Merge branch 'main' into enable-post-scripts-process-on-failure

Author: Phillita

.github/workflows/main.yml

@@ -146,7 +146,7 @@ jobs:
         export SHIPIT_GEM_PATH="${PWD}"
         mkdir /tmp/new-app
         cd /tmp/new-app
-        gem install rails -v '~> 8.0.2' --no-document
+        gem install rails -v '~> 8.1.1' --no-document
         rails new shipit --skip-action-cable --skip-turbolinks --skip-action-mailer --skip-active-storage --skip-webpack-install --skip-action-mailbox --skip-action-text -m "${SHIPIT_GEM_PATH}/template.rb"
       env:
         SHIPIT_EDGE: "1"

CHANGELOG.md

@@ -8,6 +8,24 @@
 * Updated README to include sections on post scripts with on_error flag
 * Refactored README to use mostly pure markdown instead of HTML
 
+# 0.44.2
+* Add dry-run flag for testing environments
+
+# 0.44.1
+* (bugfix) Fix NoMethodError in continuous delivery delayed banner when `next_commit_to_deploy` is nil
+
+# 0.44.0
+* Return 422 and log when a webhook is from an unknown (unconfigured) GitHub organization.
+
+# 0.43.3
+* (bugfix) Ensure we always call `bundle config set without`, even if the without group is empty
+
+# 0.43.0
+* Use `bundle config set frozen true` instead of deprecated `--frozen` flag
+
+# 0.42.2
+* Move git ask pass to env config for improved local development (##1441)
+
 # 0.42.1
 
 * Fix unbounded memory usage in RefreshCheckRunsJob(#1436)

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shipit-engine (0.42.1)
+    shipit-engine (0.44.2)
       active_model_serializers (~> 0.9.3)
       ansi_stream (~> 0.0.6)
       autoprefixer-rails (~> 6.4.1)
@@ -16,7 +16,7 @@ PATH
       omniauth-github (~> 1.4)
       paquito
       pubsubstub (~> 0.2)
-      rails (~> 8.0.1)
+      rails (>= 8.1.1)
       rails-timeago (~> 2.13.0)
       rails_autolink (~> 1.1.6)
       rake
@@ -33,75 +33,78 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (8.0.2)
-      actionpack (= 8.0.2)
-      activesupport (= 8.0.2)
+    action_text-trix (2.1.15)
+      railties
+    actioncable (8.1.1)
+      actionpack (= 8.1.1)
+      activesupport (= 8.1.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.0.2)
-      actionpack (= 8.0.2)
-      activejob (= 8.0.2)
-      activerecord (= 8.0.2)
-      activestorage (= 8.0.2)
-      activesupport (= 8.0.2)
+    actionmailbox (8.1.1)
+      actionpack (= 8.1.1)
+      activejob (= 8.1.1)
+      activerecord (= 8.1.1)
+      activestorage (= 8.1.1)
+      activesupport (= 8.1.1)
       mail (>= 2.8.0)
-    actionmailer (8.0.2)
-      actionpack (= 8.0.2)
-      actionview (= 8.0.2)
-      activejob (= 8.0.2)
-      activesupport (= 8.0.2)
+    actionmailer (8.1.1)
+      actionpack (= 8.1.1)
+      actionview (= 8.1.1)
+      activejob (= 8.1.1)
+      activesupport (= 8.1.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.0.2)
-      actionview (= 8.0.2)
-      activesupport (= 8.0.2)
+    actionpack (8.1.1)
+      actionview (= 8.1.1)
+      activesupport (= 8.1.1)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.0.2)
-      actionpack (= 8.0.2)
-      activerecord (= 8.0.2)
-      activestorage (= 8.0.2)
-      activesupport (= 8.0.2)
+    actiontext (8.1.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.1)
+      activerecord (= 8.1.1)
+      activestorage (= 8.1.1)
+      activesupport (= 8.1.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.0.2)
-      activesupport (= 8.0.2)
+    actionview (8.1.1)
+      activesupport (= 8.1.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
     active_model_serializers (0.9.13)
       activemodel (>= 3.2)
       concurrent-ruby (~> 1.0)
-    activejob (8.0.2)
-      activesupport (= 8.0.2)
+    activejob (8.1.1)
+      activesupport (= 8.1.1)
       globalid (>= 0.3.6)
-    activemodel (8.0.2)
-      activesupport (= 8.0.2)
-    activerecord (8.0.2)
-      activemodel (= 8.0.2)
-      activesupport (= 8.0.2)
+    activemodel (8.1.1)
+      activesupport (= 8.1.1)
+    activerecord (8.1.1)
+      activemodel (= 8.1.1)
+      activesupport (= 8.1.1)
       timeout (>= 0.4.0)
-    activestorage (8.0.2)
-      actionpack (= 8.0.2)
-      activejob (= 8.0.2)
-      activerecord (= 8.0.2)
-      activesupport (= 8.0.2)
+    activestorage (8.1.1)
+      actionpack (= 8.1.1)
+      activejob (= 8.1.1)
+      activerecord (= 8.1.1)
+      activesupport (= 8.1.1)
       marcel (~> 1.0)
-    activesupport (8.0.2)
+    activesupport (8.1.1)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
       minitest (>= 5.1)
       securerandom (>= 0.3)
@@ -118,7 +121,6 @@ GEM
       ice_nine (~> 0.11.0)
       thread_safe (~> 0.3, >= 0.3.1)
     base64 (0.3.0)
-    benchmark (0.4.1)
     bigdecimal (3.2.2)
     builder (3.3.0)
     byebug (11.1.3)
@@ -232,9 +234,9 @@ GEM
     net-smtp (0.5.0)
       net-protocol
     nio4r (2.7.3)
-    nokogiri (1.18.8-arm64-darwin)
+    nokogiri (1.18.9-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-linux-gnu)
+    nokogiri (1.18.9-x86_64-linux-gnu)
       racc (~> 1.4)
     oauth2 (2.0.9)
       faraday (>= 0.17.3, < 3.0)
@@ -275,28 +277,28 @@ GEM
       rack
       redis (~> 4.0)
     racc (1.8.1)
-    rack (2.2.17)
+    rack (2.2.22)
     rack-session (1.0.2)
       rack (< 3)
     rack-test (2.2.0)
       rack (>= 1.3)
     rackup (1.0.0)
       rack (< 3)
       webrick
-    rails (8.0.2)
-      actioncable (= 8.0.2)
-      actionmailbox (= 8.0.2)
-      actionmailer (= 8.0.2)
-      actionpack (= 8.0.2)
-      actiontext (= 8.0.2)
-      actionview (= 8.0.2)
-      activejob (= 8.0.2)
-      activemodel (= 8.0.2)
-      activerecord (= 8.0.2)
-      activestorage (= 8.0.2)
-      activesupport (= 8.0.2)
+    rails (8.1.1)
+      actioncable (= 8.1.1)
+      actionmailbox (= 8.1.1)
+      actionmailer (= 8.1.1)
+      actionpack (= 8.1.1)
+      actiontext (= 8.1.1)
+      actionview (= 8.1.1)
+      activejob (= 8.1.1)
+      activemodel (= 8.1.1)
+      activerecord (= 8.1.1)
+      activestorage (= 8.1.1)
+      activesupport (= 8.1.1)
       bundler (>= 1.15.0)
-      railties (= 8.0.2)
+      railties (= 8.1.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -311,13 +313,14 @@ GEM
       actionview (> 3.1)
       activesupport (> 3.1)
       railties (> 3.1)
-    railties (8.0.2)
-      actionpack (= 8.0.2)
-      activesupport (= 8.0.2)
+    railties (8.1.1)
+      actionpack (= 8.1.1)
+      activesupport (= 8.1.1)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
       thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.2.1)
@@ -396,6 +399,7 @@ GEM
     thread_safe (0.3.6)
     tilt (2.2.0)
     timeout (0.4.1)
+    tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)

app/controllers/shipit/webhooks_controller.rb

@@ -36,6 +36,16 @@ def verify_signature
         "signature=#{request.headers['X-Hub-Signature']}",
         "status=#{status}"
       ].join(' '))
+    rescue Shipit::GithubOrganizationUnknown => e
+      head(422)
+      Rails.logger.warn([
+        'WebhookController#verify_signature',
+        'Webhook from unknown organization',
+        "event=#{event}",
+        "repository_owner=#{repository_owner}",
+        "unknown_organization=#{e.message}",
+        "status=#{status}"
+      ].join(' '))
     end
 
     def check_if_ping

app/models/shipit/deploy_spec/bundler_discovery.rb

@@ -26,9 +26,18 @@ def discover_machine_env
       end
 
       def bundle_install
-        bundle = %(bundle install #{frozen_flag} --jobs 4 --path #{bundle_path} --retry 2)
-        bundle += " --without=#{bundler_without.join(':')}" unless bundler_without.empty?
-        [remove_ruby_version_from_gemfile, bundle]
+        install_command = %(bundle install --jobs 4 --retry 2)
+        [
+          remove_ruby_version_from_gemfile,
+          (bundle_config_frozen if frozen_mode?),
+          bundle_config_path,
+          bundle_without_groups,
+          install_command
+        ].compact
+      end
+
+      def bundle_config_path
+        "bundle config set --local path #{bundle_path}"
       end
 
       def remove_ruby_version_from_gemfile
@@ -41,11 +50,18 @@ def remove_ruby_version_from_gemfile
         end
       end
 
-      def frozen_flag
-        return unless gemfile_lock_exists?
-        return if config('dependencies', 'bundler', 'frozen') == false
+      def bundle_config_frozen
+        'bundle config set --local frozen true'
+      end
+
+      def bundle_without_groups
+        "bundle config set --local without '#{bundler_without.join(':')}'"
+      end
+
+      def frozen_mode?
+        return false unless gemfile_lock_exists?
 
-        '--frozen'
+        config('dependencies', 'bundler', 'frozen') != false
       end
 
       def bundler_without

app/models/shipit/task_execution_strategy/default.rb

@@ -62,7 +62,11 @@ def check_for_abort
 
       def perform_task
         capture_all!(@commands.install_dependencies)
-        capture_all!(@commands.perform)
+        if ENV['SHIPIT_DRY_RUN'].present?
+          @task.write("\nSkipping deploy steps (dry run mode)\n")
+        else
+          capture_all!(@commands.perform)
+        end
       end
 
       def checkout_repository

app/views/shipit/stacks/_banners.html.erb

@@ -70,7 +70,11 @@
         <p class="banner__text">
           Continuous Delivery for this stack is currently paused because
 
-          <%= link_to_if stack.deployment_checks_passed?, 'the pre-deploy checks failed', stack_commit_checks_path(stack, sha: stack.next_commit_to_deploy.sha) %>.
+          <% if stack.next_commit_to_deploy %>
+            <%= link_to_if stack.deployment_checks_passed?, 'the pre-deploy checks failed', stack_commit_checks_path(stack, sha: stack.next_commit_to_deploy.sha) %>.
+          <% else %>
+            the pre-deploy checks failed.
+          <% end %>
           You can either wait for them to pass, or trigger a deploy manually.
         </p>
       </div>

config/secrets.development.shopify.yml

@@ -1,5 +1,4 @@
 host: 'shipit-engine.myshopify.io'
-redis_url: 'redis://shipit-engine.railgun:6379'
 
 # For creating an app see: https://github.com/Shopify/shipit-engine/blob/main/docs/setup.md#creating-the-github-app
 
@@ -21,4 +20,4 @@ github:
     oauth:
       id:
       secret:
-      teams:
+      teams:

dev.yml

@@ -6,14 +6,17 @@ type: rails
 
 up:
   - packages:
-    - sqlite
+      - sqlite
   - ruby
-  - isogun
   - nginx
   - redis
   - mysql
   - bundler:
       without: ci
+  - custom:
+      name: Check for secrets file
+      met?: test -f config/secrets.development.yml
+      meet: "echo \"Run 'dev bootstrap' first (WARNING: drops database)\" && exit 1"
 
 server:
   root: test/dummy

lib/shipit.rb

@@ -71,7 +71,8 @@ module Shipit
     :internal_hook_receivers,
     :preferred_org_emails,
     :task_execution_strategy,
-    :task_logger
+    :task_logger,
+    :use_git_askpass
   )
 
   def task_execution_strategy
@@ -297,6 +298,10 @@ def task_logger
     @task_logger ||= Logger.new(nil)
   end
 
+  def use_git_askpass?
+    @use_git_askpass.nil? ? true : @use_git_askpass
+  end
+
   protected
 
   def revision_file