CLOUDP-267029 - auto bump on publish variants (#4147)

# Summary
- adds a new variant that always runs
- but it only pushes changes under certain circumstances as defined
below
- unpacking has been moved to `project/tmp` to ensure we don't commit
them

## When to run the pre-commit hook and push changes
- Dependabot: Branch starts with dependabot/
- Agent bump: Branch ends with _version_bump
- Release: Branch starts with operator-release

## How
- A new Task and variant that runs on every PR
   - Name: Pre-commit
   - Gets current branch
   - Runs: Pre-commit and pushes (only if changes are there)
- Conditions when to do the commit and push:
- Easy: Only when specific branch name, otherwise just cancel
(implemented)
  - Better: create.tasks based on above information

## Proof of Work

### Pre-Commit skipped
-
https://spruce.mongodb.com/task/ops_manager_kubernetes_run_pre_commit_run_precommit_and_push_patch_1706841847f03ed296470183d275f66ac908295f_67c81c321a5ca40007e2985d_25_03_05_09_41_11/logs?execution=0

### Pre-Commit not skipped
- dependabot: 10gen/ops-manager-kubernetes#4151
```
[2025/03/05 11:22:36.503] To https://github.com/10gen/ops-manager-kubernetes.git
[2025/03/05 11:22:36.503]    fd8d787e1..4ef668655  dependabot/go_modules/golang.org/x/crypto-0.35.0 -> dependabot/go_modules/golang.org/x/crypto-0.35.0
[2025/03/05 11:22:36.506] finished
```
![Screenshot 2025-03-05 at 11 31
36](https://github.com/user-attachments/assets/b19eea8b-baa9-46f0-9c15-7f65a778a985)
- after the commit it runs again in the next commit, but will be skipped
because no changes are staged:
https://spruce.mongodb.com/version/67c83cb67e26fb0007bb9a23/tasks?variant=^run_pre_commit$

## Checklist
- [x] Have you linked a jira ticket and/or is the ticket in the title?
- [x] Have you checked whether your jira ticket required DOCSP changes?
- [x] Have you checked for release_note changes?

Author: nammn

.evergreen.yml

@@ -194,6 +194,8 @@ github_pr_aliases:
     task_tags: [ "unit_tests" ]
   - variant_tags: [ "e2e_test_suite" ]
     task_tags: [ "patch-run" ]
+  - variant_tags: [ "auto_bump" ]
+    task_tags: [ "patch-run" ]
 
 # Allows to see evergreen checks in GitHub commits
 # https://github.com/10gen/ops-manager-kubernetes/commits/master/
@@ -316,6 +318,24 @@ tasks:
           image_name: agent-pct
           include_tags: release
 
+  - name: run_precommit_and_push
+    tags: ["patch-run"]
+    commands:
+      - func: clone
+      - func: python_venv
+      - func: download_kube_tools
+      - func: setup_shellcheck
+      - command: github.generate_token
+        params:
+          expansion_name: GH_TOKEN
+      - command: subprocess.exec
+        type: setup
+        params:
+          include_expansions_in_env:
+            - GH_TOKEN
+          working_dir: src/github.com/10gen/ops-manager-kubernetes
+          binary: scripts/evergreen/precommit_bump.sh
+
   # Pct only triggers this variant once a new agent image is out
   # these releases the agent with the operator suffix (not patch id) on ecr to allow for digest pinning to pass.
   # For this to work, we rely on skip_tags which is used to determine whether
@@ -1510,6 +1530,16 @@ buildvariants:
     tasks:
       - name: release_agents_on_ecr_conditional
 
+  - name: run_pre_commit
+    priority: 70
+    display_name: run_pre_commit
+    allowed_requesters: [ "patch", "github_pr" ]
+    tags: [ "auto_bump" ]
+    run_on:
+      - ubuntu2204-small
+    tasks:
+      - name: run_precommit_and_push
+
   - name: init_tests_with_olm
     display_name: init_tests_with_olm
     depends_on:

.gitignore

@@ -21,6 +21,7 @@ cache
 **/env*/
 *.bak
 **/pytest_cache/
+tmp/*
 bin/*
 **/*.iml
 helm_out
@@ -89,3 +90,4 @@ docker/mongodb-enterprise-tests/.test_identifiers*
 
 logs-debug/
 /ssdlc-report/*
+.gocache/

docker/mongodb-enterprise-tests/kubetester/omtester.py

@@ -769,6 +769,7 @@ def should_include_tag(version: Optional[Dict[str, str]]) -> bool:
     Manager.
 
     """
+
     feature_controls_enabled_version = "4.2.2"
     if version is None:
         return True

scripts/evergreen/precommit_bump.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+set -Eeou pipefail
+source scripts/dev/set_env_context.sh
+
+export GOLANGCI_LINT_CACHE="${HOME}/.cache/golangci-lint"
+
+# Detect the original branch (same commit, but not the evg-pr-test-* branch which evg creates)
+ORIGINAL_BRANCH=$(git for-each-ref --format='%(refname:short) %(objectname)' refs/remotes/origin | grep "$(git rev-parse HEAD)" | grep -v "evg-pr-test-" | awk '{print $1}' | sed 's|^origin/||' | head -n 1)
+
+if [[ -z "${ORIGINAL_BRANCH}" ]]; then
+  echo "Error: Could not determine the original branch."
+  exit 1
+fi
+echo "Detected original branch: ${ORIGINAL_BRANCH}"
+
+REQUIRED_PATTERNS=(
+  "^dependabot/"
+  "_version_bump$"
+  "^enterprise-operator-release-"
+)
+
+echo "Checking branch '${ORIGINAL_BRANCH}' against required patterns:"
+
+MATCH_FOUND=false
+for pattern in "${REQUIRED_PATTERNS[@]}"; do
+  if [[ "${ORIGINAL_BRANCH}" =~ ${pattern} ]]; then
+    MATCH_FOUND=true
+    echo "✅ Match found: '${ORIGINAL_BRANCH}' matches pattern '${pattern}'"
+    break
+  fi
+done
+
+if [[ "${MATCH_FOUND}" == false ]]; then
+  echo "❌ Branch '${ORIGINAL_BRANCH}' does not match any required patterns. Exiting."
+  printf " - %s\n" "${REQUIRED_PATTERNS[@]}"
+  exit 0
+fi
+
+echo "Detected a branch that should be bumped."
+
+git checkout "${ORIGINAL_BRANCH}"
+
+EVERGREEN_MODE=true .githooks/pre-commit
+
+git add .
+
+if [[ -z $(git diff --name-only --cached) ]]; then
+  echo "No staged changes to commit. Exiting."
+  exit 0
+fi
+
+git commit -m "Run pre-commit hook"
+git remote set-url origin https://x-access-token:"${GH_TOKEN}"@github.com/10gen/ops-manager-kubernetes.git
+
+echo "changes detected, pushing them"
+git push origin "${ORIGINAL_BRANCH}"

scripts/evergreen/retry-evergreen.sh

@@ -38,7 +38,7 @@ EVERGREEN_API="https://evergreen.mongodb.com/api"
 MAX_RETRIES="${EVERGREEN_MAX_RETRIES:-3}"
 
 # shellcheck disable=SC2207
-BUILD_IDS=($(curl -s -H "Api-User: ${EVERGREEN_USER}" -H "Api-Key: ${EVERGREEN_API_KEY}" ${EVERGREEN_API}/rest/v2/versions/"${VERSION}" | jq -r '.build_variants_status[] | select(.build_variant!="unit_tests") | .build_id'))
+BUILD_IDS=($(curl -s -H "Api-User: ${EVERGREEN_USER}" -H "Api-Key: ${EVERGREEN_API_KEY}" ${EVERGREEN_API}/rest/v2/versions/"${VERSION}" | jq -r '.build_variants_status[] | select(.build_variant != "unit_tests" and .build_variant != "run_pre_commit") | .build_id'))
 
 for BUILD_ID in "${BUILD_IDS[@]}"; do
   echo "Finding failed tasks in BUILD ID: ${BUILD_ID}"

scripts/evergreen/setup_kubectl.sh

@@ -4,7 +4,8 @@ set -Eeou pipefail
 source scripts/dev/set_env_context.sh
 
 bindir="${PROJECT_DIR}/bin"
-mkdir -p "${bindir}"
+tmpdir="${PROJECT_DIR}/tmp"
+mkdir -p "${bindir}" "${tmpdir}"
 
 echo "Downloading latest kubectl"
 curl -s --retry 3 -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
@@ -14,9 +15,9 @@ echo "kubectl version --client"
 mv kubectl "${bindir}"
 
 echo "Downloading helm"
-helm=helm.tgz
-helm_version="v3.13.0"
-curl -s https://get.helm.sh/helm-${helm_version}-linux-amd64.tar.gz --output "${helm}"
-tar xfz "${helm}" &> /dev/null
-mv linux-amd64/helm "${bindir}"
-rm "${helm}"
+helm_archive="${tmpdir}/helm.tgz"
+helm_version="v3.17.1"
+curl -s https://get.helm.sh/helm-${helm_version}-linux-amd64.tar.gz --output "${helm_archive}"
+
+tar xfz "${helm_archive}" -C "${tmpdir}" &> /dev/null
+mv "${tmpdir}/linux-amd64/helm" "${bindir}"

scripts/evergreen/setup_shellcheck.sh

@@ -4,12 +4,13 @@ set -Eeou pipefail
 source scripts/dev/set_env_context.sh
 
 bindir="${PROJECT_DIR:?}/bin"
-mkdir -p "${PROJECT_DIR}/bin/"
+tmpdir="${PROJECT_DIR:?}/tmp"
+mkdir -p "${bindir}" "${tmpdir}"
 
 echo "Downloading shellcheck"
-shellcheck=shellcheck.tar.xz
+shellcheck_archive="${tmpdir}/shellcheck.tar.xz"
 shellcheck_version="v0.9.0"
-curl --retry 3 --silent -L "https://github.com/koalaman/shellcheck/releases/download/${shellcheck_version}/shellcheck-${shellcheck_version}.linux.x86_64.tar.xz" -o ${shellcheck}
-tar xf "${shellcheck}"
-mv shellcheck-"${shellcheck_version}"/shellcheck "${bindir}"
-rm "${shellcheck}"
+curl --retry 3 --silent -L "https://github.com/koalaman/shellcheck/releases/download/${shellcheck_version}/shellcheck-${shellcheck_version}.linux.x86_64.tar.xz" -o "${shellcheck_archive}"
+tar -xf "${shellcheck_archive}" -C "${tmpdir}"
+mv "${tmpdir}/shellcheck-${shellcheck_version}/shellcheck" "${bindir}"
+rm "${shellcheck_archive}"