From f36a248d4647a4386597499347600a9cabe27ea5 Mon Sep 17 00:00:00 2001
From: Fabien Boucher <fboucher@redhat.com>
Date: May 14 2020 10:56:55 +0000
Subject: Integrate fedora-infra/ansible/pull-request/54 job


Co-Authored-By: Nils Philippsen <nils@redhat.com>
Co-Authored-By: Pierre-Yves Chibon <pingou@pingoured.fr>

The current version of Zuul on softwarefactory-project.io does not
allow to define roles and tasks along with any Ansible plugins
for security reasons. The future version of Zuul will allow this
by skipping thoses roles and hidding them to the job playbooks.

In the meantime let's add the jobs here. Jobs have been written by
Nils Philippsen and Pierre-Yves Chibon.

---

diff --git a/playbooks/fedora-infra/ansible-review-base.yaml b/playbooks/fedora-infra/ansible-review-base.yaml
new file mode 100644
index 0000000..eddbd2d
--- /dev/null
+++ b/playbooks/fedora-infra/ansible-review-base.yaml
@@ -0,0 +1,14 @@
+- hosts: all
+  tasks:
+    - name: Install ansible-review
+      package:
+        name: python3-ansible-review
+        state: latest
+
+    - name: Install invocation script
+      copy:
+        src: ansible-review-filtered.sh
+        dest: /usr/local/bin/ansible-review-filtered.sh
+        owner: root
+        group: root
+        mode: '0755'
diff --git a/playbooks/fedora-infra/ansible-review-diff.yaml b/playbooks/fedora-infra/ansible-review-diff.yaml
new file mode 100644
index 0000000..a56d8e4
--- /dev/null
+++ b/playbooks/fedora-infra/ansible-review-diff.yaml
@@ -0,0 +1,8 @@
+- hosts: all
+  tasks:
+    - name: Run ansible-review on the changes in the PR
+      shell: >
+        git diff origin/{{ zuul.branch|quote }}...{{ zuul.branch|quote }}
+        | ansible-review-filtered.sh
+      args:
+        chdir: '{{ zuul.project.src_dir }}'
diff --git a/playbooks/fedora-infra/ansible-review-everything.yaml b/playbooks/fedora-infra/ansible-review-everything.yaml
new file mode 100644
index 0000000..1d1914f
--- /dev/null
+++ b/playbooks/fedora-infra/ansible-review-everything.yaml
@@ -0,0 +1,11 @@
+- hosts: all
+  tasks:
+    - name: Run ansible-review on the playbooks and roles
+      shell: >
+        exitcode=0;
+        while read pbrulefile; do
+          ansible-review-filtered.sh "$pbrulefile" || exitcode=1;
+        done <<<$(find playbooks roles -name "*.yml" -o -name "*.yaml");
+        exit "$exitcode"
+      args:
+        chdir: '{{ zuul.project.src_dir }}'
diff --git a/playbooks/fedora-infra/ansible-review-filtered.sh b/playbooks/fedora-infra/ansible-review-filtered.sh
new file mode 100644
index 0000000..84d2206
--- /dev/null
+++ b/playbooks/fedora-infra/ansible-review-filtered.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# Remove warnings on stderr about missing configuration and used default rules.
+
+SEDSCRIPT='
+0,/^WARN: No configuration file found at/{/^WARN: No configuration file found at/d;};
+1,/^WARN: Using example .* found at/{/^WARN: Using example .* found at/d;};
+'
+
+exec ansible-review "$@" 2> >(sed -e "$SEDSCRIPT" >&2)
diff --git a/zuul.d/fedora-infra-jobs.yaml b/zuul.d/fedora-infra-jobs.yaml
new file mode 100644
index 0000000..a8b7639
--- /dev/null
+++ b/zuul.d/fedora-infra-jobs.yaml
@@ -0,0 +1,14 @@
+---
+- job:
+    name: ansible-review-base
+    pre-run: playbooks/fedora-infra/ansible-review-base.yaml
+
+- job:
+    name: ansible-review-everything
+    parent: ansible-review-base
+    run: playbooks/fedora-infra/ansible-review-everything.yaml
+
+- job:
+    name: ansible-review-diff
+    parent: ansible-review-base
+    run: playbooks/fedora-infra/ansible-review-diff.yaml