refactor(RELEASE-2475): convert close-advisory-issues to python

This commit replaces the inline task script for the
close-advisory-issues managed task with a standalone python script
contained in the utils image. The tekton unit tests are updated
accordingly. We only keep one happy path test as the other scenarios are
covered by pytest in the utils repo.

Assisted-By: Cursor

Signed-off-by: Johnny Bieren <jbieren@redhat.com>

Author: johnbieren

tasks/managed/close-advisory-issues/close-advisory-issues.yaml

@@ -121,7 +121,7 @@ spec:
         - name: sourceDataArtifact
           value: $(params.sourceDataArtifact)
     - name: close-issues
-      image: quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
+      image: quay.io/jbieren/release-service-utils:closeissues_2
       computeResources:
         limits:
           memory: 32Mi
@@ -131,86 +131,16 @@ spec:
       volumeMounts:
         - name: access-token-secret-vol
           mountPath: "/etc/secrets"
-      script: |
-        #!/usr/bin/env bash
-        # We do not set -x here because it would leak the ACCESS_TOKEN
-        set -eu
-
-        ACCESS_TOKEN="$(cat /etc/secrets/token)"
-        EMAIL="$(cat /etc/secrets/email)"
-
-        ISSUE_TRACKERS='{
-            "Jira": {
-                "api": "rest/api/2/issue",
-                "servers": [
-                    "issues.redhat.com",
-                    "jira.atlassian.com",
-                    "redhat.atlassian.net"
-                ]
-            },
-            "bugzilla": {
-                "api": "rest/bug",
-                "servers": [
-                    "bugzilla.redhat.com"
-                ]
-            }
-        }'
-
-        DATA_FILE="$(params.dataDir)/$(params.dataPath)"
-        if [ ! -f "${DATA_FILE}" ] ; then
-            echo "No data JSON was provided."
-            exit 1
-        fi
-
-        NUM_ISSUES=$(jq -cr '.releaseNotes.issues.fixed | length' "${DATA_FILE}")
-        for ((i = 0; i < NUM_ISSUES; i++)); do
-            issue=$(jq -c --argjson i "$i" '.releaseNotes.issues.fixed[$i]' "${DATA_FILE}")
-            server=$(jq -r '.source' <<< "$issue")
-            if [ "$server" = "issues.redhat.com" ] ; then
-                server=redhat.atlassian.net
-            fi
-            if [ "$server" != "redhat.atlassian.net" ] ; then
-                echo "This task currently only supports closing issues on issues.redhat.com"
-                echo "and redhat.atlassian.net. Skipping issue $issue as it is on $server"
-                continue
-            fi
-
-            CURL_ARGS=(-u "${EMAIL}:${ACCESS_TOKEN}")
-
-            API=$(jq -r '.[] | select(.servers[] | contains("'"$server"'")) | .api' <<< "$ISSUE_TRACKERS")
-            API_URL="https://${server}/${API}/$(jq -r '.id' <<< "$issue")"
-
-            if [ "$(curl-with-retry "${CURL_ARGS[@]}" "${API_URL}" | jq -r '.fields.status.name')" == "Closed" ] ; then
-                echo "Issue $issue is already in Closed state. Skipping it."
-                continue
-            fi
-
-            echo "Closing issue $issue"
-            CLOSE_COMMENT="Fixed in Konflux Advisory $(params.advisoryUrl)"
-            CLOSING_RC=0
-            # Get the Closed transition id. This varies per Jira project
-            if ! CLOSED_ID="$(curl-with-retry "${CURL_ARGS[@]}" "${API_URL}/transitions" \
-              | jq -er '.transitions[] | select(.name=="Closed") | .id')"; then
-                echo "Warning: failed to fetch the closed state id for issue $issue. We most likely do not have" \
-                  "permission to close it. Will try to add a comment instead."
-                CLOSING_RC=1
-            # Close the issue
-            elif ! curl-with-retry "${CURL_ARGS[@]}" -XPOST --data \
-              '{"transition":{"id":"'"$CLOSED_ID"'"},"update":{"comment":[{"add":{"body":"'"$CLOSE_COMMENT"'"}}]}}' \
-              -H "Content-Type: application/json" "${API_URL}/transitions"; then
-                echo "Warning: failed to close issue $issue. Will try to add a comment instead."
-                CLOSING_RC=1
-            fi
-
-            if [ "$CLOSING_RC" -ne 0 ] ; then
-                # Try to add the comment even if closing failed
-                if ! curl-with-retry "${CURL_ARGS[@]}" -XPOST --data \
-                  '{"body":"'"$CLOSE_COMMENT"'"}' \
-                  -H "Content-Type: application/json" "${API_URL}/comment"; then
-                    echo "Warning: failed to add comment to issue $issue."
-                fi
-            fi
-        done
+      env:
+        - name: PARAM_DATA_DIR
+          value: $(params.dataDir)
+        - name: PARAM_DATA_PATH
+          value: $(params.dataPath)
+        - name: PARAM_ADVISORY_URL
+          value: $(params.advisoryUrl)
+        - name: JIRA_SECRET_PATH
+          value: /etc/secrets
+      command: ["/home/scripts/python/tasks/managed/close_advisory_issues.py"]
     - name: create-trusted-artifact
       computeResources:
         limits:

tasks/managed/close-advisory-issues/tests/mocks.sh

@@ -0,0 +1,21 @@
+---
+# Declarative mocks for Tekton tests of this task (Python entrypoint). Rendered
+# by .github/scripts/render_python_task_mocks_from_yaml.py when
+# test_tekton_tasks.sh runs.
+version: 1
+services:
+  - type: http_json
+    port: 8080
+    bind: 127.0.0.1
+    mock_server_for_env_var: JIRA_API_BASE_URL
+    mock_server_api_path: ""
+    routes:
+      - path_contains: /issue/ISSUE-123/transitions
+        method: POST
+        body: '{}'
+      - path_contains: /issue/ISSUE-123/transitions
+        method: GET
+        body: '{"transitions":[{"id":"91","name":"Closed","description":""},{"id":"11","name":"New"}]}'
+      - path_contains: /issue/ISSUE-123
+        method: GET
+        body: '{"fields":{"status":{"name":"Open"}}}'

tasks/managed/close-advisory-issues/tests/mocks.yaml

@@ -1,10 +1,5 @@
 #!/usr/bin/env bash
 
-# Add mocks to the beginning of task step script
-TASK_PATH="$1"
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-yq -i '.spec.steps[1].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[1].script' "$TASK_PATH"
-
 # Create a dummy access token secret (and delete it first if it exists)
 kubectl delete secret konflux-advisory-jira-secret --ignore-not-found
 kubectl create secret generic konflux-advisory-jira-secret --from-literal=token=abcdefg --from-literal=email=team@domain.com