cmd/relui: add Cloud Build triggering support

Build the Google-facing BoringCrypto image as part of publishing the
release.

I found myself a bit stuck with modeling the step. Currently it's split
in two, which means it's unlikely to trigger two builds but we don't
have any way to retry a build if it flakes. Merging the creation and the
await lets us retry, but creates a risk of publishing the Docker image
twice. Splitting the publishing step out would fix that, but I didn't
want to have to write more code to do the publishing. I think we'll have
to see how it goes.

Change-Id: I9ad4e79d05611ea744191a4d9d4a6c8df38c523a
Reviewed-on: https://go-review.googlesource.com/c/build/+/504819
Auto-Submit: Heschi Kreinick <[email protected]>
Reviewed-by: Carlos Amedee <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>
Run-TryBot: Heschi Kreinick <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>

Author: heschi

cmd/relui/main.go

@@ -23,6 +23,7 @@ import (
 	"strings"
 	"time"
 
+	cloudbuild "cloud.google.com/go/cloudbuild/apiv1/v2"
 	"cloud.google.com/go/compute/metadata"
 	"cloud.google.com/go/storage"
 	"github.com/google/go-github/github"
@@ -142,6 +143,10 @@ func main() {
 	if err != nil {
 		log.Fatalf("Could not connect to GCS: %v", err)
 	}
+	cloudbuildClient, err := cloudbuild.NewClient(ctx)
+	if err != nil {
+		log.Fatalf("Could not connect to Cloud Build: %v", err)
+	}
 	var dbPool db.PGDBTX
 	dbPool, err = pgxpool.Connect(ctx, *pgConnect)
 	if err != nil {
@@ -168,17 +173,20 @@ func main() {
 	signServer := sign.NewServer()
 	protos.RegisterReleaseServiceServer(grpcServer, signServer)
 	buildTasks := &relui.BuildReleaseTasks{
-		GerritClient:     gerritClient,
-		GerritHTTPClient: oauth2.NewClient(ctx, creds.TokenSource),
-		GerritURL:        "https://go.googlesource.com/go",
-		PrivateGerritURL: "https://team.googlesource.com/golang/go-private",
-		CreateBuildlet:   coordinator.CreateBuildlet,
-		SignService:      signServer,
-		GCSClient:        gcsClient,
-		ScratchURL:       *scratchFilesBase,
-		ServingURL:       *servingFilesBase,
-		DownloadURL:      *edgeCacheURL,
-		ProxyPrefix:      "https://proxy.golang.org/golang.org/toolchain/@v",
+		GerritClient:       gerritClient,
+		GerritHTTPClient:   oauth2.NewClient(ctx, creds.TokenSource),
+		GerritURL:          "https://go.googlesource.com/go",
+		PrivateGerritURL:   "https://team.googlesource.com/golang/go-private",
+		CreateBuildlet:     coordinator.CreateBuildlet,
+		SignService:        signServer,
+		GCSClient:          gcsClient,
+		ScratchURL:         *scratchFilesBase,
+		ServingURL:         *servingFilesBase,
+		DownloadURL:        *edgeCacheURL,
+		ProxyPrefix:        "https://proxy.golang.org/golang.org/toolchain/@v",
+		CloudBuildClient:   &task.RealCloudBuildClient{Client: cloudbuildClient},
+		BoringBuildProject: "symbolic-datum-552",
+		BoringBuildTrigger: "golang-publish-internal-boringcrypto",
 		PublishFile: func(f task.WebsiteFile) error {
 			return publishFile(*websiteUploadURL, userPassAuth, f)
 		},

go.mod

@@ -4,6 +4,7 @@ go 1.18
 
 require (
 	cloud.google.com/go/bigquery v1.50.0
+	cloud.google.com/go/cloudbuild v1.9.0
 	cloud.google.com/go/compute/metadata v0.2.3
 	cloud.google.com/go/datastore v1.11.0
 	cloud.google.com/go/errorreporting v0.3.0

go.sum

@@ -34,6 +34,8 @@ cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4g
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/bigquery v1.50.0 h1:RscMV6LbnAmhAzD893Lv9nXXy2WCaJmbxYPWDLbGqNQ=
 cloud.google.com/go/bigquery v1.50.0/go.mod h1:YrleYEh2pSEbgTBZYMJ5SuSr0ML3ypjRB1zgf7pvQLU=
+cloud.google.com/go/cloudbuild v1.9.0 h1:GHQCjV4WlPPVU/j3Rlpc8vNIDwThhd1U9qSY/NPZdko=
+cloud.google.com/go/cloudbuild v1.9.0/go.mod h1:qK1d7s4QlO0VwfYn5YuClDGg2hfmLZEb4wQGAbIgL1s=
 cloud.google.com/go/compute v1.19.3 h1:DcTwsFgGev/wV5+q8o2fzgcHOaac+DKGC91ZlvpsQds=
 cloud.google.com/go/compute v1.19.3/go.mod h1:qxvISKp/gYnXkSAD1ppcSOveRAmzxicEv/JlizULFrI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=

internal/relui/buildrelease_test.go

@@ -211,18 +211,26 @@ esac
 		},
 	}
 
+	const boringProject, boringTrigger = "boring-build-project", "boring-build-trigger"
+
 	buildTasks := &BuildReleaseTasks{
-		GerritClient:     gerrit,
-		GerritHTTPClient: http.DefaultClient,
-		GerritURL:        fakeGerrit.GerritURL() + "/go",
-		GCSClient:        nil,
-		ScratchURL:       "file://" + filepath.ToSlash(t.TempDir()),
-		ServingURL:       "file://" + filepath.ToSlash(servingDir),
-		CreateBuildlet:   fakeBuildlets.CreateBuildlet,
-		SignService:      task.NewFakeSignService(t),
-		DownloadURL:      dlServer.URL,
-		ProxyPrefix:      dlServer.URL,
-		PublishFile:      publishFile,
+		GerritClient:       gerrit,
+		GerritHTTPClient:   http.DefaultClient,
+		GerritURL:          fakeGerrit.GerritURL() + "/go",
+		GCSClient:          nil,
+		ScratchURL:         "file://" + filepath.ToSlash(t.TempDir()),
+		ServingURL:         "file://" + filepath.ToSlash(servingDir),
+		CreateBuildlet:     fakeBuildlets.CreateBuildlet,
+		SignService:        task.NewFakeSignService(t),
+		DownloadURL:        dlServer.URL,
+		ProxyPrefix:        dlServer.URL,
+		PublishFile:        publishFile,
+		BoringBuildProject: boringProject,
+		BoringBuildTrigger: boringTrigger,
+		CloudBuildClient: &task.FakeCloudBuild{
+			Project:       boringProject,
+			AllowedBuilds: map[string]map[string]string{boringTrigger: {"_GO_VERSION": wantVersion}},
+		},
 		ApproveAction: func(ctx *workflow.TaskContext) error {
 			if strings.Contains(ctx.TaskName, "Release Coordinator Approval") {
 				return nil

internal/relui/workflows.go

@@ -431,6 +431,11 @@ func addSingleReleaseWorkflow(
 		goimportsCommit := wf.Task2(wd, "Wait for goimports CL submission", version.AwaitCL, goimportsCL, wf.Const(""))
 		wf.Output(wd, "goimports CL submitted", goimportsCommit)
 	}
+
+	boringBuild := wf.Task1(wd, "Start boringcrypto build", build.runBoringCryptoBuild, nextVersion, wf.After(uploaded))
+	boringResult := wf.Task1(wd, "Await boringcrypto build", build.awaitCloudBuild, boringBuild)
+	wf.Output(wd, "BoringCrypto Docker image status", boringResult)
+
 	wf.Output(wd, "Published to website", published)
 	return published
 }
@@ -569,6 +574,9 @@ type BuildReleaseTasks struct {
 	PublishFile            func(task.WebsiteFile) error
 	CreateBuildlet         func(context.Context, string) (buildlet.RemoteClient, error)
 	SignService            sign.Service
+	BoringBuildProject     string
+	BoringBuildTrigger     string
+	CloudBuildClient       task.CloudBuildClient
 	ApproveAction          func(*wf.TaskContext) error
 }
 
@@ -1373,6 +1381,17 @@ func (tasks *BuildReleaseTasks) publishArtifacts(ctx *wf.TaskContext, version st
 	return task.Published{Version: version, Files: files}, nil
 }
 
+func (b *BuildReleaseTasks) runBoringCryptoBuild(ctx context.Context, version string) (string, error) {
+	return b.CloudBuildClient.RunBuildTrigger(ctx, b.BoringBuildProject, b.BoringBuildTrigger, map[string]string{"_GO_VERSION": version})
+}
+
+func (b *BuildReleaseTasks) awaitCloudBuild(ctx *wf.TaskContext, id string) (string, error) {
+	detail, err := task.AwaitCondition(ctx, 30*time.Second, func() (string, bool, error) {
+		return b.CloudBuildClient.Completed(ctx, b.BoringBuildProject, id)
+	})
+	return detail, err
+}
+
 // cutPrefix returns s without the provided leading prefix string
 // and reports whether it found the prefix.
 // If s doesn't start with prefix, cutPrefix returns s, false.

internal/task/cloudbuild.go

@@ -0,0 +1,63 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package task
+
+import (
+	"context"
+	"fmt"
+
+	cloudbuild "cloud.google.com/go/cloudbuild/apiv1/v2"
+	"cloud.google.com/go/cloudbuild/apiv1/v2/cloudbuildpb"
+)
+
+type CloudBuildClient interface {
+	// RunBuildTrigger runs an existing trigger in project with the given substitutions.
+	RunBuildTrigger(ctx context.Context, project, trigger string, substitutions map[string]string) (buildID string, _ error)
+	// Completed reports whether a build has finished, returning an error if it's failed.
+	// It's suitable for use with AwaitCondition.
+	Completed(ctx context.Context, project, buildID string) (detail string, completed bool, _ error)
+}
+
+type RealCloudBuildClient struct {
+	Client *cloudbuild.Client
+}
+
+func (c *RealCloudBuildClient) RunBuildTrigger(ctx context.Context, project, trigger string, substitutions map[string]string) (string, error) {
+	op, err := c.Client.RunBuildTrigger(ctx, &cloudbuildpb.RunBuildTriggerRequest{
+		ProjectId: project,
+		TriggerId: trigger,
+		Source: &cloudbuildpb.RepoSource{
+			Substitutions: substitutions,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	if _, err = op.Poll(ctx); err != nil {
+		return "", err
+	}
+	meta, err := op.Metadata()
+	if err != nil {
+		return "", err
+	}
+	return meta.Build.Id, nil
+}
+
+func (c *RealCloudBuildClient) Completed(ctx context.Context, project, buildID string) (string, bool, error) {
+	build, err := c.Client.GetBuild(ctx, &cloudbuildpb.GetBuildRequest{
+		ProjectId: project,
+		Id:        buildID,
+	})
+	if err != nil {
+		return "", false, err
+	}
+	if build.FinishTime == nil {
+		return "", false, nil
+	}
+	if build.Status != cloudbuildpb.Build_SUCCESS {
+		return "", false, fmt.Errorf("build %q failed: %v", buildID, build.FailureInfo)
+	}
+	return build.StatusDetail, true, nil
+}

internal/task/fakes.go

@@ -19,6 +19,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -647,3 +648,29 @@ func fakeGPGFile(f string) string {
 	}
 	return f + ".asc"
 }
+
+var _ CloudBuildClient = (*FakeCloudBuild)(nil)
+
+type FakeCloudBuild struct {
+	Project       string
+	AllowedBuilds map[string]map[string]string
+}
+
+const fakeBuildID = "build-12345"
+
+func (cb *FakeCloudBuild) RunBuildTrigger(ctx context.Context, project string, trigger string, substitutions map[string]string) (string, error) {
+	if project != cb.Project {
+		return "", fmt.Errorf("unexpected project %v, want %v", project, cb.Project)
+	}
+	if allowedSubs, ok := cb.AllowedBuilds[trigger]; !ok || !reflect.DeepEqual(allowedSubs, substitutions) {
+		return "", fmt.Errorf("unexpected trigger %v: got params %#v, want %#v", trigger, substitutions, allowedSubs)
+	}
+	return fakeBuildID, nil
+}
+
+func (cb *FakeCloudBuild) Completed(ctx context.Context, project string, id string) (string, bool, error) {
+	if project != cb.Project || id != fakeBuildID {
+		return "", false, fmt.Errorf("unexpected build project/id: got %v %v, want %v %v", project, id, cb.Project, fakeBuildID)
+	}
+	return "here's some build detail", true, nil
+}