Add test of used SHAs

We add additional test, that runs bootstarp-ansible.sh and
with that verifies that all roles and collections could be retrieved
from opendev. On top of that it runs extra task that retireves
service_projects and checkout it to the defined SHA.

Test runs only when we change files that we're testing.

Change-Id: I5ad5d4e5b0e59098fae9d185706753397caea6ec
(cherry picked from commit ad0fdb2840)

scripts/bootstrap-ansible.sh

@@ -118,7 +118,7 @@ TOX_CONSTRAINTS_SHA=$(awk '/requirements_git_install_branch:/ {print $2}' playbo
 
 # if we are in CI, grab the u-c file from the locally cached repo, otherwise download
 TOX_CONSTRAINTS_PATH="/opt/ansible-runtime-constraints-${TOX_CONSTRAINTS_SHA}.txt"
-if [[ -z "${ZUUL_SRC_PATH+defined}" ]]; then
+if [[ -z "${ZUUL_SRC_PATH+defined}" || ! -d "${ZUUL_SRC_PATH:-''}" ]]; then
   wget ${TOX_CONSTRAINTS_FILE:-"https://opendev.org/openstack/requirements/raw/${TOX_CONSTRAINTS_SHA}/upper-constraints.txt"} -O ${TOX_CONSTRAINTS_PATH}
 else
   git --git-dir=${ZUUL_SRC_PATH}/opendev.org/openstack/requirements/.git show ${TOX_CONSTRAINTS_SHA}:upper-constraints.txt > ${TOX_CONSTRAINTS_PATH}

scripts/gate-check-commit.sh

@@ -40,7 +40,7 @@ export ANSIBLE_LOG_DIR="/openstack/log/ansible-logging"
 export SCENARIO=${1:-"aio_lxc"}
 
 # Set the action base on the second CLI parameter
-# Actions available: [ 'deploy', 'upgrade', 'varstest', 'linters' ]
+# Actions available: [ 'deploy', 'upgrade', 'varstest', 'shastest', 'linters' ]
 export ACTION=${2:-"deploy"}
 
 # Set the installation method for the OpenStack services
@@ -105,7 +105,7 @@ if which iptables; then
 fi
 
 # Bootstrap an AIO
-if [[ -z "${SKIP_OSA_BOOTSTRAP_AIO+defined}" && "${ACTION}" != "linters" ]]; then
+if [[ -z "${SKIP_OSA_BOOTSTRAP_AIO+defined}" && "${ACTION}" != "linters" &&  "${ACTION}" != "shastest" ]]; then
     source "${OSA_CLONE_DIR}/scripts/bootstrap-aio.sh"
 fi
 
@@ -113,6 +113,10 @@ if [[ "${ACTION}" == "varstest" ]]; then
   pushd "${OSA_CLONE_DIR}/tests"
       openstack-ansible test-vars-overrides.yml
   popd
+elif [[ "${ACTION}" == "shastest" ]]; then
+  pushd "${OSA_CLONE_DIR}/tests"
+      openstack-ansible test-upstream-shas.yml
+  popd
 elif [[ "${ACTION}" == "linters" ]]; then
   pushd "${OSA_CLONE_DIR}"
     # Install linter tools

tests/test-upstream-shas.yml

@@ -0,0 +1,45 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Ensuring upstream SHAs validity
+  hosts: "localhost"
+  gather_facts: no
+  connection: local
+  user: root
+  tasks:
+    - name: Include repo_packages variables
+      include_vars:
+        dir: "{{ playbook_dir }}/../playbooks/defaults/repo_packages"
+        ignore_unknown_extensions: True
+        extensions:
+          - 'yml'
+
+    - name: Define list of services tracked
+      set_fact:
+        service_projects: "{{ hostvars[inventory_hostname] | select('match', '^([a-z_]*)_git_track_branch') | map('regex_replace', '^([a-z_]*)_git_track_branch', '\\1') | list }}"
+
+    - name: Clone git repos
+      git:
+        repo: "{{ hostvars[inventory_hostname][item ~ '_git_repo'] }}"
+        dest: "/tmp/opendev/{{ hostvars[inventory_hostname][item ~ '_git_repo'] | basename }}"
+        version: "{{ hostvars[inventory_hostname][item ~ '_git_install_branch'] }}"
+        depth: "10"
+        update: true
+        force: true
+      with_items: "{{ service_projects }}"
+      register: git_clone
+      until: git_clone is success
+      retries: "2"
+      delay: "10"

zuul.d/jobs.yaml

@@ -232,6 +232,17 @@
     parent: openstack-ansible-deploy-aio
     nodeset: ubuntu-bionic
 
+# Ensuring SHAs are valid
+- job:
+    name: openstack-ansible-shastest-metal
+    parent: openstack-ansible-deploy
+    nodeset: ubuntu-focal
+    irrelevant-files: []
+    files:
+      - ^ansible-collection-requirements\.yml
+      - ^ansible-role-requirements\.yml
+      - ^playbooks\/defaults\/repo_packages\/.*\.yml
+
 # Running linters check
 - job:
     name: openstack-ansible-linters-ubuntu-focal

zuul.d/playbooks/pre-osa-aio.yml

@@ -30,7 +30,7 @@
       environment:
         # ZUUL_SRC_PATH is used by tests/get-ansible-role-requirements to
         # where the CI provided git sources were cloned.
-        ZUUL_SRC_PATH: "{{ _zuul_src_path }}"
+        ZUUL_SRC_PATH: "{{ (action != 'shastest') | ternary(_zuul_src_path, '') }}"
         ANSIBLE_PACKAGE: "{{ ansible_package | default('') }}"
         SETUP_ARA: 'true'
       when: action != 'upgrade'
@@ -51,3 +51,4 @@
       when:
         - action != 'upgrade'
         - action != 'linters'
+        - action != 'shastest'

zuul.d/project-templates.yaml

@@ -17,10 +17,12 @@
     check:
       jobs:
         - openstack-ansible-varstest-aio
+        - openstack-ansible-shastest-metal
         - openstack-tox-docs
     gate:
       jobs:
         - openstack-ansible-varstest-aio
+        - openstack-ansible-shastest-metal
         - openstack-tox-docs
     periodic:
       jobs: