Commit Graph

3730 Commits

Author SHA1 Message Date
Robert Lin
076498f2dc
feat/enterpriseportal: implement UpdateCodyGatewayAccess (#63926)
Implements the only Cody Access write API we have right now, the ability
to apply overrides to Cody Gateway rate limits, which we'll have in
Enterprise Portal with
https://github.com/sourcegraph/sourcegraph/pull/63858

A lot of the diff is a new generated mock for the Cody Access store so
that we can write some simple unit tests.

With this addition, all initially proposed Cody Gateway access APIs are
implemented.

Part of https://linear.app/sourcegraph/issue/CORE-218
Closes https://linear.app/sourcegraph/issue/CORE-160

## Test plan

Unit and existing integration tests
2024-08-08 13:21:18 -07:00
William Bezuidenhout
cacc01be6f
ci: provide a more descriptive error when pipegen fails (#64362)
Give a more descriptive error when we are unable to find a merge base
and can't find the files that have changed.

Closes DINF-162
## Test plan
1. `git fetch -v --prune --depth=100 -- origin
ccbaba24b72f3c6f4524b3f560ca839143ea463b`
2. `git merge-base HEAD origin/main` --- you'll get nothing since there
is no merge base in the current history

Increase the repo history
1. `git fetch --unshallow`
2. `git merge-base HEAD origin/main`
```
0a6e509af3
```
## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->

Co-authored-by: Bolaji Olajide <bolaji.olajide@sourcegraph.com>
2024-08-08 14:13:07 +00:00
Jean-Hadrien Chabran
2c73f72e85
chore(local): rename experiment single-program commandset (#64341)
Now that https://github.com/sourcegraph/sourcegraph/pull/64339 is
merged, we can tell users more about what to expect with `sg start
single-program-experimental-blame-sqs`. And as it's been in flight for a
while now, it's safe to say that's it's time to give it a shorter name
😊.

So it's been renamed from `single-program-experimental-blame-sqs` to
`minimal`. And to ensure nobody is getting confused, a `deprecated`
attribute has been added on the command sets, which is used here to
indicate that the new alternative is `sg start`.

 Thoughts about `sg start minimal`? `sg start single` perhaps? 

Running the old commandset: (ignore the yellow message, that's just a
local warning from `sg`)

![CleanShot 2024-08-07 at 17 37
31@2x](https://github.com/user-attachments/assets/a36afe54-7ccc-4437-b11b-ad288536c8da)

Running the new commandset, with the preamble explaining what to expect:

![CleanShot 2024-08-07 at 17 38
51@2x](https://github.com/user-attachments/assets/aa9af41a-8bad-48f5-ae46-68a357464bf5)

## Test plan

Locally tested.
2024-08-08 13:55:06 +02:00
Felix Kling
1c729823d5
refactor(svelte): Improve integration with sg (#64333)
There currently isn't a 'one step' way to start a local Sourcegraph
instance with the SvelteKit app.

This commit adds `sg start enterprise-sveltekit` to fix that.

The changes in https://github.com/sourcegraph/sourcegraph/pull/64272
allow us to run the vite dev server in front of the Sourcegraph
instance, instead of building the assets and having them served by
frontend.
This gives us the benefit of hot module reloading and in general seems
to be a less fragile approach.

It's basically the same what we do with the React app in development
mode.

## Test plan

`sg start enterprise-sveltekit` starts the vite dev server as well as
the sourcegraph instance. Navigating to
`https://sourcegraph.test:3443/search` opens the Svelte app (when
enabled and logged in). Making a change in a source file updates the web
page immediately.

`sg start web-sveltekit-standalone` still works
2024-08-08 11:39:26 +02:00
Erik Seliger
5a39f81d84
chore: Move cmd/frontend/backend to internal (#64261)
To prevent cross-cmd imports in the future, moving the backend package into internal.

Test plan: Just moved a package around, Go compiler doesn't complain and CI still passes.
2024-08-08 11:02:51 +02:00
Noah S-C
b9c4e2aae9
Revert "Revert "refactor: upgrade to rules_oci 2.0 (2nd attempt)"" (#64354)
Reverts sourcegraph/sourcegraph#64351

## Test plan

Need to test on main due to main-only CI steps (even with main dry-run)
2024-08-08 09:00:08 +00:00
Greg Magolan
384959a6c8
fix(build): forward runfiles in custom oci_image_cross rule (#64353)
This should resolve the Workflows delivery failure seen in
https://buildkite.com/sourcegraph/sourcegraph/builds/286482#01912eb8-a1a9-48c6-81b0-4f5a09448bbb
after landing the rules_oci 2 upgrade:

```
  · Error: failed to compute runfiles hash for manifest: error concurrently hashing file /mnt/ephemeral/output/sourcegraph/__main__/execroot/__main__/bazel-out/k8-opt-ST-d57f47055a04/bin/dev/build-tracker/image_underlying/blobs/sha256/104f4630c01017c52e968bfe039f6eb7622ef1ad9d44d94d784cc9c39992961b: failed to open file /mnt/ephemeral/output/sourcegraph/__main__/execroot/__main__/bazel-out/k8-opt-ST-d57f47055a04/bin/dev/build-tracker/image_underlying/blobs/sha256/104f4630c01017c52e968bfe039f6eb7622ef1ad9d44d94d784cc9c39992961b for hashing: open /mnt/ephemeral/output/sourcegraph/__main__/execroot/__main__/bazel-out/k8-opt-ST-d57f47055a04/bin/dev/build-tracker/image_underlying/blobs/sha256/104f4630c01017c52e968bfe039f6eb7622ef1ad9d44d94d784cc9c39992961b: no such file or directory
```

The issue was that the runfiles of the underlying oci_image
(`image_underlying` target) were not being forwarded through the custom
`oci_image_cross` rule and therefor were not being built or fetched from
the remote cache and layed out on disk for the delivery step.

In this repo, the `oci_image` rule is a macro that is an underlying
`oci_image` with the main target being an `oci_image_cross`:

```
# Apply a transition on oci_image targets and their deps to apply a transition on platforms
# to build binaries for Linux when building on MacOS.
def oci_image(name, **kwargs):
    _oci_image(
        name = name + "_underlying",
        tars = kwargs.pop("tars", []) + ["//internal/version:stamps"],
        **kwargs
    )

    oci_image_cross(
        name = name,
        image = ":" + name + "_underlying",
        platform = select({
            "@platforms//os:macos": Label("@zig_sdk//platform:linux_amd64"),
            "//conditions:default": Label("@platforms//host"),
        }),
        visibility = kwargs.pop("visibility", ["//visibility:public"]),
    )
```

## Test plan

CI

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-08-08 09:40:41 +01:00
Noah S-C
addba96f47
Revert "refactor: upgrade to rules_oci 2.0 (2nd attempt)" (#64351)
Reverts sourcegraph/sourcegraph#63829

Not working with Aspect Delivery

## Test plan

CI
2024-08-07 22:15:21 +00:00
Greg Magolan
be015c58c2
refactor: upgrade to rules_oci 2.0 (2nd attempt) (#63829)
2nd attempt of #63111, a follow up
https://github.com/sourcegraph/sourcegraph/pull/63085

rules_oci 2.0 brings a lot of performance improvement around oci_image
and oci_pull, which will benefit Sourcegraph. It will also make RBE
faster and have less load on remote cache.

However, 2.0 makes some breaking changes like

- oci_tarball's default output is no longer a tarball
- oci_image no longer compresses layers that are uncompressed, somebody
has to make sure all `pkg_tar` targets have a `compression` attribute
set to compress it beforehand.
- there is no curl fallback, but this is fine for sourcegraph as it
already uses bazel 7.1.

I checked all targets that use oci_tarball as much as i could to make
sure nothing depends on the default tarball output of oci_tarball. there
was one target which used the default output which i put a TODO for
somebody else (somebody who is more on top of the repo) to tackle
**later**.

## Test plan

CI. Also run delivery on this PR (don't land those changes)

---------

Co-authored-by: Noah Santschi-Cooney <noah@santschi-cooney.ch>
2024-08-07 22:21:49 +01:00
Jean-Hadrien Chabran
4591d989a6
chore(local): clear ambiguity in between sg version|live (#64122)
Context: As I was catching up with my Slack notifications, I spotted
this
[conversation](https://sourcegraph.slack.com/archives/C04MYFW01NV/p1721137862832899?thread_ts=1721136881.733869&cid=C04MYFW01NV)
and this PR is a 5m fix to avoid the problem to happen again.

What: If you haven't used `sg` in a while, it's easy to think that `sg
version` refers to the currently deployed Sourcegraph instance and not
the CLI. This commit adds a little preamble on stderr to not mess with
script usage while still reminding the user that it's the CLI version
that gets printed out.

Before: we printed the version without any context
After: we also print the following on stderr: `👉 Showing the current
version of the sg CLI, if you're looking for deployed Sourcegraph
instances version, please use `sg live` instead.`. Stderr so we don't
break things like `$(sg version)`.

Note: at a broader level, we should generalize this pattern, we don't
use too much `sg` raw output in scripts, but for the few places where
it's the case, it's a footgun.

<!-- PR description tips:
https://www.notion.so/sourcegraph/Write-a-good-pull-request-description-610a7fd3e613496eb76f450db5a49b6e
-->

## Test plan

Locally tested + CI. 

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

## Changelog

- `sg version` explicitly mentions that it's the CLI version that's
printed out, not any instance version.

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-08-07 18:34:38 +02:00
Jean-Hadrien Chabran
9f0e1e04b8
chore(local): improve runnable cmds preambles in sg start (#64339)
`sg start ...` commands have a preamble field to inform the user about
various things. Prior to this PR, they were rather easy to miss. Along
the way, I've fixed the printing so if there multiple lines of preamble,
they appear nicely.

This PR addresses that. 


<details><summary>before/after</summary>
<p>
<img
src="https://github.com/user-attachments/assets/22d94ebb-e247-4e4e-8dab-1f502f1e8b46"/>
<img
src="https://github.com/user-attachments/assets/7cbbf41b-a926-4ebd-9f6d-bbdd779cc8b4"/>
</p>
</details> 

## Test plan

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

Locally tested, see before/after.
2024-08-07 15:20:07 +00:00
William Bezuidenhout
61b41814bd
fix(sg): provide suggestions we fail to get local gcp account email address (#64325)
Part of https://github.com/sourcegraph/devx-support/issues/1142

If we fail to get the gcp address, provide steps the user can try to fix
it

![Screenshot 2024-08-07 at 10 14
00](https://github.com/user-attachments/assets/39e6fdcb-ee60-43b8-bdca-d28a9d210b2e)


## Test plan
Tested locally

## Changelog
sg - provide steps a user can follow if we fail to get the local gcp
email address
2024-08-07 14:02:30 +00:00
Bolaji Olajide
2e642bc85e
fix(bazel): surface error message when gazelle cant process glob expression (#64214)
Closes DINF-89

Gazelle sometimes have trouble processing glob expressions, and this
isn't reported as a failure even though it ultimately results in the
`BUILD.bazel` not being correctly updated.

## Test plan

* Manual testing

In `client/web/BUILD.bazel`, add a new `src` to the `web_lib` ts_project
target that includes a glob pattern.

```
...
ts_project(
    name = "web_lib",
    srcs = glob(["!src/playwright/*.spec.ts"]) + [
        "src/Index.tsx",
        "src/LegacyLayout.tsx",
        "src/LegacyRouteContext.tsx",
        "src/LegacySourcegraphWebApp.tsx",
        "src/PageError.tsx",
        "src/SearchQueryStateObserver.tsx",
        "src/SourcegraphWebApp.tsx",
...
```

When you run `go run ./dev/sg bazel configure`, the command should fail
with an error message instead of returning exit 0.

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->

---------

Co-authored-by: Jean-Hadrien Chabran <jean-hadrien.chabran@sourcegraph.com>
2024-08-06 17:37:15 -05:00
Bolaji Olajide
4a5e1e450a
feat(sg): report user os information via analytics (#64280)
Closes DINF-193

![CleanShot 2024-08-05 at 21 28
37@2x](https://github.com/user-attachments/assets/34f121c5-5a85-456c-b12b-2f959573fcae)

OS information is now part of the `sg` analytics metadata.


## Test plan

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

Any `sg` operation now reports the os information.

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-08-06 17:31:50 -05:00
Petri-Johan Last
1cac35b246
Update wolfi hashes (#64289)
Ran `sg wolfi update-hashes`

## Test plan

Hashes updated.

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->

---------

Co-authored-by: William Bezuidenhout <william.bezuidenhout@sourcegraph.com>
2024-08-06 15:54:02 +02:00
Varun Gandhi
38633daef0
chore: Consolidate mocks for uploads's Store type (#64286)
Instead of re-generating and re-compiling the mocks 3 times,
consolidate them into a single storemocks package.

This should also provide better code navigation in the editor.
2024-08-06 10:15:17 +01:00
Petri-Johan Last
44e848d4ba
Enable p4-fusion by default for Perforce code host connections (#64101) 2024-08-02 11:15:16 +02:00
Filip Haftek
e4ebecf205
ephemerals: fix feature flag name (#64237)
Make ephemeral feature flag consistent across sg cli and CloudAPI:
-
[get](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/dev/sg/internal/cloud/instance.go?L193)
is ok
-
[set](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/dev/sg/internal/cloud/instance.go?L206)
was different
- CloudAPI uses now
[this](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/controller/-/blob/cmd/apiserver/api/v1/instance.go?L20)

## Test plan

[e2e against CloudAPI](https://github.com/sourcegraph/cloud/pull/12747)
2024-08-02 10:54:44 +02:00
YK
83f553e1ec
Update the legacy link to sg doc (#64017)
## Test plan

Check each new link manually

---------

Co-authored-by: Bolaji Olajide <25608335+BolajiOlajide@users.noreply.github.com>
2024-08-01 16:18:30 -07:00
Julie Tibshirani
5c5ed6ca27
feat(search): remove smart search logic (#64215)
This change removes the backend smart search logic. After this, searches
with smart search enabled (`sm=1`) will be executed in the default
'precise' mode (`sm=0`). For old searches that use `sm=1` and
`patterntype=standard`, it's possible that they will now return no
results.

Looking at telemetry, only 0.1% of searches on dot com trigger any smart
search rule. So this change should only affect a small percentage of
usage. To mitigate the impact on these rare cases, this PR adds an alert
whenever there are no results and smart search is enabled, suggesting
users switch to keyword search. (This will help in the majority of
cases, since the most frequent smart search rule rewrites literal
queries to use 'AND' between terms).

Closes SPLF-92
2024-08-01 18:02:35 +03:00
Filip Haftek
66be2ddcb6
sg cloud eph: simplify status (#64209)
1. Make `sg cloud eph` instance status Reason simple string, as CloudAPI
will take over and return Reason with job URL - no need to parse Reason
anymore.
```sh
go run ./dev/sg cloud eph status --name ff-eph56
⚠️ Running sg with a dev build, following flags have different default value unless explictly set: skip-auto-update, disable-analytics
 Ephemeral instance "ff-eph56" status retrieved
Ephemeral instance details:
Name                                     Expires In           Instance status                          Details
ff-eph56                                 4h37m4.79031s        unspecified                              creation task is already running: https://console.cloud.google.com/workflows/workflow/us-central1/create-instance-c31bd1a4ea84/executions?project=michael-test-03
```
2. Allow re-run create if CloudAPI returns status with Reason - it means
instance is not fully created yet, so user might re-try create -
CloudAPI will ensure more than one create is not running at the same
time.

3. Updated printers with GOTO action for each instance details:
```sh
go run ./dev/sg cloud eph list --all
⚠️ Running sg with a dev build, following flags have different default value unless explictly set: skip-auto-update, disable-analytics
☁️ Fetched 10 instances
Name                                     Expires In           Instance status                          Details
andre-eph-1                              30h10m42.989163s     unspecified                              invoke: sg cloud eph status --name andre-eph-1
ff-eph56                                 4h34m43.989154s      unspecified                              invoke: sg cloud eph status --name ff-eph56
```

## Test plan

Unit tests simplified.
E2e against old and new CloudAPI.

---------

Co-authored-by: William Bezuidenhout <william.bezuidenhout@sourcegraph.com>
2024-08-01 14:44:03 +02:00
Bolaji Olajide
776701ba9c
fix(sg): acknowledge command execution state to avoid recursion when executing short running commands (#64181)
Some commands like the
[`batcheshelper-builder`](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/sg.config.yaml?L821)
aren't long running commands.
This command is used to build and load an image into docker. The `cmd`
section returns an `exit 0`. This behavior combined with
`continueWatchOnExit` results in an infinite loop where the process is
continually restarted because `sg` doesn't know that the process has
finished executing and isn't a long-running process.


https://github.com/user-attachments/assets/e7a027a1-6f93-403f-9240-6a791255fba9

An example of the behavior is shown below as running `sg start batches`
results in the `batcheshelper-builder` command continually restarted.

The fix is quite simple, we return an empty receiver channel when the
process is done executing so that `sg` knows it's done and doesn't
restart the command unless there's a change.

## Test plan

* Manual testing with `go run ./dev/sg start batches` doesn't result in
an infinite loop anymore.
* Add unit tests

## Changelog
2024-07-31 16:09:44 -05:00
William Bezuidenhout
8a3e4c3bcc
fix(sg): cloud ephemeral - do no trigger builds on main-dry-run (#64190)
Triggering cloud ephemeral builds on main-dry-run leads to unexpected
results which is due to how the eventual pipeline is generated.

Closes DINF-165

### Generated pipeline?
The pipeline gets generated based on _what matches first_. We detect
cloud ephemeral builds if there is an environment variable
`CLOUD_EPHEMERAL=true`. We detect main-dry-runs if the branch prefix is
`main-dry-run`...

Now due to the `main-dry-run` match happening before the cloud ephemeral
match a Cloud Ephemeral build on a main dry run gets detected as _just_
a `main-dry-run` build.

#### Alternatives
Sure we can just move the Cloud Ephemeral match earlier, but it's
difficult to say what else might break. We could also just add the we
force the runtype to always be `CloudEphemeral` if we're on the Cloud
Ephemeral pipeline, but I don't want to make the pipline a special
snowflake and detect the current pipeline just for Cloud Ephemeral.

#### Why deny it the deployment?
Ultimately, `main-dry-run` builds are meant for ... `main` not cloud
ephemeral. People can just switch to their original branch and run `sg
cloud eph deploy` and the branch will be deployed with no issue

## Test plan
Executed locally
```
./sg-test cloud eph build
⚠️ Running sg with a dev build, following flags have different default value unless explictly set: skip-auto-update, disable-analytics
⚠️ Triggering Cloud Ephemeral builds from "main-dry-run" branches are not supported. Try renaming the branch to not have the "main-dry-run" prefix as it complicates the eventual pipeline that gets generated

  To rename a branch and launch a cloud ephemeral deployment do:

  1.  git branch -m "main-dry-run/lol" <my-new-name>
  2.  git push --set-upstream origin <my-new-name>
  3. trigger the build by running  sg cloud ephemeral build
  FAQ https://www.notion.so/sourcegraph/How-to-deploy-my-branch-on-an-ephemeral-Cloud-instance-dac45846ca2a4e018c802aba37cf6465?pvs=4#20cb92ae27464891a9d03650b4d67cee


 failed to trigger epehemeral build for branch: main-dry-run branch is not supported
```

## Changelog
* sg: deny deployment of `main-dry-run` branches on Cloud Ephemeral.
2024-07-31 16:16:29 +02:00
Noah S-C
1538e42180
chore(bazel): emit json profile for image push jobs (properly) (#64189)
Typo when copying the flags from somewhere else, names mismatched and
didnt upload 🤦

Also adding in proper BEP emitting, it appears the build_event_log.bin
that was being output was actually for the honeyvent bazel invocation

## Test plan

CI main dry-run
https://buildkite.com/sourcegraph/sourcegraph/builds/285375

## Changelog
2024-07-31 13:46:15 +01:00
Noah S-C
6d3e4a5b74
chore(bazel): emit json profile for image push jobs (#64188)
For more insights into whats happening during those damn build commands

Also removes emitting to honeycomb, that was my experiment that has
concluded.

## Test plan

CI

## Changelog
2024-07-31 12:11:54 +00:00
Varun Gandhi
8f2479edd2
feat: Add support for precise usagesForSymbol (#64126)
This patch wires up the newly changed APIs in #64118 
to the GraphQL API, enabling precise support in the
usagesForSymbol API. It also handles pagination.

Fixes https://linear.app/sourcegraph/issue/GRAPH-573

## Test plan

Manually tested. Will add automated tests in follow-up PR.

## Changelog

- Adds support for precise code navigation to the experimental
`usagesForSymbol` API, which can be used to implement a
  reference panel or similar functionality.
2024-07-31 13:55:07 +08:00
Erik Seliger
c4c375a642
chore: Move authn into cmd/frontend (#63648)
They should not be used outside of cmd/frontend, so making it a frontend
internal package.

While doing that, I realized that there is a coupling dependency between
authz providers and auth (which is authN) providers: GitLab code host
connections can do authz mapping via the usernames of another OIDC or
SAML auth provider
(https://sourcegraph.com/docs/admin/code_hosts/gitlab#administrator-sudo-level-access-token).
It turns out this feature does not work anymore, since at least several
releases, because we don't actually instantiate auth providers outside
of `cmd/frontend` and thus the mapping will never find anything (auth
providers don't explode when queried before init, unlike authz).
This only now became clear as I moved this code, and the dependency
graph was broken, so that's a nice property of these cleanups I guess 😬
Since it doesn't seem to work for quite some time, I opted for removing
it, and added a changelog entry about it. Not sure if that is
sufficient, I raised a thread here:
https://sourcegraph.slack.com/archives/C03K05FCRFH/p1721848436473209.
This would've prevented this change and needed more refactoring as
unfortunately we cannot map an auth provider by the conf type to a
record in the `user_external_accounts` table and need to actually
instantiate it.

Test plan: Compiler doesn't complain, tests still pass.

## Changelog

GitLab code host connections were [able to sync permissions by mapping
Sourcegraph users to GitLab users via the username property of an
external OIDC or SAML
provider](https://sourcegraph.com/docs/admin/code_hosts/gitlab#administrator-sudo-level-access-token)
that is shared across Sourcegraph and GitLab. This integration stopped
working a long time ago, and it has been removed in this release.
2024-07-31 03:26:25 +02:00
Erik Seliger
38b79fbb2f
authz: Compute providers on the fly (#64012)
Previously, we would store authz providers globally and refresh them
every now and then.
However, creating the providers is fairly cheap (1.3ms in a local trace)
so we should not keep them in memory and remember to not forget to start
the watcher routine.

This will help for multi-tenant Sourcegraph in that providers are now
computed for the context in question, and not held globally. Keeping
potentially 100k authz providers in memory will not scale.

Test plan: Still works, local Jaeger traces are quite acceptable.
2024-07-31 02:59:41 +02:00
Erik Seliger
c917330d6b
authz: Drop requirement for installing authz providers in every service (#63743)
This is a register call that is easy to forget. When forgotten, all queries against the repo store will block forever.

In addition, this adds a hard-dependency on conf to every services startup, plus a busy loop. With multi-tenant, this will not work great because authz providers would be a global, and we instead want most things to be ephemeral so they're per-provider. This is a step toward that, but doesn't yet remove the providers global variable.

Good news, it turns out that we don't actually need to register the providers in every service! The reason they were required was to check if zero providers are configured, or if authzbypass mode is enabled.

Authz bypass mode is usually ON, except when there are problems with the authz providers, meaning some authz providers might not be able to sync permissions. Bypassing of permissions is only ever happening if there are ALSO zero providers configured.

So this is basically an optimization for the case where an instance has zero authz configured so that the SQL queries are a bit simpler. This also helps in tests because with bypass mode on and no providers configured, authz enforcement is effectively off in the repo store.
This makes it so that in tests we need to do slightly more work, but also makes for a more realistic test vs at runtime setup. Also, it's highly recommended to use mocks for DB wherever possible in more high-level components to keep tests fast.

To never have a scenario where we accidentally mess up here and enable bypass mode erroneously, this PR drops that entirely. Authz is always enforced, but when a code host connection is unrestricted (i.e., will not spawn a provider) the repos are still visible, so this should be no change over before.

## Test plan

The stack starts and works, and all CI tests are still passing. Code review should help as well.
2024-07-31 01:23:34 +02:00
Noah S-C
adef82f9ed
feat(bazel): read binary version info from accompanying files in OCI images instead of stamping //internal/version (#63977)
https://linear.app/sourcegraph/issue/DINF-111/rework-how-we-inject-version-in-our-artifacts

Pros:
- saves having to rebuild `bazel query 'kind("go_library", rdeps(//...,
//internal/version))' | wc -l` == 523 Go packages when stamp variables
cause a rebuild
- Cutting out GoLink action time when stamp changes but code is cached

Cons:
- Binaries themselves are no longer stamped, only knowing their version
info within the context of the docker image
- A tad extra complexity in internal/version/version.go to handle this
new divergence

---

Before:
```
$ bazel aquery --output=summary --include_commandline=false --include_artifacts=false --include_aspects=false --stamp 'inputs(".*volatile-status\.txt", //...)'

  Action: 1
  Genrule: 2
  Rustc: 3
  ConvertStatusToJson: 88
  GoLink: 383
```

After:
```
$ bazel aquery --output=summary --include_commandline=false --include_artifacts=false --include_aspects=false --stamp 'inputs(".*volatile-status\.txt", //...)'

Mnemonics:
  Genrule: 2
  Action: 3
  Rustc: 3
  ConvertStatusToJson: 86
```

## Test plan

Lots of building & rebuilding with stamp flags, comparing execution logs
& times

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-30 20:52:01 +00:00
Jean-Hadrien Chabran
7b0f478d6f
chore(ci): pass --profile to bazel-do jobs (#64148)
Follow-up to [this
comment](https://github.com/sourcegraph/sourcegraph/pull/63910#discussion_r1683190713)
where the need was raised for having profiles for further inspection of
problematic targets when run in isolation.

Basically, every bazel-do will now collect the profile, and it'll be
uploaded as a job artifact.

## Test plan

See https://buildkite.com/sourcegraph/sourcegraph/builds/284913 for a
test run.

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-30 08:01:27 -05:00
Jean-Hadrien Chabran
bc4acd1fbd
feat(local): sg tail (#64146)
This PR brings back https://github.com/sourcegraph/sgtail back in `sg`,
plus a few adjustments to make it easier to use. I'll archive that repo
once this PR lands.

@camdencheek mentioned you here as you've been the most recent beta
tester, it's more an FYI than a request for a review, though it's
welcome if you want to spend a bit of time reading this.

Closes DINF-155

## Test plan

Locally tested + new unit test + CI

## Changelog

- Adds a new `sg tail` command that provides a better UI to tail and
filter log messages from `sg start --tail`.
2024-07-30 14:03:27 +02:00
William Bezuidenhout
9898262143
ci: automatic retry push images job at least 1 (#64145)
Closes DINF-154

## Test plan
CI

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-30 09:32:03 +01:00
Varun Gandhi
3f0a85219c
chore: Move codenav types to lower-level package (#64141)
For the implementation of precise usagesForSymbol, I need to be
able to access some of these types in the codenav package directly, so move
a bunch of types there to avoid an import cycle: codenav -> resolvers -> codenav.
2024-07-30 12:25:11 +08:00
Noah S-C
878931fceb
chore(ci): emit execlog for image push jobs (#64130)
So we can dig into why stuff is being built

## Test plan

CI

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-29 14:08:10 +00:00
William Bezuidenhout
4f5793473f
chore(sg): show cloud ephemeral faq (#64127)
* show a link to the FAQ on certain errors
* add FAQ command to open the FAQ page

Closes  DINF-150
<!-- PR description tips:
https://www.notion.so/sourcegraph/Write-a-good-pull-request-description-610a7fd3e613496eb76f450db5a49b6e
-->

## Test plan
Locally
```
⚠️ Triggering Cloud Ephemeral builds from "main" is not supported.

  Alternatively, if you still want to deploy "main" you can do:

  1. create a new branch off main by running  git switch <branch-name>
  2. push the branch to the remote by running  git push -u origin <branch-name>
  3. trigger the build by running  sg cloud ephemeral build

  FAQ https://www.notion.so/sourcegraph/How-to-deploy-my-branch-on-an-ephemeral-Cloud-instance-dac45846ca2a4e018c802aba37cf6465?pvs=4#20cb92ae27464891a9d03650b4d67cee
```

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-29 15:58:51 +02:00
Noah S-C
51cf4dcba8
fix(ci): reduce push_all concurrency even further due to ratelimits (#64111)
😢 

## Test plan

CI

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-26 19:13:27 +01:00
James Cotter
d2dd9ac454
msp/deploy: remove old author variable (#64107)
Leftover that somehow slipped through 🤦🏻 

## Test plan
CI
<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->
2024-07-26 16:56:53 +01:00
James Cotter
20664df7fc
msp/deploy: use BUILDKITE_BUILD_CREATOR as fallback (#64104)
If a build is triggered from the web the variable BUILDKITE_BUILD_AUTHOR
is not set which the msp_deploy.sh script requires. This PR uses
BUILDKITE_BUILD_CREATOR as a fallback if _AUTHOR is missing

## Test plan
Tested locally
2024-07-26 15:51:09 +01:00
Noah S-C
59a0d15eab
fix(ci): reduce push_all concurrency due to ratelimits (#64106)
<!-- PR description tips:
https://www.notion.so/sourcegraph/Write-a-good-pull-request-description-610a7fd3e613496eb76f450db5a49b6e
-->

## Test plan

CI

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-26 14:44:23 +00:00
Varun Gandhi
6d981c60ad
chore: Update main occurrence extraction code to allow for symbol-based matching (#64082)
At the heart of the loop for extracting usages across a Sourcegraph
instance is the `extractLocationsFromPosition` function, which
extracts related symbols and source ranges from a single SCIP
Document. (Source ranges for returning to the user directly,
and related symbols to do further lookups, e.g. in the case
of inheritance.)

Since we want to perform matching based on symbol names in the upcoming
precise usagesForSymbol API, and also return symbol names for each
associated source range, this function needs to be updated to:
1. Be able to take a symbol name for doing lookups. This is done using
    the new `FindUsagesKey` type which allows two cases - position-based and
    symbol-based.
2. Be able to return symbol names associated with every source range.
    This is done by creating a new `UsageBuilder` type which somewhat subsumes
    the `Location` type. We avoid copying the same 'UploadID' and 'Path'
    fields eagerly for clarity; that will be handled by callers in the future when
    they mix `UsageBuilder` values across different Documents (by first calling `build`).

For the above, I've introduced a new func `extractRelatedUsagesAndSymbolNames`,
and `extractLocationsFromPosition` delegates to that. In the future,
`extractLocationsFromPosition` will be removed.
2024-07-26 18:28:43 +08:00
Noah S-C
1069817b5b
chore(bazel): rework push_all to improve concurrency by avoiding bazel server lock (round 2) (#64079)
Second attempt at https://github.com/sourcegraph/sourcegraph/pull/64044,
now that rate limit is set right. So lets boost the concurrency to all
cores!

## Test plan

main dry-run
https://buildkite.com/sourcegraph/sourcegraph/builds/284268#0190e9cf-b902-4f7c-a1ad-fca8700b8fa0

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-25 12:59:43 +00:00
Varun Gandhi
cadb6d8e70
chore: Unify LsifStore.*SymbolUsages APIs into one (#64076)
For precise usagesForSymbols, we want to propagate usages everywhere
(with associated symbol names, not just 'Location' values). This PR
introduces the new Usage type, and unifies the old GetBulkSymbolUsages and
GetMinimalBulkSymbolUsages APIs into a single GetSymbolUsages API.

We convert the Usage values to Location to avoid changing a lot of code
at once.

We also change the DB query to do grouping and aggregation for us
instead of doing it in Go code.

---------

Co-authored-by: Christoph Hegemann <christoph.hegemann@sourcegraph.com>
2024-07-25 20:45:47 +08:00
YK
09bd207693
Update the outdated link to #dev-experience to #discuss-dev-infra (#64018)
## Test plan

Test each link manually.

---------

Co-authored-by: Bolaji Olajide <25608335+BolajiOlajide@users.noreply.github.com>
2024-07-25 06:58:22 -05:00
Bolaji Olajide
20b858f6c3
fix(build-tracker): Failed back-compat doesn't count towards branch-locking quota (#63911)
Closes
[DINF-51](https://linear.app/sourcegraph/issue/DINF-51/failed-back-compat-doesnt-count-towards-branch-locking-quota)

## Context

If a back-compat step on main fails, the build is marked as having
failed. However, we don't treat that as a failure in build-tracker,
resulting in no #buildkite-main post and not counting towards failed
build quota for locking main.

The reason why this was happening is that the Backcompat build wasn't
linked to the main Sourcegraph build in anyway. However, when a
backcompat fails the main build reflects the status of this failure, but
we do not use this field when determining the status of a build, so it
doesn't work for our use case.

![CleanShot 2024-07-18 at 15 04
15@2x](https://github.com/user-attachments/assets/9553330a-ad98-45cc-b4ce-03a22ca1b99d)

We [instead do a walkthrough of all the jobs associated with a build to
figure
out](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/dev/build-tracker/main.go?L349-372)
if the build has failed, fixed or is passing.

With this logic, it means we have to link the steps from child builds
that a particular build triggers to it's parent.

## Test plan

* Create a build that'll have backcompat failing
* The build tracker event associated with the main build will be
reported with a state of failed to buildkite.

![CleanShot 2024-07-18 at 15 10
45@2x](https://github.com/user-attachments/assets/1bf503ab-0020-47bf-9512-b3a9ee5d4e36)


## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-25 06:45:09 -05:00
Noah S-C
c016ce08c1
Revert "chore(bazel): rework push_all to improve concurrency by avoiding bazel server lock" (#64051)
Reverts sourcegraph/sourcegraph#64044

Dockerhub cant handle it and keeps ratelimiting us

## Test plan

CI
2024-07-24 19:33:21 +00:00
William Bezuidenhout
0309564f93
ci: make internal+promote release higher priority in runtypes (#64049)
With the https://github.com/sourcegraph/sourcegraph/pull/63985/files
PatchRelease is matched before InternalRelease leading to the wrong
build being generated.

We therefore move the Promote and Internal Release runtypes higher in
priority so that they get matched first.

## Test plan
```
export RELEASE_INTERNAL=true
export VERSION="5.5.2463"
go run ./dev/sg ci preview
```
👇🏼 
```
go run ./dev/sg ci preview
⚠️ Running sg with a dev build, following flags have different default value unless explictly set: skip-auto-update, disable-analytics
If the current branch were to be pushed, the following pipeline would be run:
  Parsed diff:
  changed files: [WORKSPACE client/web-sveltekit/BUILD.bazel client/web-sveltekit/playwright.config.ts client/web-sveltekit/src/lib/navigation/GlobalHeader.svelte client/web-
  sveltekit/src/routes/[...repo=reporev]/(validrev)/(code)/page.spec.ts client/web/src/cody/chat/new-chat/NewCodyChatPage.tsx client/web/src/cody/sidebar/new-cody-sidebar/NewCodySidebar.tsx
  client/web/src/cody/sidebar/new-cody-sidebar/NewCodySidebarWebChat.tsx client/web/src/enterprise/batches/settings/AddCredentialModal.tsx
  client/web/src/enterprise/batches/settings/BatchChangesCreateGitHubAppPage.tsx client/web/src/repo/blame/hooks.ts client/web/src/repo/blame/shared.ts cmd/frontend/auth/user.go
  cmd/frontend/auth/user_test.go cmd/frontend/internal/codycontext/context.go cmd/frontend/internal/codycontext/context_test.go deps.bzl dev/ci/push_all.sh dev/ci/runtype/runtype.go go.mod go.sum
  internal/codeintel/uploads/BUILD.bazel internal/codeintel/uploads/internal/background/backfiller/BUILD.bazel internal/codeintel/uploads/internal/background/backfiller/mocks_test.go
  internal/codeintel/uploads/internal/background/commitgraph/BUILD.bazel internal/codeintel/uploads/internal/background/commitgraph/job_commitgraph.go
  internal/codeintel/uploads/internal/background/expirer/BUILD.bazel internal/codeintel/uploads/internal/background/expirer/mocks_test.go
  internal/codeintel/uploads/internal/background/processor/BUILD.bazel internal/codeintel/uploads/internal/background/processor/mocks_test.go internal/codeintel/uploads/internal/store/BUILD.bazel
  internal/codeintel/uploads/internal/store/commitdate.go internal/codeintel/uploads/internal/store/commitdate_test.go internal/codeintel/uploads/internal/store/observability.go
  internal/codeintel/uploads/internal/store/store.go internal/codeintel/uploads/mocks_test.go internal/database/migration/shared/data/cmd/generator/consts.go
  internal/database/migration/shared/data/stitched-migration-graph.json package.json pnpm-lock.yaml schema/schema.go schema/site.schema.json]
  diff changes: "Go, Client, pnpm, Docs, Shell"
  The generated build pipeline will now follow, see you next time!

  • Detected run type: Internal release
  • Detected diffs: Go, Client, pnpm, Docs, Shell
  • Computed variables:
    • VERSION=5.5.2463
  • Computed build steps:
    • Aspect Workflow specific steps
      • 🤖 Generated steps that include Buildifier, Gazelle, Test and Integration/E2E tests
    • Image builds
      • :bazel::packer: 🚧 Build executor image
    • :bazel: Bazel prechecks & build  sg
    • :bazel: BackCompat Tests
    • :bazel:🧹 Go mod tidy
    • Linters and static analysis
      • 🍍:lint-roller: Run sg lint → depends on bazel-prechecks
    • Client checks
      • :java: Build (client/jetbrains)
      • :vscode: Tests for VS Code extension
      • :stylelint: Stylelint (all)
    • Security Scanning
      • Semgrep SAST Scan
    • Publish candidate images
      • :bazel::docker: Push candidate Images
    • End-to-end tests
      • :bazel::docker::packer: Executors E2E → depends on bazel-push-images-candidate
    • Publish images
      • :bazel::packer:  Publish executor image → depends on executor-vm-image:candidate
      • :bazel:⤴️ Publish executor binary
      • :bazel::docker: Push final images → depends on main::test main::test_2
    • Release
      • Release tests → depends on bazel-push-images
      • Finalize internal release

```
<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-24 18:59:58 +00:00
Noah S-C
14123fcc42
chore(bazel): rework push_all to improve concurrency by avoiding bazel server lock (#64044)
This PR is a second attempt at improving push_all.sh, continuing on from
(and inspired by) https://github.com/sourcegraph/sourcegraph/pull/63391.
As a recap, that PR uses
[--script_path](https://bazel.build/reference/command-line-reference#flag--script_path)
to emit a short bash script for every `oci_push` target, which
essentially does minor setup + invokes the executable as if running
`bazel run`.

While the idea in https://github.com/sourcegraph/sourcegraph/pull/63391
was good, it trades concurrent server locking with an equal amount of
overhead in sequentially building the scripts. By observing the
scripts<b>[1]</b> that it would emit, we can notice a few things:
- The path
`/home/noah/.cache/bazel/_bazel_noah/8fd1d20666a46767e7f29541678514a0/execroot/__main__/bazel-out/k8-fastbuild/bin/`
shows up twice, which is the same path that `./bazel-bin` points at
- The script only `cd`'s to a path, unsets some environment variables,
and then executes the underlying script of the target.

The path can be observed to be a combination of bazel-bin, the target's
package (`//cmd/batcheshelper` in this case), as well as the target with
some extra static strings (`candidate_push` with `push_` prefix and
`.sh{,.runfiles}` suffixes for the script & its runfiles respectively).
Knowing this, and assuming that this is reliably so, we can opt to
recreate this manually instead, saving on the hefty overhead of `bazel
run --script_path`.

The current average times for `Push candidate images` and `Push final
images` are ~7m50s and ~8m30s respectively. While the example
main-dry-run build
[here](https://buildkite.com/sourcegraph/sourcegraph/builds/284041#0190e54a-9aaa-471a-81bf-623fce6ffa45)
isnt fully representative of how much rebuilding is required, it sets a
pretty solid 3m20s baseline.

Note this may break with rules_oci changes, but imo thats a small and
very infrequent cost to pay for cleaner log output + shaving a good
piece of time off.

<details><summary><b>[1]</b> A <code>--script_path</code>
example</summary>

```
#!/nix/store/mqc7dqwp046lh41dhs7r7q7192zbliwd-bash/bin/bash
cd /home/noah/.cache/bazel/_bazel_noah/8fd1d20666a46767e7f29541678514a0/execroot/__main__/bazel-out/k8-fastbuild/bin/cmd/batcheshelper/push_candidate_push.sh.runfiles/__main__ && \
  exec env \
    -u JAVA_RUNFILES \
    -u RUNFILES_DIR \
    -u RUNFILES_MANIFEST_FILE \
    -u RUNFILES_MANIFEST_ONLY \
    -u TEST_SRCDIR \
    BUILD_WORKING_DIRECTORY=/home/noah/Sourcegraph/sourcegraph \
    BUILD_WORKSPACE_DIRECTORY=/home/noah/Sourcegraph/sourcegraph \
  /home/noah/.cache/bazel/_bazel_noah/8fd1d20666a46767e7f29541678514a0/execroot/__main__/bazel-out/k8-fastbuild/bin/cmd/batcheshelper/push_candidate_push.sh "$@"
```

</details> 

## Test plan

Observe a `sg ci build main-dry-run`
[here](https://buildkite.com/sourcegraph/sourcegraph/builds/284041#0190e54a-9aaa-471a-81bf-623fce6ffa45).

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-24 16:55:09 +01:00
Varun Gandhi
dc7da57edb
chore: Make location fetching queries more uniform (#64026)
This patch changes the location querying code so that:
1. We're populating structures corresponding to SCIP instead of LSIF
   (with "scheme" and "identifier" inside "MonikerData")
2. Avoid repeatedly allocating a constant string 'scip' for the scheme
    only to throw it away later.
3. Makes the two queries and their scanning code more similar for easier
    comparison. When I land precise usagesForSymbol, I will de-duplicate
    some of the scanning code between these two queries.

I have avoided renaming all of the local variables to avoid creating
more noise.

## Test plan

Covered by existing tests.
2024-07-24 11:14:22 +02:00
Will Dollman
9dd901f3c9
Integrate security release approval into release pipeline (#63990)
As part of the [Vuln Scanning
Improvements](https://linear.app/sourcegraph/project/[p0]-vulnerability-scanning-improvements-75299c4312dd/issues)
project, I've been working on tooling to automate the security approval
step of the release process.

This PR integrates these improvements into the release pipeline:

* Internal releases will run a vulnerability scan
* Promote-to-public releases will check for security approval

If a public release does not have security approval, it will block the
promotion process. The step happens at the start of the pipeline so
should be a fast-fail. You can also check for release approval before
running promotion by running `@secbot cve approve-release <version>` in
the #secbot-commands channel. In an ideal world we (security) will have
already gone through and approved ahead of release.

I've tested this PR as much as I can without running an actual release!
We have a 5.5.x release tomorrow so it'll be a good test. If it does
cause problems that can't be easily solved, it can always be temporarily
disabled.

I've tagged this PR to be backported to `5.5.x`.

<!-- PR description tips:
https://www.notion.so/sourcegraph/Write-a-good-pull-request-description-610a7fd3e613496eb76f450db5a49b6e
-->

## Pre-merge checklist

- [x] Revert commit that disables release promotion

## Test plan

Manual testing of the release process:
- [x] [Successful test
run](https://buildkite.com/sourcegraph/sourcegraph/builds/283774#0190dfd6-fa70-4cea-9711-f5b8493c7714)
that shows the security scan being triggered
- [x] [Promote to public test
run](https://buildkite.com/sourcegraph/sourcegraph/builds/283826) that
shows the security approval approving a release
- [x] [Promote to public test
run](https://buildkite.com/sourcegraph/sourcegraph/builds/283817#0190e0ec-0641-4451-b7c7-171e664a3127)
that shows the security approval rejecting a release with un-accepted
CVEs

<!-- REQUIRED; info at
https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles
-->

## Changelog

<!-- OPTIONAL; info at
https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c
-->
2024-07-24 09:19:49 +01:00