qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/change_owners/self_service_roles.py

@@ -8,15 +8,75 @@ from reconcile.change_owners.approver import (
 from reconcile.change_owners.bundle import BundleFileType
 from reconcile.change_owners.change_types import (
     Approver,
-    BundleFileChange,
     ChangeTypeContext,
     ChangeTypeProcessor,
+    FileChange,
 )
+from reconcile.change_owners.changes import BundleFileChange
+from reconcile.gql_definitions.change_owners.queries import self_service_roles
 from reconcile.gql_definitions.change_owners.queries.self_service_roles import (
     PermissionGitlabGroupMembershipV1,
     PermissionSlackUsergroupV1,
     RoleV1,
 )
+from reconcile.utils import expiration, gql
+from reconcile.utils.membershipsources.models import (
+    RoleBot,
+    RoleMember,
+    RoleUser,
+)
+from reconcile.utils.membershipsources.resolver import resolve_role_members
+
+CHANGE_OWNERS_LABELS_LABEL = "change-owners-labels"
+
+
+class NoApproversInSelfServiceRoleError(Exception):
+    """
+    Thrown when a self-service role has no approvers
+    """
+
+
+class DatafileIncompatibleWithChangeTypeError(Exception):
+    """
+    Thrown when a datafile and a change type are hooked up
+    in a self-service role, but are not compatible schema wise.
+    """
+
+
+def fetch_self_service_roles(gql_api: gql.GqlApi) -> list[RoleV1]:
+    roles: list[RoleV1] = []
+    for r in expiration.filter(self_service_roles.query(gql_api.query).roles or []):
+        if not r.self_service:
+            continue
+        validate_self_service_role(r)
+        roles.append(r)
+    return roles
+
+
+def validate_self_service_role(role: RoleV1) -> None:
+    """
+    Validate that a self-service role has approvers and that the referenced
+    change-types and datafiles/resources are compatible.
+    """
+    if not role.users and not role.bots and not role.member_sources:
+        raise NoApproversInSelfServiceRoleError(
+            f"The role {role.name} has no users, bots or memberSources definitions "
+            "to drive the self-service process. Add approvers to the roles."
+        )
+    for ssc in role.self_service or []:
+        if ssc.change_type.context_schema:
+            # check that all referenced datafiles have a schema that
+            # is compatible with the change-type
+            incompatible_datafiles = [
+                df.path
+                for df in ssc.datafiles or []
+                if df.datafile_schema != ssc.change_type.context_schema
+            ]
+            if incompatible_datafiles:
+                raise DatafileIncompatibleWithChangeTypeError(
+                    f"The datafiles {incompatible_datafiles} are not compatible with the "
+                    f"{ssc.change_type.name} change-types contextSchema {ssc.change_type.context_schema}"
+                )
 
 
 def cover_changes_with_self_service_roles(
@@ -44,6 +104,12 @@ def change_type_contexts_for_self_service_roles(
 
     # role lookup enables fast lookup roles for (filetype, filepath, changetype-name)
     role_lookup: dict[tuple[BundleFileType, str, str], list[RoleV1]] = defaultdict(list)
+    # schema role lookup enables fast lookup roles for a (schema, changetype-name)
+    schema_role_lookup: dict[tuple[str, str], list[RoleV1]] = defaultdict(list)
+    change_types_by_name: dict[str, ChangeTypeProcessor] = {
+        ctp.name: ctp for ctp in change_type_processors
+    }
+
     for r in roles:
         # build role lookup for self_service section of a role
         if r.self_service:
@@ -51,59 +117,115 @@ def change_type_contexts_for_self_service_roles(
                 if ss.datafiles:
                     for df in ss.datafiles:
                         role_lookup[
-                            (BundleFileType.DATAFILE, df.path, ss.change_type.name)
+                            BundleFileType.DATAFILE, df.path, ss.change_type.name
                         ].append(r)
                 if ss.resources:
                     for res in ss.resources:
                         role_lookup[
-                            (BundleFileType.RESOURCEFILE, res, ss.change_type.name)
+                            BundleFileType.RESOURCEFILE, res, ss.change_type.name
                         ].append(r)
+                if (
+                    ss.change_type.context_schema
+                    and not ss.datafiles
+                    and not ss.resources
+                ):
+                    # change types mentioned without datafiels or resources apply
+                    # to all datafiles and resources of the given schema
+                    schema_role_lookup[
+                        ss.change_type.context_schema, ss.change_type.name
+                    ].append(r)
+
+    # resolve approvers for self-service roles, either directly or via member sources
+    resolved_approvers = resolve_role_members([r for r in roles if r.self_service])
 
     # match every BundleChange with every relevant ChangeTypeV1
     change_type_contexts = []
     for bc in bundle_changes:
         for ctp in change_type_processors:
             for ownership in ctp.find_context_file_refs(
-                bc.fileref, bc.old, bc.new, set()
+                change=FileChange(
+                    file_ref=bc.fileref,
+                    old=bc.old,
+                    new=bc.new,
+                    old_backrefs=bc.old_backrefs,
+                    new_backrefs=bc.new_backrefs,
+                ),
+                expansion_trail=set(),
             ):
                 # if the context file is bound with the change type in
                 # a role, build a changetypecontext
-                for role in role_lookup[
-                    (
-                        ownership.owned_file_ref.file_type,
-                        ownership.owned_file_ref.path,
-                        ownership.change_type.name,
-                    )
-                ]:
-                    approvers = [
-                        Approver(u.org_username, u.tag_on_merge_requests)
-                        for u in role.users or []
-                    ]
-                    approvers.extend(
-                        [
-                            Approver(b.org_username, False)
-                            for b in role.bots or []
-                            if b.org_username
+                owning_roles: dict[str, RoleV1] = {}
+                for ct_lineage in change_types_by_name[
+                    ownership.change_type.name
+                ].lineage:
+                    owning_roles.update({
+                        role.name: role
+                        for role in role_lookup[
+                            ownership.owned_file_ref.file_type,
+                            ownership.owned_file_ref.path,
+                            ct_lineage,
                         ]
+                    })
+                owning_roles.update({
+                    role.name: role
+                    for role in (
+                        schema_role_lookup[
+                            ownership.owned_file_ref.schema,
+                            ownership.change_type.name,
+                        ]
+                        if ownership.owned_file_ref.schema
+                        else []
                     )
-                    change_type_contexts.append(
-                        (
-                            bc,
-                            ChangeTypeContext(
-                                change_type_processor=ctp,
-                                context=f"RoleV1 - {role.name}",
-                                origin=ownership.change_type.name,
-                                approvers=approvers,
-                                approver_reachability=approver_reachability_from_role(
-                                    role
-                                ),
-                                context_file=ownership.context_file_ref,
-                            ),
-                        )
-                    )
+                })
+                for role in owning_roles.values():
+                    change_type_contexts.append((
+                        bc,
+                        ChangeTypeContext(
+                            change_type_processor=ctp,
+                            context=f"RoleV1 - {role.name}",
+                            origin=ownership.change_type.name,
+                            approvers=[
+                                approver
+                                for rm in resolved_approvers.get(role.name, [])
+                                if (approver := build_approver(rm)) is not None
+                            ],
+                            approver_reachability=approver_reachability_from_role(role),
+                            change_owner_labels=change_type_labels_from_role(role),
+                            context_file=ownership.context_file_ref,
+                        ),
+                    ))
     return change_type_contexts
 
 
+def build_approver(role_member: RoleMember) -> Approver | None:
+    """
+    Builds an approver from a role member. Can return None if the passed
+    approver is not considered valid within this context, e.g. not having
+    an org username.
+    """
+    match role_member:
+        case RoleUser():
+            return Approver(role_member.org_username, role_member.tag_on_merge_requests)
+        case RoleBot() if role_member.org_username:
+            return (
+                Approver(role_member.org_username, False)
+                if role_member.org_username
+                else None
+            )
+    return None
+
+
+def change_type_labels_from_role(role: RoleV1) -> set[str]:
+    change_owner_labels = (
+        role.labels[CHANGE_OWNERS_LABELS_LABEL]
+        if role.labels and CHANGE_OWNERS_LABELS_LABEL in role.labels
+        else None
+    )
+    if change_owner_labels:
+        return {label.strip() for label in change_owner_labels.split(",")}
+    return set()
+
+
 def approver_reachability_from_role(role: RoleV1) -> list[ApproverReachability]:
     reachability: list[ApproverReachability] = []
     for permission in role.permissions or []:
@@ -112,6 +234,7 @@ def approver_reachability_from_role(role: RoleV1) -> list[ApproverReachability]:
                 SlackGroupApproverReachability(
                     slack_group=permission.handle,
                     workspace=permission.workspace.name,
+                    channel=permission.channels[0],
                 )
             )
         elif isinstance(permission, PermissionGitlabGroupMembershipV1):

reconcile/change_owners/tester.py

@@ -1,11 +1,8 @@
 import os
 import sys
+from collections.abc import Generator
 from dataclasses import dataclass
-from typing import (
-    Any,
-    Optional,
-    Tuple,
-)
+from typing import Any
 
 import jsonpath_ng
 import pygments
@@ -17,10 +14,12 @@ from pygments.token import Name
 
 from reconcile.change_owners.change_owners import fetch_change_type_processors
 from reconcile.change_owners.change_types import (
-    BundleFileChange,
     BundleFileType,
     ChangeTypeProcessor,
     FileRef,
+)
+from reconcile.change_owners.changes import (
+    BundleFileChange,
     parse_resource_file_content,
 )
 from reconcile.change_owners.self_service_roles import (
@@ -33,7 +32,7 @@ from reconcile.utils import gql
 
 def test_change_type_in_context(
     change_type_name: str, role_name: str, app_interface_path: str
-):
+) -> None:
     print(f"Sections marked with '{SELF_SERVICABLE_MARKER}' are self serviceable\n\n")
 
     role = get_self_service_role_by_name(role_name)
@@ -81,7 +80,7 @@ SELF_SERVICABLE_MARKER = "self-serviceable"
 
 def print_annotated_file(
     file: BundleFileChange, self_serviceable_paths: list[jsonpath_ng.JSONPath]
-):
+) -> None:
     # add a markers to the data to indicate which parts are self serviceable
     for path_expression in self_serviceable_paths:
         for self_serviceable_data in path_expression.find(file.new):
@@ -103,7 +102,6 @@ def print_annotated_file(
 
 @dataclass
 class AppInterfaceRepo:
-
     root_dir: str
 
     def data_dir(self) -> str:
@@ -150,7 +148,7 @@ class AppInterfaceRepo:
             for file in files:
                 if file.endswith(".yml") or file.endswith(".yaml"):
                     filepath = os.path.join(root, file)
-                    with open(filepath, "r") as f:
+                    with open(filepath, encoding="locale") as f:
                         parsed_yaml = yaml.safe_load(f)
                         if parsed_yaml.get("$schema") == schema:
                             relative_path = filepath[len(self.data_dir()) :]
@@ -165,7 +163,7 @@ class AppInterfaceRepo:
         self, file_type: BundleFileType, path: str
     ) -> BundleFileChange:
         if file_type == BundleFileType.DATAFILE:
-            with open(f"{self.data_dir()}{path}", "r") as f:
+            with open(f"{self.data_dir()}{path}", encoding="locale") as f:
                 parsed_yaml = yaml.safe_load(f)
                 return BundleFileChange(
                     fileref=FileRef(
@@ -175,10 +173,12 @@ class AppInterfaceRepo:
                     ),
                     old=parsed_yaml,
                     new=parsed_yaml,
+                    old_content_sha="",
+                    new_content_sha="",
                     diffs=[],
                 )
         elif file_type == BundleFileType.RESOURCEFILE:
-            with open(f"{self.resource_dir()}{path}", "r") as f:
+            with open(f"{self.resource_dir()}{path}", encoding="locale") as f:
                 content = f.read()
                 parsed_content, schema = parse_resource_file_content(content)
                 return BundleFileChange(
@@ -189,6 +189,8 @@ class AppInterfaceRepo:
                     ),
                     old=parsed_content,
                     new=parsed_content,
+                    old_content_sha="",
+                    new_content_sha="",
                     diffs=[],
                 )
         else:
@@ -201,11 +203,11 @@ class SelfServiceableHighlighter(Filter):
     in a structured file.
     """
 
-    def __init__(self, self_serviceable_marker: str):
+    def __init__(self, self_serviceable_marker: str) -> None:
         Filter.__init__(self)
         self.self_serviceable_marker = self_serviceable_marker
 
-    def filter(self, _, stream):
+    def filter(self, _: Any, stream: Any) -> Generator[tuple[Any, Any], None, None]:
         for ttype, value in stream:
             if value != self.self_serviceable_marker:
                 ttype = Name
@@ -213,12 +215,12 @@ class SelfServiceableHighlighter(Filter):
 
 
 class FilesystemFileDiffResolver:
-    def __init__(self, app_interface_repo: AppInterfaceRepo):
+    def __init__(self, app_interface_repo: AppInterfaceRepo) -> None:
         self.app_interface_repo = app_interface_repo
 
     def lookup_file_diff(
         self, file_ref: FileRef
-    ) -> Tuple[Optional[dict[str, Any]], Optional[dict[str, Any]]]:
+    ) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
         file = self.app_interface_repo.bundle_file_for_path(
             file_type=file_ref.file_type, path=file_ref.path
         )
@@ -227,7 +229,7 @@ class FilesystemFileDiffResolver:
 
 def get_changetype_processor_by_name(
     change_type_name: str, app_interface_repo: AppInterfaceRepo
-) -> Optional[ChangeTypeProcessor]:
+) -> ChangeTypeProcessor | None:
     processors = fetch_change_type_processors(
         gql.get_api(), FilesystemFileDiffResolver(app_interface_repo)
     )
@@ -236,7 +238,7 @@ def get_changetype_processor_by_name(
 
 def get_self_service_role_by_name(
     role_name: str,
-) -> Optional[RoleV1]:
+) -> RoleV1 | None:
     result = self_service_roles.query(
         gql.get_api().query, variables={"name": role_name}
     ).roles

reconcile/checkpoint.py

@@ -4,6 +4,7 @@ The checks are defined in
 https://gitlab.cee.redhat.com/app-sre/contract/-/blob/master/content/process/sre_checkpoints.md
 
 """
+
 import logging
 import re
 from collections.abc import (
@@ -17,10 +18,7 @@ from functools import (
 )
 from http import HTTPStatus
 from pathlib import Path
-from typing import (
-    Any,
-    Union,
-)
+from typing import Any
 
 import requests
 from jinja2 import Template
@@ -86,7 +84,7 @@ def render_template(
     template: Path, name: str, path: str, field: str, bad_value: str
 ) -> str:
     """Render the template with all its fields."""
-    with open(template) as f:
+    with open(template, encoding="locale") as f:
         t = Template(f.read(), keep_trailing_newline=True, trim_blocks=True)
         return t.render(
             app_name=name, app_path=path, field=field, field_value=bad_value
@@ -120,7 +118,7 @@ def file_ticket(
 def report_invalid_metadata(
     app: Mapping[str, Any],
     path: str,
-    board: Mapping[str, Union[str, Mapping]],
+    board: Mapping[str, str | Mapping],
     settings: Mapping[str, Any],
     parent: str,
     dry_run: bool = False,