From 9b9f999edb5ac6ae49d224a7609b641c167966dc Mon Sep 17 00:00:00 2001
From: Jan Kaluza <jkaluza@redhat.com>
Date: Apr 13 2018 08:09:16 +0000
Subject: Allow filtering images according to 'advisory_highest_cve_severity'


---

diff --git a/freshmaker/handlers/brew/sign_rpm.py b/freshmaker/handlers/brew/sign_rpm.py
index 3b958db..ecc9995 100644
--- a/freshmaker/handlers/brew/sign_rpm.py
+++ b/freshmaker/handlers/brew/sign_rpm.py
@@ -70,12 +70,14 @@ class BrewSignRPMHandler(BaseHandler):
         advisories = errata.advisories_from_event(event)
 
         # Filter out advisories which are not allowed by configuration.
-        advisories = [advisory for advisory in advisories
-                      if self.allow_build(
-                          ArtifactType.IMAGE,
-                          advisory_name=advisory.name,
-                          advisory_security_impact=advisory.security_impact,
-                          advisory_state=advisory.state)]
+        advisories = [
+            advisory for advisory in advisories
+            if self.allow_build(
+                ArtifactType.IMAGE,
+                advisory_name=advisory.name,
+                advisory_security_impact=advisory.security_impact,
+                advisory_highest_cve_severity=advisory.highest_cve_severity,
+                advisory_state=advisory.state)]
 
         # Filter out advisories which are already in Freshmaker DB.
         advisories = self._filter_out_existing_advisories(advisories)
diff --git a/freshmaker/handlers/errata/errata_advisory_rpms_signed.py b/freshmaker/handlers/errata/errata_advisory_rpms_signed.py
index 6fe6bca..bf641c6 100644
--- a/freshmaker/handlers/errata/errata_advisory_rpms_signed.py
+++ b/freshmaker/handlers/errata/errata_advisory_rpms_signed.py
@@ -93,6 +93,7 @@ class ErrataAdvisoryRPMsSignedHandler(ContainerBuildHandler):
                 ArtifactType.IMAGE,
                 advisory_name=event.advisory.name,
                 advisory_security_impact=event.advisory.security_impact,
+                advisory_highest_cve_severity=event.advisory.highest_cve_severity,
                 advisory_product_short_name=event.advisory.product_short_name):
             msg = ("Errata advisory {0} is not allowed by internal policy "
                    "to trigger rebuilds.".format(event.advisory.errata_id))
@@ -673,6 +674,7 @@ class ErrataAdvisoryRPMsSignedHandler(ContainerBuildHandler):
         if self.allow_build(
                 ArtifactType.IMAGE, advisory_name=self.event.advisory.name,
                 advisory_security_impact=self.event.advisory.security_impact,
+                advisory_highest_cve_severity=self.event.advisory.highest_cve_severity,
                 advisory_product_short_name=self.event.advisory.product_short_name,
                 published=True):
             published = True
diff --git a/tests/test_errata_advisory_rpms_signed_handler.py b/tests/test_errata_advisory_rpms_signed_handler.py
index 6b293e4..332cbb6 100644
--- a/tests/test_errata_advisory_rpms_signed_handler.py
+++ b/tests/test_errata_advisory_rpms_signed_handler.py
@@ -230,6 +230,35 @@ class TestErrataAdvisoryRPMsSignedHandler(helpers.ModelsTestCase):
 
     @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
         'ErrataAdvisoryRPMsSignedHandler': {
+            'image': [
+                {'advisory_highest_cve_severity': ['critical', 'important']}
+            ]
+        }
+    })
+    @patch.object(freshmaker.conf, 'dry_run', new=True)
+    def test_allow_build_by_highest_cve_severity(self):
+        compose_4 = Compose(odcs_compose_id=4)
+        db.session.add(compose_4)
+        db.session.commit()
+
+        for severity in ["moderate", "critical", "important"]:
+            self.rhba_event.advisory.highest_cve_severity = severity
+            self.mock_find_images_to_rebuild.return_value = [[]]
+            handler = ErrataAdvisoryRPMsSignedHandler()
+            handler.handle(self.rhba_event)
+
+            db_event = Event.get(db.session, message_id='123')
+            self.assertEqual(db_event.state, EventState.SKIPPED.value)
+            if severity == "moderate":
+                self.assertTrue(db_event.state_reason.endswith(
+                    "is not allowed by internal policy to trigger rebuilds."))
+            else:
+                self.assertEqual(
+                    db_event.state_reason,
+                    "No container images to rebuild for advisory 'RHBA-2017'")
+
+    @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
+        'ErrataAdvisoryRPMsSignedHandler': {
             'image': [{'advisory_name': 'RHBA-2017'}]
         }
     })