Add Gerrit 3.11 image builds and testing

This adds Gerrit 3.11 image builds an a system-config-run job for a 3.11
deployment. We don't add 3.10 to 3.11 upgrade testing yet. This will
happen as a followup once we're happy with general image building and
testing.

This adds explicit push and force push permissions to the Administrators
group via code reviewed changes. The reason for this is Gerrit 3.11 has
decided that everything should be code reviewed by default including
actions by Administrators. Since we're just doing this for bootstrapping
of testing we quickly add the old expected permissions back via code
review.

This has a side effect of bumping up the change numbers for the cahnges
we care about in review up by 2 integer values. The tests and
screenshots are all updated to accomodate the shift in change numbers.

Change-Id: Ib7090563a869577ed100ca71c496e8779e5b1010

playbooks/zuul/bootstrap-test-review.yaml

@@ -99,9 +99,13 @@
 
           pushd All-Projects
 
+          # Setup change id hook. Adapted from Zuul quickstart setup.
+          f="$(git rev-parse --git-dir)/hooks/commit-msg"; curl -o "$f" http://localhost:8081/tools/hooks/commit-msg ; chmod +x "$f"
+
           echo "{{ group_json.id }}	CI-tools" >> groups # noqa 203
           git commit -a -m "Add CI-tools group"
-          git push origin HEAD:refs/meta/config
+          git push origin HEAD:refs/for/refs/meta/config
+          ssh -i /root/.ssh/id_25519 -p 29418 -l 'admin' localhost gerrit review -l Code-Review=2 --submit -p All-Projects 1,1
 
           cat >> project.config << EOF
           [label "Verified"]
@@ -115,11 +119,14 @@
                   description = CI result votes. Maximum required to merge and is provided by the Zuul's gate queue.
                   submittableIf = label:Verified=MAX AND -label:Verified=MIN
                   canOverrideInChildProjects = false
+          [access "refs/*"]
+                  push = +force group Administrators
           [access "refs/heads/*"]
                   label-Verified = -2..+2 group CI-tools
           EOF
           git commit -a -m 'Update All-Project configuration'
-          git push origin HEAD:refs/meta/config
+          git push origin HEAD:refs/for/refs/meta/config
+          ssh -i /root/.ssh/id_25519 -p 29418 -l 'admin' localhost gerrit review -l Code-Review=2 --submit -p All-Projects 2,1
 
           popd
 
@@ -238,20 +245,6 @@
           curl -Lo .git/hooks/commit-msg http://localhost:8081/tools/hooks/commit-msg
           chmod u+x .git/hooks/commit-msg
 
-          cat >file-1.txt <<EOF
-          Hello, this is a file
-          EOF
-          git add file-1.txt
-          git commit -m "Sample review 1"
-          git push gerrit HEAD:refs/for/master
-
-          cat >file-2.txt <<EOF
-          Hello, this is a file
-          EOF
-          git add file-2.txt
-          git commit -m "Sample review 2"
-          git push gerrit HEAD:refs/for/master
-
           cat >file-3.txt <<EOF
           Hello, this is a file
           EOF
@@ -259,6 +252,20 @@
           git commit -m "Sample review 3"
           git push gerrit HEAD:refs/for/master
 
+          cat >file-4.txt <<EOF
+          Hello, this is a file
+          EOF
+          git add file-4.txt
+          git commit -m "Sample review 4"
+          git push gerrit HEAD:refs/for/master
+
+          cat >file-5.txt <<EOF
+          Hello, this is a file
+          EOF
+          git add file-5.txt
+          git commit -m "Sample review 5"
+          git push gerrit HEAD:refs/for/master
+
     - name: Post a sample failure review
       uri:
         url: 'http://localhost:8081/a/changes/{{ item.id }}/revisions/1/review'
@@ -290,15 +297,15 @@
             - test-disk-full https://zuul.opendev.org/t/openstack/build/0897fafc9743580794652fc49e3c9baf : DISK_FULL in {{ range(1, 59) | random }}m 48s
             - test-error https://zuul.opendev.org/t/openstack/build/0897bedc9743580794652fc49e3c1234 : ERROR This is an error message in {{ range(1, 59) | random }}m 32s
       loop:
-        - id: '1'
+        - id: '3'
           verified: '-2'
           priority: '-1'
           backport: '-1'
-        - id: '2'
+        - id: '4'
           verified: '+1'
           priority: '+1'
           backport: '0'
-        - id: '3'
+        - id: '5'
           verified: '+2'
           priority: '+2'
           backport: '+1'
@@ -318,16 +325,16 @@
 
             - test-second-ci https://zuul.opendev.org/t/openstack/build/f9c14856bf4e485089ca8fc8f00f324b : SUCCESS in {{ range(1, 59) | random}}m 11s
       loop:
-        - 1
-        - 2
         - 3
+        - 4
+        - 5
 
     # NOTE(ianw) we do an add/delete/add cycle as we've seen issues
     # with duplicate updates causing problems before; e.g.
     #  https://gerrit-review.googlesource.com/c/gerrit/+/312602
     - name: Post a file review to confirm accountPatchDb connection
       uri:
-        url: 'http://localhost:8081/a/changes/y%2Ftestproject~1/revisions/1/files/file-1.txt/reviewed'
+        url: 'http://localhost:8081/a/changes/y%2Ftestproject~3/revisions/1/files/file-3.txt/reviewed'
         method: '{{ item[0] }}'
         user: admin
         password: secret

testinfra/test_gerrit.py

@@ -43,10 +43,10 @@ def test_gerrit_screenshot(host):
 
     shots = (
         ('http://localhost:8081', None, 'gerrit-main-page.png'),
-        ('http://localhost:8081/c/x/test-project/+/1', script,
+        ('http://localhost:8081/c/x/test-project/+/3', script,
-         'gerrit-change-page-1.png'),
+         'gerrit-change-page-3.png'),
-        ('http://localhost:8081/c/x/test-project/+/2', script,
+        ('http://localhost:8081/c/x/test-project/+/4', script,
-         'gerrit-change-page-2.png')
+         'gerrit-change-page-4.png')
     )
 
     take_screenshots(host, shots)

zuul.d/docker-images/gerrit.yaml

@@ -137,6 +137,99 @@
     vars: *gerrit_vars_3_10
     files: *gerrit_files_3_10
 
+# Gerrit 3.11 jobs
+- job:
+    name: system-config-build-image-gerrit-3.11
+    description: Build a gerrit image.
+    parent: system-config-build-image
+    pre-run:
+      - playbooks/zuul/gerrit/repos.yaml
+      - playbooks/zuul/gerrit/submodules.yaml
+    run: playbooks/zuul/gerrit/run.yaml
+    requires: gerrit-base-container-image
+    provides: gerrit-3.11-container-image
+    required-projects: &gerrit_projects_3_11
+      - name: opendev/system-config
+        override-checkout: master
+      - name: gerrit.googlesource.com/gerrit
+        override-checkout: stable-3.11
+      # Backend behavior plugins
+      - name: gerrit.googlesource.com/plugins/commit-message-length-validator
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/delete-project
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/hooks
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/its-base
+        # There is no 3.11 branch
+        override-checkout: master
+      - name: gerrit.googlesource.com/plugins/its-storyboard
+        # There is no 3.11 branch
+        override-checkout: master
+      - name: gerrit.googlesource.com/plugins/plugin-manager
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/replication
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/reviewnotes
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/singleusergroup
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/webhooks
+        override-checkout: v3.11.0
+      # UI behavior plugins
+      - name: gerrit.googlesource.com/plugins/codemirror-editor
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/download-commands
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/gitiles
+        override-checkout: v3.11.0
+      - name: gerrit.googlesource.com/plugins/zuul-results-summary
+        override-checkout: main
+      # Non plugin submodules
+      - name: gerrit.googlesource.com/java-prettify
+        override-checkout: master
+      - name: gerrit.googlesource.com/jgit
+        override-checkout: master
+      - name: gerrit.googlesource.com/polymer-bridges
+        override-checkout: v3.11.0
+    vars: &gerrit_vars_3_11
+      docker_images:
+        - context: docker/gerrit/bazel
+          repository: opendevorg/gerrit
+          target: gerrit
+          path: /home/zuul/src/gerrit.googlesource.com/gerrit
+          tags:
+            - '3.11'
+    files: &gerrit_files_3_11
+      - docker/gerrit/base/
+      - docker/gerrit/bazel/
+      - playbooks/zuul/gerrit/
+      - playbooks/test-review.yaml
+      - testinfra/test_gerrit.py
+      - jeepyb/
+      - roles/bazelisk-build/
+
+- job:
+    name: system-config-upload-image-gerrit-3.11
+    description: Build and upload a gerrit image.
+    parent: system-config-upload-image
+    pre-run:
+      - playbooks/zuul/gerrit/repos.yaml
+      - playbooks/zuul/gerrit/submodules.yaml
+    run: playbooks/zuul/gerrit/run.yaml
+    requires: gerrit-base-container-image
+    provides: gerrit-3.11-container-image
+    required-projects: *gerrit_projects_3_11
+    vars: *gerrit_vars_3_11
+    files: *gerrit_files_3_11
+
+- job:
+    name: system-config-promote-image-gerrit-3.11
+    description: Promote a previously published gerrit image to latest.
+    parent: system-config-promote-image
+    vars: *gerrit_vars_3_11
+    files: *gerrit_files_3_11
+
 # Gerrit master jobs
 - job:
     name: system-config-build-image-gerrit-master-base
@@ -237,6 +330,11 @@
               - name: opendev-buildset-registry
               - name: system-config-build-image-gerrit-base
                 soft: true
+        - system-config-build-image-gerrit-3.11:
+            dependencies:
+              - name: opendev-buildset-registry
+              - name: system-config-build-image-gerrit-base
+                soft: true
         - system-config-build-image-gerrit-master:
             voting: false
             dependencies:
@@ -255,7 +353,13 @@
               - name: opendev-buildset-registry
               - name: system-config-upload-image-gerrit-base
                 soft: true
+        - system-config-upload-image-gerrit-3.11:
+            dependencies:
+              - name: opendev-buildset-registry
+              - name: system-config-upload-image-gerrit-base
+                soft: true
     deploy:
       jobs:
         - system-config-promote-image-gerrit-base
         - system-config-promote-image-gerrit-3.10
+        - system-config-promote-image-gerrit-3.11

zuul.d/project.yaml

@@ -67,6 +67,11 @@
               - name: opendev-buildset-registry
               - name: system-config-build-image-gerrit-3.10
                 soft: true
+        - system-config-run-review-3.11:
+            dependencies:
+              - name: opendev-buildset-registry
+              - name: system-config-build-image-gerrit-3.11
+                soft: true
         # Disabled until we can test the 3.10 -> 3.11 upgrade
         #- system-config-upgrade-review:
         #    dependencies:
@@ -220,6 +225,11 @@
               - name: opendev-buildset-registry
               - name: system-config-upload-image-gerrit-3.10
                 soft: true
+        - system-config-run-review-3.11:
+            dependencies:
+              - name: opendev-buildset-registry
+              - name: system-config-upload-image-gerrit-3.11
+                soft: true
         - system-config-run-refstack:
             dependencies:
               - name: opendev-buildset-registry

zuul.d/system-config-run.yaml

@@ -1103,6 +1103,15 @@
     vars:
       zuul_test_gerrit_version: '3.10'
 
+- job:
+    name: system-config-run-review-3.11
+    parent: system-config-run-review-base
+    description: |
+      Run the playbook for gerrit 3.11 (in a container).
+    requires: gerrit-3.11-container-image
+    vars:
+      zuul_test_gerrit_version: '3.11'
+
 # Disabled until we can test the 3.10 to 3.11 upgrade
 #- job:
 #    name: system-config-upgrade-review