[Bug]: SignArtifacts.groovy clones opensearch-build in the workspace and not in a folder

[abhinavGupta16]

Describe the bug

SignArtifacts.groovy currently clones the opensearch-build repo in the same workspace without creating a folder. This can cause issues since there might be other repositories that maybe cloning the their repositories and would mix up all the files in one directory.

To reproduce

Create a dummy job to clone any repository other than opensearch-build inside workspace on jenkins and call signer. After that, run ls $WORKSPACE to see files from both the repos in the same directory

Expected behavior

signArtifacts.groovy should create a separate temp folder to clone and run the commands for signing process

Acceptance Criteria

• signArtifacts works in an isolated directory that it creates
• all previous jobs should be able to run signAritfacts as expected (promoteArtifacts-job, signArtifacts-job, data-prepper-job)

Screenshots

If applicable, add screenshots to help explain your problem.

Host / Environment

No response

Additional context

No response

Relevant log output

data-prepper job for example clones data-prepper repository and signer clones opensearch-build and below are the contents of the final workspace with files from both repositories mixed in a single folder

+ ls /var/jenkins/workspace/Playground/david-abhng-dataprepper-job
ADMINS.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
DEVELOPER_GUIDE.md
LICENSE.txt
MAINTAINERS.md
NOTICE
ONBOARDING.md
Pipfile
Pipfile.lock
README.md
assemble.sh
build
build.gradle
build.sh
checkout.sh
ci.sh
config
data-prepper-api
data-prepper-core
data-prepper-logstash-configuration
data-prepper-plugins
deployment
docker
gradle
gradle.properties
gradlew
gradlew.bat
jenkins
lib
manifests
manifests.sh
meta
opensearch.pgp
publish
pyproject.toml
pytest.ini
release
release-notes
run.sh
scripts
settings.gradle
sign.sh
src
test.sh
tests
tools
vars
whitesource.config
zenhub_tab_image.png

[dblock]

All jobs should be executing inside docker contains with separate file systems and not walk over each-other.

[abhinavGupta16]

All jobs should be executing inside docker contains with separate file systems and not walk over each-other.

Yes. But we can have multiple repositories being clones inside the same job. Updated the description log output for better explanation

[prudhvigodithi]

I dont see this a breaking issue, for the fact the build repo workflows has to be called with scripts being on the workspace folder example as ./build.sh, ./test.sh, having a separate copy in another folder would end changing the logic, but long story short is this still valid @gaiksaya @peterzhuamazon ?

[gaiksaya]

We can remove the cloning logic from this library and let the workspace take care of the execution of .sign.sh similar to test and build.sh

[peterzhuamazon]

This was at a time when we are not sure about how Jenkins workspace default git clone runs.
We can ignore this issue for now.

[gaiksaya]

Hi @peterzhuamazon looks like this is still issue. Do you know if there is a workaround?

[gaiksaya]

The below solution works:
Adding a dir

        if (!fileExists("$WORKSPACE/sign.sh")) {
            dir('opensearch-build'){
            git url: 'https://github.com/opensearch-project/opensearch-build.git', branch: 'main'
            }
        }

Let me know if anyone has any better solution. Thanks!