vref: code
- compile: VREF/ is special, like NAME/
- update hook: use a new "check_vrefs" sub to
- spawn helpers for each vref in @allowed_refs
- for each vref returned by the helper, call check_ref
This commit is contained in:
Sitaram Chamarty
parent
29b2c2fdce
commit
56f975d14c
51
contrib/VREF/gl-VREF-COUNT
Executable file
51
contrib/VREF/gl-VREF-COUNT
Executable file
|
|
@ -0,0 +1,51 @@
|
|||
#!/bin/bash
|
||||
|
||||
# gitolite VREF to count number of changed/new files in a push
|
||||
|
||||
# see gitolite docs for what the first 7 arguments mean
|
||||
|
||||
# inputs:
|
||||
# arg-8 is a number
|
||||
# arg-9 is optional, and can be "NEWFILES"
|
||||
# outputs (STDOUT)
|
||||
# arg-7 if the number of changed (or new, if arg-9 supplied) files is > arg-8
|
||||
# otherwise nothing
|
||||
# exit status:
|
||||
# always 0
|
||||
|
||||
die() { echo "$@" >&2; exit 1; }
|
||||
[ -z "$8" ] && die "not meant to be run manually"
|
||||
|
||||
newsha=$3
|
||||
oldtree=$4
|
||||
newtree=$5
|
||||
refex=$7
|
||||
|
||||
max=$8
|
||||
|
||||
nf=
|
||||
[ "$9" = "NEWFILES" ] && nf='--diff-filter=A'
|
||||
# NO_SIGNOFF implies NEWFILES
|
||||
[ "$9" = "NO_SIGNOFF" ] && nf='--diff-filter=A'
|
||||
|
||||
# count files against all the other commits in the system not just $oldsha
|
||||
# (why? consider what is $oldtree when you create a new branch, or what is
|
||||
# $oldsha when you update an old feature branch from master and then push it
|
||||
count=`git log --name-only $nf --format=%n $newtree --not --all | grep . | sort -u | wc -l`
|
||||
|
||||
[[ $count -gt $max ]] && {
|
||||
# count has been exceeded. If $9 was NO_SIGNOFF there's still a chance
|
||||
# for redemption -- if the top commit has a proper signed-off by line
|
||||
[ "$9" = "NO_SIGNOFF" ] && {
|
||||
author_email=$(git log --format=%ae -1 $newsha)
|
||||
git cat-file -p $newsha |
|
||||
egrep -i >/dev/null "^ *$count +new +files +signed-off by: *$author_email *$" && exit 0
|
||||
echo $refex top commit message should include the text \'$count new files signed-off by: $author_email\'
|
||||
exit 0
|
||||
}
|
||||
echo -n $refex "(too many "
|
||||
[ -n "$nf" ] && echo -n "new " || echo -n "changed "
|
||||
echo "files in this push)"
|
||||
}
|
||||
|
||||
exit 0
|
||||
|
|
@ -75,32 +75,12 @@ push @allowed_refs, @ { $repos{'@all'} {$ENV{GL_USER}} || [] };
|
|||
push @allowed_refs, @ { $repos{$ENV{GL_REPO}}{'@all'} || [] };
|
||||
push @allowed_refs, @ { $repos{'@all'} {'@all'} || [] };
|
||||
|
||||
# prepare the list of refs to be checked
|
||||
# first check the main ref (this is a *real* ref, like refs/heads/master, and
|
||||
# is what we print in the log)
|
||||
my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, $ref, $att_acc);
|
||||
|
||||
# previously, we just checked $ref -- the ref being updated, which is passed
|
||||
# to us by git (see man githooks). Now we also have to treat each NAME being
|
||||
# updated as a potential "ref" and check that, if NAME-based restrictions have
|
||||
# been specified
|
||||
|
||||
my @refs = ($ref); # the first ref to check is the real one
|
||||
# because making it work screws up efficiency like no tomorrow...
|
||||
if (exists $repos{$ENV{GL_REPO}}{NAME_LIMITS}) {
|
||||
# this is special to git -- the hash of an empty tree
|
||||
my $empty='4b825dc642cb6eb9a060e54bf8d69288fbee4904';
|
||||
# well they're not really "trees" but $empty is indeed the empty tree so
|
||||
# we can just pretend $oldsha/$newsha are also trees, and anyway 'git
|
||||
# diff' only wants trees
|
||||
my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
|
||||
my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
|
||||
push @refs, map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree`;
|
||||
}
|
||||
|
||||
# we potentially have many "refs" to check. The one we print in the log is
|
||||
# the *first* one (which is a *real* ref, like refs/heads/master), while all
|
||||
# the rest (if they exist) are like NAME/something. So we do the first one
|
||||
# separately to capture it, then run the rest (if any)
|
||||
my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, (shift @refs), $att_acc);
|
||||
check_ref (\@allowed_refs, $ENV{GL_REPO}, $_ , $att_acc) for @refs;
|
||||
# then we check all virtual refs
|
||||
check_vrefs(\@allowed_refs, $ENV{GL_REPO}, $att_acc);
|
||||
|
||||
# if we returned at all, all the checks succeeded. Check secondary hooks now
|
||||
$UPDATE_CHAINS_TO ||= 'hooks/update.secondary';
|
||||
|
|
@ -111,3 +91,50 @@ log_it("", "$att_acc\t" . substr($oldsha, 0, 14) . "\t" . substr($newsha, 0, 14
|
|||
"\t$reported_repo\t$ref\t$log_refex");
|
||||
|
||||
exit 0;
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
sub check_vrefs {
|
||||
my ( $ar_ref, $repo, $aa ) = @_;
|
||||
# these will be passed on as args 1, 2, 4 to check_ref. Arg-3 will be
|
||||
# the new ref being checked.
|
||||
|
||||
# this sub uses $ref, $oldsha, and $newsha globals; they're pretty much
|
||||
# 'constant' once you enter an update hook anyway
|
||||
|
||||
my $empty = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'; # this is special to git -- the hash of an empty tree
|
||||
my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
|
||||
my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
|
||||
my @first6 = ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa );
|
||||
|
||||
# first, handle the VREF thats's been in "core" forever...
|
||||
if ( $repos{ $ENV{GL_REPO} }{NAME_LIMITS} ) {
|
||||
for my $ref ( map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree` ) {
|
||||
check_ref( $ar_ref, $repo, $ref, $aa );
|
||||
}
|
||||
}
|
||||
|
||||
my %vref_seen;
|
||||
|
||||
for my $vr ( grep { m(^VREF/) } map { $_->[1] } sort { $a->[0] <=> $b->[0] } @{$ar_ref} ) {
|
||||
next if $vref_seen{$vr}++;
|
||||
|
||||
# find code pertaining to $vr and run it; see docs for details
|
||||
my ( $dummy, $pgm, @args ) = split '/', $vr;
|
||||
$pgm = "$ENV{GL_BINDIR}/gl-VREF-$pgm";
|
||||
-x $pgm or die "can't find helper program for $vr\n";
|
||||
|
||||
open( my $fh, "-|", $pgm, @first6, $vr, @args ) or die "can't spawn helper program for $vr: $!\n";
|
||||
while (<$fh>) {
|
||||
my ( $vref, $deny_message ) = split( ' ', $_, 2 );
|
||||
my $ret = check_ref( $ar_ref, $repo, $vref, $aa, 1 );
|
||||
die "$ret\n" . ( $deny_message || '' ) if $ret =~ /DENIED/ and $ret !~ /by fallthru/;
|
||||
# I could change check_ref to take one more argument, say
|
||||
# 'fallthru_is_pass', but I want to keep these changes as
|
||||
# isolated as possible for now
|
||||
}
|
||||
close($fh) or die $!
|
||||
? "Error closing sort pipe: $!"
|
||||
: "Exit status $? from VREF helper program for $vr";
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -175,9 +175,9 @@ sub parse_conf_line
|
|||
@refs = qw(refs/.*) unless @refs;
|
||||
# deprecation warning
|
||||
map { print STDERR "WARNING: old syntax 'PATH/' found; please use new syntax 'NAME/'\n" if s(^PATH/)(NAME/) } @refs;
|
||||
# fully qualify refs that dont start with "refs/" or "NAME/";
|
||||
# fully qualify refs that dont start with "refs/" or "NAME/" or "VREF/";
|
||||
# prefix them with "refs/heads/"
|
||||
@refs = map { m(^(refs|NAME)/) or s(^)(refs/heads/); $_ } @refs;
|
||||
@refs = map { m(^(refs|NAME|VREF)/) or s(^)(refs/heads/); $_ } @refs;
|
||||
@refs = map { s(/USER/)(/\$gl_user/); $_ } @refs;
|
||||
|
||||
# expand the user list, unless it is just "@all"
|
||||
|
|
|
|||
Loading…
Reference in a new issue