DAOS-15677 cq: add copyright GHA and remove required-githooks (#15552)

Add GHA to check for copyright update.
Move core logic from update-copyright githook into
check_update_copyright.sh so the logic is shared between the githook and
GHA.

Remove required-githooks watermark since it did not work in all scenarios and the
GHA checks are more secure than client-side githooks.

Combination of #15552, #15596, #15636, #15639

Skip-build: true

Signed-off-by: Dalton Bohning <[email protected]>

.github/workflows/linting.yml

@@ -197,6 +197,20 @@ jobs:
       - name: Run check
         run: yamllint --format github .
 
+  copyright:
+    name: Copyright check
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out source repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Run check
+        run: |
+          \[ ! -x ./utils/cq/check_update_copyright.sh \] || ./utils/cq/check_update_copyright.sh \
+            $(git merge-base HEAD ${{ github.event.pull_request.base.sha || github.ref }}) gha
+
   linting-summary:
     name: Linting Summary
     runs-on: ubuntu-24.04
@@ -211,6 +225,7 @@ jobs:
       - codespell
       # - clang-format  # not required
       - yaml-lint
+      - copyright
     if: (!cancelled())
     steps:
       - name: Check if any job failed

Jenkinsfile

@@ -365,25 +365,6 @@ pipeline {
         stage('Check PR') {
             when { changeRequest() }
             parallel {
-                stage('Used Required Git Hooks') {
-                    steps {
-                        catchError(stageResult: 'UNSTABLE', buildResult: 'SUCCESS',
-                                   message: 'PR did not get committed with required git hooks.  ' +
-                                            'Please see utils/githooks/README.md.') {
-                            sh 'if ! ' + cachedCommitPragma('Required-githooks', 'false') + '''; then
-                                   echo 'PR did not get committed with required git hooks.  ' +
-                                        'Please see utils/githooks/README.md.'
-                                   exit 1
-                                fi'''
-                        }
-                    }
-                    post {
-                        unsuccessful {
-                            echo 'PR did not get committed with required git hooks.  ' +
-                                 'Please see utils/githooks/README.md.'
-                        }
-                    }
-                } // stage('Used Required Git Hooks')
                 stage('Branch name check') {
                     when { changeRequest() }
                     steps {

utils/cq/check_update_copyright.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+#
+#  Copyright 2024 Intel Corporation.
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+# Check or update copyright date in modified files.
+# Usage: check_update_copyright.sh <git_target> <githook|gha>
+#   mode "githook" will update copyright dates in place.
+#   mode "gha" will just print a warning in a GHA-compatible format.
+
+set -e
+
+git_target="$1"
+mode="$2"
+case "$mode" in
+    "githook" | "gha")
+        ;;
+    *)
+        echo "Usage: check_update_copyright.sh <git_target> <githook|gha>"
+        exit 1
+esac
+
+# Navigate to repo root
+PARENT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+cd "$PARENT_DIR"/../../
+
+
+regex='(^[[:blank:]]*[\*/]*.*)((Copyright[[:blank:]]*)([0-9]{4})(-([0-9]{4}))?)([[:blank:]]*(Intel.*$))'
+year=$(date +%Y)
+errors=0
+targets=(
+    # Entries with wildcard.  These must be first and start with '*' or
+    # older versions of git will return files that were not changed.
+    '*.c'
+    '*.h'
+    '*.go'
+    '*.py'
+    '*.proto'
+    '*.java'
+    '*.yml'
+    '*.yaml'
+    '*.sh'
+    '*.bash'
+    '*Dockerfile*'
+    '*README*'
+    '*LICENSE*'
+    '*NOTICE*'
+    '*.txt'
+    '*.md'
+    # Entries without a wildcard
+    'Makefile'
+    'Jenkinsfile'
+    'SConscript'
+    'SConstruct'
+    'copyright'
+    '.env'
+)
+
+if [ -z "$files" ]; then
+    files=$(git diff "$git_target" --cached --diff-filter=AM --name-only -- "${targets[@]}")
+else
+    echo "  Checking against custom files"
+fi
+
+os=$(uname -s)
+
+. utils/githooks/git-version.sh
+
+for file in $files; do
+    if [[ "$file" == *vendor* ]] || [[ "$file" == *pb.go ]]    ||
+       [[ "$file" == *_string.go ]] || [[ "$file" == *pb-c* ]] ||
+       { [ "$mode" == "githook" ] &&
+         [ "$git_vercode" -ge 2030000 ] &&
+         [ "$(git diff --cached -I Copyright "$file")" = '' ]; }; then
+        continue
+    fi
+    read -r y1 y2 <<< "$(sed -nre "s/^.*$regex.*$/\4 \6/p" "$file")"
+    if [[ -z $y1 ]] ; then
+        # Print warning but don't error on non-existent copyright 
+        echo "  Copyright Information not found in: $file"
+    elif [[ $y1 -ne $year && $year -ne $y2 ]] ; then
+        if [[ "$mode" == "githook" ]]; then
+            # Update copyright in place
+            if ! git reset "$file"; then
+                echo "  Unable to un-stage $file"
+                errors=$((errors + 1))
+            fi
+            if [[ "$os" == 'Linux' ]]; then
+                sed -i -re "s/$regex/\1Copyright $y1-$year \8/" "$file"
+            else
+                sed -i '' -re "s/$regex/\1Copyright $y1-$year \8/" "$file"
+            fi
+
+            if ! git add "$file"; then
+                echo "  Unable to re-stage $file"
+                errors=$((errors + 1))
+            fi
+        elif [[ "$mode" == "gha" ]]; then
+            # Print error but do not update
+            lineno="$(grep -nE "$regex" "$file" | cut -f1 -d:)"
+            echo "::error file=$file,line=$lineno::Copyright out of date"
+            errors=$((errors + 1))
+        fi
+    fi
+done
+
+if [[ $errors -ne 0 ]]; then
+    echo "  $errors errors while checking/fixing copyrights."
+    exit 1
+fi

utils/githooks/hook_base.sh

@@ -54,9 +54,3 @@ run-parts() {
 }
 
 run-parts utils/githooks/"${hook}".d "$@" 1>&2
-
-# Create temp file for the commit-msg watermark to indicate this hook was ran.
-# But not for the commit-msg itself.
-if [ "${hook}" != "commit-msg" ]; then
-    touch ".${hook}"
-fi

utils/githooks/pre-commit.d/10-update-copyright.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+#
+#  Copyright 2022-2024 Intel Corporation.
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+# A git hook to validate and correct the copyright date in source files.
+
+_print_githook_header "Copyright"
+if [ -e .git/MERGE_HEAD ]; then
+    echo "Merge commit. Skipping"
+    exit 0
+fi
+
+echo "Updating copyright headers"
+
+utils/cq/check_update_copyright.sh "$TARGET" githook

utils/githooks/pre-commit.d/30-Jenkinsfile → utils/githooks/pre-commit.d/30-Jenkinsfile.sh

@@ -23,9 +23,9 @@ echo "Checking syntax"
 HOST="${HOST:-build.hpdd.intel.com}"
 CURL_VERBOSE=${CURL_VERBOSE:-""}
 CURL_PROXY="${CURL_PROXY:+-x }${CURL_PROXY:-}"
-CURL_OPTS="$CURL_PROXY $CURL_VERBOSE -s"
+CURL_OPTS=("$CURL_PROXY" "$CURL_VERBOSE" -s)
 URL="https://$HOST/pipeline-model-converter/validate"
-if ! output=$(curl $CURL_OPTS -s -X POST -F "jenkinsfile=<${1:-Jenkinsfile}" "$URL"); then
+if ! output=$(curl "${CURL_OPTS[@]}" -s -X POST -F "jenkinsfile=<${1:-Jenkinsfile}" "$URL"); then
     echo "  Failed to access $URL. Skipping"
     exit 0
 fi