# Shared zuul config common to all tenants.
# Contains definitions of trusted jobs.

# Changes to the base require a special procedure, because they can
# not be tested before landing, and if they are faulty, they will
# break all jobs, meaning subsequent corrections will not be able to
# land.  To make a change:
#
# 1) Ensure that base-test and its playbooks are identical to base.
# 2) Make the change to base-test and/or its playbooks.
# 3) Merge the change from step 2.  No jobs normally use base-test, so
#    this is safe.
# 4) Propose a change to a job to reparent it to base-test.  Choose a
#    job which will exercise whatever you are changing.  The
#    "unittests" job in zuul-jobs is a good choice.  Use [DNM] in the
#    commit subject so that people know not to merge the change.  Set
#    it to "Work in progress" so people don't review it.
# 5) Once test results arrive for the change in step 2, make a change
#    which copies the job and/or playbooks of base-test to base.  In
#    the commit message, link to (without using Depends-On:) the
#    change from step 4 so reviewers can see the test results.
# 6) Once the change in step 5 merges, abandon the change from step 4.

- job:
    name: base
    parent: null
    abstract: true
    description: |
      The base job for Gerrit's installation of Zuul.

      All jobs ultimately inherit from this.  It runs a pre-playbook
      which copies all of the job's prepared git repos on to all of
      the nodes in the nodeset.  It runs a post-playbook which copies
      all of the files in the logs/ subdirectory of the executor
      work directory to the logserver.

      It also sets default timeout and nodeset values (which may be
      overidden).

      Responds to these variables:

      .. zuul:jobvar:: base_serial
         :default: Omitted

         This sets the serial keyword in the pre and post playbooks
         which can be an integer or percentage.

         See ansible documentation for more information:
         http://docs.ansible.com/ansible/latest/playbooks_delegation.html

    pre-run: playbooks/base/pre.yaml
    post-run:
      - playbooks/base/post.yaml
      - playbooks/base/post-logs.yaml
    roles:
      - zuul: opendev.org/zuul/zuul-jobs
    timeout: 1800
    post-timeout: 1800
    nodeset: debian-stretch

# See the procedure described above "base" before making changes to
# this job.
- job:
    name: base-test
    parent: null
    ansible-version: 2.8
    description: |
      A job to test changes to the base job without disturbing the
      main job in production.  Not for general use.
    pre-run: playbooks/base-test/pre.yaml
    post-run:
      - playbooks/base-test/post.yaml
      - playbooks/base-test/post-logs.yaml
    roles:
      - zuul: opendev.org/zuul/zuul-jobs
    timeout: 1800
    post-timeout: 1800
    nodeset: debian-stretch

# A mutex (default semaphore max is 1) so that only one job at a time
# is updating the plugins.json file.
- semaphore:
    name: gerrit-plugins-json

- job:
    name: gerrit-plugin-publish
    description: |
      Publish a previously built Gerrit plugin

      This downloads a previously built gerrit plugin archive from the
      log storage system and uploads it to an artifact publishing site.

      It is meant to run immediately after gerrit-plugin-build.  It is
      a separate job so that it can use a mutex to obtain exclusive
      write access to the plugins.json file.
    run: playbooks/gerrit-plugin/publish.yaml
    post-review: true
    semaphores: gerrit-plugins-json
    nodeset:
      nodes: []