Initial upload - Untested.
Link between the Github repos and the bugzilla, runs as a web service, receives webhook on PR from github.
This commit is contained in:
299
webhook-endpoint.py
Normal file
299
webhook-endpoint.py
Normal file
@@ -0,0 +1,299 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
import os
|
||||||
|
import json
|
||||||
|
import base64
|
||||||
|
import sqlite3
|
||||||
|
import logging
|
||||||
|
import hmac
|
||||||
|
import hashlib
|
||||||
|
import datetime as dt
|
||||||
|
from typing import Optional, Tuple
|
||||||
|
|
||||||
|
import httpx
|
||||||
|
from fastapi import FastAPI, Header, HTTPException, Request
|
||||||
|
from fastapi.responses import JSONResponse, PlainTextResponse
|
||||||
|
from github import Github, Auth
|
||||||
|
|
||||||
|
# ------------- Logging -------------
|
||||||
|
logging.basicConfig(
|
||||||
|
level=os.environ.get("LOG_LEVEL", "INFO"),
|
||||||
|
format="[%(asctime)s] %(levelname)s %(message)s",
|
||||||
|
datefmt="%Y-%m-%dT%H:%M:%SZ",
|
||||||
|
)
|
||||||
|
logging.Formatter.converter = dt.datetime.utctimetuple
|
||||||
|
logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
# ------------- Config via env -------------
|
||||||
|
|
||||||
|
GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
|
||||||
|
GITHUB_OWNER = os.environ["GITHUB_OWNER"] # e.g. Koozali-SME-Server
|
||||||
|
WEBHOOK_SECRET = os.environ["WEBHOOK_SECRET"] # same secret configured in GitHub webhook
|
||||||
|
|
||||||
|
# For canonical link in messages (where to direct contributors)
|
||||||
|
GITEA_BASE_URL = os.environ.get("GITEA_BASE_URL", "https://src.koozali.org")
|
||||||
|
GITEA_ORG = os.environ.get("GITEA_ORG", "smeserver")
|
||||||
|
|
||||||
|
# Bugzilla config
|
||||||
|
BUGZILLA_BASE_URL = os.environ.get("BUGZILLA_BASE_URL", "https://bugs.koozali.org")
|
||||||
|
BUGZILLA_AUTH_MODE = os.environ.get("BUGZILLA_AUTH_MODE", "basic") # "basic" or "api_key"
|
||||||
|
BUGZILLA_USER = os.environ.get("BUGZILLA_USER", "brianr")
|
||||||
|
BUGZILLA_PASSWORD = os.environ.get("BUGZILLA_PASSWORD", "")
|
||||||
|
BUGZILLA_API_KEY = os.environ.get("BUGZILLA_API_KEY", "")
|
||||||
|
BUGZILLA_PRODUCT = os.environ.get("BUGZILLA_PRODUCT", "SME11")
|
||||||
|
BUGZILLA_COMPONENT_FALLBACK = os.environ.get("BUGZILLA_COMPONENT_FALLBACK", "General")
|
||||||
|
BUGZILLA_ATTACH_DIFF = os.environ.get("BUGZILLA_ATTACH_DIFF", "true").lower() == "true"
|
||||||
|
|
||||||
|
# Policy: keep PR open on Bugzilla failure (your chosen behavior)
|
||||||
|
KEEP_PR_OPEN_ON_BZ_FAIL = True
|
||||||
|
BUGZILLA_FAILURE_LABEL = os.environ.get("BUGZILLA_FAILURE_LABEL", "bugzilla-needed")
|
||||||
|
|
||||||
|
# SQLite for PR->Bug mapping
|
||||||
|
STATE_PATH = os.environ.get("STATE_PATH", "./webhook_state.sqlite")
|
||||||
|
|
||||||
|
# ------------- Clients -------------
|
||||||
|
|
||||||
|
class State:
|
||||||
|
def __init__(self, path: str):
|
||||||
|
self.conn = sqlite3.connect(path, check_same_thread=False)
|
||||||
|
self._init()
|
||||||
|
|
||||||
|
def _init(self):
|
||||||
|
c = self.conn.cursor()
|
||||||
|
c.execute("""
|
||||||
|
CREATE TABLE IF NOT EXISTS pr_map (
|
||||||
|
pr_key TEXT PRIMARY KEY,
|
||||||
|
bug_id INTEGER NOT NULL,
|
||||||
|
created_at TEXT NOT NULL,
|
||||||
|
updated_at TEXT NOT NULL
|
||||||
|
)""")
|
||||||
|
self.conn.commit()
|
||||||
|
|
||||||
|
def get_bug(self, pr_key: str) -> Optional[int]:
|
||||||
|
c = self.conn.cursor()
|
||||||
|
c.execute("SELECT bug_id FROM pr_map WHERE pr_key=?", (pr_key,))
|
||||||
|
row = c.fetchone()
|
||||||
|
return row[0] if row else None
|
||||||
|
|
||||||
|
def set_bug(self, pr_key: str, bug_id: int):
|
||||||
|
now = dt.datetime.utcnow().replace(microsecond=0).isoformat() + "Z"
|
||||||
|
c = self.conn.cursor()
|
||||||
|
c.execute("""
|
||||||
|
INSERT INTO pr_map (pr_key, bug_id, created_at, updated_at)
|
||||||
|
VALUES (?, ?, ?, ?)
|
||||||
|
ON CONFLICT(pr_key) DO UPDATE SET bug_id=excluded.bug_id, updated_at=excluded.updated_at
|
||||||
|
""", (pr_key, bug_id, now, now))
|
||||||
|
self.conn.commit()
|
||||||
|
|
||||||
|
class Bugzilla:
|
||||||
|
def __init__(self):
|
||||||
|
self.base = BUGZILLA_BASE_URL.rstrip("/")
|
||||||
|
self.auth_mode = BUGZILLA_AUTH_MODE
|
||||||
|
|
||||||
|
def _headers(self):
|
||||||
|
h = {"Accept": "application/json"}
|
||||||
|
if self.auth_mode == "api_key" and BUGZILLA_API_KEY:
|
||||||
|
h["X-BUGZILLA-API-KEY"] = BUGZILLA_API_KEY
|
||||||
|
return h
|
||||||
|
|
||||||
|
def _auth(self) -> Optional[Tuple[str, str]]:
|
||||||
|
if self.auth_mode == "basic":
|
||||||
|
return (BUGZILLA_USER, BUGZILLA_PASSWORD)
|
||||||
|
return None
|
||||||
|
|
||||||
|
def create_bug(self, summary: str, description: str, component: str) -> int:
|
||||||
|
url = f"{self.base}/rest/bug"
|
||||||
|
payload = {
|
||||||
|
"product": BUGZILLA_PRODUCT,
|
||||||
|
"component": component or BUGZILLA_COMPONENT_FALLBACK,
|
||||||
|
"summary": summary,
|
||||||
|
"description": description,
|
||||||
|
}
|
||||||
|
r = httpx.post(url, headers=self._headers(), auth=self._auth(), json=payload, timeout=60)
|
||||||
|
if r.status_code not in (200, 201):
|
||||||
|
raise RuntimeError(f"Bugzilla create failed: {r.status_code} {r.text}")
|
||||||
|
data = r.json()
|
||||||
|
bug_id = data.get("id") or (data.get("bugs") and data["bugs"][0]["id"])
|
||||||
|
if not bug_id:
|
||||||
|
raise RuntimeError("Bugzilla response missing bug id")
|
||||||
|
return int(bug_id)
|
||||||
|
|
||||||
|
def add_attachment(self, bug_id: int, filename: str, summary: str, data_bytes: bytes):
|
||||||
|
url = f"{self.base}/rest/bug/{bug_id}/attachment"
|
||||||
|
payload = {
|
||||||
|
"ids": [bug_id],
|
||||||
|
"data": base64.b64encode(data_bytes).decode("ascii"),
|
||||||
|
"file_name": filename,
|
||||||
|
"summary": summary,
|
||||||
|
"content_type": "text/x-patch",
|
||||||
|
"is_patch": True,
|
||||||
|
}
|
||||||
|
r = httpx.post(url, headers=self._headers(), auth=self._auth(), json=payload, timeout=120)
|
||||||
|
if r.status_code not in (200, 201):
|
||||||
|
raise RuntimeError(f"Bugzilla attach failed: {r.status_code} {r.text}")
|
||||||
|
|
||||||
|
def add_comment(self, bug_id: int, comment: str):
|
||||||
|
url = f"{self.base}/rest/bug/{bug_id}/comment"
|
||||||
|
payload = {"comment": comment}
|
||||||
|
r = httpx.post(url, headers=self._headers(), auth=self._auth(), json=payload, timeout=60)
|
||||||
|
if r.status_code not in (200, 201):
|
||||||
|
raise RuntimeError(f"Bugzilla comment failed: {r.status_code} {r.text}")
|
||||||
|
|
||||||
|
# ------------- GitHub client -------------
|
||||||
|
|
||||||
|
gh = Github(auth=Auth.Token(GITHUB_TOKEN))
|
||||||
|
bz = Bugzilla()
|
||||||
|
state = State(STATE_PATH)
|
||||||
|
|
||||||
|
# ------------- App -------------
|
||||||
|
|
||||||
|
app = FastAPI()
|
||||||
|
|
||||||
|
def verify_signature(secret: str, body: bytes, signature: str):
|
||||||
|
if not signature:
|
||||||
|
raise HTTPException(status_code=401, detail="Missing signature")
|
||||||
|
expected = "sha256=" + hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
|
||||||
|
if not hmac.compare_digest(expected, signature):
|
||||||
|
raise HTTPException(status_code=401, detail="Invalid signature")
|
||||||
|
|
||||||
|
def pr_comment_success(gitea_repo_url: str, bug_id: int) -> str:
|
||||||
|
return (
|
||||||
|
"Thanks for the contribution!\n\n"
|
||||||
|
"This repository is a read-only mirror of the canonical repo on Gitea:\n"
|
||||||
|
f"- Canonical: {gitea_repo_url}\n"
|
||||||
|
f"- Please file and discuss changes in Bugzilla: {BUGZILLA_BASE_URL}\n\n"
|
||||||
|
f"We created Bug {bug_id} to track this proposal:\n"
|
||||||
|
f"- {BUGZILLA_BASE_URL}/show_bug.cgi?id={bug_id}\n\n"
|
||||||
|
"This pull request will be closed here. Further pushes to this PR branch will be mirrored as updated attachments on the Bug.\n"
|
||||||
|
)
|
||||||
|
|
||||||
|
def pr_comment_failure(gitea_repo_url: str, repo: str, pr_url: str, target_branch: str) -> str:
|
||||||
|
return (
|
||||||
|
"Thanks for the contribution!\n\n"
|
||||||
|
"This repository is a read-only mirror of the canonical repo on Gitea:\n"
|
||||||
|
f"- Canonical: {gitea_repo_url}\n\n"
|
||||||
|
"We were unable to create a Bugzilla ticket automatically at this time.\n"
|
||||||
|
f"Please open a bug at {BUGZILLA_BASE_URL} (Product: {BUGZILLA_PRODUCT}, Component: {repo}) and include:\n"
|
||||||
|
f"- GitHub PR: {pr_url}\n"
|
||||||
|
f"- Target branch: {target_branch}\n"
|
||||||
|
"- Summary and rationale for the change\n\n"
|
||||||
|
"This pull request will remain open for now. Once a Bugzilla ticket exists, our maintainers will reference it here and proceed with review on Bugzilla.\n"
|
||||||
|
)
|
||||||
|
|
||||||
|
@app.get("/healthz")
|
||||||
|
async def healthz():
|
||||||
|
return PlainTextResponse("ok")
|
||||||
|
|
||||||
|
@app.post("/webhook/github")
|
||||||
|
async def github_webhook(
|
||||||
|
request: Request,
|
||||||
|
x_hub_signature_256: str = Header(None),
|
||||||
|
x_github_event: str = Header(None),
|
||||||
|
):
|
||||||
|
body = await request.body()
|
||||||
|
verify_signature(WEBHOOK_SECRET, body, x_hub_signature_256)
|
||||||
|
try:
|
||||||
|
payload = json.loads(body.decode("utf-8"))
|
||||||
|
except Exception:
|
||||||
|
raise HTTPException(status_code=400, detail="Invalid JSON")
|
||||||
|
|
||||||
|
if x_github_event != "pull_request":
|
||||||
|
return JSONResponse({"status": "ignored", "event": x_github_event})
|
||||||
|
|
||||||
|
action = payload.get("action")
|
||||||
|
if action not in ("opened", "reopened", "synchronize", "ready_for_review"):
|
||||||
|
return JSONResponse({"status": "ignored", "action": action})
|
||||||
|
|
||||||
|
repo_full = payload["repository"]["full_name"] # owner/repo on GitHub
|
||||||
|
owner = payload["repository"]["owner"]["login"]
|
||||||
|
repo = payload["repository"]["name"]
|
||||||
|
pr = payload["pull_request"]
|
||||||
|
pr_num = pr["number"]
|
||||||
|
pr_url = pr["html_url"]
|
||||||
|
pr_title = pr.get("title") or ""
|
||||||
|
pr_body = pr.get("body") or ""
|
||||||
|
base = pr["base"]
|
||||||
|
head = pr["head"]
|
||||||
|
target_branch = base["ref"]
|
||||||
|
head_sha = head["sha"][:7]
|
||||||
|
gitea_repo_url = f"{GITEA_BASE_URL}/{GITEA_ORG}/{repo}"
|
||||||
|
|
||||||
|
pr_key = f"{repo_full}#{pr_num}"
|
||||||
|
bug_id = state.get_bug(pr_key)
|
||||||
|
|
||||||
|
gh_repo = gh.get_repo(repo_full)
|
||||||
|
|
||||||
|
def fetch_pr_patch() -> bytes:
|
||||||
|
url = f"https://api.github.com/repos/{owner}/{repo}/pulls/{pr_num}"
|
||||||
|
r = httpx.get(url, headers={"Accept": "application/vnd.github.v3.patch", "Authorization": f"token {GITHUB_TOKEN}"}, timeout=120)
|
||||||
|
r.raise_for_status()
|
||||||
|
return r.content
|
||||||
|
|
||||||
|
if bug_id is None and action in ("opened", "reopened", "ready_for_review", "synchronize"):
|
||||||
|
# Create Bugzilla bug
|
||||||
|
summary = f"[GH PR #{pr_num}] {GITEA_ORG}/{repo}: {pr_title}"
|
||||||
|
description = (
|
||||||
|
"Source\n"
|
||||||
|
f"- Canonical repo (Gitea): {gitea_repo_url}\n"
|
||||||
|
f"- GitHub mirror PR: {pr_url}\n\n"
|
||||||
|
"Project policy\n"
|
||||||
|
"This GitHub repository is a read-only mirror. Reviews and decisions happen in Bugzilla.\n\n"
|
||||||
|
"Submitter’s notes\n"
|
||||||
|
f"{pr_body}\n"
|
||||||
|
)
|
||||||
|
component = repo # change if you need fallback
|
||||||
|
|
||||||
|
try:
|
||||||
|
bug_id = bz.create_bug(summary, description, component)
|
||||||
|
state.set_bug(pr_key, bug_id)
|
||||||
|
logger.info(f"Created Bugzilla bug {bug_id} for {pr_key}")
|
||||||
|
except Exception as e:
|
||||||
|
logger.error(f"Bugzilla create failed for {pr_key}: {e}")
|
||||||
|
# Post failure comment and keep PR open
|
||||||
|
gh_repo.get_pull(pr_num).create_issue_comment(pr_comment_failure(gitea_repo_url, repo, pr_url, target_branch))
|
||||||
|
if BUGZILLA_FAILURE_LABEL:
|
||||||
|
with contextlib.suppress(Exception):
|
||||||
|
gh_repo.create_label(BUGZILLA_FAILURE_LABEL, "ededed")
|
||||||
|
with contextlib.suppress(Exception):
|
||||||
|
gh_repo.get_issue(pr_num).add_to_labels(BUGZILLA_FAILURE_LABEL)
|
||||||
|
return JSONResponse({"status": "bugzilla_failed"})
|
||||||
|
|
||||||
|
# Attach patch (optional)
|
||||||
|
if BUGZILLA_ATTACH_DIFF:
|
||||||
|
try:
|
||||||
|
patch = fetch_pr_patch()
|
||||||
|
bz.add_attachment(
|
||||||
|
bug_id=bug_id,
|
||||||
|
filename=f"PR-{pr_num}-{head_sha}.patch",
|
||||||
|
summary=f"Patch for PR #{pr_num} ({head_sha})",
|
||||||
|
data_bytes=patch
|
||||||
|
)
|
||||||
|
except Exception as e:
|
||||||
|
logger.warning(f"Attach patch failed for bug {bug_id}: {e}")
|
||||||
|
|
||||||
|
# Comment and close PR
|
||||||
|
comment = pr_comment_success(gitea_repo_url, bug_id)
|
||||||
|
pr_obj = gh_repo.get_pull(pr_num)
|
||||||
|
pr_obj.create_issue_comment(comment)
|
||||||
|
if pr_obj.state != "closed":
|
||||||
|
pr_obj.edit(state="closed")
|
||||||
|
return JSONResponse({"status": "ok", "bug_id": bug_id})
|
||||||
|
|
||||||
|
elif bug_id is not None and action == "synchronize":
|
||||||
|
# Attach updated patch to existing bug and ensure PR closed
|
||||||
|
try:
|
||||||
|
patch = fetch_pr_patch()
|
||||||
|
bz.add_attachment(
|
||||||
|
bug_id=bug_id,
|
||||||
|
filename=f"PR-{pr_num}-{head_sha}.patch",
|
||||||
|
summary=f"Updated patch for PR #{pr_num} ({head_sha})",
|
||||||
|
data_bytes=patch
|
||||||
|
)
|
||||||
|
pr_obj = gh_repo.get_pull(pr_num)
|
||||||
|
if pr_obj.state != "closed":
|
||||||
|
pr_obj.edit(state="closed")
|
||||||
|
return JSONResponse({"status": "ok", "bug_id": bug_id})
|
||||||
|
except Exception as e:
|
||||||
|
logger.error(f"Attach update failed for bug {bug_id}: {e}")
|
||||||
|
return JSONResponse({"status": "attach_failed", "bug_id": bug_id})
|
||||||
|
|
||||||
|
return JSONResponse({"status": "noop"})
|
||||||
Reference in New Issue
Block a user