💖 Python Jira needs CI maintenance help

[ssbarnea]

That is a call for help on fixing JIRA CI project so we can test and merge change. I am personally against merging any change that does not pass CI but reality is that CI degrated considerably in the last years and cannot be fixed in one hour or two, probably not even an entire weekend.

If you care about its future, there are two ways you can pick

• Raise PRs that are addressing the CI issues and not by removing or disabling tests.
• Use the sponsor option to show your support, maybe you can convince me to go back to jira instead of the other projects
• Become a maintainer yourself. Well that is the best and if you can deal with first bullet, you have my approval.

PS. Sadly but I am unable to review and PR that does not report as green.

[truthbyron]

Hi @ssbarnea, I believe this is failing because of Deprecation of basic authentication with passwords for Jira and Confluence APIs, given the Travis runs of my PR:

E           jira.exceptions.JIRAError: JiraError HTTP 403 url: https://pycontribs.atlassian.net/rest/auth/1/session
E           	text: Basic auth with password is not allowed on this instance

I was able to create tie a test Jira account to the testing cloud instance, create an API token, and authenticate using a basic auth tuple of (email, token) and get a totally different set (and way more) errors, so I think that method works.

Is there any way we could get a dedicated token generated for the test and admin user and change to using email address instead of username for this block

jira/tests/tests.py

Lines 116 to 134 in 5c27f6d

	if "CI_JIRA_ADMIN" in os.environ:
	self.CI_JIRA_ADMIN = os.environ["CI_JIRA_ADMIN"]
	else:
	self.CI_JIRA_ADMIN = "ci-admin"
	if "CI_JIRA_ADMIN_PASSWORD" in os.environ:
	self.CI_JIRA_ADMIN_PASSWORD = os.environ["CI_JIRA_ADMIN_PASSWORD"]
	else:
	self.CI_JIRA_ADMIN_PASSWORD = "sd4s3dgec5fhg4tfsds3434"
	if "CI_JIRA_USER" in os.environ:
	self.CI_JIRA_USER = os.environ["CI_JIRA_USER"]
	else:
	self.CI_JIRA_USER = "ci-user"
	if "CI_JIRA_USER_PASSWORD" in os.environ:
	self.CI_JIRA_USER_PASSWORD = os.environ["CI_JIRA_USER_PASSWORD"]
	else:
	self.CI_JIRA_USER_PASSWORD = "sd4s3dgec5fhg4tfsds3434"

I'm not sure how technically able to help I am, but I'm happy to research more/help if you have time to give any direction (otherwise I'll keep poking around as I can). Thanks for this project and for your time.

[csullivannet]

@ssbarnea I've run this as well, setting the environment variables for CI_JIRA_ADMIN, CI_JIRA_ADMIN_PASSWORD, CI_JIRA_USER, CI_JIRA_USER_PASSWORD to my own username (my e-mail) and my API token. I was able to successfully authenticate when running python -m tox locally.

Further, I disabled the check here to see whether I'm the admin:

jira/tests/tests.py

Lines 163 to 165 in 5c27f6d

	if not self.jira_admin.current_user():
	self.initialized = 1
	sys.exit(3)

This resulted in being able to make the API calls which returned 403. This shows that I was an authenticated but not authorized user. This gives me confidence that this will resolve this authentication issue.

Updating these two lines to use the token instead of password should fix the authentication issue, (although it may be possible the username must be replaced with the e-mail):

jira/tests/tests.py

Line 124 in 5c27f6d

self.CI_JIRA_ADMIN_PASSWORD = "sd4s3dgec5fhg4tfsds3434"

jira/tests/tests.py

Line 134 in 5c27f6d

self.CI_JIRA_USER_PASSWORD = "sd4s3dgec5fhg4tfsds3434"

Unfortunately neither I nor @truthbyron have access to the ci-admin user, so we cannot create this token. The token can be generated here when logged in as ci-admin: https://id.atlassian.com/manage/api-tokens

[ssbarnea]

@truthbyron @csullivannet I added both of you as side-admins on https://pycontribs.atlassian.net/ -- please use your powers with extra attention. My hope is that you will find time to fix the CI issues. Reply here if you need my help again on other aspects.

We are better off removing the hardcoded credentials from the code and replacing them with a fast fail when they are not defined. These variables are defined on Travis, so the values from code are likely not even used.

I also sent you invite to github team, which I suppose will allow you to configure travis credentials at https://travis-ci.com/pycontribs/jira/settings in case you need to update them.

Merging changes will still need review and I am more than happy to help with these once I see travis reporting green.

[csullivannet]

@ssbarnea Thanks, I've been able to update the build to use a new token I generated for the ci-admin/ci-user users. This has fixed authentication. It does appear that some tests may now be legitimately broken, but I'll need to investigate further to confirm. A preliminary glance shows almost all the errors are due to the missing name field, which is likely due to GDPR compliance updates server side.

[truthbyron]

Thank you both @ssbarnea and @csullivannet ! I hope to able to get back to this mid-next week and help fix any legitimate broken tests.

[csullivannet]

@ssbarnea @truthbyron I have the CI returned to green by #909

It's likely there still remains code broken by Jira's GDPR compliance updates that's not covered by the tests.

[truthbyron]

Nice @csullivannet! I'll be able to do some review/testing tomorrow.

[Addono]

So over the last month or so sometimes a new solution has come up. I will just leave them here as food for thought for anyone who wants to pick it up.

Testing against Jira Cloud - old pipeline:

• PRs do not have a pipeline if they do not supply credentials themselves. Repo maintainers need to first check over the PR manually to see if there is any bad intent to steal the CI secrets. If not, then the PR branch is pushed to a branch inside the repo, which will run the CI.
  Yes, this is tedious, however a bot could help with this. To me, the real advantage of this approach is that the old pipeline can be kept.

Testing against Jira Server:

• Use atlas-cli to spin up a Jira instance with a 3 day development license. (I have been working on this quite a while back on this. The issue I ran into is that 1) a jira-run-standalone server does not come with the jira-software plugin installed. There exists an API, however it's undocumented. So instead my next step would be to use robotic process automation to click through the GUI in a headless browser to get a license. In other projects I had success by creating an archive of the data folder of the Jira instance and just unzip it in the CI pipeline. However, none of the tests in that project were writing to the Jira instance. Hence, having the license expired wasn't an issue. 2) I couldn't find any commit since the last stable release where this library's tests would pass against my local Jira server instance. At some point I started cherry-picking patches from 896 - GDPR Update and CI fixes #909, but even that wasn't enough to get it to run. (If anyone feels like going down this road, then feel free to ping me and I can show where I left of and discuss your approach.)

[ssbarnea]

Both approaches are needed, but the 2nd one can be easier to implement by using a test container. We need to be sure that this container starts with ready to use jira instance without any modifications.

Once we have it, we can make use of https://github.com/tox-dev/tox-docker to allow it to start/stop it for testing.

[Addono]

That was also my gut feeling, however no Atlassian SDK containers existed last time I checked - which was ~2 months ago. So I put a Dockerfile together, which can start a Jira standalone instance. However, then you still need to click through the UI to enable Jira Software and create a test user. So, a Jira instance "without modifications" is not enough in order to be able to run the test suite.
https://github.com/Addono/docker-atlassian-sdk/blob/master/Dockerfile

The Jira SDK seems quite stable - last release was mid 2019 - so I wouldn't expect it to require a lot of maintenance, hence maintaining it here would be an option - leaving it up to others requires trusting them.

Tox-docker looks cool, probably cleaner to use that than running the container detached as I was fiddling with 😅.