#!/usr/bin/env lucicfg
# Copyright 2019 The Flutter Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
"""
LUCI project configuration for the production instance of LUCI.

After modifying this file execute it ('./main.star') to regenerate the configs.

This file uses a Python-like syntax known as Starlark:
https://docs.bazel.build/versions/master/skylark/language.html

The documentation for lucicfg can be found here:
https://chromium.googlesource.com/infra/luci/luci-go/+/refs/heads/master/lucicfg/doc/README.md
"""

load("//lib/common.star", "common")
load("//lib/repos.star", "repos")
load("//cocoon_config.star", "cocoon_config")
load("//flutter_config.star", "flutter_config")
load("//recipes_config.star", "recipes_config")
load("//engine_config.star", "engine_config")
load("//infra_config.star", "infra_config")
load("//iostools_config.star", "iostools_config")
load("//packages_config.star", "packages_config")

# Avoid jumping back and forth with configs being updated by lower version
# lucicfg.
LUCICFG_VERSION = "1.32.1"
lucicfg.check_version(LUCICFG_VERSION)

# Use LUCI Scheduler BBv2 names and add Scheduler realms configs.
lucicfg.enable_experiment("crbug.com/1182002")

lucicfg.config(
    config_dir = "generated/flutter",
    tracked_files = ["**/*"],
    fail_on_warnings = True,
    lint_checks = ["default"],
)

luci.project(
    name = "flutter",
    config_dir = "luci",
    buildbucket = "cr-buildbucket.appspot.com",
    logdog = "luci-logdog.appspot.com",
    milo = "luci-milo.appspot.com",
    scheduler = "luci-scheduler.appspot.com",
    swarming = "chromium-swarm.appspot.com",
    notify = "luci-notify.appspot.com",
    tricium = "tricium-prod.appspot.com",
    acls = [
        acl.entry(
            roles = [
                acl.BUILDBUCKET_READER,
                acl.LOGDOG_READER,
                acl.PROJECT_CONFIGS_READER,
                acl.SCHEDULER_READER,
            ],
            groups = "all",
        ),
        acl.entry(
            roles = [
                acl.BUILDBUCKET_TRIGGERER,
                acl.SCHEDULER_TRIGGERER,
            ],
            groups = [
                "project-flutter-prod-schedulers",
                "project-flutter-staging-schedulers",
            ],
        ),
        acl.entry(
            roles = [
                acl.BUILDBUCKET_OWNER,
                acl.SCHEDULER_OWNER,
            ],
            groups = "project-flutter-admins",
        ),
        acl.entry(
            acl.LOGDOG_WRITER,
            groups = "luci-logdog-chromium-writers",
        ),
        acl.entry(
            roles = [acl.CQ_COMMITTER, acl.CQ_DRY_RUNNER],
            groups = ["project-flutter-try-schedulers"],
        ),
    ],
    bindings = [
        luci.binding(
            roles = "role/configs.validator",
            groups = [
                "project-flutter-try-task-accounts",
                "project-flutter-prod-task-accounts",
                "project-flutter-staging-task-accounts",
            ],
        ),
        luci.binding(
            roles = "role/swarming.poolOwner",
            groups = "project-flutter-admins",
        ),
        luci.binding(
            roles = "role/swarming.poolViewer",
            groups = "all",  # public
        ),
    ],
)

# Allow admins to use LED and "Debug" button on every builder and bot.
luci.binding(
    realm = "@root",
    roles = "role/swarming.poolUser",
    groups = "project-flutter-admins",
)
luci.binding(
    realm = "@root",
    roles = "role/swarming.taskTriggerer",
    groups = "project-flutter-admins",
)

# These 4 pool security realms are effectively no-ops,
# as they inherit ACLs from the @root realm (defined via acls/bindings above).
# However, they are left here to ensure humans can search & find them,
# since they are referenced from LUCI's side of configs in `pools.cfg` file.
luci.realm(name = "pools/prod")
luci.realm(name = "pools/try")
luci.realm(name = "pools/staging")
luci.realm(name = "pools/tests")

def task_triggerers(*, pool_realm, builder_realms, users = None, groups = None, projects = "flutter"):
    # Allow submitting tasks to the pool.
    luci.binding(
        realm = pool_realm,
        roles = "role/swarming.poolUser",
        users = users,
        groups = groups,
        projects = projects,
    )

    # Allow associating tasks with a particular builder realm.
    luci.binding(
        realm = builder_realms,
        roles = "role/swarming.taskTriggerer",
        users = users,
        groups = groups,
    )

    # Allow to create subbuilds.
    luci.binding(
        realm = builder_realms,
        roles = "role/buildbucket.creator",
        users = users,
        groups = groups,
    )

# Permissions for prod builds to trigger subbuilds.
task_triggerers(
    pool_realm = "pools/prod",
    builder_realms = ["prod"],
    users = ["flutter-prod-builder@chops-service-accounts.iam.gserviceaccount.com"],
    groups = [
        "project-flutter-led-prod-users",
    ],
    projects = [
        "flutter",
        "dart",
    ],
)

# Permissions to run LED jobs with try builds.
task_triggerers(
    pool_realm = "pools/try",
    builder_realms = ["try"],
    users = ["flutter-try-builder@chops-service-accounts.iam.gserviceaccount.com"],
    groups = [
        "project-flutter-led-users",
        "project-flutter-try-schedulers",
    ],
)

# Permissions to run LED jobs with staging builds.
task_triggerers(
    pool_realm = "pools/staging",
    builder_realms = ["staging"],
    groups = [
        "project-flutter-led-users",
        "project-flutter-staging-schedulers",
    ],
    projects = [
        "flutter",
        "dart",
    ],
)

luci.logdog(gs_bucket = "chromium-luci-logdog")

luci.milo(
    logo =
        "https://storage.googleapis.com/chrome-infra-public/logo/flutter-logo.svg",
    favicon = "https://storage.googleapis.com/flutter_infra/favicon.ico",
)

luci.bucket(
    name = "prod",
    acls = [
        acl.entry(
            acl.BUILDBUCKET_TRIGGERER,
            groups = "project-flutter-prod-schedulers",
        ),
        acl.entry(
            acl.SCHEDULER_TRIGGERER,
            groups = "project-flutter-prod-schedulers",
        ),
    ],
)

luci.bucket(
    name = "try",
    acls = [
        acl.entry(
            acl.BUILDBUCKET_TRIGGERER,
            groups =
                "project-flutter-try-schedulers",
        ),
    ],
)

# These shawdow bucket is used to trigger a real Buildbucket build using led
# go/luci-how-to-led#new-trigger-a-real-buildbucket-build-using-led

# No need to add constraints as try builds do not persist anything.
luci.bucket(
    name = "try.shadow",
    shadows = "try",
    constraints = luci.bucket_constraints(
        pools = ["luci.flutter.try"],
        service_accounts = ["flutter-try-builder@chops-service-accounts.iam.gserviceaccount.com"],
    ),
    bindings = [
        # for led permissions.
        luci.binding(
            roles = "role/buildbucket.creator",
            groups = "project-flutter-try-schedulers",
        ),
    ],
    dynamic = True,
)

luci.bucket(
    name = "prod.shadow",
    shadows = "prod",
    constraints = luci.bucket_constraints(
        pools = ["luci.flutter.prod"],
        service_accounts = ["flutter-prod-builder@chops-service-accounts.iam.gserviceaccount.com"],
    ),
    bindings = [
        # for led permissions.
        luci.binding(
            roles = "role/buildbucket.creator",
            groups = "project-flutter-prod-schedulers",
        ),
    ],
    dynamic = True,
)

luci.bucket(
    name = "staging.shadow",
    shadows = "staging",
    constraints = luci.bucket_constraints(
        pools = ["luci.flutter.staging"],
        service_accounts = ["flutter-staging-builder@chops-service-accounts.iam.gserviceaccount.com"],
    ),
    bindings = [
        # for led permissions.
        luci.binding(
            roles = "role/buildbucket.creator",
            groups = "project-flutter-staging-schedulers",
        ),
    ],
    dynamic = True,
)

luci.bucket(
    name = "staging",
    acls = [
        acl.entry(
            acl.BUILDBUCKET_TRIGGERER,
            groups = "project-flutter-staging-schedulers",
        ),
    ],
)

# CQ group configurations. Only FLUTTER_RECIPES is using
# LUCI CQ but we still need the CQ configurations for all
# the try configurations for led recipe tests.
common.cq_group(repos.FLUTTER_INFRA)

luci.builder.defaults.properties.set({
    "$kitchen": {
        "emulate_gce": True,
    },
    "$flutter/goma": {
        "server": "rbe-prod1.endpoints.fuchsia-infra-goma-prod.cloud.goog",
    },
    "$flutter/rbe": {
        "instance": "projects/flutter-rbe-prod/instances/default",
        "platform": "container-image=docker://gcr.io/cloud-marketplace/google/debian11@sha256:69e2789c9f3d28c6a0f13b25062c240ee7772be1f5e6d41bb4680b63eae6b304",
    },
    "$recipe_engine/isolated": {
        "server": "https://isolateserver.appspot.com",
    },
    "$recipe_engine/swarming": {
        "server": "https://chromium-swarm.appspot.com",
    },
    "mastername": "client.flutter",
    "goma_jobs": "200",
    "rbe_jobs": "200",
    "upload_packages": False,
    "clobber": False,
})

############################ End Global Defaults ############################
cocoon_config.setup()

# While it doens't make alphabetical sense, temporarily it does
flutter_config.setup()

engine_config.setup()

infra_config.setup()

iostools_config.setup()

packages_config.setup()

recipes_config.setup()

######################### Console Definitions #################################