dhall-diff: add new job

This change adds a new dhall-diff job to verify generated config
is idempotent.

Change-Id: I96a335dc78c4fa74564b854997433e5be0b5e633

doc/source/general-jobs.rst

@@ -2,6 +2,7 @@ General Purpose Jobs
 ====================
 
 .. zuul:autojob:: dco-license
+.. zuul:autojob:: dhall-diff
 .. zuul:autojob:: unittests
 .. zuul:autojob:: markdownlint
 .. zuul:autojob:: multinode

doc/source/general-roles.rst

@@ -15,6 +15,7 @@ General Purpose Roles
 .. zuul:autorole:: emit-job-header
 .. zuul:autorole:: enable-netconsole
 .. zuul:autorole:: ensure-bazelisk
+.. zuul:autorole:: ensure-dhall
 .. zuul:autorole:: ensure-dstat-graph
 .. zuul:autorole:: ensure-markdownlint
 .. zuul:autorole:: fetch-markdownlint
@@ -33,6 +34,7 @@ General Purpose Roles
 .. zuul:autorole:: remove-build-sshkey
 .. zuul:autorole:: remove-gpgkey
 .. zuul:autorole:: remove-sshkey
+.. zuul:autorole:: render-diff
 .. zuul:autorole:: revoke-sudo
 .. zuul:autorole:: run-dstat
 .. zuul:autorole:: sign-artifacts

playbooks/dhall/diff.yaml

@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - render-diff

playbooks/dhall/prepare.yaml

@@ -0,0 +1,25 @@
+- hosts: all
+  tasks:
+    - name: Check for tools
+      command: type make git bzip2
+      failed_when: false
+      register: _tools
+
+    - name: Install tools
+      package:
+        name:
+          - git
+          - bzip2
+          - make
+      become: true
+      when: _tools.rc != 0
+
+    - name: Check for dhall command
+      command: type -p dhall-to-json
+      failed_when: false
+      register: _dhall_tools
+
+    - name: Install dhall
+      include_role:
+        name: ensure-dhall
+      when: _dhall_tools.rc != 0

roles/ensure-dhall/README.rst

@@ -0,0 +1,10 @@
+Ensure dhall is installed
+
+Installs the specified version of the haskell implementation.
+
+**Role Variables**
+
+.. zuul:rolevar:: dhall_version
+   :default: 1.31.1
+
+   The dhall version.

roles/ensure-dhall/defaults/main.yaml

@@ -0,0 +1,9 @@
+dhall_version: 1.31.1
+dhall_versions:
+  "1.31.1":
+    - url: https://github.com/dhall-lang/dhall-haskell/releases/download/1.31.1/dhall-1.31.1-x86_64-linux.tar.bz2
+      checksum: sha256:f8312727bbd4af74d183efce2e22f7b7807246a600fcc85600945f4790e4294a
+    - url: https://github.com/dhall-lang/dhall-haskell/releases/download/1.31.1/dhall-json-1.6.3-x86_64-linux.tar.bz2
+      checksum: sha256:7ec6b54f70f077d8876bb40633905f2a0a2c69e83a3ce0bd3d9f7577e1210489
+    - url: https://github.com/dhall-lang/dhall-haskell/releases/download/1.31.1/dhall-yaml-1.0.3-x86_64-linux.tar.bz2
+      checksum: sha256:04d95773f9e96340a29f2857a55fb718735b83596abacf1d7b9fa3f6004067cb

roles/ensure-dhall/tasks/main.yaml

@@ -0,0 +1,33 @@
+- name: Create temp directory
+  tempfile:
+    state: directory
+  register: dhall_archive_tempdir
+
+- name: Check requested version
+  fail:
+    msg: |
+      Unknown dhall version: {{ dhall_version }}.
+      It needs to be defined in {{ opendev_url }}/roles/ensure-dhall/defaults/main.yaml
+  when: dhall_versions[dhall_version] is not defined
+  vars:
+    opendev_url: https://opendev.org/zuul/zuul-jobs/src/branch/master/
+
+- name: Download tools
+  get_url:
+    url: "{{ zj_dhall_tool_item.url }}"
+    dest: "{{ dhall_archive_tempdir.path }}/{{ zj_dhall_tool_item.url | basename }}"
+    checksum: "{{ zj_dhall_tool_item.checksum }}"
+  loop: "{{ dhall_versions[dhall_version] }}"
+  loop_control:
+    loop_var: zj_dhall_tool_item
+
+- name: Unpack tools
+  command: "tar -xf {{ dhall_archive_tempdir.path }}/{{ zj_dhall_tool_item.url | basename }} --strip-components=2 -j --mode='a+x' -C /usr/local/bin"
+  become: yes
+  # ANSIBLE0006: Skip linting since it triggers on the "tar" command,
+  # but we prefer the command above
+  tags:
+    - skip_ansible_lint
+  loop: "{{ dhall_versions[dhall_version] }}"
+  loop_control:
+    loop_var: zj_dhall_tool_item

roles/render-diff/README.rst

@@ -0,0 +1,15 @@
+Run render command and ensure there are no resulting differences.
+
+Ensure that generated configuration files are idempotent.
+
+**Role Variables**
+
+.. zuul:jobvar:: render_command
+   :default: make
+
+   The command that render the configuration files.
+
+.. zuul:rolevar:: zuul_work_dir
+   :default: {{ zuul.project.src_dir }}
+
+   Directory to run the render command in.

roles/render-diff/defaults/main.yaml

@@ -0,0 +1,4 @@
+render_command: make
+
+zuul_work_dir: "{{ zuul.project.src_dir }}"
+diff_ignore_errors: false

roles/render-diff/tasks/main.yaml

@@ -0,0 +1,38 @@
+- name: "Run render command: {{ render_command }}"
+  command: "{{ render_command }}"
+  args:
+    chdir: "{{ zuul_work_dir }}"
+
+- name: Check for diff
+  command: git diff
+  args:
+    chdir: "{{ zuul_work_dir }}"
+  register: render_diff
+  # ANSIBLE0006: Skip linting since it triggers on the "git" command,
+  # but diff is not supported by ansible git module.
+  tags:
+    - skip_ansible_lint
+
+- name: Abort on diff
+  when:
+    - render_diff.stdout
+    - not diff_ignore_errors
+  failed_when: true
+  debug:
+    msg: |
+      The repository content is not consistent.
+      Please run `{{ render_command }}` before `git commit`
+
+      {% if render_diff.stdout | regex_search('^-') %}
+      You commited change in a configuration file without using the equivalent source file.
+      Please update the source file first and run {{ render_command }}.
+
+      {% else %}
+      You commited change in a file without running make.
+      Please run `{{ render_command }}` before `git commit`.
+
+      {% endif %}
+
+      The difference is:
+
+      {{ git_diff.stdout }}

test-playbooks/dhall/setup-project.yaml

@@ -0,0 +1,23 @@
+- hosts: all
+  tasks:
+    - name: Setup files
+      copy:
+        content: "{{ item.content }}"
+        dest: "{{ zuul.project.src_dir }}/{{ item.dest }}"
+      loop:
+        - content: "all:\n\tdhall-to-yaml < test.dhall > test.yaml"
+          dest: Makefile
+        - content: "21 + 21"
+          dest: test.dhall
+        - content: "42\n"
+          dest: test.yaml
+
+    - name: Commit changes
+      shell: |
+        if ! test -f ~/.gitconfig && ! test -d ~/.config/git ; then
+          git config --global user.email "you@example.com"
+          git config --global user.name "Your Name"
+        fi
+        git add Makefile test.dhall test.yaml && git commit -m "test content"
+      args:
+        chdir: "{{ zuul.project.src_dir }}"

test-playbooks/dhall/test-dhall-diff.yaml

@@ -0,0 +1,31 @@
+- hosts: all
+  tasks:
+    - name: Success dhall-diff
+      include_role:
+        name: render-diff
+
+    - name: Ensure dhall-diff succeeded
+      assert:
+        that:
+          - render_diff.stdout == ''
+
+    - name: Introduce a difference
+      copy:
+        content: "44"
+        dest: "{{ zuul.project.src_dir }}/test.yaml"
+
+    - name: Commit the difference
+      command: git commit -a -m "test update"
+      args:
+        chdir: "{{ zuul.project.src_dir }}"
+
+    - name: Failed dhall-diff
+      include_role:
+        name: render-diff
+      vars:
+        diff_ignore_errors: yes
+
+    - name: Ensure dhall-diff failed
+      assert:
+        that:
+          - render_diff.stdout != ''

zuul-tests.d/dhall.yaml

@@ -0,0 +1,17 @@
+- job:
+    name: zuul-jobs-test-dhall-diff
+    description: Test the dhall-diff job and roles
+    parent: dhall-diff
+    files:
+      - playbooks/dhall/.*
+      - roles/ensure-dhall/.*
+      - roles/render-diff/.*
+    pre-run: test-playbooks/dhall/setup-project.yaml
+    run: test-playbooks/dhall/test-dhall-diff.yaml
+
+- project:
+    check:
+      jobs: &id001
+        - zuul-jobs-test-dhall-diff
+    gate:
+      jobs: *id001

zuul.d/general-jobs.yaml

@@ -93,3 +93,24 @@
          Override the default searching above with explicit
          domain/path references (see validate-zone-db role)
     run: playbooks/validate-zone-db/run.yaml
+
+- job:
+    name: dhall-diff
+    description: |
+      Ensure that generated configuration files are idempotent.
+
+      This job runs a render command and check that no files are
+      modified.
+
+      .. zuul:jobvar:: dhall_render_command
+         :default: make
+
+         The command that render the configuration files.
+
+      .. zuul:jobvar:: dhall_version
+         :default: 1.31.1
+
+         The dhall version.
+
+    pre-run: playbooks/dhall/prepare.yaml
+    run: playbooks/dhall/diff.yaml