) {
         var child_nodes = tag.children, nodes = [];

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shipit-engine
 version: !ruby/object:Gem::Version
-  version: 0.45.1
+  version: 0.45.3
 platform: ruby
 authors:
 - Jean Boussier
@@ -918,6 +918,7 @@ files:
 - test/jobs/refresh_status_job_test.rb
 - test/jobs/shipit/background_job_test.rb
 - test/jobs/shipit/continuous_delivery_job_test.rb
+- test/jobs/shipit/create_on_github_job_test.rb
 - test/jobs/unique_job_test.rb
 - test/jobs/update_github_last_deployed_ref_job_test.rb
 - test/lib/shipit/deploy_commands_test.rb
@@ -1018,7 +1019,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.8
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Application deployment software
 test_files:
@@ -1150,6 +1151,7 @@ test_files:
 - test/jobs/refresh_status_job_test.rb
 - test/jobs/shipit/background_job_test.rb
 - test/jobs/shipit/continuous_delivery_job_test.rb
+- test/jobs/shipit/create_on_github_job_test.rb
 - test/jobs/unique_job_test.rb
 - test/jobs/update_github_last_deployed_ref_job_test.rb
 - test/lib/shipit/deploy_commands_test.rb