feat: add watchers, additional assignees, and per-rule Slack labels to firewatch rules #277
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| { | ||
| "python.testing.pytestArgs": [ | ||
| "tests" | ||
| ], | ||
| "python.testing.unittestEnabled": false, | ||
| "python.testing.pytestEnabled": true | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # Copy to development/env.list (gitignored) and fill secrets. | ||
| # See docs/contribution_guide.md and scripts/smoke-openshift-ci-replay.sh | ||
|
|
||
| # Prow run under test (example from contribution guide; pick any completed run) | ||
| BUILD_ID=1696039978221441024 | ||
| JOB_NAME=periodic-ci-openshift-pipelines-release-tests-release-v1.11-openshift-pipelines-ocp4.14-lp-interop-openshift-pipelines-interop-aws | ||
| JOB_NAME_SAFE=openshift-pipelines-interop-aws | ||
|
|
||
| # Staging Jira (recommended for experiments) | ||
| JIRA_SERVER_URL=https://redhat.stage.atlassian.net | ||
| JIRA_TOKEN= | ||
|
|
||
| # firewatch config: include failure_rules; example exercises slack + watcher fields (merge with your rules) | ||
| FIREWATCH_DEFAULT_JIRA_PROJECT=LPINTEROP | ||
| FIREWATCH_CONFIG='{"failure_rules":[{"step":"*","failure_type":"all","classification":"Smoke","jira_project":"LPINTEROP","slack_channel":"#firewatch-dev","slack_user":"firewatch-tool@redhat.com"}]}' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| import json | ||
| import os | ||
| import subprocess | ||
| import sys | ||
|
|
||
| import requests | ||
|
|
||
| JIRA_CLOUD = "https://redhat.atlassian.net" | ||
| ISSUE_URL = f"{JIRA_CLOUD}/rest/api/3/issue" | ||
|
|
||
|
|
||
| def _unwrap_kv_payload(data: dict) -> dict: | ||
| inner = data.get("data") or {} | ||
| nested = inner.get("data") | ||
| if isinstance(nested, dict) and ("email" in nested or "token" in nested or "username" in nested): | ||
| return nested | ||
| return inner if isinstance(inner, dict) else {} | ||
|
|
||
|
|
||
| def load_credentials_from_vault() -> tuple[str | None, str | None]: | ||
| path = os.environ.get("FIREWATCH_JIRA_VAULT_PATH") | ||
| if not path: | ||
| return None, None | ||
| out = subprocess.check_output( | ||
| ["vault", "kv", "get", "-format=json", path], | ||
| text=True, | ||
| ) | ||
| payload = _unwrap_kv_payload(json.loads(out)) | ||
| email_key = os.environ.get("FIREWATCH_JIRA_VAULT_EMAIL_FIELD", "email") | ||
| token_key = os.environ.get("FIREWATCH_JIRA_VAULT_TOKEN_FIELD", "token") | ||
| return payload.get(email_key), payload.get(token_key) | ||
|
|
||
|
|
||
| def main() -> None: | ||
| print("GET /rest/api/3/issue (no auth)") | ||
| r = requests.get(ISSUE_URL, timeout=30) | ||
| print(f" status={r.status_code}") | ||
| print(f" body snippet: {r.text[:200]!r}") | ||
| print() | ||
| print("POST /rest/api/3/issue with empty fields (no auth)") | ||
| r2 = requests.post( | ||
| ISSUE_URL, | ||
| json={"fields": {}}, | ||
| headers={"Content-Type": "application/json"}, | ||
| timeout=30, | ||
| ) | ||
| print(f" status={r2.status_code}") | ||
| print(f" body snippet: {r2.text[:200]!r}") | ||
| email = os.getenv("JIRA_EMAIL") | ||
| token = os.getenv("JIRA_TOKEN") | ||
| if (not email or not token) and os.getenv("FIREWATCH_JIRA_VAULT_PATH"): | ||
| ve, vt = load_credentials_from_vault() | ||
| if ve and vt: | ||
| email, token = ve, vt | ||
| print() | ||
| print("Loaded JIRA_EMAIL / JIRA_TOKEN from Vault (FIREWATCH_JIRA_VAULT_PATH).") | ||
| if not email or not token: | ||
| print() | ||
| print( | ||
| "Set JIRA_EMAIL and JIRA_TOKEN, or source scripts/jira_vault_env.sh " | ||
| "(FIREWATCH_JIRA_VAULT_PATH) before running, for an authenticated POST.", | ||
| ) | ||
| sys.exit(0) | ||
| print() | ||
| print("POST /rest/api/3/issue with invalid fields (auth)") | ||
| r3 = requests.post( | ||
| ISSUE_URL, | ||
| json={"fields": {}}, | ||
| headers={"Content-Type": "application/json"}, | ||
| auth=(email, token), | ||
| timeout=30, | ||
| ) | ||
| print(f" status={r3.status_code}") | ||
| print(f" body snippet: {r3.text[:300]!r}") | ||
|
|
||
|
|
||
| if __name__ == "__main__": | ||
| main() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| if [[ -z "${FIREWATCH_JIRA_VAULT_PATH:-}" ]]; then | ||
| echo "FIREWATCH_JIRA_VAULT_PATH is not set (KV path to the firewatch-tool Jira secret)." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| EMAIL_FIELD="${FIREWATCH_JIRA_VAULT_EMAIL_FIELD:-email}" | ||
| TOKEN_FIELD="${FIREWATCH_JIRA_VAULT_TOKEN_FIELD:-token}" | ||
|
|
||
| JSON=$(vault kv get -format=json "${FIREWATCH_JIRA_VAULT_PATH}") | ||
|
|
||
| export JIRA_EMAIL | ||
| export JIRA_TOKEN | ||
| JIRA_EMAIL=$(echo "${JSON}" | jq -r --arg k "${EMAIL_FIELD}" '.data.data[$k] // .data[$k] // empty') | ||
| JIRA_TOKEN=$(echo "${JSON}" | jq -r --arg k "${TOKEN_FIELD}" '.data.data[$k] // .data[$k] // empty') | ||
|
|
||
| if [[ -z "${JIRA_EMAIL}" || -z "${JIRA_TOKEN}" ]]; then | ||
| echo "Could not read email/token from Vault at ${FIREWATCH_JIRA_VAULT_PATH}." >&2 | ||
| echo "Set FIREWATCH_JIRA_VAULT_EMAIL_FIELD / FIREWATCH_JIRA_VAULT_TOKEN_FIELD if your KV keys differ." >&2 | ||
| exit 1 | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/usr/bin/env bash | ||
| # Replay firewatch against one completed Prow job (Phase 1 of openshift-ci validation). | ||
|
Collaborator
There was a problem hiding this comment. is this a test? shouldnt this go under test dir |
||
| # Prerequisites: development/env.list (see env.list.example). JIRA_TOKEN may be set there or in repo-root .env. | ||
| # | ||
| # Phase 2 (rehearsal): use fork https://github.com/amp-rh/openshift-release -- push a branch, open a PR to | ||
| # openshift/release, then comment on the PR: | ||
| # /pj-rehearse periodic-ci-RedHatQE-interop-testing-master-ibm-fusion-access-operator-ocp4.21-lp-interop-ibm-fusion-access-operator-ipi-ocp421 | ||
| # That periodic uses workflow firewatch-ipi-aws (post: firewatch-report-issues). Rehearsal uses the | ||
| # firewatch image pinned in openshift/release, not your local firewatch branch, unless you bump the image there. | ||
| set -euo pipefail | ||
|
|
||
| ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" | ||
| cd "$ROOT" | ||
|
|
||
| ENV_FILE="${ROOT}/development/env.list" | ||
| if [[ ! -f "$ENV_FILE" ]]; then | ||
| echo "Missing ${ENV_FILE}. Copy development/env.list.example and set JIRA_TOKEN." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| set -a | ||
| # shellcheck disable=SC1090 | ||
| source "$ENV_FILE" | ||
| set +a | ||
|
|
||
| if [[ -f "${ROOT}/.env" ]]; then | ||
| while IFS= read -r line; do | ||
| [[ "$line" =~ ^[[:space:]]*# ]] && continue | ||
| case "$line" in | ||
| JIRA_TOKEN=*) | ||
| if [[ -z "${JIRA_TOKEN:-}" ]]; then | ||
| v="${line#JIRA_TOKEN=}" | ||
| v="${v#\"}" | ||
| v="${v%\"}" | ||
| v="${v#\'}" | ||
| v="${v%\'}" | ||
| export JIRA_TOKEN="$v" | ||
| fi | ||
| ;; | ||
| JIRA_EMAIL=*) | ||
| if [[ -z "${JIRA_EMAIL:-}" ]]; then | ||
| v="${line#JIRA_EMAIL=}" | ||
| v="${v#\"}" | ||
| v="${v%\"}" | ||
| export JIRA_EMAIL="$v" | ||
| fi | ||
| ;; | ||
| esac | ||
| done < "${ROOT}/.env" | ||
| fi | ||
|
|
||
| if [[ -z "${JIRA_TOKEN:-}" ]]; then | ||
| echo "JIRA_TOKEN is empty. Set it in development/env.list or as JIRA_TOKEN= in repo-root .env." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [[ -z "${JIRA_SERVER_URL:-}" ]]; then | ||
| echo "JIRA_SERVER_URL is required (see env.list.example)." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "${JIRA_TOKEN}" > /tmp/firewatch-smoke-token | ||
| uv sync -q | ||
| GEN_ARGS=( | ||
| firewatch jira-config-gen | ||
| --token-path /tmp/firewatch-smoke-token | ||
| --server-url "${JIRA_SERVER_URL}" | ||
| --template-path "${ROOT}/src/templates/jira.config.j2" | ||
| ) | ||
| if [[ -n "${JIRA_EMAIL:-}" ]]; then | ||
| GEN_ARGS+=(--email "${JIRA_EMAIL}") | ||
| fi | ||
| uv run "${GEN_ARGS[@]}" | ||
| rm -f /tmp/firewatch-smoke-token | ||
|
|
||
| uv run python -c " | ||
| import json | ||
| with open('/tmp/jira.config') as f: | ||
| cfg = json.load(f) | ||
| cfg.pop('proxies', None) | ||
| with open('/tmp/jira.config', 'w') as f: | ||
| json.dump(cfg, f, indent=2) | ||
| " | ||
|
|
||
| export FIREWATCH_DEFAULT_JIRA_PROJECT="${FIREWATCH_DEFAULT_JIRA_PROJECT:?}" | ||
| export FIREWATCH_CONFIG="${FIREWATCH_CONFIG:?}" | ||
|
|
||
| exec uv run firewatch report \ | ||
| --keep-job-dir \ | ||
| --jira-config-path /tmp/jira.config | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why we need this file