Pin the osbuild-composer commit for testing

[achilleas-k]

Pin the osbuild-composer commit to use so that it doesn't float and cause unexpected failures.

We will later add a cronjob to update the commit regularly, like we do with osbuild.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Now that osbuild-composer is pinned via Schutzfile, consider removing or repurposing the get_last_passed_commit function if it's no longer used to avoid dead code and confusion about the current source of the commit.
• It might be safer to handle missing or null .dependencies.composer.commit entries in Schutzfile explicitly (e.g., with a clear error message) so the deploy fails early and predictably when the pin is not defined.
• For consistency and readability, consider using the same style of jq invocation for both composer and osbuild commits (either both with cat or both directly on the file) and aligning the JSON paths if their structures are intended to be parallel.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Now that `osbuild-composer` is pinned via `Schutzfile`, consider removing or repurposing the `get_last_passed_commit` function if it's no longer used to avoid dead code and confusion about the current source of the commit.
- It might be safer to handle missing or `null` `.dependencies.composer.commit` entries in `Schutzfile` explicitly (e.g., with a clear error message) so the deploy fails early and predictably when the pin is not defined.
- For consistency and readability, consider using the same style of `jq` invocation for both composer and osbuild commits (either both with `cat` or both directly on the file) and aligning the JSON paths if their structures are intended to be parallel.

## Individual Comments

### Comment 1
<location path="schutzbot/deploy.sh" line_range="192-193" />
<code_context>
-
-setup_repo osbuild-composer "${GIT_COMMIT}" 5
+# Get pinned commit for osbuild-composer to install RPMs
+COMPOSER_GIT_COMMIT=$(jq -r '.["'"${ID}-${VERSION_ID}"'"].dependencies.composer.commit' Schutzfile)
+setup_repo osbuild-composer "${COMPOSER_GIT_COMMIT}" 5

 OSBUILD_GIT_COMMIT=$(cat Schutzfile | jq -r '.["'"${ID}-${VERSION_ID}"'"].dependencies.osbuild.commit')
</code_context>
<issue_to_address>
**issue:** Consider validating the composer commit from Schutzfile before passing it to setup_repo.

`get_last_passed_commit` used to guarantee a valid commit; now we trust the value from `Schutzfile` directly. If the key is missing or the value is `null`/empty, `setup_repo` will receive an invalid commit and fail later in a confusing way. Please add a check for `null`/empty here and fail fast with a clear error message mentioning the missing/invalid composer commit for `${ID}-${VERSION_ID}`.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue: Consider validating the composer commit from Schutzfile before passing it to setup_repo.

get_last_passed_commit used to guarantee a valid commit; now we trust the value from Schutzfile directly. If the key is missing or the value is null/empty, setup_repo will receive an invalid commit and fail later in a confusing way. Please add a check for null/empty here and fail fast with a clear error message mentioning the missing/invalid composer commit for ${ID}-${VERSION_ID}.

[achilleas-k]

Failures will be fixed by a04ceb6 (on #534).

[F-X64]

I'm in favor of fixing the version.
I assume we will have an automatic PR as we do with the schutzfile?

[achilleas-k]

I assume we will have an automatic PR as we do with the schutzfile?

Not yet, but I'll set it up.

[achilleas-k]

Actually, let me just add the scheduled job in this PR. No need to do it elsewhere.

[achilleas-k]

Added script and action.

[thozza]

In general, this looks good, but there are some copy&paste errors.

[achilleas-k]

Thanks for catching those. Fixed and rebased.

[thozza]

LGTM