Fix policy PR, add interactive mode (#237)

* Fix options not parsing branch

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

* Fix bug creating local feature branch

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

* Add interactive mode to policy create

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

---------

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Author: puerco

sourcetool/internal/cmd/options.go

@@ -91,8 +91,10 @@ type branchOptions struct {
 	branch string
 }
 
+// ParseLocator parses an SPDX locator string and assigns its components
+// to the branch options fields.
 func (bo *branchOptions) ParseLocator(lString string) error {
-	components, err := vcslocator.Locator(lString).Parse()
+	components, err := vcslocator.Locator(lString).Parse(vcslocator.WithRefAsBranch(true))
 	if err != nil {
 		return fmt.Errorf("parsing repository slug: %w", err)
 	}

sourcetool/internal/cmd/policy.go

@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"github.com/spf13/cobra"
+	"sigs.k8s.io/release-utils/util"
 
 	"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/policy"
 	"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/sourcetool"
@@ -19,12 +20,14 @@ type policyViewOpts struct {
 
 type policyCreateOpts struct {
 	branchOptions
+	interactive     bool
 	openPullRequest bool
 }
 
 func (pco *policyCreateOpts) AddFlags(cmd *cobra.Command) {
 	pco.branchOptions.AddFlags(cmd)
 	cmd.PersistentFlags().BoolVar(&pco.openPullRequest, "pr", true, "Open a pull request to check-in the policy")
+	cmd.PersistentFlags().BoolVar(&pco.interactive, "interactive", true, "confirm before performing changes")
 }
 
 func addPolicy(parentCmd *cobra.Command) {
@@ -125,7 +128,10 @@ func addPolicyCreate(parent *cobra.Command) {
 	policyViewCmd := &cobra.Command{
 		Short: "creates a source policy for a repository",
 		Long: `The create subcommand inspects the controls in place for a repo
-and creates a new policy for it. 
+and creates a new policy for it. By default it will create a pull request
+in the community source policy repository. If you choose not to, it will
+just print the generated policy.
+
 `,
 		Use:           "create owner/repo@branch",
 		SilenceUsage:  false,
@@ -143,6 +149,10 @@ and creates a new policy for it.
 				return err
 			}
 
+			if err := opts.EnsureDefaults(); err != nil {
+				return err
+			}
+
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
@@ -161,7 +171,9 @@ and creates a new policy for it.
 			// Create a new sourcetool object
 			srctool, err := sourcetool.New(
 				sourcetool.WithAuthenticator(authenticator),
+				// Uncomment when we want to support custom policy repos
 				// sourcetool.WithPolicyRepo(opts.policyRepo),
+				sourcetool.WithCreatePolicyPR(opts.openPullRequest),
 			)
 			if err != nil {
 				return err
@@ -175,6 +187,31 @@ and creates a new policy for it.
 				return fmt.Errorf("repository already has a policy checked into the community repo")
 			}
 
+			if opts.openPullRequest && opts.interactive {
+				fmt.Printf(`
+
+sourcetool is about to perform the following actions on your behalf:
+
+    >  Open a pull request in %s/%s checking in
+       a SLSA source policy for the current controls enabled
+       in %s/%s.
+
+We will push a branch to your fork of the community repository and 
+open the pull request from there.
+
+`, policy.SourcePolicyRepoOwner, policy.SourcePolicyRepo, opts.owner, opts.repository)
+
+				_, s, err := util.Ask("Type 'yes' if you want to continue?", "yes|no|no", 3)
+				if err != nil {
+					return err
+				}
+
+				if !s {
+					fmt.Println("Cancelled.")
+					return nil
+				}
+			}
+
 			// Create the policy, this will open the pull request in the community
 			// repo if the options say so.
 			pcy, pr, err := srctool.CreateRepositoryPolicy(

sourcetool/internal/cmd/setup.go

@@ -8,7 +8,6 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/release-utils/util"
 
-	"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/policy"
 	"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/sourcetool"
 	"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/sourcetool/models"
 )
@@ -30,9 +29,10 @@ func (so *setupOpts) AddFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringVar(
 		&so.userForkOrg, "user-fork", "", "GitHub organization to look for forks of repos (for pull requests)",
 	)
-	cmd.PersistentFlags().StringVar(
-		&so.policyRepo, "policy-repo", fmt.Sprintf("%s/%s", policy.SourcePolicyRepoOwner, policy.SourcePolicyRepo), "repository to store the SLSA source policy",
-	)
+	// Uncomment when we support custom policy repos
+	// cmd.PersistentFlags().StringVar(
+	// 	&so.policyRepo, "policy-repo", fmt.Sprintf("%s/%s", policy.SourcePolicyRepoOwner, policy.SourcePolicyRepo), "repository to store the SLSA source policy",
+	// )
 
 	cmd.PersistentFlags().BoolVar(
 		&so.interactive, "interactive", true, "confirm before performing changes",

sourcetool/pkg/repo/clone.go

@@ -99,8 +99,14 @@ func (c *Clone) AddRemote(name, url string) error {
 
 // PushToRemote pushes the active branch to the specified remote
 func (c *Clone) PushRemote(remoteName string) error {
+	refSpecs := []config.RefSpec{
+		config.RefSpec(fmt.Sprintf(
+			"+refs/heads/%s:refs/heads/%s", c.FeatureBranch, c.FeatureBranch,
+		)),
+	}
 	err := c.repo.Push(&git.PushOptions{
 		RemoteName: remoteName,
+		RefSpecs:   refSpecs,
 	})
 	if err != nil {
 		return fmt.Errorf("pushing to remote: %w", err)

sourcetool/pkg/repo/implementation.go

@@ -134,6 +134,12 @@ func (impl *defaultPrmImpl) CloneRepo(opts *options.PullRequestManagerOptions, a
 		return nil, fmt.Errorf("adding remote: %w", err)
 	}
 
+	// Create the feature branch
+	if err := clone.CreateFeatureBranch(); err != nil {
+		clone.Cleanup()
+		return nil, fmt.Errorf("creating feature branch locally: %w", err)
+	}
+
 	return clone, nil
 }