ci: add jjbb jobs and utility script (#205)

Add the definition for the pull request job so that it can be managed
from this repo. The values in defaults.yml will be merged with the pull
request definition. `check_paths_for_matches` is a utility script used
to prevent unnecessary builds from happening on every push to master due
to problems with the Jenkins `git` plugin.

.ci/bin/check_paths_for_matches.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""
+Small wrapper script for jenkins to see if a regex pattern matches any of the
+paths generated by diffing between two commits.
+"""
+import argparse
+import os
+import re
+import subprocess
+import sys
+
+debug = "DEBUG" in os.environ
+
+
+def check_paths_for_matches(pattern, git_commit, git_previous_commit):
+    """Check if any paths between GIT_PREVIOUS_COMMIT and GIT_COMMIT match our pattern.
+
+    For merge commits only actual path changes are included rather than changes
+    from all parents. If GIT_PREVIOUS_COMMIT is not populated, use just the
+    paths that GIT_COMMIT represents. If GIT_PREVIOUS_COMMIT is not populated
+    and GIT_COMMIT is a merge commit, use all path changes from each parent. If
+    GIT_PREVIOUS_COMMIT is the same as GIT_COMMIT, that should generate no path
+    changes.
+    """
+    # Handle case where GIT_PREVIOUS_COMMIT isn't set (e.g. the first build),
+    if not git_previous_commit:
+        command = [
+            "git",
+            "diff-tree",
+            "-m",
+            "--no-commit-id",
+            "--name-only",
+            "-r",
+            git_commit,
+        ]
+    else:
+        command = ["git", "diff", "--name-only", git_previous_commit, git_commit]
+
+    # Run the command and populate paths.
+    completed_process = subprocess.run(
+        command, check=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT
+    )
+    paths = completed_process.stdout.decode().strip().split("\n")
+
+    # Look for any matches of pattern -> path.
+    possible_matches = [(path, pattern.match(path)) for path in paths]
+    if any([match for path, match in possible_matches]):
+        if debug:
+            print("matching change(s) found for {}".format(git_commit))
+            for path, match in possible_matches:
+                if match:
+                    print(path)
+        sys.stdout.write("match")
+        sys.stdout.flush()
+        exit(0)
+    else:
+        if debug:
+            print("no matching change(s) found for {}".format(git_commit))
+        exit(1)
+
+
+if __name__ == "__main__":
+    # Change our working directory so we're in $WORKSPACE.
+    os.chdir(os.path.dirname(os.path.abspath(__file__)))
+
+    # Define and parse arguments.
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--pattern", help="A regular expression pattern.")
+    parser.add_argument(
+        "--git-commit", help="The contents of the GIT_COMMIT environmental variable."
+    )
+    parser.add_argument(
+        "--git-previous-commit",
+        nargs="?",
+        help="The contents of the GIT_PREVIOUS_COMMIT environmental variable.",
+    )
+    args = parser.parse_args()
+
+    compiled_pattern = re.compile(args.pattern)
+    check_paths_for_matches(compiled_pattern, args.git_commit, args.git_previous_commit)

.ci/jobs/defaults.yml

@@ -0,0 +1,76 @@
+---
+
+##### GLOBAL METADATA
+
+- meta:
+    cluster: kibana-ci
+
+##### JOB DEFAULTS
+
+- job:
+    logrotate:
+      daysToKeep: 30
+      numToKeep: 100
+    properties:
+    - github:
+        url: https://github.com/elastic/elastic-charts/
+    - inject:
+        properties-content: 'HOME=$JENKINS_HOME
+
+          '
+    concurrent: true
+    node: linux
+    scm:
+    - git:
+        name: origin
+        credentials-id: f6c7695a-671e-4f4f-a331-acdce44ff9ba
+        reference-repo: /var/lib/jenkins/.git-references/elastic-charts.git
+        branches:
+        - ${ghprbActualCommit}
+        url: [email protected]:elastic/elastic-charts.git
+        refspec: +refs/pull/${ghprbPullId}/*:refs/remotes/origin/pr/${ghprbPullId}/*
+        basedir: ''
+        wipe-workspace: 'True'
+    triggers:
+    - github-pull-request:
+        org-list:
+        - elastic
+        allow-whitelist-orgs-as-admins: true
+        github-hooks: true
+        status-context: kibana-ci
+        cancel-builds-on-update: true
+    vault:
+      role_id: 443f9500-f443-19ba-d698-1a48e104f8ba
+    wrappers:
+    - ansicolor
+    - timeout:
+        type: absolute
+        timeout: 180
+        fail: true
+    - timestamps
+    builders:
+    - shell: |-
+        #!/usr/local/bin/runbld
+
+        set -euo pipefail
+
+        set +x
+        export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID")
+        unset VAULT_ROLE_ID VAULT_SECRET_ID
+        export CODECOV_TOKEN=$(vault read -field=token secret/kibana-issues/prod/codecov)
+        unset VAULT_TOKEN
+        set -x
+
+        ./.ci/run.sh
+    publishers:
+    - email:
+        recipients: [email protected]
+    - google-cloud-storage:
+        credentials-id: kibana-ci-gcs-plugin
+        uploads:
+        - classic:
+            file-pattern: stories/__image_diff_snapshots__/**/*
+            storage-location: gs://kibana-ci-artifacts/jobs/$JOB_NAME/$BUILD_NUMBER
+            share-publicly: true
+            upload-for-failed-jobs: true
+            show-inline: true

.ci/jobs/elastic+elastic-charts+pull-request.yml

@@ -0,0 +1,5 @@
+---
+- job:
+    name: elastic+elastic-charts+pull-request
+    display-name: 'elastic / elastic-charts # pull-request'
+    description: Testing of elastic-charts pull requests.