tree cda4a2e57f180ee511efa8be71b1f48a58fcf98e
parent bef7b263893bf64368d00aeb6d3e8cf7976dbdf2
author Paul Jolly <paul@myitcv.io> 1610646629 +0000
committer Paul Jolly <paul@myitcv.org.uk> 1610730519 +0000

ci: move to build branch model

Currently, runtrybot triggers a repository_dispatch build via the
test_dispatch workflow.

This dispatch workflow then starts the process of updating the CL with a
"starting" notification, running the build matrix, and then finally
updating the CL with the result state.

However, because this all happens as part of the dispatch workflow, it
all happens using the _tip_ definitions of the dispatch workflow, not
the definition in the commit under test.

This means that when we need to make changes to the workflow definition,
the try bot result from testing that CL is not the result of using the
changes to the workflow in that commit. Hence we must blindly submit
that CL and hope that it doesn't break the workflow (the next tip build
will tell us but still). This is clearly very brittle.

This change switches us to a model of using build branches that are
created by the initial repository_dispatch. These branches then trigger
a regular branch build, albeit using a special git ref
(ci/$CHANGE_ID/$COMMIT). Status updates to the corresponding CL happen
as before, but this time from the build branch workflow. When a CL build
branch workflow has completed, the corresponding build branch is deleted
(regardless of the test result).  Note that for now we do not delete
this branch: we first want to ensure that a master build succeeds.

Note that from a security perspective this is fine (tm). In order to
trigger a repository_dispatch event in the first place a user must have
write permission to the CUE repo. So there is no privilege escalation
here.

The initial repository dispatch is triggered by a user with write
privileges, but then the subsequent push of the build branch happens as
cueckoo.

Closes #513

Change-Id: I2738fc488d6a8ef08e7e83b151b12934b9f1ee15
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/8212
Reviewed-by: Paul Jolly <paul@myitcv.org.uk>