roles/prepare-gerrit-repos/tasks/repo.yaml

- name: Prepare project
  debug:
    msg: "{{ project.name }} {{ project_dest }}"

- name: Check if zuul.branch exists in repo
  set_fact:
    # If zuul checked out the branch we're testing (ie, gerrit's
    # branch), then it exists.
    project_branch_exists: "{{ zuul.projects[gerrit_project_name].checkout == project.checkout }}"

- name: Check if repo has a dependent change
  set_fact:
    repo_has_dependent_change: "{{ zuul['items'] | selectattr('project.canonical_name', 'eq', project.canonical_name) | list | length | bool }}"

- name: Check if repo is in submodules
  ignore_errors: true
  set_fact:
    project_in_gitmodules: "{{ lookup ('ini', 'path section=submodule \"' + project_dest + '\" file=' + zuul.executor.work_root + '/' + zuul.projects[gerrit_project_name].src_dir + '/.gitmodules', errors='ignore') }}"
- name: Coerce submodule check to boolean
  set_fact:
    project_in_gitmodules: "{{ project_in_gitmodules | default('') | length > 0 | bool }}"

- name: Check if repo is a tracking branch
  ignore_errors: true
  set_fact:
    tracking_branch: "{{ lookup ('ini', 'branch section=submodule \"' + project_dest + '\" file=' + zuul.executor.work_root + '/' + zuul.projects[gerrit_project_name].src_dir + '/.gitmodules', errors='ignore') }}"
- name: Coerce tracking branch to boolean
  set_fact:
    tracking_branch: "{{ ((tracking_branch | default('')) == '.') | bool }}"

- name: Check for unsatisfiable source repo condition
  when:
    - "project_in_gitmodules"
    - "project.canonical_name != zuul.project.canonical_name"
    - "not project_branch_exists or not tracking_branch"
    - "repo_has_dependent_change"
  fail:
    msg: >-
      The repository {{ project.name }} does not contain the branch
      under test ({{ zuul.projects[gerrit_project_name].checkout }}),
      but this change depends on a change to that project and branch.
      While Zuul is able to check out the repos in the requested
      state, the branch mismatch means that Gerrit's submodule
      subscription would not automatically update the submodule
      pointer, and the merged state would not reflect the tested
      state.

      This configuration would be testable by creating a {{
      zuul.projects[gerrit_project_name].checkout }} branch in the {{
      project.name }} repo.  Alternatively, you can merge the
      dependent change, manually update the submodule pointer, then
      test this change again.

# If there is no matching branch we need to check out the actual sha
# defined in the parent repo.
- name: Update submodule
  when: "project_in_gitmodules and (not project_branch_exists or not tracking_branch)"
  # Set protocol.file.allow=always while submodule init, which lets
  # the submodule command to clone from a local directory. It's
  # necessary as of Git 2.38.1, where the default was changed to
  # "user" in response to CVE-2022-39253.
  command: "git -c protocol.file.allow=always submodule update --init {{ project_dest }}"
  args:
    chdir: "{{ gerrit_root }}"

# Else:
- name: Move repo into place
  when: "not (project_in_gitmodules and (not project_branch_exists or not tracking_branch))"
  command: "mv -T -f {{ ansible_user_dir }}/{{ project.src_dir }} {{ gerrit_root }}/{{ project_dest }}"