crimport

#!/bin/bash

#
# crimport REPO_GITHUB_ACCOUNT REPO_NAME [GERRIT_USER]: imports the given
# repository into gerrit.  See the usage message for details.
#

#
# Configuration
#

# DNS name or IP address of Gerrit server
igp_gerrit_host=cr.joyent.us
# Group name for Gerrit superusers
igp_gerrit_group="Temporary Git Superusers"
# Temporary directory for cloned project
igp_tmproot="${TMPDIR-/var/tmp}/crimport-$$"
# URL for accessing Github API
igp_github_api="https://api.github.com"
# Location of file containing user's Github API token
igp_github_token_file=~/.github-api-token
# User that Gerrit uses to push to Github
igp_github_gerrit_user="joyent-automation"
# Slug for the "Joyent Engineering" team
igp_github_eng_slug="joyent-engineering"

#
# Runtime state
#

#
# SSH host string.  This is generally the same as igp_gerrit_host, but may
# include a "username@" if specified on the command line.
#
igp_gerrit_sshhost=

#
# Source repository: GitHub account and repository name.
# These are filled in from the command-line arguments.
#
igp_gh_account=
igp_gh_repo=

# Gerrit project name.  This is constructed from the GitHub parameters.
igp_gerrit_project=

# Gerrit username.  This is reported by the server.
igp_gerrit_username=

# Directory into which the source repository is cloned.
igp_clonedir=

function usage
{
	cat <<EOF >&2
usage: crimport [-A] REPO_GITHUB_ACCOUNT REPO_NAME [GERRIT_USER]

This tool copies a GitHub repository at

    https://github.com/REPO_GITHUB_ACCOUNT/REPO_NAME

to a new project on the Joyent Gerrit server at $igp_gerrit_host.  The new
Gerrit project will be configured to replicate back to GitHub.

REPO_GITHUB_ACCOUNT may be either an individual GitHub account or a GitHub
organization.

If GERRIT_USER is provided, then that username is used when pushing over ssh to
Gerrit.

This tool must be run as a Gerrit and GitHub administrator.  It will temporarily
add you to the list of Git Superusers in order to do the import, and it will
remove you from that group upon completion.

In order to give the tool access to GitHub, you must place a GitHub API token
in ~/.github-api-token. (If for some reason you need to skip updating the GitHub
repository's settings, use -A to skip that step.)
EOF
	exit 2
}

function main
{
	trap igp_cleanup exit

	local SKIP_GH=
	while getopts ":Ah" opt; do
		case $opt in
			A) SKIP_GH=true;;
			h) usage;;
			?) fail "invalid option: -$OPTARG";;
		esac
	done
	shift $((OPTIND-1))

	if [[ $# != 2  && $# != 3 ]]; then
		usage
	fi

	if [[ ! $1 =~ ^[-a-zA-Z0-9_]+$ ]] ||
	   [[ ! $2 =~ ^[-a-zA-Z0-9_]+$ ]]; then
		fail "GitHub account or repo name contains unsupported" \
		    "characters"
	fi

	igp_gh_account=$1
	igp_gh_repo=$2
	igp_gerrit_project="$1/$2"
	igp_clonedir="$igp_tmproot/$igp_gh_repo"

	if [[ -n "$3" ]]; then
		igp_gerrit_sshhost="$3@$igp_gerrit_host"
	else
		igp_gerrit_sshhost="$igp_gerrit_host"
	fi

	if [[ -z $SKIP_GH ]]; then
		echo "Setting up Github repo for Gerrit pushes ... "
		igp_github_protect $igp_gh_account $igp_gh_repo
	fi

	echo -n "Detecting your Gerrit username ... "
	igp_gerrit_configure || fail "failed"
	echo "$igp_gerrit_username"

	echo "Cloning github.com repository $igp_gerrit_project into " \
	    "\"$igp_clonedir\"" >&2
	mkdir "$igp_tmproot" || fail "failed to mkdir \"$igp_tmproot\""
	igp_github_clone $igp_gh_account $igp_gh_repo "$igp_clonedir" ||
	    fail "failed to clone"

	echo "Creating remote Gerrit project $igp_gerrit_project" >&2
	igp_project_create $igp_gerrit_project \
	    "http://github.com/$igp_gh_account/$igp_gh_repo" ||
	    fail "failed to create Gerrit project"

	#
	# Fortunately, adding and removing members using this interface is
	# idempotent, so we don't need to check first.
	#
	echo -n "Adding '$igp_gerrit_username' to" \
	    "group \"$igp_gerrit_group\" ... "
	igp_gerrit set-members "'$igp_gerrit_group'" \
	    --add "$igp_gerrit_username" || fail "failed"

	echo "Pushing existing changes to Gerrit project" >&2
	igp_gerrit_push "$igp_clonedir" "$igp_gerrit_project" || \
	    fail "failed to push changes"

	echo -n "Removing '$igp_gerrit_username' from" \
	    "group \"$igp_gerrit_group\" ... "
	igp_gerrit set-members "'$igp_gerrit_group'" \
	    --remove "$igp_gerrit_username" || fail "failed"

	cat <<EOF
Success!  The following project has been created on the Gerrit server:

    https://$igp_gerrit_host/#/admin/projects/$igp_gerrit_project

To make sure replication to GitHub will work, please make sure that the
"Joyent Engineering" team on GitHub has write access to the GitHub project
by visiting this page:

    https://github.com/$igp_gerrit_project/settings/collaboration

EOF
}

function fail
{
	echo "crimport: $@" >&2
	exit 1
}

#
# igp_cleanup: clean up temporary files.  We do this for both normal and
# abnormal exit.
#
function igp_cleanup
{
	#
	# This is just an especially paranoid check so that we don't do
	# something terrible.
	#
	if [[ -d $igp_tmproot ]]; then
		echo -n "cleaning up $igp_tmproot ... " >&2
		(cd $igp_tmproot && \
		    [[ -d $igp_gh_repo/.git ]] &&
		    rm -rf $igp_gh_repo)
		rmdir $igp_tmproot
		echo "done." >&2
	fi
}

#
# igp_gerrit ARGS...
#
# This runs the gerrit CLI over ssh.  For example, to run the "flush-caches"
# subcommand, run "igp_gerrit flush-caches".
#
function igp_gerrit
{
	ssh $igp_gerrit_sshhost gerrit "$@"
}

#
# igp_project_create NAME SOURCE
#
# Creates a project called NAME on the Gerrit server with appropriate settings.
#
function igp_project_create
{
	#
	# The extra quotes around the description are necessary, per the Gerrit
	# create-project documentation.
	#
	igp_gerrit "create-project" \
	    --parent="GitHub-Joyent" \
	    --description="'Authoritative source for $2'" \
	    --submit-type=FAST_FORWARD_ONLY \
	    "$1"
}

#
# igp_github_clone ACCOUNT REPONAME DSTPATH
#
# Clones the specified repository to the specified local path.
#
function igp_github_clone
{
	if [[ ! $1 =~ ^[-a-zA-Z0-9_]+$ ]] ||
	   [[ ! $2 =~ ^[-a-zA-Z0-9_]+$ ]]; then
		fail "bogus account or repo name!"
	fi

	git clone git@github.com:$1/$2.git $3
}

#
# igp_github_protect ACCOUNT REPONAME
#
# Adds branch protection to the Github repo to ensure only Gerrit can
# push to the "master" branch.
#
function igp_github_protect
{
	if [[ ! $1 =~ ^[-a-zA-Z0-9_]+$ ]] ||
	   [[ ! $2 =~ ^[-a-zA-Z0-9_]+$ ]]; then
		fail "bogus account or repo name!"
	fi

	if [[ ! -f $igp_github_token_file ]]; then
		fail "couldn't find $igp_github_token_file"
	fi

	local TOKEN="$(cat $igp_github_token_file)"
	local BRANCH="master"
	local UNIQUE="$RANDOM$RANDOM$RANDOM:"

	# Check that the Gerrit user is able to push
	local PERM_RESULT
	PERM_RESULT=$(curl -s --write-out "$UNIQUE%{http_code}\n" \
	    -u "$TOKEN:x-oauth-basic" -X GET \
	    "$igp_github_api/repos/$1/$2/collaborators/$igp_github_gerrit_user/permission")
	if [[ $? != 0 ]]; then
		fail "couldn't get permissions for $igp_github_gerrit_user"
	fi

	local PERM_INFO=$(grep -v "^$UNIQUE" <<< "$PERM_RESULT")
	local STATUS=$(grep "^$UNIQUE" <<< "$PERM_RESULT" | cut -d: -f2)

	if [[ $STATUS != "200" ]]; then
		fail "couldn't get permissions (HTTP status code $STATUS)"
	fi

	local PERM=$(json permission <<< "$PERM_INFO")
	if [[ $PERM != "write" && $PERM != "admin" ]]; then
		fail "$igp_github_gerrit_user needs push access to $1/$2"
	fi

	# Set branch protection on master, so that only Gerrit can push.
	curl -fsS -u "$TOKEN:x-oauth-basic" -X PUT -d@- \
	    "$igp_github_api/repos/$1/$2/branches/$BRANCH/protection" \
	    > /dev/null <<-EOF
		{
		    "required_status_checks": {
		        "strict": true,
		        "contexts": [ ]
		    },
		    "required_pull_request_reviews": null,
		    "enforce_admins": true,
		    "restrictions": {
		        "users": [
		            "$igp_github_gerrit_user"
		        ],
		        "teams": []
		    }
		}
	EOF
	if [[ $? != 0 ]]; then
		fail "failed to set branch protection"
	fi

	#
	# Disable all but squash merging, to make it harder to accidentally do
	# merge commits.
	#
	# Github doesn't allow completely disabling merge buttons, but we can
	# at least restrict it enough to make it harder for anyone to do. In
	# the future we could also create a bot that automatically marks all
	# PRs as failing checks.
	#
	curl -fsS -u "$TOKEN:x-oauth-basic" -X PATCH -d@- \
	    "$igp_github_api/repos/$1/$2" > /dev/null <<-EOF
		{
		    "name": "$2",
		    "allow_squash_merge": true,
		    "allow_merge_commit": false,
		    "allow_rebase_merge": false,
		    "has_projects": false
		}
	EOF
	if [[ $? != 0 ]]; then
		fail "failed to set branch protection"
	fi

	# Get the "Joyent Engineering" team's ID.
	local TEAMS
	TEAMS=$(curl -fsS -u "$TOKEN:x-oauth-basic" \
	    "$igp_github_api/orgs/$1/teams")
	if [[ $? != 0 ]]; then
		fail "failed to list $1 teams"
	fi

	local JOYENT_ID=$(json -a \
	    -c "this.slug === '$igp_github_eng_slug'" id <<< "$TEAMS")
	if [[ -z $JOYENT_ID ]]; then
		fail "failed to find Joyent Engineering team's ID"
	fi

	curl -fsS -u "$TOKEN:x-oauth-basic" -X PUT -d@- \
	    "$igp_github_api/teams/$JOYENT_ID/repos/$1/$2" <<-EOF
		{
			"permission": "push"
		}
	EOF
	if [[ $? != 0 ]]; then
		fail "failed to grant Engineering push access to $1/$2"
	fi
}

#
# igp_gerrit_push REPO_PATH PROJECT_NAME
#
# For the local git repository at REPO_PATH, add a remote for the Gerrit project
# PROJECT_NAME and push the repository to it.
#
function igp_gerrit_push
{
	(
	set -o errexit
	cd "$1" 2>&1;

	git remote add cr git+ssh://$igp_gerrit_sshhost/$2.git
	git push cr master
	) || fail "failed to push to Gerrit"
}

#
# igp_gerrit_configure: determine the current Gerrit username based on what the
# server reports when we try to use it.  If the user specified a username
# argument, this is redundant.  But they may not have, and this approach will
# always report whatever username we're using to access the server.
#
# The actual approach leaves something to be desired, but Gerrit doesn't provide
# the equivalent of who(1) or id(1).  On the plus side, this output should be
# stable enough for use here.
#
function igp_gerrit_configure
{
	igp_gerrit_username=$(ssh $igp_gerrit_sshhost 2>&1 | \
	   grep '^ *git clone.*REPOSITORY_NAME.git' | \
	   sed -e s'#.*ssh://\(.*\)@.*#\1#') ||
	   fail "failed to parse out Gerrit username"

	if [[ -z "$igp_gerrit_username" ]]; then
		fail "failed to discover Gerrit username"
	fi
}


main "$@"