From 5fc22f27cfcdb7b99dc32880569c290a8e9391a8 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Mon, 3 Apr 2023 09:23:17 -0700
Subject: [PATCH] Require function = NoBlock to be set on Gerrit labels

A recent change to the openstack/releases ACLs pointed out that we don't
require function to be set on Gerrit label definitions. This would
result in the Gerrit default of MaxWithBlock which will interfere with
submit requirements.

Enforce that function is set and that the value is NoBlock via our
normalize script. This will add function = NoBlock entries to the file
if not set which results in a diff causing the test to fail.

In order to do this I refactored the submit-requirements and function
checking of the normalize script a bit. We now check the label section
independently of all other sections which allows us to reduce repetition
when dealing with label sections.

Change-Id: I9e83c1cde3fe20ea2c34cdf86cd2fd3006bfe62a
---
 tools/normalize_acl.py | 51 ++++++++++++++++++++++++++----------------
 1 file changed, 32 insertions(+), 19 deletions(-)

diff --git a/tools/normalize_acl.py b/tools/normalize_acl.py
index d59ac5c297..5b75c9e349 100755
--- a/tools/normalize_acl.py
+++ b/tools/normalize_acl.py
@@ -56,6 +56,17 @@ def tokens(data):
     return data
 
 
+def normalize_boolean_ops(key, value):
+    # Gerrit 3.6 takes lower-case "and/or" literally -- as in
+    # you literally need to have and/or in the commit string.
+    # Gerrit 3.7 fixes this, but let's standarise on capital
+    # booleans
+    if key in ('copyCondition', 'submittableIf', 'applicableIf'):
+        value = value.replace(' and ', ' AND ')
+        value = value.replace(' or ', ' OR ')
+    return "%s = %s" % (key, value)
+
+
 acl = {}
 out = ''
 
@@ -227,6 +238,7 @@ if '8' in transformations:
 if '9' in transformations:
     missing_sr = {}
     for section in acl.keys():
+        newsection = []
         if section.startswith("label "):
             label_name = section.split(' ')[1]
             sr_found = False
@@ -239,26 +251,27 @@ if '9' in transformations:
                        % label_name)
                 missing_sr['submit-requirement %s' % label_name] = [msg]
 
-        # Insert an inline comment if the ACL uses an invalid function
-        newsection = []
-        for option in acl[section]:
-            key, value = [x.strip() for x in option.split('=', 1)]
-            if key == 'function':
-                if value != 'NoBlock':
-                    newsection.append(
-                        '# XXX: The only supported function type is NoBlock')
+            keys = []
+            for option in acl[section]:
+                key, value = [x.strip() for x in option.split('=', 1)]
+                keys.append(key)
+                # Insert an inline comment if the ACL uses an invalid function
+                if key == 'function':
+                    if value != 'NoBlock':
+                        newsection.append(
+                            '# XXX: The only supported function type is '
+                            'NoBlock')
+                newsection.append(normalize_boolean_ops(key, value))
+            # Add function = NoBlock to label sections if not set as the
+            # default is MaxWithBlock which will interfere with submit
+            # requirements.
+            if 'function' not in keys:
+                newsection.append('function = NoBlock')
+        else:
+            for option in acl[section]:
+                key, value = [x.strip() for x in option.split('=', 1)]
+                newsection.append(normalize_boolean_ops(key, value))
 
-            # Gerrit 3.6 takes lower-case "and/or" literally -- as in
-            # you literally need to have and/or in the commit string.
-            # Gerrit 3.7 fixes this, but let's standarise on capital
-            # booleans
-            if key in ('copyCondition', 'submittableIf', 'applicableIf'):
-                value = value.replace(' and ', ' AND ')
-                value = value.replace(' or ', ' OR ')
-                newsection.append("%s = %s" % (key, value))
-                continue
-
-            newsection.append(option)
         acl[section] = newsection
     acl.update(missing_sr)