BUILD-4657: use standard build scripts for poetry

Signed-off-by: Jayadeep Kinavoor Madam <[email protected]>

Author: jayadeep-km-sonarsource

.cirrus.yml

@@ -1,10 +1,10 @@
-artifactory_build: &artifactory_build
+env:
+  ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]
+  ARTIFACTORY_DEPLOY_REPO: sonarsource-pypi-public-qa
+  ARTIFACTORY_PRIVATE_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
   ARTIFACTORY_DEPLOY_USERNAME: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer username]
-  ARTIFACTORY_DEPLOY_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
-
-artifactory_private: &artifactory_private
-  ARTIFACTORY_PRIVATE_USERNAME: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader username]
-  ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
+  ARTIFACTORY_DEPLOY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
+  DEPLOY_PULL_REQUEST: 'true'
 
 container_definition: &CONTAINER_DEFINITION
   dockerfile: .cirrus/poetry.Dockerfile
@@ -15,42 +15,43 @@ container_definition: &CONTAINER_DEFINITION
   builder_role: cirrus-builder
   builder_image: docker-builder-v*
   builder_instance_type: t3.small
-  builder_subnet_id: ${CIRRUS_AWS_SUBNET}
+  builder_subnet_ids: ${CIRRUS_AWS_SUBNETS}
+  use_in_memory_disk: true
+  docker_arguments:
+    CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
+  cpu: 3
+  memory: 8G
 
-only_sonarsource_qa: &ONLY_SONARSOURCE_QA
-  only_if: $CIRRUS_USER_COLLABORATOR == 'true' && $CIRRUS_TAG == "" && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == "master")
-
-env:
-  CIRRUS_SHELL: bash
-  ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]
-  ARTIFACTORY_DEPLOY_REPO: sonarsource-pypi-public-qa
+only_if: $CIRRUS_USER_COLLABORATOR == "true" && $CIRRUS_TAG == "" && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH || $CIRRUS_BRANCH =~ "feature/*" || $CIRRUS_BRANCH =~ "dogfood-on-.*")
 
+poetry_cache_template: &POETRY_CACHE
+  poetry_cache:
+    folder: .cache/poetry/
+    fingerprint_script: cat poetry.lock
 
-build_task:
+.poetry_template: &POETRY_TEMPLATE
   eks_container:
     <<: *CONTAINER_DEFINITION
-    cpu: 2
-    memory: 2G
-  env:
-    <<: *artifactory_build
-  build_script:
-    - poetry install
-    - poetry version $(poetry version -s).${CI_BUILD_NUMBER}
-    - poetry build
-    - poetry config repositories.sonarsource https://repox.jfrog.io/artifactory/api/pypi/${ARTIFACTORY_DEPLOY_REPO}
-    - poetry publish -r sonarsource --username ${ARTIFACTORY_DEPLOY_USERNAME} --password ${ARTIFACTORY_DEPLOY_PASSWORD} --verbose
+  <<: *POETRY_CACHE
+  poetry_install_script:
+    - source .cirrus/set_poetry_build_version "$CI_BUILD_NUMBER"
+    - echo "PROJECT_VERSION=$PROJECT_VERSION" >> $CIRRUS_ENV
+    - jfrog config add repox --artifactory-url "$ARTIFACTORY_URL" --access-token "$ARTIFACTORY_PRIVATE_ACCESS_TOKEN"
+    - jfrog poetry-config --server-id-resolve repox --repo-resolve sonarsource-pypi
+    - jfrog poetry install --build-name="$CIRRUS_REPO_NAME" --build-number="$CI_BUILD_NUMBER"
+
+build_task:
+  <<: *POETRY_TEMPLATE
+  alias: build
+  name: "Build"
+  build_script: .cirrus/poetry_build_publish
 
 promote_task:
-  <<: *ONLY_SONARSOURCE_QA
-  eks_container:
-    <<: *CONTAINER_DEFINITION
-    cpu: 2
-    memory: 2G
+  depends_on:
+    - build
   env:
     ARTIFACTORY_PROMOTE_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promoter access_token]
-  promote_script:
-    # Temporary hack script until https://sonarsource.atlassian.net/browse/BUILD-4592 is completed
-    # Artifact is copied to sonarsource-pypi-public-builds repo for testing the release workflow as part of https://sonarsource.atlassian.net/browse/BUILD-4501
-    - export VERSION=$(poetry version -s).$CI_BUILD_NUMBER
-    - jfrog config add repox --artifactory-url "$ARTIFACTORY_URL" --access-token "$ARTIFACTORY_PROMOTE_ACCESS_TOKEN"
-    - jfrog rt cp sonarsource-pypi-public-qa/sonar_dummy_python_oss/$VERSION/ sonarsource-pypi-public-builds/sonar_dummy_python_oss/$VERSION/
+    GITHUB_TOKEN: VAULT[development/github/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promotion token]
+    ARTIFACTS: sonar-summy-python-oss
+  <<: *POETRY_TEMPLATE
+  promote_script: .cirrus/cirrus_promote_python

.cirrus/cirrus_promote_python

@@ -0,0 +1,20 @@
+#!/bin/bash
+# JFrog promotion, notify GitHub and Burgr
+# shellcheck source=/dev/null
+
+set -euo pipefail
+
+: "${CIRRUS_BRANCH?}" "${CIRRUS_DEFAULT_BRANCH?}" "${CI_BUILD_NUMBER?}" "${CIRRUS_REPO_NAME?}"
+
+echo ">> Promote Python build"
+set +o verbose
+source cirrus-env PROMOTE
+set -o verbose
+jfrog config remove repox
+cirrus_jfrog_promote
+
+if [[ -v GITHUB_TOKEN ]]; then
+  github-notify-promotion
+else
+  echo "GITHUB_TOKEN unset: skipping build number commit status on GitHub"
+fi

.cirrus/poetry_build_publish

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Regular way to build a SonarSource Poetry project.
+# - ARTIFACTORY_DEPLOY_REPO: deployment repository (sonarsource-pypi-public-qa or sonarsource-pypi-private-qa)
+# shellcheck source=/dev/null
+
+set -euo pipefail
+
+: "${ARTIFACTORY_URL?}" "${ARTIFACTORY_DEPLOY_REPO?}" "${ARTIFACTORY_DEPLOY_ACCESS_TOKEN?}"
+: "${CIRRUS_BRANCH?}" "${CIRRUS_DEFAULT_BRANCH?}" "${CI_BUILD_NUMBER?}" "${CIRRUS_REPO_NAME?}"
+
+function jfrog_poetry_publish() {
+  jfrog config remove repox
+  jfrog config add repox --artifactory-url "$ARTIFACTORY_URL" --access-token "$ARTIFACTORY_DEPLOY_ACCESS_TOKEN"
+  project_name=$(poetry version | awk {'print $1'})
+  pushd dist
+  jfrog rt upload ./ "$ARTIFACTORY_DEPLOY_REPO/$project_name/$PROJECT_VERSION/" --module="$project_name:$PROJECT_VERSION" \
+    --build-name="$CIRRUS_REPO_NAME" --build-number="$CI_BUILD_NUMBER"
+  popd
+  jfrog rt build-collect-env "$CIRRUS_REPO_NAME" "$CI_BUILD_NUMBER"
+  jfrog rt build-publish "$CIRRUS_REPO_NAME" "$CI_BUILD_NUMBER" \
+    --env-include 'PROJECT;GIT_*;*VERSION*;BUILD_*;GITHUB_*;CIRRUS_*;*BRANCH*;*ID' \
+    --env-exclude "*login*;*pass*;*psw*;*pwd*;*secret*;*key*;*token*;*auth*"
+}
+
+poetry build
+if [[ -n "${CIRRUS_PR:-}" ]]; then
+  if [ "${DEPLOY_PULL_REQUEST:-}" == "true" ]; then
+    jfrog_poetry_publish
+  fi
+elif [[ "$CIRRUS_BRANCH" = "$CIRRUS_DEFAULT_BRANCH" || "$CIRRUS_BRANCH" =~ ^"branch-" || "$CIRRUS_BRANCH" =~ ^"dogfood-on-" ]]; then
+  jfrog_poetry_publish
+fi

.cirrus/set_poetry_build_version

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+BUILD_ID=$1
+
+if ! current_version=$(poetry version -s); then
+  echo "Could not get version from Poetry project ('poetry version -s')" >&2
+  echo "$current_version"
+  exit 1
+fi
+release_version=${current_version%".dev"*}
+# In case of 2 digits, we need to add a '0' as the 3rd digit.
+digit_count=$(echo "${release_version//./ }" | wc --words)
+if [[ "$digit_count" -lt 3 ]]; then
+  release_version="$release_version.0"
+fi
+if [[ "$digit_count" -gt 3 && $release_version =~ [0-9]+\.[0-9]+\.[0-9]+ ]]; then
+  release_version="${BASH_REMATCH[0]}"
+  echo "WARN: version was truncated to $release_version because it had more than 3 digits"
+fi
+new_version="$release_version.${BUILD_ID}"
+
+echo "Replacing version $current_version with $new_version"
+poetry version "$new_version"
+export PROJECT_VERSION=$new_version