bazel-lock

#!/bin/sh -u

[ $# -ne 1 ] && echo "Usage: $0  <target to upgrade>" && exit 1

# This tool is just to demonstrate a possible usage.
# Ideally this is part of Bazel itself, replacing these hacks.

BAZEL=${BAZEL:-bazel}
if ! $BAZEL --version >/dev/null 2>&1; then
	if ! bazelisk --version >/dev/null 2>&1; then
		echo "$BAZEL not found" >&2
		exit 1
	fi
	BAZEL=bazelisk
fi

wd=.
root=$(dirname "$0")
if [ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]; then
	# echo "NOTE: Running within $BAZEL"
	wd=$BUILD_WORKSPACE_DIRECTORY
	root=$PWD/external/bazel_lock/
fi
W=$wd/WORKSPACE
L=$wd/LOCKFILE.bzl

GetFirstOfListField() {
	name=$1; shift
	field=$1; shift
	grep -h -A999 -F "name = \"$name\"," "$W" \
	| while read -r line; do [ ')' = "$line" ] && break; echo "$line"; done \
	| grep -A1 -E "^$field = \[" \
	| while read -r line; do echo "$line" && [ "$line" != "${line#*\"}" ] && break; done \
	| awk -v FS='"' '{print $2}' \
	| while read -r s; do [ -n "$s" ] && echo "$s"; done
}
# NOTE: on macOS `grep -mX -AY` is broken (could not find)
GetStringField() {
	name=$1; shift
	field=$1; shift
	value=$(grep -h -A999 -F "name = \"$name\"," "$W" \
		| while read -r line; do [ ')' = "$line" ] && break; echo "$line"; done \
		| grep -m1 -E "^$field = \"" \
		| awk -v FS='"' '{print $2}')
	if [ "$field" = url ] && [ -z "$value" ]; then
		GetFirstOfListField "$name" urls
	else
		echo "$value"
	fi
}

Pin() {
	printf 'locked["%s"] = {%s}\n' "$1" "$2" >>"$L"
}

KeyHTTPArchive() {
	url=$1; shift
	type=$1; shift
	upgrades_slug=$1; shift
	upgrade_constraint=$1; shift
	upgrade_constraint_url_contains=$1; shift
	echo "http_archive> $url $type $upgrades_slug $upgrade_constraint $upgrade_constraint_url_contains"
}

KeyGitRepository() {
	tag=$1; shift
	branch=$1; shift
	remote=$1; shift
	upgrade_constraint=$1; shift
	echo "git_repository> $tag $branch $remote $upgrade_constraint"
}

GitHubCurl() {
	o=$1; shift
	if [ -n "${GITHUB_TOKEN:-}" ]; then
		curl -#fSLo "$o" -H "authorization: token $GITHUB_TOKEN" "$@"
	else
		curl -#fSLo "$o" "$@"
	fi
}

FilterSemVer() {
	filter=$1; shift
	script=$(mktemp)
	{
		echo 'from __future__ import print_function'
		echo 'import sys'
	} >"$script"
	#https://raw.githubusercontent.com/rbarrois/python-semanticversion/eda1ac8c22a99dbd01cd57fbcd459856b469ae46/semantic_version/base.py
	cat "$root"/semantic_version-eda1ac8c22a99dbd01cd57fbcd459856b469ae46.py >>"$script"
	{
		echo 'versions = {}'
		echo 'for line in sys.stdin:'
		echo '    version_and_url = line.rstrip().split(" ", 1)'
		echo '    if len(version_and_url) != 2:'
		echo '        for version, url in versions.items():'
		echo '            print("{} {}".format(version, url), file=sys.stderr)'
		echo '        print("Bad version/URL: {}".format(version_and_url), file=sys.stderr)'
		echo '        exit(42)'
		echo '    version, url = version_and_url'
		echo '    versions[Version.coerce(version)] = url'
		echo 'selected = SimpleSpec(sys.argv[1]).select(versions)'
		echo 'if not selected:'
		echo '    exit(42)'
		echo 'print(selected, versions[selected])'
	} >>"$script"
	python "$script" "$filter"
	err=$?
	rm "$script"
	return $err
}

errcode=0

if [ ! -f "$W" ]; then
	echo "No Bazel $W in $PWD" >&2
	errcode=1
fi
[ $errcode -ne 0 ] && exit $errcode

echo 'locked = {}' >"$L"

# Upgrade what needs to be resolved
echo 'Upgrading dependencies...'
for kind in http_archive git_repository; do
	# shellcheck disable=SC2013
	for name in $(grep -A1 -F "$kind(" "$W" | grep -F ' name = ' | awk -v FS='"' '{print $2}'); do
		case $kind in
		git_repository)
			remote=$(GetStringField "$name" remote)
			if [ -z "$remote" ]; then
				echo "Upgrading $kind(name = \"$name\", ...)"
				echo "@$name is missing 'remote' field" >&2
				errcode=1
				continue
			fi
			tag=$(GetStringField "$name" tag)
			branch=$(GetStringField "$name" branch)
			{ [ -n "$tag" ] || [ -n "$branch" ]; } && continue
			echo "Upgrading $kind(name = \"$name\", ...)"
			upgrade_constraint=$(GetStringField "$name" upgrade_constraint)
			if [ -z "$upgrade_constraint" ]; then
				echo "@$name requires exactly one of 'tag', 'branch' or 'upgrade_constraint' to be provided" >&2
				errcode=1
				continue
			fi
			tag_commit=$(git ls-remote --tags "$remote" \
				| grep -vF '^{}' \
				| while read -r commit ref; do
					# Extract & deduplicate version-like strings
					echo "$(echo "$ref" | grep -Eo '[0-9]+(\.[0-9]+)+' | sort -u) $commit"
				done \
				| FilterSemVer "$upgrade_constraint")
			if [ -z "$tag_commit" ]; then
				echo "No release of $remote match constraint $upgrade_constraint" >&2
				errcode=1
				continue
			fi
			tag=$(echo "$tag_commit" | awk '{print $1}')
			commit=$(echo "$tag_commit" | awk '{print $2}')
			echo "Selected @$name's tag:"
			echo "$kind("
			echo "    name = \"$name\","
			echo "    remote = \"$remote\","
			echo "    upgrade_constraint = \"$upgrade_constraint\","
			echo "    ..."
			echo "    commit = \"$commit\",  # tag = \"$tag\""
			echo ")"
			echo
			Pin "$(KeyGitRepository '' "$branch" "$remote" "$upgrade_constraint")" "\"commit\": \"$commit\""
			;;

		http_archive)
			url=$(GetStringField "$name" url)
			[ -n "$url" ] && continue
			upgrades_slug=$(GetStringField "$name" upgrades_slug)
			[ -z "$upgrades_slug" ] && continue
			echo "Upgrading $kind(name = \"$name\", ...)"
			type=$(GetStringField "$name" type)
			upgrade_constraint=$(GetStringField "$name" upgrade_constraint)
			upgrade_constraint_url_contains=$(GetStringField "$name" upgrade_constraint_url_contains)
			version=''
			if [ -z "$upgrade_constraint" ]; then
				if [ -z "$type" ]; then
					echo "Missing 'type' field. Try: type = \"zip\"" >&2
					errcode=1
					continue
				fi
				case "${upgrades_slug%%/*}" in
				github.com)
					repo=git://$upgrades_slug.git
					HEAD=$(git ls-remote "$repo" | grep HEAD | awk '{print $1}')
					if [ -z "$HEAD" ]; then
						echo "Could not resolve HEAD of $repo: remote not responding." >&2
						errcode=1
						continue
					fi
					url=https://$upgrades_slug/archive/$HEAD.$type
					version=HEAD
					;;
				*)
					echo "Unsupported $kind slug: ${upgrades_slug%%/*}" >&2
					errcode=1
					continue
				esac
			else
				case "${upgrades_slug%%/*}" in
				github.com)
					gh_releases_url=https://api.github.com/repos/"${upgrades_slug#*/}"/releases
					curled=$(mktemp)
					if ! GitHubCurl "$curled" "$gh_releases_url"; then
						rm "$curled"
						echo "Failed fetching $gh_releases_url" >&2
						errcode=1
						continue
					fi
					version_url=$( (cat "$curled" && rm "$curled") \
						| jq '.[] | select( .draft == false and .prerelease == false ) | .assets[] | .browser_download_url' \
						| jq    ". | select(endswith(\"$type\"))" \
						| jq -r ". | select(endswith(\"$upgrade_constraint_url_contains\"))" \
						| while read -r gh_url; do
							# Extract & deduplicate version-like strings
							echo "$(echo "${gh_url%.*}" | grep -Eo '[0-9]+(\.[0-9]+)+' | sort -u) $gh_url"
						done \
						| FilterSemVer "$upgrade_constraint")
					if [ -z "$version_url" ]; then
						echo "No release of $upgrades_slug match constraint $upgrade_constraint" >&2
						errcode=1
						continue
					fi
					version=$(echo "$version_url" | awk '{print $1}')
					url=$(echo "$version_url" | awk '{print $2}')
					;;
				*)
					echo "Unsupported $kind slug: ${upgrades_slug%%/*}. Maybe use git_repository()?" >&2
					# TODO? git ls-remote + git archive (really should be using git_repository)
					errcode=1
					continue
				esac
			fi
			echo "Selected @$name's URL:"
			echo "$kind("
			echo "    name = \"$name\","
			[ -n "$type" ] && echo "    type = \"$type\","
			echo "    upgrades_slug = \"$upgrades_slug\","
			[ -n "$upgrade_constraint" ] && echo "    upgrade_constraint = \"$upgrade_constraint\","
			[ -n "$upgrade_constraint_url_contains" ] && echo "    upgrade_constraint_url_contains = \"$upgrade_constraint_url_contains\","
			echo "    ..."
			echo "    url = \"$url\",  # $version"
			echo ")"
			echo
			Pin "$(KeyHTTPArchive '' "$type" "$upgrades_slug" "$upgrade_constraint" "$upgrade_constraint_url_contains")" "\"url\": \"$url\""
			;;

		*) exit 42
		esac
	done
done
[ $errcode -ne 0 ] && exit $errcode

# Clean so sum of only most recently downloaded files is computed
echo 'Cleaning some Bazel state...'
$BAZEL clean --expunge >/dev/null 2>&1 || true
# Run build
echo 'Locking repositories...'
txt=$(mktemp)
cd "$wd" && $BAZEL build "$@" 2>&1 | tee "$txt"
errcode=$?
cd -
if [ $errcode -ne 0 ]; then
	echo 'Failed while locking!' >&2
	cat "$L" >&2
	cat "$txt" >&2
	rm "$txt"
	echo "Failed to run $BAZEL build $*" >&2
	exit $errcode
fi

# Catch reproduciblility suggestions
(cat "$txt" && rm "$txt") \
| grep -F 'indicated that a canonical reproducible form can be obtained' \
| while read -r line; do
	name=$(echo "$line" | awk -v FS="'" '{print $2}')

	pinned=$(echo "$line" \
			| awk -v FS='and dropping' '{print $1}' \
			| awk -v FS='modifying arguments' '{print $2}' \
			| sed -E 's% ([^ ]+) =% "\1":%g')
	pinned=${pinned# }
	pinned=${pinned% }

	kind=$(grep -m1 -h -B1 -F "name = \"$name\"," "$W" | head -n1 | sed 's%(%%')
	case "$kind" in
		http_archive)
			url=$(GetStringField "$name" url)
			type=$(GetStringField "$name" type)
			upgrades_slug=$(GetStringField "$name" upgrades_slug)
			upgrade_constraint=$(GetStringField "$name" upgrade_constraint)
			upgrade_constraint_url_contains=$(GetStringField "$name" upgrade_constraint_url_contains)
			key="$(KeyHTTPArchive "$url" "$type" "$upgrades_slug" "$upgrade_constraint" "$upgrade_constraint_url_contains")"
			# If upgraded, use lockfile to resolve url
			if [ -z "$url" ]; then
				Pin "$key" "\"url\": locked[\"$key\"][\"url\"], $pinned"
			else
				Pin "$key" "$pinned"
			fi
			;;
		git_repository)
			tag=$(GetStringField "$name" tag)
			branch=$(GetStringField "$name" branch)
			remote=$(GetStringField "$name" remote)
			upgrade_constraint=$(GetStringField "$name" upgrade_constraint)
			key="$(KeyGitRepository "$tag" "$branch" "$remote" "$upgrade_constraint")"
			if ! echo "$pinned" | grep -F '"commit":' >/dev/null 2>&1; then
				Pin "$key" "\"commit\": locked[\"$key\"][\"commit\"], $pinned"
			else
				Pin "$key" "$pinned"
			fi
			;;
		*)
			echo "Unhandled rule '$kind'" && exit 2
	esac
	echo "Pinned @$name"
done

echo Finishing up...
script=$(mktemp)
cat << EOF >"$script"
from __future__ import print_function
import json
EOF
cat "$L" >>"$script"
cat << EOF >>"$script"
print('locked = {}')
for k in sorted(locked):
	# Uses json.dumps to fmt with double quotes
	v = json.dumps(locked[k], sort_keys=True)
	k = json.dumps(k)
	print('locked[{}] = {}'.format(k, v))
EOF
pretty=$(mktemp)
python "$script" >"$pretty"
errcode=$?
rm "$script"
[ $errcode -ne 0 ] && rm "$pretty" && exit $errcode
mv "$pretty" "$L"