ci: add first version of copybara workflow

This is a simple migration of the existing copybara setup to run on top
of GitHub actions. The "github" and "github-pr" copybara commands are
invoked via repository dispatch workflows, and run as the cueckoo user.

The repository dispatch workflows are triggered via
github.com/cue-sh/tools/cmd/cuekcoo.

This tool is not, for now, added as a dependency because that would
create a requirement cycle. This is not a problem in and of itself, but
we choose to postpone making that decision for now (plus gorelease
appears to have a bug relating to this). So for now we require:

github.com/cue-sh/tools/cmd/cueckoo@v0.0.0-20210205194434-b3293e86064a

Change-Id: Ibf146c900c7888a1be813020fbd897f2602a60ad
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/8521
Reviewed-by: Paul Jolly <paul@myitcv.org.uk>

.github/workflows/mirror.yml

@@ -0,0 +1,29 @@
+# Generated by internal/ci/ci_tool.cue; do not edit
+
+name: Scheduled repo mirror
+on:
+  schedule:
+  - cron: '*/30 * * * *'
+jobs:
+  mirror:
+    runs-on: ubuntu-18.04
+    defaults:
+      run:
+        shell: bash
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Mirror Gerrit to GitHub
+      run: |-
+        cd _scripts
+        docker run --rm -v $PWD/cache:/root/copybara/cache -v $PWD:/usr/src/app --entrypoint="" cueckoo/copybara:afc4ae03eed00b0c9d7415141cd1b5dfa583da7c bash -c " \
+        	set -eu; \
+        	echo \"${{ secrets.gerritCookie }}\" > ~/.gitcookies; \
+        	chmod 600 ~/.gitcookies; \
+        	git config --global user.name cueckoo; \
+        	git config --global user.email cueckoo@gmail.com; \
+        	git config --global http.cookiefile \$HOME/.gitcookies; \
+          	echo https://cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }}@github.com > ~/.git-credentials; \
+        	chmod 600 ~/.git-credentials; \
+        	java -jar /opt/copybara/copybara_deploy.jar migrate copy.bara.sky github; \
+        	"

.github/workflows/repository_dispatch.yml

@@ -4,21 +4,67 @@ name: Repository Dispatch
 on:
 - repository_dispatch
 jobs:
-  start:
-    if: ${{ startsWith(github.event.action, 'Build for refs/changes/') }}
+  runtrybot:
     runs-on: ubuntu-18.04
     defaults:
       run:
         shell: bash
+    if: ${{ github.event.client_payload.type == 'runtrybot' }}
     steps:
-    - name: Checkout ref
+    - name: Trigger trybot
       run: |-
         mkdir tmpgit
         cd tmpgit
         git init
         git config user.name cueckoo
         git config user.email cueckoo@gmail.com
         git config http.https://github.com/.extraheader "AUTHORIZATION: basic $(echo -n cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} | base64)"
-        git fetch https://cue-review.googlesource.com/cue ${{ github.event.client_payload.ref }}
-        git checkout -b ci/${{ github.event.client_payload.changeID }}/${{ github.event.client_payload.commit }} FETCH_HEAD
-        git push https://github.com/cuelang/cue ci/${{ github.event.client_payload.changeID }}/${{ github.event.client_payload.commit }}
+        git fetch https://cue-review.googlesource.com/cue ${{ github.event.client_payload.payload.ref }}
+        git checkout -b ci/${{ github.event.client_payload.payload.changeID }}/${{ github.event.client_payload.payload.commit }} FETCH_HEAD
+        git push https://github.com/cuelang/cue ci/${{ github.event.client_payload.payload.changeID }}/${{ github.event.client_payload.payload.commit }}
+  mirror:
+    runs-on: ubuntu-18.04
+    defaults:
+      run:
+        shell: bash
+    if: ${{ github.event.client_payload.type == 'mirror' }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Mirror Gerrit to GitHub
+      run: |-
+        cd _scripts
+        docker run --rm -v $PWD/cache:/root/copybara/cache -v $PWD:/usr/src/app --entrypoint="" cueckoo/copybara:afc4ae03eed00b0c9d7415141cd1b5dfa583da7c bash -c " \
+        	set -eu; \
+        	echo \"${{ secrets.gerritCookie }}\" > ~/.gitcookies; \
+        	chmod 600 ~/.gitcookies; \
+        	git config --global user.name cueckoo; \
+        	git config --global user.email cueckoo@gmail.com; \
+        	git config --global http.cookiefile \$HOME/.gitcookies; \
+          	echo https://cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }}@github.com > ~/.git-credentials; \
+        	chmod 600 ~/.git-credentials; \
+        	java -jar /opt/copybara/copybara_deploy.jar migrate copy.bara.sky github; \
+        	"
+  importpr:
+    runs-on: ubuntu-18.04
+    defaults:
+      run:
+        shell: bash
+    if: ${{ github.event.client_payload.type == 'importpr' }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: 'Import PR #${{ github.event.client_payload.commit }} from GitHub to Gerrit'
+      run: |-
+        cd _scripts
+        docker run --rm -v $PWD/cache:/root/copybara/cache -v $PWD:/usr/src/app --entrypoint="" cueckoo/copybara:afc4ae03eed00b0c9d7415141cd1b5dfa583da7c bash -c " \
+        	set -eu; \
+        	echo \"${{ secrets.gerritCookie }}\" > ~/.gitcookies; \
+        	chmod 600 ~/.gitcookies; \
+        	git config --global user.name cueckoo; \
+        	git config --global user.email cueckoo@gmail.com; \
+        	git config --global http.cookiefile \$HOME/.gitcookies; \
+          	echo https://cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }}@github.com > ~/.git-credentials; \
+        	chmod 600 ~/.git-credentials; \
+        	java -jar /opt/copybara/copybara_deploy.jar migrate copy.bara.sky github-pr ${{ github.event.client_payload.payload.pr }}; \
+        	"

_scripts/copy.bara.sky

@@ -0,0 +1,74 @@
+# Copyright 2021 The CUE Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# The copybara configuration for the cuelang/cue repository
+#
+# When used in conjunction with the cueckoo/copybara Docker image this
+# configuration can be run in two modes:
+#
+#     github
+#     github-pr N
+#
+# The first mode mirrors Gerrit to GitHub. The second mode imports PR #N from
+# GitHub to Gerrit.
+#
+# See the CUE-defined copybara workflow defined in internal/ci for an example
+# of how to pass in Gerrit and GitHub credentials when running an instance of
+# the cueckoo/copybara image.
+
+github_url = "https://github.com/cuelang/cue.git"
+gerrit_url = "https://cue-review.googlesource.com/cue"
+
+origin_github_pr = git.github_pr_origin(
+        baseline_from_branch = True,
+        use_merge = True,
+        url = github_url,
+        )
+
+origin_gerrit = git.origin(
+        url = gerrit_url,
+        ref = "master",
+        )
+
+destination_gerrit = git.gerrit_destination(
+        url = gerrit_url,
+        fetch = "master",
+        push_to_refs_for = "master%hashtag=github-pr",
+        )
+
+# Mirror from Gerrit -> GitHub
+git.mirror(
+        name = "github",
+        origin = gerrit_url,
+        destination = github_url,
+        refspecs = ["refs/*"],
+        prune = False,
+        )
+
+# Import a PR from GitHub to Gerrit
+core.workflow(
+        name = "github-pr",
+        origin = origin_github_pr,
+        destination = destination_gerrit,
+        authoring = authoring.pass_thru("CUE team <no-reply@google.com>"),
+        transformations = [
+            metadata.replace_message(
+                "${GITHUB_PR_TITLE}\n\n" +
+                "${GITHUB_PR_BODY}\n\n" +
+                "Closes #${GITHUB_PR_NUMBER}\n" +
+                "https://github.com/cuelang/cue/pull/${GITHUB_PR_NUMBER}",
+                ),
+            ],
+        mode = "CHANGE_REQUEST",
+        )