staging: Hardcode currently used user of IBS

We should consolidate to a nicer user name...

common/config.go

@@ -64,9 +64,9 @@ type Permissions struct {
 }
 
 const (
-	Label_StagingAuto   = "staging/Auto"
-	Label_ReviewPending = "review/Pending"
-	Label_ReviewDone    = "review/Done"
+	Label_StagingAuto    = "staging/Auto"
+	Label_ReviewPending  = "review/Pending"
+	Label_ReviewDone     = "review/Done"
 )
 
 func LabelKey(tag_value string) string {

common/git_utils.go

@@ -283,7 +283,7 @@ func (e *GitHandlerImpl) GitClone(repo, branch, remoteUrl string) (string, error
 func (e *GitHandlerImpl) GitBranchHead(gitDir, branchName string) (string, error) {
 	id, err := e.GitExecWithOutput(gitDir, "show-ref", "--heads", "--hash", branchName)
 	if err != nil {
-		return "", fmt.Errorf("Can't find default branch: %s", branchName)
+		return "", fmt.Errorf("Can't find default branch: %s in %s", branchName, gitDir)
 	}
 
 	id = strings.TrimSpace(SplitLines(id)[0])
@@ -297,7 +297,7 @@ func (e *GitHandlerImpl) GitBranchHead(gitDir, branchName string) (string, error
 func (e *GitHandlerImpl) GitRemoteHead(gitDir, remote, branchName string) (string, error) {
 	id, err := e.GitExecWithOutput(gitDir, "show-ref", "--hash", "--verify", "refs/remotes/"+remote+"/"+branchName)
 	if err != nil {
-		return "", fmt.Errorf("Can't find default branch: %s", branchName)
+		return "", fmt.Errorf("Can't find default branch: %s in %s", branchName, gitDir)
 	}
 
 	return strings.TrimSpace(id), nil
@@ -904,6 +904,7 @@ func (e *GitHandlerImpl) GitSubmoduleList(gitPath, commitId string) (submoduleLi
 				for _, te := range tree.items {
 					if te.isTree() {
 						trees[p+te.name+"/"] = te.hash
+						submoduleList[p+te.name] = te.hash
 					} else if te.isSubmodule() {
 						submoduleList[p+te.name] = te.hash
 					}

common/obs_utils.go

@@ -694,13 +694,15 @@ func (r *BuildResultList) BuildResultSummary() (success, finished bool) {
 			if !ok {
 				panic("Unknown result code: " + result.Code)
 			}
-			if r.isLastBuild && result.Code == "unknown" {
-				// it means the package has never build yet,
-				// but we don't know the reason
-				detail.Finished = true
+			if r.isLastBuild {
+				// we are always finished, since it is the last result
+				// also when there is "unknown" state, it just means it
+				// it was never done
+				finished = true
+			} else {
+			        finished = finished && detail.Finished
 			}
 
-			finished = finished && detail.Finished
 			success = success && detail.Success
 
 			if !finished {

obs-staging-bot/main.go

@@ -27,6 +27,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"runtime/debug"
 	"slices"
@@ -127,6 +128,10 @@ func ProcessBuildStatus(project *common.BuildResultList) BuildStatusSummary {
 	found:
 		for j := 0; j < len(project.Result); j++ {
 			common.LogDebug("  found match for @ idx:", j)
+			if project.Result[i].Dirty {
+				// ignore possible temporary failures and wait for settling
+				return BuildStatusSummaryBuilding
+			}
 			res := ProcessRepoBuildStatus(project.Result[i].Status)
 			switch res {
 			case BuildStatusSummarySuccess:
@@ -885,10 +890,13 @@ func ProcessPullRequest(gitea common.Gitea, org, repo string, id int64) (bool, e
 		if !stagingConfig.RebuildAll {
 			for pkg, headOid := range headSubmodules {
 				if baseOid, exists := baseSubmodules[pkg]; !exists || baseOid != headOid {
+					if pkg != "rpms" && pkg != "dependencies" {
+					_, spkg := filepath.Split(pkg)
 					if exists {
-						modifiedPackages = append(modifiedPackages, pkg)
+						modifiedPackages = append(modifiedPackages, spkg)
 					} else {
-						newPackages = append(newPackages, pkg)
+						newPackages = append(newPackages, spkg)
+					}
 					}
 					common.LogDebug(pkg, ":", baseOid, "->", headOid)
 				}
@@ -1017,6 +1025,7 @@ func ProcessPullRequest(gitea common.Gitea, org, repo string, id int64) (bool, e
 				}
 			}
 		}
+
 		switch overallBuildStatus {
 		case BuildStatusSummarySuccess:
 			status.Status = common.CommitStatus_Success

systemd/obs-staging-bot.service

@@ -6,9 +6,13 @@ After=network-online.target
 Type=exec
 ExecStart=/usr/bin/obs-staging-bot
 EnvironmentFile=-/etc/default/obs-staging-bot.env
-DynamicUser=yes
-NoNewPrivileges=yes
-ProtectSystem=strict
+User=autogits_obs_staging_bot
+Group=users
+
+# This may work when not using ssh api connections:
+#DynamicUser=yes
+#NoNewPrivileges=yes
+#ProtectSystem=strict
 
 [Install]
 WantedBy=multi-user.target

workflow-direct/main.go

@@ -123,7 +123,7 @@ func processConfiguredRepositoryAction(action *common.RepositoryWebhookEvent, co
 			common.LogError("   - ", action.Repository.Name, "repo is not sha256. Ignoring.")
 			return
 		}
-		common.PanicOnError(git.GitExec(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", action.Repository.Clone_Url, action.Repository.Name))
+		common.PanicOnError(git.GitExec(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", "../" + action.Repository.Name, action.Repository.Name))
 		defer git.GitExecQuietOrPanic(gitPrj, "submodule", "deinit", "--all", "-f")
 
 		branch := strings.TrimSpace(git.GitExecWithOutputOrPanic(path.Join(gitPrj, action.Repository.Name), "branch", "--show-current"))
@@ -215,7 +215,7 @@ func processConfiguredPushAction(action *common.PushWebhookEvent, config *common
 	}
 
 	if stat, err := os.Stat(filepath.Join(git.GetPath(), gitPrj, action.Repository.Name)); err != nil {
-		git.GitExecOrPanic(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", action.Repository.Clone_Url, action.Repository.Name)
+		git.GitExecOrPanic(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", "../" + action.Repository.Name, action.Repository.Name)
 		common.LogDebug("Pushed to package that is not part of the project. Re-adding...", err)
 	} else if !stat.IsDir() {
 		common.LogError("Pushed to a package that is not a submodule but exists in the project. Ignoring.")
@@ -420,7 +420,7 @@ next_repo:
 		}
 
 		// add repository to git project
-		common.PanicOnError(git.GitExec(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", r.CloneURL, r.Name))
+		common.PanicOnError(git.GitExec(gitPrj, "submodule", "--quiet", "add", "--force", "--depth", "1", "../" + r.Name, r.Name))
 
 		curBranch := strings.TrimSpace(git.GitExecWithOutputOrPanic(path.Join(gitPrj, r.Name), "branch", "--show-current"))
 		if branch != curBranch {

workflow-pr/pr_processor.go

@@ -180,6 +180,33 @@ func (pr *PRProcessor) SetSubmodulesToMatchPRSet(prset *common.PRSet) error {
 					}
 
 					updateSubmoduleInPR(submodulePath, prHead, git)
+					err := git.GitExec(path.Join(common.DefaultGitPrj, submodulePath), "lfs", "fetch")
+					common.LogError("lfs fetch err: ", err)
+					if err = git.GitExec(path.Join(common.DefaultGitPrj, submodulePath), "lfs", "fsck"); err != nil {
+
+						found_comment := false
+						timeline, terr := common.FetchTimelineSinceLastPush(Gitea, prHead, org, repo, idx)
+						if terr != nil {
+							common.LogError("lfs fsck error, but timeline fetch failed")
+							break
+						}
+						msgPrefix := "The LFS objects are broken!"
+						for _, t := range timeline {
+						        if t.Type == common.TimelineCommentType_Comment && strings.HasPrefix(t.Body, msgPrefix) {               
+						                found_comment = true
+								common.LogError("lfs fsck Comment already found")
+
+						                break
+						        }
+						}
+						        
+						if !found_comment && !common.IsDryRun {
+							Gitea.AddComment(pr.PR, msgPrefix + " Please verify with 'git lfs fsck'")
+						}
+						common.LogError("lfs fsck failed with: ", err.Error())
+						return err
+					}
+
 					status, err := git.GitStatus(common.DefaultGitPrj)
 					common.LogDebug("status:", status)
 					common.LogDebug("submodule", repo, " hash:", id, " -> ", prHead)
@@ -302,14 +329,16 @@ func (pr *PRProcessor) UpdatePrjGitPR(prset *common.PRSet) error {
 	PrjGit := PrjGitPR.PR.Base.Repo
 	prjGitPRbranch := PrjGitPR.PR.Head.Name
 	if PrjGitPR.PR.Base.RepoID != PrjGitPR.PR.Head.RepoID {
-		PrjGitPR.RemoteName, err = git.GitClone(common.DefaultGitPrj, "", PrjGit.SSHURL)
-		git.GitExecOrPanic(common.DefaultGitPrj, "fetch", PrjGitPR.RemoteName, PrjGitPR.PR.Head.Sha)
-		git.GitExecOrPanic(common.DefaultGitPrj, "checkout", PrjGitPR.PR.Head.Sha)
-		common.LogInfo("Cannot update this PR as it's on another remote, not branch:", prjGitPRbranch, "Assuming this is by-design. (eg. project git PR only)")
-		return nil
+		// permission check, if submission comes from foreign repo
+		if !PrjGitPR.PR.AllowMaintainerEdit {
+                	common.LogError("Warning: source and target branch are in different repositories. We may not have the right permissions...")
+	//		Gitea.AddComment(PrjGitPR.PR, "This PR does not allow maintainer changes, but referenced package branch has changed!")
+			return nil
+		}
 	}
 
-	PrjGitPR.RemoteName, err = git.GitClone(common.DefaultGitPrj, prjGitPRbranch, PrjGit.SSHURL)
+//	PrjGitPR.RemoteName, err = git.GitClone(common.DefaultGitPrj, prjGitPRbranch, PrjGit.SSHURL)
+	PrjGitPR.RemoteName, err = git.GitClone(common.DefaultGitPrj, PrjGitPR.PR.Head.Ref, PrjGitPR.PR.Head.Repo.SSHURL)
 	common.PanicOnError(err)
 	git.GitExecOrPanic(common.DefaultGitPrj, "fetch", PrjGitPR.RemoteName, PrjGitBranch)
 
@@ -357,6 +386,7 @@ func (pr *PRProcessor) UpdatePrjGitPR(prset *common.PRSet) error {
 			}
 			common.PanicOnError(git.GitExec(common.DefaultGitPrj, params...))
 			PrjGitPR.PR.Head.Sha = newHeadCommit
+			Gitea.SetLabels(PrjGit.Owner.UserName, PrjGit.Name, PrjGitPR.PR.Index, []string{prset.Config.Label("PR/updated")})
 		}
 
 		// update PR
@@ -373,7 +403,7 @@ func (pr *PRProcessor) UpdatePrjGitPR(prset *common.PRSet) error {
 			}
 			return CurrentTitle == NewTitle
 		}
-		if PrjGitPR.PR.User.UserName == CurrentUser.UserName && (PrjGitPR.PR.Body != PrjGitBody || !isPrTitleSame(PrjGitPR.PR.Title, PrjGitTitle)) {
+		if !pr.config.NoProjectGitPR && PrjGitPR.PR.User.UserName == CurrentUser.UserName && (PrjGitPR.PR.Body != PrjGitBody || !isPrTitleSame(PrjGitPR.PR.Title, PrjGitTitle)) {
 			Gitea.UpdatePullRequest(PrjGit.Owner.UserName, PrjGit.Name, PrjGitPR.PR.Index, &models.EditPullRequestOption{
 				RemoveDeadline: true,
 				Title:          PrjGitTitle,
@@ -464,11 +494,11 @@ func (pr *PRProcessor) Process(req *models.PullRequest) error {
 						if _, ok := err.(*repository.RepoMergePullRequestConflict); !ok {
 							common.PanicOnError(err)
 						}
-					} else {
-						Gitea.AddComment(pr.PR, "Closing here because the associated Project PR has been closed.")
-						Gitea.UpdatePullRequest(org, repo, idx, &models.EditPullRequestOption{
-							State: "closed",
-						})
+//					} else {
+//						Gitea.AddComment(pr.PR, "Closing here because the associated Project PR has been closed.")
+//						Gitea.UpdatePullRequest(org, repo, idx, &models.EditPullRequestOption{
+//							State: "closed",
+//						})
 					}
 				}
 			}