chore: add verify-commits make target

Add a Make target that verifies commits added between the current
head and master:
- reference only one upstream, if any
- if referencing an upstream, only make changes to the vendor,
  manifests, and/or respective staging directory

Author: njhale

Makefile

@@ -147,6 +147,10 @@ verify-manifests: manifests
 verify-nested-vendor:
 	./scripts/check-staging-vendor.sh
 
+.PHONY: verify-commits
+verify-commits:
+	./scripts/verify_commits.sh $(PULL_BASE_REF) # see https://github.com/kubernetes/test-infra/blob/master/prow/jobs.md#job-environment-variables
+
 .PHONY: verify
 verify:
 	echo "Checking for unstaged root vendor changes"
@@ -155,6 +159,8 @@ verify:
 	$(MAKE) verify-manifests
 	echo "Checking for unsynced nested [go.mod,go.sum] files"
 	$(MAKE) verify-nested-vendor
+	echo "Checking commit integrity"
+	$(MAKE) verify-commits
 
 .PHONY: help
 help: ## Display this help.

scripts/verify_commits.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+function err() {
+    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: $*" >&2
+}
+
+function info() {
+    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: $*"
+}
+
+function verify_upstream_sync() {
+    local remote="${1}"
+    local downstream_commit="${2}"
+    local staging_dir="staging/${remote}"
+
+    local outside_staging
+    outside_staging="$(git show --name-only "${downstream_commit}" -- ":!${staging_dir}" ':!vendor :!manifests')"
+    if [[ -n "${outside_staging}" ]]; then
+        err "downstream staging commit ${downstream_commit} changes files outside of ${staging_dir}, vendor, and manifests directories"
+        err "${outside_staging}"
+        err "hint: factor out changes to these directories into a standalone commit"
+        return 1
+    fi
+}
+
+function upstream_ref() {
+    local downstream_commit="${1}"
+
+    local log
+    log="$(git log -n 1 "${downstream_commit}")"
+
+    local -a upstream_repos
+    mapfile -t upstream_repos < <(echo "${log}" | grep 'Upstream-repository:' | awk '{print $2}')
+
+    local -a upstream_commits
+    mapfile -t upstream_commits < <(echo "${log}" | grep 'Upstream-commit:' | awk '{print $2}')
+
+    if (( ${#upstream_repos[@]} < 1 && ${#upstream_commits[@]} < 1 )); then
+        # no upstream commit referenced
+        return 0
+    fi
+
+    if (( ${#upstream_repos[@]} > 1 )); then
+        err "downstream staging commit ${downstream_commit} references more than one upstream repo:"
+        err "${upstream_repos[@]}"
+        err "staging commits may only reference a single upstream repo"
+        return 1
+    fi
+
+    if (( ${#upstream_commits[@]} > 1 )); then
+        err "downstream staging commit ${downstream_commit} references more than one upstream commit:"
+        err "${upstream_commits[@]}"
+        err "staging commits may only reference a single upstream commit"
+        return 1
+    fi
+
+    if git branch -r --contains "${upstream_commits[0]}" | grep -vq "${upstream_repos[0]}/.*"; then
+        err "downstream staging commit ${downstream_commit} references upstream commit ${upstream_commits[0]} that doesn't exist in ${upstream_repos[0]}"
+        err "staging commits must reference a repository containing the given upstream commit"
+        return 1
+    fi
+
+    echo "${upstream_repos[0]}"
+    echo "${upstream_commits[0]}"
+}
+
+function fetch_remotes() {
+    local -a remotes
+    remotes=(
+        'api'
+        'operator-registry'
+        'operator-lifecycle-manager'
+    )
+    for r in "${remotes[@]}"; do
+        local url
+        url="https://github.com/operator-framework/${r}.git"
+
+        git remote add "${r}" "${url}" || git remote set-url "${r}" "${url}"
+        git fetch "${r}" master
+    done
+}
+
+function main() {
+    fetch_remotes || { err "failed to fetch remotes" &&  exit 1; }
+
+    local target_branch="${1:-master}"
+
+    # get all commits we're introducing into the target branch
+    local -a new_commits
+    mapfile -t new_commits < <(git rev-list HEAD "^${target_branch}")
+
+    local -a sr
+    for commit in "${new_commits[@]}"; do
+        info "verifying ${commit:0:7}"
+
+        mapfile -t sr < <(upstream_ref "${commit}" || exit 1)
+        if (( ${#sr[@]} < 2 )); then # the ref contains a tuple if the values were properly parsed from the commit message
+            # couldn't find staging cherry-pick reference in the commit message
+            # assume it's downstream-only commit
+            info "${commit:0:7} does not reference upstream commit, verifying as downstream-only"
+        else
+            # found staging cherry-pick reference in commit message
+            # verify as an upstream sync
+            info "${commit:0:7} references upstream commit (${sr[*]}), verifying as upstream sync"
+            verify_upstream_sync "${sr[0]}" "${commit}"
+        fi
+
+    done
+}
+
+main "$@"