syntax = "proto2";

// This message describes a Commit Queue configuration for an entire project.
// The config file cq.cfg should be stored in the project's config directory.
message Config {
  // Required. Version of the config format.
  optional int32 version = 1;

  // The actual configurations, shared across multiple repositories.
  repeated SharedConfig configs = 2;
}

// This message describes a shared configuration for multiple repositories.
message SharedConfig {
  message Repository {
    // Required. URL to repository and also its identifier.
    optional string url = 1;

    // Refs to follow for the repository.
    // If this field is left unspecified, refs/heads/master will be used.
    repeated string refs = 2;
  }

  // At least one required. List repositories which share this CQ configuration.
  repeated Repository repos = 1;

  // List of verifiers that verify if the CL is ready to be committed.
  optional Verifiers verifiers = 2;

  // URL of the CQ status app to push updates to.
  optional string cq_status_url = 3;

  // Delay between commit bursts in seconds. Default value is 480.
  optional int32 commit_burst_delay = 4;

  // Maximum number of commits done sequentially, before waiting for
  // commit_burst_delay. Default value is 4.
  optional int32 max_commit_burst = 5;

  // Configuration options for Rietveld code review.
  // DEPRECATED, will be removed.
  optional Rietveld rietveld = 6 [deprecated = true];

  // Configuration options for Gerrit code review.
  optional Gerrit gerrit = 7;

  // If present, the CQ will refrain from processing any CLs which CQ was
  // triggered after this time. Setting this time very far in the past will
  // effectively make CQ not process any CLs.
  //
  // This is an UTC RFC3339 (stiptime(tm)) string representing the time.
  // For example, "2017-12-23T15:47:58Z" and Z is required.
  optional string draining_start_time = 8;
}

message Rietveld {
  // Required. URL of the codereview site.
  optional string url = 1;
}

// Unlike Rietveld, Gerrit doesn't need a separate url.
// Instead, the Repository url must be specified on the Gerrit instance,
// and CQ will deduce Gerrit url from it.
// Also, gerrit_cq_ability verifier must be defined in case of Gerrit.
//
// For example, if https://chromium.googlesource.com/infra/infra.git is your
// repo url provided in `git_repo_url` above, then
// https://chromium-review.googlesource.com/#/admin/projects/infra/infra should
// show general properties of your project.
//
// Also,
// https://chromium-review.googlesource.com/#/admin/projects/infra/infra,access
// should show ACLs for refs in your project, but you may need to be admin to
// see it. This will come handy to enable and customize the CQ-related workflows
// for your project.
message Gerrit {
  // Optional. If set, tells CQ to vote on a given label to mark result of CQ
  // run.  The vote is either -1 if failed or 1 on success, and will be given on
  // non-dry runs only.
  // This vote can then be used in Gerrit's rule for submitting issues, so as to
  // require CQ run. CQ will attempt to submit issue only after setting this
  // label.
  optional string cq_verified_label = 1;

  // Optional and only allowed if cq_verified_label is set. Default: False.
  // If set, tells CQ to vote on the Verified label even on dry run.
  // This is useful if CQ has no presubmit builders, as dry run would be
  // totally equivalent to full run, except that CQ won't try to actually submit
  // the code.
  optional bool dry_run_sets_cq_verified_label = 2;
}

// Verifiers are various types of checks that a Commit Queue performs on a CL.
// All verifiers must pass in order for a CL to be landed. Configuration file
// describes types of verifiers that should be applied to each CL and their
// parameters.
message Verifiers {
  // [Rietveld only] This verifier is used to ensure that an LGTM was posted to
  // the code review site from a valid project committer. It also validates
  // ability of non-committers to trigger CQ, which for Gerrit is done by
  // GerritCQAbilityVerifier.
  optional ReviewerLgtmVerifier reviewer_lgtm = 1;

  // [Gerrit only] GerritCQAbilityVerifier ensures that a user who triggered
  // this CQ attempt has actually rights to do so based on 3 factors:
  //  * membership of the user in committers & dryrunners group,
  //  * the state of CL/patchset on which CQ is triggered,
  //  * relationship of the user to the CL.
  // This verifier must be specified for Gerrit.
  optional GerritCQAbilityVerifier gerrit_cq_ability = 5;

  // This verifier is used to check tree status before committing a CL. If the
  // tree is closed, then the verifier will wait until it is reopened.
  optional TreeStatusLgtmVerifier tree_status = 2;

  // This verifier triggers a set of tryjobs that are to be run on builders on
  // Buildbot. It automatically retries failed try-jobs and only allows CL to
  // land if each builder has succeeded in the latest retry. If a given tryjob
  // result is too old (>1 day) it is ignored.
  optional TryJobVerifier try_job = 3;

  // This verifier is used to ensure that the author has signed Google's
  // Contributor License Agreement.
  optional SignCLAVerifier sign_cla = 4;

  message ReviewerLgtmVerifier {
    // Required. Name of the chrome-infra-auth group, which contains the list of
    // identities authorized to approve (lgtm) a CL and trigger CQ run or dry
    // run.
    optional string committer_list = 1;

    // Number of seconds to wait for LGTM on CQ. Default value is 0.
    optional int32 max_wait_secs = 2;

    // Message to be posted to code review site when no LGTM is found. Default
    // value is "No LGTM from a valid reviewer yet. Only full committers are "
    // "accepted.\nEven if an LGTM may have been provided, it was from a "
    // "non-committer,\n_not_ a full super star committer.\nSee "
    // "http://www.chromium.org/getting-involved/become-a-committer\nNote that "
    // "this has nothing to do with OWNERS files."
    optional string no_lgtm_msg = 3;

    // Optional, but recommended. Name of the chrome-infra-auth group,
    // which contains the list of identities authorized to trigger CQ dry run.
    // This is usually the same group as tryjob-access.
    optional string dry_run_access_list = 4;
  }

  message GerritCQAbilityVerifier {
    // Required. Name of the chrome-infra-auth group, which contains the list of
    // identities authorized to trigger CQ runs on any CLs in this project.
    optional string committer_list = 1;

    // Optional, but strongly recommended. Name of the chrome-infra-auth group,
    // which contains the list of identities authorized to trigger CQ dry run
    // on Gerrit CLs they own (not to be confused with OWNER files) even if CL
    // hasn't been approved.
    // This is usually the same group as tryjob-access.
    optional string dry_run_access_list = 4;

    // Optional. allow_submit_with_open_deps controls how CQ full run behaves
    // when current Gerrit CL has open dependencies (not yet submitted CLs on
    // which *this* CL depends).
    //
    // If set to false (default), CQ will abort full run attempt immediately if
    // open dependencies are detected.
    //
    // If set to true, then CQ will not abort full run and upon passing all
    // other verifiers, CQ will attempt to submit the CL regardless of open
    // dependencies. In turn, if Gerrit project config allows this, Gerrit will
    // execute submit all dependent CLs first and then this CL.
    optional bool allow_submit_with_open_deps = 5;
  }

  message TreeStatusLgtmVerifier {
    // Required. URL of the project tree status app.
    optional string tree_status_url = 1;
  }

  message TryJobVerifier {
    message EquivalentBuilder {
      // Required. Bucket name of this builder.
      optional string bucket = 1;
      // Required. Name of this builder.
      optional string builder = 2;
      // Percentage expressing probability of CQ requiring this builder
      // instead of the builder to which this builder is equilvanet to.
      //
      // If not specified, defaults to 50.
      //
      // A choice itself is made deterministicly based on CL alone, hereby
      // all CQ attempts on all patchsets of a given CL will require the same
      // builder, assuming CQ config doesn't change in the mean time.
      //
      // Note that if `owner_whitelist_group` is also specified, the choice over
      // two builders will be made only for CLs owned by whitelisted group.
      //
      // To illustrate, suppose percentage=10. Then,
      //   Without owner_whitelist_group,
      //      ~10% of all CQ attempts will choose this builder.
      //   With owner_whitelist_group set and, suppose, 1/5 of CQ attempts are
      //      ran on CLs owned by this group, then only ~(1/10)*(1/5) or
      //      ~2% of all CQ attempts will choose this builder.
      optional int32 percentage = 3;
      // If not specified, limits the builder to CL owners in this group.
      optional string owner_whitelist_group = 4;
    }

    message Builder {
      // Name of the builder.
      optional string name = 1;

      // Optionally specify a builder name that triggers the given builder.
      // Otherwise, CQ will trigger this builder (default). If in doubt, you
      // probably won't need this.
      optional string triggered_by = 2;

      // When this field is present, it marks given builder as experimental. It
      // is only executed on a given percentage of the CLs and the outcome does
      // not affect the decicion whether a CL can land or not. This is typically
      // used to test new builders and estimate their capacity requirements.
      optional float experiment_percentage = 4;

      // Optionally specified alternative builder for CQ to choose instead.
      // If provided, CQ will choose only one of the equivalent builders as
      // required based purely on given CL and CL's owner and **regardless** of
      // the possibly already completed try jobs.
      //
      // Note: none of the equivalent builders should be part of triggered_by
      //  chain, although CQ may eventually relax this requirement somewhat.
      optional EquivalentBuilder equivalent_to = 5;
    }

    message Bucket {
      // Name of the bucket. This is typically the same as a master name without
      // the 'master.' prefix, e.g. 'chromium.linux' or 'tryserver.webrtc'. CQ
      // will automatically add 'master.' prefix if not there.
      optional string name = 1;

      // Builders on which tryjobs should be triggered.
      repeated Builder builders = 2;
    }

    // Buckets on which tryjobs are triggered/watched.
    repeated Bucket buckets = 1;

    message TryJobRetryConfig {
      // Retry quota for a single tryjob.
      optional int32 try_job_retry_quota = 1;

      // Retry quota for all tryjobs in a CL.
      optional int32 global_retry_quota = 2;

      // The weight assigned to each tryjob failure.
      optional int32 failure_retry_weight = 3;

      // The weight assigned to each transient failure.
      optional int32 transient_failure_retry_weight = 4;

      // The weight assigned to tryjob timeouts.
      optional int32 timeout_retry_weight = 5;
    }

    // Provides project specific trybot retry configuration. This overrides the
    // defaults used in the CQ.
    optional TryJobRetryConfig try_job_retry_config = 2;
  }

  message SignCLAVerifier {}
}