Update downstream check script on 21.x branch (#466)

The downstream change checking script has received a number of
improvements on trunk which should be cherry-picked to the release
branch, ahead of changes that fail to make branching being made. This
includes:

Check review approvals in downstream changes
0361b4e
#408
Disable review approval portion of downstream change check
5522f06
#449
Allow additional whitespace in downstream issue tagging
52fc4c2
#459

Together, these make the following changes:
* The GutHub token being used is changed to one automatically generated
for the Action, instead of the LLVM Sync token which has different
permissions.
* When a pull request is detected as making a downstream change, a
comment is left by the bot to explain the downstream patch policy, and
the existence of the check.
* The pull request making the downstream change, and the tracking issue
are both automatically labelled with the downstream change tag.
* The regular expression for searching for the tagging line in the pull
request has been relaxed to allow for additional whietspace.
* A dry run option is added to script so it can be run to check without
the aboce automatic comment/labelling.

This patch series also added an additional check on who has reviewed the
downsteam change, but this check is reverted within the same series.

Author: dcandler

.github/workflows/check_downstream_changes.yml

@@ -34,18 +34,10 @@ jobs:
     if: github.repository == 'arm/arm-toolchain'
 
     steps:
-      # Generate a token for gh tool
-      - name: Configure Access Token
-        uses: actions/create-github-app-token@v1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.SYNC_APP_ID }}
-          private-key: ${{ secrets.SYNC_APP_PRIVATE_KEY }}
-
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Run Check Script
         run: python3 arm-software/ci/check_downstream_changes.py --repo ${{ github.repository }} --pr ${{ github.event.pull_request.number }}
         env:
-          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

arm-software/ci/check_downstream_changes.py

@@ -29,6 +29,9 @@
 logger = logging.getLogger(__name__)
 
 MERGE_IGNORE_PATHSPEC_FILE = Path(__file__).parent / ".automerge_ignore"
+HELP_COMMENT_TEXT = """This pull review modifies files outside of the `arm-software` directory, so please ensure it follows the [Downstream Patch Policy](https://github.com/arm/arm-toolchain/blob/arm-software/CONTRIBUTING.md#downstream-patch-policy).
+An automated check will test if the tagging requirements have been met. Please wait for approving reviews from both Arm Toolchain for Embedded and Arm Toolchain for Linux teams before merging."""
+DOWNSTREAM_CHANGE_LABEL = "downstream-change"
 
 
 # Check gh is working before using it
@@ -55,7 +58,16 @@ def check_gh_status() -> None:
 
 # Use gh to get information about the pull request.
 def get_pr_json(pr_num: str, repo: str) -> dict:
-    args = ["gh", "pr", "view", pr_num, "--repo", repo, "--json", "body,files,title"]
+    args = [
+        "gh",
+        "pr",
+        "view",
+        pr_num,
+        "--repo",
+        repo,
+        "--json",
+        "body,comments,files,labels,title",
+    ]
     logger.debug(f"Running `{shlex.join(args)}`")
     try:
         p = subprocess.run(
@@ -159,7 +171,7 @@ def has_downstream_changes(input_json: dict) -> bool:
 def find_pr_issue(input_json: dict) -> str:
     logger.debug("body text: %s", input_json["body"])
     matches = re.findall(
-        "^((?:removes )?downstream issue: *#([0-9]+))",
+        r"^\s*((?:removes )?downstream issue: *#([0-9]+))",
         input_json["body"],
         flags=re.I | re.M,
     )
@@ -180,6 +192,91 @@ def find_pr_issue(input_json: dict) -> str:
     return issue_num
 
 
+# Add a label to a pull request.
+def add_pr_label(pr_num: str, repo: str, input_json: dict) -> None:
+    # Check if the issue is already labelled.
+    for label_json in input_json["labels"]:
+        if label_json["name"] == DOWNSTREAM_CHANGE_LABEL:
+            return
+    args = [
+        "gh",
+        "pr",
+        "edit",
+        pr_num,
+        "--repo",
+        repo,
+        "--add-label",
+        DOWNSTREAM_CHANGE_LABEL,
+    ]
+    logger.debug(f"Running `{shlex.join(args)}`")
+    try:
+        p = subprocess.run(
+            args,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as error:
+        logger.error(
+            f"Check error. Failure adding pr label\ncmd:{shlex.join(error.cmd)}\ncode:{error.returncode}\nstdout:{error.stdout}\nstderr:{error.stderr}"
+        )
+        sys.exit(1)
+
+
+# Add a label to an issue.
+def add_issue_label(issue_num: str, repo: str, input_json: dict) -> None:
+    # Check if the issue is already labelled.
+    for label_json in input_json["labels"]:
+        if label_json["name"] == DOWNSTREAM_CHANGE_LABEL:
+            return
+    args = [
+        "gh",
+        "issue",
+        "edit",
+        issue_num,
+        "--repo",
+        repo,
+        "--add-label",
+        DOWNSTREAM_CHANGE_LABEL,
+    ]
+    logger.debug(f"Running `{shlex.join(args)}`")
+    try:
+        p = subprocess.run(
+            args,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as error:
+        logger.error(
+            f"Check error. Failure adding issue label\ncmd:{shlex.join(error.cmd)}\ncode:{error.returncode}\nstdout:{error.stdout}\nstderr:{error.stderr}"
+        )
+        sys.exit(1)
+
+
+# Add a comment explaining the additional requirements for downstream changes
+def add_help_comment(pr_num: str, repo: str, input_json: dict) -> None:
+    # Check if the comment has already been made first, so as not to repost
+    # every time the script runs.
+    for comment_json in input_json["comments"]:
+        if comment_json["body"] == HELP_COMMENT_TEXT:
+            return
+    args = ["gh", "pr", "comment", pr_num, "--repo", repo, "--body", HELP_COMMENT_TEXT]
+    logger.debug(f"Running `{shlex.join(args)}`")
+    try:
+        p = subprocess.run(
+            args,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as error:
+        logger.error(
+            f"Check error. Failure adding comment\ncmd:{shlex.join(error.cmd)}\ncode:{error.returncode}\nstdout:{error.stdout}\nstderr:{error.stderr}"
+        )
+        sys.exit(1)
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument(
@@ -197,6 +294,11 @@ def main():
         action="store_true",
         help="Print verbose log messages",
     )
+    parser.add_argument(
+        "--dryrun",
+        action="store_true",
+        help="Don't make modifications such as comments or labels",
+    )
 
     args = parser.parse_args()
 
@@ -213,6 +315,9 @@ def main():
 
     link_text = "Please check https://github.com/arm/arm-toolchain/blob/arm-software/CONTRIBUTING.md#downstream-patch-policy for information on the downstream patch policy and how changes need to be tracked."
     if needs_tagging:
+        if not args.dryrun:
+            add_pr_label(args.pr, args.repo, pr_json)
+            add_help_comment(args.pr, args.repo, pr_json)
         if issue_num is None:
             logger.info(
                 f"Check failed. Pull request #{args.pr} contains downstream changes, but does not have a correctly formatted link to a downstream tracking issue. {link_text}"
@@ -225,6 +330,8 @@ def main():
                 )
                 sys.exit(1)
             else:
+                if not args.dryrun:
+                    add_issue_label(args.pr, args.repo, pr_json)
                 logger.info(
                     f"Check passed. Pull request #{args.pr} contains downstream changes, and a correctly formatted link to a downstream tracking issue."
                 )