From 60515efbf33436fc0876302ccf734df5449320f6 Mon Sep 17 00:00:00 2001
From: Stephen Kitt <skitt@redhat.com>
Date: Mon, 30 Sep 2024 17:53:37 +0200
Subject: [PATCH] Check unmerged commits in dependencies

This adds a script which examines submariner-io dependencies with
versions referencing untagged git commits, that is to say commits
which haven't been released. It ensures that any such dependencies
point to a commit in the relevant branch, to avoid merging PRs with
pointers to unmerged commits. Since the project rebases on PR merge,
the commit hashes change, and dependent PRs can end up being merged
with a reference to an in-development commit; that can break local
builds.

Since Shipyard doesn't have any submariner-io dependencies, this isn't
integrated into CI yet; it will be used in other Submariner projects.

Signed-off-by: Stephen Kitt <skitt@redhat.com>
---
 scripts/shared/check-non-release-versions.sh | 26 ++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100755 scripts/shared/check-non-release-versions.sh

diff --git a/scripts/shared/check-non-release-versions.sh b/scripts/shared/check-non-release-versions.sh
new file mode 100755
index 00000000..094d729b
--- /dev/null
+++ b/scripts/shared/check-non-release-versions.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf $tmpdir' EXIT
+
+# List all submariner-io dependencies with a - in their version
+# We're looking for versions pointing to commits, of the form
+# vX.Y.Z-0.YYYYMMDDhhmmss-hash
+failed=0
+shopt -s lastpipe
+GOWORK=off go list -m -mod=mod -json all |
+    jq -r 'select(.Path | contains("/submariner-io/")) | select(.Main != true) | select(.Version | contains ("-")) | select(.Version | length > 14) | "\(.Path) \(.Version)"' |
+    while read -r project version; do
+        cd "$tmpdir" || exit 1
+        git clone "https://$project"
+        cd "${project##*/}" || exit 1
+        hash="${version##*-}"
+        branch="${GITHUB_BASE_REF:-devel}"
+        if ! git merge-base --is-ancestor "$hash" "origin/$branch"; then
+            printf "This project depends on %s %s\n" "$project" "$version"
+            printf "but %s branch %s does not contain commit %s\n" "$project" "$branch" "$hash"
+            failed=1
+        fi
+    done
+
+exit $failed