Rewrite of TPS integrations using basic bash scripts (#3090)

* Speculative rewrite of TPS lock check

* Fix executable

* Fix curl error

* More curl request fixes

* Logic fix & formatting

* Improve error reporting in TPS lock check

* Include environment to get TPS secrets

* Rewrite TPS release recorder to match other TPS script

* Continue on error when recording the release

* Document usage of TPS scripts

* fix spelling

* Fix record release to drop app_id (CLI does not have this) and honor the 204 status for success

* Clarify missing argument messages

* Corrections based on PR feedback

* Stable CLI releases are always "production"

* No longer need the TPS_API_STAGE secret

* Fix to set the release stage in description too

* Always output TPS response status

* Move retry attempt to end of loop

.github/workflows/create-cli-release.yml

@@ -19,7 +19,10 @@ on:
 jobs:
   check-for-moratorium:
     if: fromJSON(inputs.isStableCandidate)
-    uses: ./.github/workflows/ctc.yml
+    run: ./scripts/release/tps_check_lock cli ${{ github.sha }}
+    environment: ChangeManagement
+    env:
+      TPS_API_TOKEN: ${{ secrets.TPS_API_TOKEN_PARAM }}
 
   get-version-channel:
     runs-on: ubuntu-latest

.github/workflows/promote-release.yml

@@ -58,18 +58,16 @@ jobs:
   change-management:
     needs: [ promote ]
     if: fromJSON(inputs.isStableRelease)
-    runs-on: ubuntu-latest
-    environment: ChangeManagement
-    env:
-      TPS_API_APP_ID: ${{ secrets.TPS_API_APP_ID }}
-      TPS_API_RELEASE_ACTOR_EMAIL: ${{ secrets.TPS_API_RELEASE_ACTOR_EMAIL }}
-      TPS_API_STAGE: ${{ secrets.TPS_API_STAGE }}
-      TPS_API_TOKEN_PARAM: ${{ secrets.TPS_API_TOKEN_PARAM }}
-      TPS_API_URL_PARAM: ${{ secrets.TPS_API_URL_PARAM }}
+    # Failure to record the release should not fail the workflow
+    continue-on-error: true
     steps:
+      # Checkout required to get github.sha
       - uses: actions/checkout@v3
-      - run: yarn --immutable --network-timeout 1000000
-      - run: ./scripts/postrelease/change_management
+      - run: ./scripts/postrelease/tps_record_release cli ${{ github.sha }}
+    environment: ChangeManagement
+    env:
+      ACTOR_EMAIL: ${{ secrets.TPS_API_RELEASE_ACTOR_EMAIL }}
+      TPS_API_TOKEN: ${{ secrets.TPS_API_TOKEN_PARAM }}
 
   create-fig-autocomplete-pr:
     if: fromJSON(inputs.isStableRelease)

.gitignore

@@ -26,4 +26,5 @@ node_modules
 
 # TEMP
 /packages/**/converted/*
-
+tpsGetLock_response.txt
+tpsRecordRelease_response.txt

scripts/postrelease/tps_record_release

@@ -0,0 +1,84 @@
+#!/bin/bash
+set -eu
+set -o pipefail
+
+# Usage: ./scripts/postrelease/tps_record_release
+# Required env vars: TPS_API_TOKEN, COMPONENT_SLUG, RELEASE_SHA, ACTOR_EMAIL
+
+# Alternate Usage: ./scripts/postrelease/tps_record_release <component-slug> <release-id>
+# Required env vars: TPS_API_TOKEN, ACTOR_EMAIL
+
+# Alternate Usage: ./scripts/postrelease/tps_record_release <component-slug> <release-id> <email>
+# Required env vars: TPS_API_TOKEN
+
+if [ -z "${TPS_HOSTNAME:-}" ]; then
+  TPS_HOSTNAME="tps.heroku.tools"
+fi
+
+if [ -z "${TPS_API_TOKEN:-}" ]; then
+  echo "Requires environment variable: TPS_API_TOKEN" >&2
+  exit 1
+fi
+
+# Argument overrides the environment variable
+component_slug="${1:-$COMPONENT_SLUG}"
+if [ -z "$component_slug" ]; then
+  echo "Requires first argument or env var COMPONENT_SLUG: Heroku component slug" >&2
+  exit 1
+fi
+
+release_sha="${2:-$RELEASE_SHA}"
+if [ -z "$release_sha" ]; then
+  echo "Requires second argument or env var RELEASE_SHA: SHA of the commit being released" >&2
+  exit 1
+fi
+
+actor_email="${3:-$ACTOR_EMAIL}"
+if [ -z "$actor_email" ]; then
+  echo "Requires third argument or env var ACTOR_EMAIL: email of actor performing the release" >&2
+  exit 1
+fi
+
+# No app_id for cli releases
+# app_id="${4:-$APP_ID}"
+# if [ -z "$app_id" ]; then
+#   echo "Requires fourth argument: UUID of app being released" >&2
+#   exit 1
+# fi
+
+stage="production"
+description="Deploy ${release_sha} of ${component_slug} in ${stage}"
+
+response_status=0
+
+tpsRecordRelease() {
+  response_status="$(curl --silent \
+    -o tpsRecordRelease_response.txt -w "%{response_code}" \
+    -X POST \
+    -H "Accept: */*" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer ${TPS_API_TOKEN}" \
+    -d "{\"component_slug\": \"${component_slug}\", \"release\": {\"sha\": \"${release_sha}\", \"actor_email\": \"${actor_email}\", \"stage\": \"${stage}\", \"description\": \"${description}\"}}" \
+    https://${TPS_HOSTNAME}/api/component/${component_slug}/releases)"
+
+  echo Response status $response_status: $(cat tpsRecordRelease_response.txt) >&2
+}
+
+echo "Recording release with ${TPS_HOSTNAME}…" >&2
+retry_count=0
+set +e
+tpsRecordRelease
+until [ "$response_status" == "204" ]
+do
+  ((retry_count++))
+  if [ $retry_count -gt 120 ]
+  then
+    echo "❌  Could not record release for \"$component_slug\" after retrying for 30-minutes." >&2
+    exit 2
+  fi
+  echo "⏳  Retry in 15-seconds…" >&2
+  sleep 15
+  tpsRecordRelease
+done
+set -e
+echo "✅  Release recorded" >&2

scripts/release/tps_check_lock

@@ -0,0 +1,65 @@
+#!/bin/bash
+set -eu
+set -o pipefail
+
+# Usage: ./scripts/release/tps_check_lock
+# Required env vars: TPS_API_TOKEN, COMPONENT_SLUG, RELEASE_SHA
+#
+# Alternate Usage: ./scripts/release/tps_check_lock <component-slug> <release-id>
+# Required env vars: TPS_API_TOKEN
+
+if [ -z "${TPS_HOSTNAME:-}" ]; then
+  TPS_HOSTNAME="tps.heroku.tools"
+fi
+
+if [ -z "${TPS_API_TOKEN:-}" ]; then
+  echo "Requires environment variable: TPS_API_TOKEN" >&2
+  exit 1
+fi
+
+# Argument overrides the environment variable
+component_slug="${1:-$COMPONENT_SLUG}"
+if [ -z "$component_slug" ]; then
+  echo "Requires first argument or env var COMPONENT_SLUG: Heroku component slug" >&2
+  exit 1
+fi
+
+release_sha="${2:-$RELEASE_SHA}"
+if [ -z "$release_sha" ]; then
+  echo "Requires second argument or env var RELEASE_SHA: SHA of the commit being released" >&2
+  exit 1
+fi
+
+response_status=0
+
+tpsGetLock() {
+  response_status="$(curl --silent \
+    -o tpsGetLock_response.txt -w "%{response_code}" \
+    -X PUT \
+    -H "Accept: */*" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer ${TPS_API_TOKEN}" \
+    -d "{\"lock\": {\"sha\": \"${release_sha}\", \"component_slug\": \"${component_slug}\"}}" \
+    https://${TPS_HOSTNAME}/api/ctc)"
+
+  echo Response status $response_status: $(cat tpsGetLock_response.txt) >&2
+}
+
+echo "Requesting deployment lock from ${TPS_HOSTNAME}…" >&2
+retry_count=0
+set +e
+tpsGetLock
+until [ "$response_status" == "200" -o "$response_status" == "201" ]
+do
+  ((retry_count++))
+  if [ $retry_count -gt 40 ]
+  then
+    echo "❌  Could not get deployment lock for \"$component_slug\" after retrying for 10-minutes." >&2
+    exit 2
+  fi
+  echo "⏳  Retry in 15-seconds…" >&2
+  sleep 15
+  tpsGetLock
+done
+set -e
+echo "✅  Lock acquired" >&2