Integrate gkernelci into every gentoo/gentoo pull request

[juippis]

Hey,

it'd be nice to have on-demand build-test from gkernelci to gentoo/gentoo pull requests. Here's the summary I wrote for an idea:

Getting a tinderbox to test our Github pull requests, that the contributions
build. Print or link all build output to Github PR. This'd work on-demand,
either by manually launching it from a shell, or even better, with Github
hooks. Using Github hooks I could imagine there to be "build" label which then
launches the process on a tinderbox, and update it to "build finished" when
done.

(Although I'd like a shell/vnc access for runtime testing)

Full text with a conrecte implementation idea can be found from:
https://dev.gentoo.org/~juippis/tmp/automated_pull_request_buildbot.txt

For me, it'd be important this worked on-demand so that people can't troll us with 100 chromium PRs wasting CPU cycles automatically. And ideally we'd launch the build test after checking that the contributed ebuild, etc are fine, and don't download anything from any fishy URLs.

[aliceinwire]

For me, it'd be important this worked on-demand so that people can't troll us with 100 chromium PRs wasting CPU cycles automatically. And ideally we'd launch the build test after checking that the contributed ebuild, etc are fine, and don't download anything from any fishy URLs.

I like this.
what kind of security do you think are needed for the "on-demand" part.
I could check a comment on the pr for example "build test" for starting manual pr test and maybe we could try to check if the person who wrote the comment is part of the github/gentoo organization.

[juippis]

We could manually add a tag, "build please" or something ("initiate build"), and then depending on the result the hook would update it to "build passed" or "build failed". That'd allow us to browse PRs based on tags, too, on Github.

Only people part of github/gentoo organization are capable of adding tags manually, so that shouldn't be a problem.

[aliceinwire]

I currently enabled pull request for sys-kernel/ as test
I'm also trying to implement gkernelci label for force gkernelci testing
https://github.com/gentoo/gentoo/labels/gkernelci
I could check that I can get the label added event in GKernelCI

[aliceinwire]

skipping tags as been introduced by this buildbot pull request
https://github.com/buildbot/buildbot/pull/3443/files

[jessesimpson36]

I'm thinking this issue would be a good next-step for getting extra visibility on gkernelci. If you have to remember to go to gkernelci.gentoo.org to view the build status's or if you have to join an IRC channel to see if builds pass or fail, then people will forget to do that.

Ideally, I think when version bumps to sys-kernel/gentoo-sources come in, that should trigger a build. But also okay with a label triggering some sort of action.

[aliceinwire]

we had this system in place until we loose access to github.com/gentoo with webhook until the github.com/gentoo got hacked (https://itsfoss.com/github-gentoo-hacked/) and infra started to set restrictions to the gentoo github organization

[jessesimpson36]

Oh wow. I completely missed the news for that. might've been before I was using Gentoo (article dated for 2018). I can imagine they might be pretty hesitant to give out permissions because of that.

[aliceinwire]

yep