notifier: Implement upgrade logic for notifier service

* If $update is enabled for git-clone, then add an exec resource
  that checks the working copy, and if HEAD is not $branch tag,
  then:
  - fetch origin
  - checkout tag (forced)
  - clean working copy, which deletes stale node_modules (and also
    config.json)

* The node_modules is updated given the 'creates' should evaluate
  to false. Add notify to ensure service restart.

* The config.json file resource already ensures its own re-creation
  and notification, hopefully Puppet merges the notifications, but
  probably fine either way?

Revert the hiera change from notifier v4 back to v3 (was pushed to
staging only, and didn't do anything), so that I check first test
that this change doesn't cause any churn on repeat runs by itself,
and then test that the upgrade works.

Author: Krinkle

hieradata/common.yaml

@@ -553,7 +553,7 @@ profile::base::groups:
   gitpuppet:
     gid: 600
 
-profile::notifier::version: v4.0.0
+profile::notifier::version: v3.0.0
 
 # https://github.com/wp-cli/wp-cli/releases
 profile::wordpress::base::wordpress_cli_version: "2.8.1"

modules/git/manifests/clone.pp

@@ -1,11 +1,15 @@
 # @summary clones a git repository
 # @param $path the filesystem path
 # @param $remote the remote url
-# @param $branch the branch to clone
+# @param $branch the branch or tag to checkout
 # @param $owner file owner
 # @param $group file group
 # @param $shared true if the group should have write access
 # @param $ensure present or absent
+# @param $update Enable this to update an existing clone after $branch points to
+#  a different tag than before. Only supports tags. This will *delete* any ignored
+#  or untracked files (such as previously provisioned configuration or node_modules).
+#  To update after branch pushes, use `notifier` instead.
 define git::clone (
   Stdlib::Unixpath $path,
   String           $remote,
@@ -14,6 +18,7 @@
   String           $group,
   Boolean          $shared = false,
   Jqlib::Ensure    $ensure = present,
+  Boolean          $update = false,
 ) {
   if $ensure == 'present' {
     if $shared {
@@ -41,6 +46,21 @@
       group   => $group,
       umask   => $umask,
     }
+
+    if $update {
+      exec { "git_checkout_${title}":
+        cwd       => $path,
+        unless    => "test \"$(git describe --exact-match --tags) = \"${branch}\"",
+        # This will delete
+        command   => "/usr/bin/git fetch --tags --prune --prune-tags \"${remote}\" && /usr/bin/git checkout --force --quiet \"${branch}\" && /usr/bin/git clean -dfx",
+        logoutput => true,
+        provider  => 'shell',
+        user      => $owner,
+        group     => $group,
+        umask     => $umask,
+      }
+    }
+
   } elsif $ensure == 'absent' {
     file { $path:
       ensure  => absent,

modules/notifier/manifests/init.pp

@@ -1,7 +1,6 @@
 # @summary configures node-notifier to receive github webhooks
 # @param $webhook_secret github webhook secret
-# @param $version git version to clone. note that the module doesn't
-#   currently auto update after changing this.
+# @param $version git tag to clone
 class notifier (
   String[1] $webhook_secret,
   String[1] $version,
@@ -26,6 +25,9 @@
     owner   => 'notifier',
     group   => 'notifier',
     branch  => $version,
+    # After updates, git::clone will delete old node_modules, allowing
+    # the next exec to install the new version, and then restart the service.
+    update  => true,
     require => Systemd::Tmpfile['notifier'],
   }
 
@@ -38,6 +40,7 @@
       Git::Clone['notifier'],
       Systemd::Tmpfile['notifier'],
     ],
+    notify  => Service['notifier'],
   }
 
   $config = {