ci: rebase PRs before running CI checks (#20985)

PRs should be rebased before running and CI checks to test the code
that would be merged, rather than the code of the repository the PR
was created from at the time it was created.

(cherry picked from commit 154757c)

Author: josephperrott

.circleci/config.yml

@@ -26,14 +26,6 @@ var_5: &job_defaults
   docker:
     - image: *docker_image
 
-# Job step for checking out the source code from GitHub. This also ensures that the source code
-# is rebased on top of master.
-var_6: &checkout_code
-  checkout:
-    # After checkout, rebase on top of master. By default, PRs are not rebased on top of master,
-    # which we want. See https://discuss.circleci.com/t/1662
-    post: git pull --ff-only origin "refs/pull/${CI_PULL_REQUEST//*pull\//}/merge"
-
 # Restores the cache that could be available for the current Yarn lock file. The cache usually
 # includes the node modules and the Bazel repository cache.
 var_7: &restore_cache
@@ -159,12 +151,34 @@ orbs:
   # push conflicts.
   queue: eddiewebb/[email protected]
 
+
+commands:
+  checkout_and_rebase:
+    description: Checkout and rebase the repository
+    steps:
+      - checkout
+      - run:
+          name: Set up environment
+          environment:
+              CIRCLE_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+              CIRCLE_GIT_REVISION: << pipeline.git.revision >>
+          command: ./.circleci/env.sh
+      - run:
+          name: Rebase PR on target branch
+          # After checkout, rebase on top of target branch.
+          command: |
+            if [ -n "$CIRCLE_PR_NUMBER" ]; then
+              # User is required for rebase.
+              git config user.name "angular-ci"
+              git config user.email "angular-ci"
+              node .circleci/rebase-pr.js
+            fi
+
 # -----------------------------------------------------------------------------------------
 # Job definitions. Jobs which are defined just here, will not run automatically. Each job
 # must be part of a workflow definition in order to run for PRs and push builds.
 # -----------------------------------------------------------------------------------------
 jobs:
-
   # -----------------------------------
   # Job to test that everything builds with Bazel
   # -----------------------------------
@@ -174,7 +188,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -196,7 +210,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -218,7 +232,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *setup_bazel_remote_execution
@@ -237,7 +251,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -260,7 +274,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -281,7 +295,7 @@ jobs:
       BROWSER_STACK_USERNAME: "angularteam1"
       BROWSER_STACK_ACCESS_KEY: "CaXMeMHD9pr5PHg8N7Jq"
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *yarn_install
@@ -303,7 +317,7 @@ jobs:
       # a rate limit exception.
       KARMA_PARALLEL_BROWSERS: 2
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *yarn_install
@@ -316,8 +330,11 @@ jobs:
   # ----------------------------------
   lint:
     <<: *job_defaults
+    environment:
+      CI_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+      CI_GIT_REVISION: << pipeline.git.revision >>
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *yarn_install
@@ -342,7 +359,7 @@ jobs:
           # much about any failures that have made it into the main branch.
           command: |
             if [ -n "$CIRCLE_PR_NUMBER" ]; then
-              yarn ng-dev commit-message validate-range --range << pipeline.git.base_revision >>...<<pipeline.git.revision>>
+              yarn ng-dev commit-message validate-range --range $CI_COMMIT_RANGE
             fi
       - run: yarn ownerslint
       - run: yarn stylelint
@@ -362,7 +379,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -414,7 +431,7 @@ jobs:
   upload_release_packages:
     <<: *job_defaults
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *yarn_install
@@ -435,7 +452,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *setup_bazel_ci_config
@@ -473,7 +490,7 @@ jobs:
     <<: *job_defaults
     resource_class: xlarge
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *yarn_install
@@ -497,7 +514,7 @@ jobs:
     <<: *job_defaults
     resource_class: xlarge
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *setup_snapshot_builds
@@ -524,7 +541,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *setup_bazel_remote_execution
@@ -545,7 +562,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -565,7 +582,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -586,7 +603,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -612,7 +629,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_binary
       - *setup_bazel_ci_config

.circleci/env-helpers.inc.sh

@@ -0,0 +1,73 @@
+####################################################################################################
+# Helpers for defining environment variables for CircleCI.
+#
+# In CircleCI, each step runs in a new shell. The way to share ENV variables across steps is to
+# export them from `$BASH_ENV`, which is automatically sourced at the beginning of every step (for
+# the default `bash` shell).
+#
+# See also https://circleci.com/docs/2.0/env-vars/#using-bash_env-to-set-environment-variables.
+####################################################################################################
+
+# Set and print an environment variable.
+#
+# Use this function for setting environment variables that are public, i.e. it is OK for them to be
+# visible to anyone through the CI logs.
+#
+# Usage: `setPublicVar <name> <value>`
+function setPublicVar() {
+  setSecretVar $1 "$2";
+  echo "$1=$2";
+}
+
+# Set (without printing) an environment variable.
+#
+# Use this function for setting environment variables that are secret, i.e. should not be visible to
+# everyone through the CI logs.
+#
+# Usage: `setSecretVar <name> <value>`
+function setSecretVar() {
+  # WARNING: Secrets (e.g. passwords, access tokens) should NOT be printed.
+  # (Keep original shell options to restore at the end.)
+  local -r originalShellOptions=$(set +o);
+  set +x -eu -o pipefail;
+
+  echo "export $1=\"${2:-}\";" >> $BASH_ENV;
+
+  # Restore original shell options.
+  eval "$originalShellOptions";
+}
+
+
+# Create a function to set an environment variable, when called.
+#
+# Use this function for creating setter for public environment variables that require expensive or
+# time-consuming computaions and may not be needed. When needed, you can call this function to set
+# the environment variable (which will be available through `$BASH_ENV` from that point onwards).
+#
+# Arguments:
+# - `<name>`: The name of the environment variable. The generated setter function will be
+#   `setPublicVar_<name>`.
+# - `<code>`: The code to run to compute the value for the variable. Since this code should be
+#   executed lazily, it must be properly escaped. For example:
+#   ```sh
+#   # DO NOT do this:
+#   createPublicVarSetter MY_VAR "$(whoami)";  # `whoami` will be evaluated eagerly
+#
+#   # DO this isntead:
+#   createPublicVarSetter MY_VAR "\$(whoami)";  # `whoami` will NOT be evaluated eagerly
+#   ```
+#
+# Usage: `createPublicVarSetter <name> <code>`
+#
+# Example:
+# ```sh
+# createPublicVarSetter MY_VAR 'echo "FOO"';
+# echo $MY_VAR;  # Not defined
+#
+# setPublicVar_MY_VAR;
+# source $BASH_ENV;
+# echo $MY_VAR;  # FOO
+# ```
+function createPublicVarSetter() {
+  echo "setPublicVar_$1() { setPublicVar $1 \"$2\"; }" >> $BASH_ENV;
+}

.circleci/env.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# Variables
+readonly projectDir=$(realpath "$(dirname ${BASH_SOURCE[0]})/..")
+readonly envHelpersPath="$projectDir/.circleci/env-helpers.inc.sh";
+readonly bashEnvCachePath="$projectDir/.circleci/bash_env_cache";
+
+# Load helpers and make them available everywhere (through `$BASH_ENV`).
+source $envHelpersPath;
+echo "source $envHelpersPath;" >> $BASH_ENV;
+
+
+####################################################################################################
+# Define PUBLIC environment variables for CircleCI.
+####################################################################################################
+# See https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables for more info.
+####################################################################################################
+setPublicVar CI "$CI"
+setPublicVar PROJECT_ROOT "$projectDir";
+# This is the branch being built; e.g. `pull/12345` for PR builds.
+setPublicVar CI_BRANCH "$CIRCLE_BRANCH";
+setPublicVar CI_BUILD_URL "$CIRCLE_BUILD_URL";
+setPublicVar CI_COMMIT "$CIRCLE_SHA1";
+# `CI_COMMIT_RANGE` is only used on push builds (a.k.a. non-PR, non-scheduled builds and rerun
+# workflows of such builds).
+setPublicVar CI_GIT_BASE_REVISION "${CIRCLE_GIT_BASE_REVISION}";
+setPublicVar CI_GIT_REVISION "${CIRCLE_GIT_REVISION}";
+setPublicVar CI_COMMIT_RANGE "$CIRCLE_GIT_BASE_REVISION..$CIRCLE_GIT_REVISION";
+setPublicVar CI_PULL_REQUEST "${CIRCLE_PR_NUMBER:-false}";
+setPublicVar CI_REPO_NAME "$CIRCLE_PROJECT_REPONAME";
+setPublicVar CI_REPO_OWNER "$CIRCLE_PROJECT_USERNAME";
+setPublicVar CI_PR_REPONAME "$CIRCLE_PR_REPONAME";
+setPublicVar CI_PR_USERNAME "$CIRCLE_PR_USERNAME";
+
+####################################################################################################
+# Decrypt GCP Credentials and store them as the Google default credentials.
+####################################################################################################
+mkdir -p "$HOME/.config/gcloud";
+openssl aes-256-cbc -d -in "${projectDir}/.circleci/gcp_token" \
+        -md md5 -k "$CIRCLE_PROJECT_REPONAME" -out "$HOME/.config/gcloud/application_default_credentials.json"
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+cp "${projectDir}/.circleci/bazel.linux.rc" "$HOME/.bazelrc";
+
+####################################################################################################
+####################################################################################################
+##                  Source `$BASH_ENV` to make the variables available immediately.               ##
+##                  ***NOTE: This must remain the the last action in this script***               ##
+####################################################################################################
+####################################################################################################
+source $BASH_ENV;