[ACS-1526] Fail on Draft and unapproved PRs (#6963)

* [ACS-1526] Fail on Draft and unapproved PRs

* [ci:force]

scripts/ci/job_hooks/before_install.sh

@@ -15,14 +15,17 @@ export GIT_HASH=`git rev-parse HEAD`
 export NODE_OPTIONS="--max_old_space_size=30000"
 
 # Settings for Nx ---------------------------------------------------------------------
-export BASE_HASH="$(git merge-base origin/$BRANCH_NAME HEAD)"
+export BASE_HASH="$(git merge-base origin/$TRAVIS_BRANCH HEAD)"
 export HEAD_HASH="HEAD"
+export HEAD_COMMIT_HASH=${TRAVIS_PULL_REQUEST_SHA:-${TRAVIS_COMMIT}}
+export COMMIT_MESSAGE=`git log --format=%B -n 1 $HEAD_COMMIT_HASH`
 
 if [ "${TRAVIS_EVENT_TYPE}" == "push" ]; then
     echo "push"
 elif [ "${TRAVIS_EVENT_TYPE}" == "pull_request" ]; then
     echo "pull_request"
     export BASE_HASH="origin/$TRAVIS_BRANCH"
+    source $PARENT_DIR/partials/_ci-flags-parser.sh
 elif [ "${TRAVIS_EVENT_TYPE}" == "cron" ]; then
     echo "cron"
 else

scripts/ci/jobs/dbpci-build-guard-check

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+EXIT_STATUS_DRAFT=0
+EXIT_STATUS_APPROVAL=0
+PR_NUMBER=null
+
+if [ "${CI_FORCE_RUN}" == "true" ]; then
+    echo -e "\e[32mWarning: CI_FORCE_RUN has been set to true, CI run will continue.\e[0m"
+    exit 0;
+fi
+
+APPROVAL_CHECK=true
+VERBOSE=false
+for var in "$@"
+do
+    case "$var" in
+      --no-approval-check) APPROVAL_CHECK=false;;
+      --verbose) VERBOSE=true;;
+      *) PR_NUMBER=$var
+    esac
+done
+
+echo -e "\e[33mFetching data from Github APi for PR: $PR_NUMBER\e[0m"
+
+PR_DATA=`curl \
+    -H "Accept: application/vnd.github.v3+json" -H "Authorization: token ${GITHUB_TOKEN}" \
+    https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${PR_NUMBER}`
+DRAFT=`echo ${PR_DATA} | jq .draft`
+
+if [ "${DRAFT}" == "false" ]; then
+    echo -e "\e[32mPR is NOT DRAFT anymore, build can proceed.\e[0m"
+else
+    echo -e "\e[31mPR is DRAFT, build will stop.\e[0m"
+    EXIT_STATUS_DRAFT=1
+fi
+
+if [ "$APPROVAL_CHECK" == "true" ]; then
+    PR_REVIEW_DATA=`curl \
+        -H "Accept: application/vnd.github.v3+json" -H "Authorization: token ${GITHUB_TOKEN}" \
+        https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${PR_NUMBER}/reviews?per_page=100`
+    APPROVED=`echo ${PR_REVIEW_DATA} | jq 'map(select(.state == "APPROVED")) | any'`
+
+    if [ "${APPROVED}" == "true" ]; then
+        echo -e "\e[32mPR is approved, build can proceed.\e[0m"
+    else
+        echo -e "\e[31mPR is NOT APPROVED yet, build will stop.\e[0m"
+        EXIT_STATUS_APPROVAL=1
+
+    fi
+fi
+
+[[ "$VERBOSE" == "true" ]] && echo $PR_DATA | jq
+[[ "$VERBOSE" == "true" ]] && echo $PR_REVIEW_DATA | jq
+
+EXIT_CODE=$(( $EXIT_STATUS_DRAFT + $EXIT_STATUS_APPROVAL ))
+exit $EXIT_CODE

scripts/ci/partials/_ci-flags-parser.sh

@@ -0,0 +1,23 @@
+# Note no #!/bin/sh as this should not spawn
+# an extra shell, since this partial shell script
+# is supposed to be invoked as part of another.
+
+# ===========================================================================
+# Flag for overwrite the affected projects calculation
+# ===========================================================================
+# Usage:
+# This flag is intended to be used only for debugging purposes!!!
+#
+# To run only a few projects, provide a valid list of comma separated projects
+# git commit -m "[affected:project-name1,project-name2] you commit message"
+#
+
+# ---------------------------------------------------------------
+# Forced CI run
+# ---------------------------------------------------------------
+if [[ $COMMIT_MESSAGE == *"[ci:force]"* ]]; then
+    echo -e "\e[31mWarning: CI build is going to run regardless of its Draft and approval status. You must be a Jedi!\e[0m"
+    export CI_FORCE_RUN=true
+else
+    export CI_FORCE_RUN=false
+fi