Integrate OpenScanHub with Packit

[lachmanfrantisek]

As a package developer, I would like to see the result of the OpenScanHub analysis for my package so I am able to fix the possible issues when a new change is introduced.

• Implement OpenScanHub integration in Packit core.
• Implement a new handler to trigger the new OpenScanHub job after the Copr build is done.
• Support differential check by sending the build from the base branch.

In the meantime, as a workaround, people can use csmock in testing farm as being tried in packit/hello-world#1530 (similar to example rpminspecsetup)

[lachmanfrantisek]

Since our capacity for Q3 is a bit limited, we -- as a Packit team -- decided to focus on other epics (see the board). For now, people can use csmock directly (as documented at https://packit.dev/docs/configuration/upstream/tests/#csmock ).

But hopefully, people from OpenScanHub will help us with the implementation.

(The details are still yet to be decided.)

[lachmanfrantisek]

We didn't pick this as a top Packit team priority for the next quarter, but anyone can still help us make this happen. We are open to any collaboration and have successfully implemented/started multiple affords thanks to people outside of the Packit team.

Here, we still have a workaround and we can even improve this workaround by adding the plan to the github.com/packit/tmt-plans (~ a shared library of various tmt plans) that is currently being created...

[lachmanfrantisek]

We've met with Situ and here are some updates:

• If not allowed by default, people might not start using this functionality. (Static analysis might not look like a cool thing..;) => We can start with doing this automatically as a next step after the Copr build. (Have a config flag for this.)
• We should use differential check but this requires target branch builds to be configured.
• MVP does not need to resolve reporting -- we can start with the OpenScanHub task URL in the check run page and leave it to the user. (Reporting the result might be done later.)
• If we give Situ pointers and guidance, he's willing to try the implementation. (Would be nice to let him implement the core functionality and the Packit team to do the service part.)

Two issues that would help with the implementation

• Set up fedora messaging configurations openscanhub/fedora-infra#3 (as mentioned, reporting can be done later)
• Allow passing SRPM as URL openscanhub/openscanhub#248 (would avoid re-uploads of Copr SRPM, should be doable)

[lachmanfrantisek]

Small update:

• Situ made the implementation in core/CLI in Add a scan-in-osh subcommand packit#2301
• The next step is to do the service part as described above. (Run the check by default as a follow-up to all successful Corp builds where we have base build available.)
  • We've created Design the OpenScanHub service integration research#213 to agree on the implementation details.

[lbarcziova]

Current TODO:

• Implement functionality needed for OpenScanHub integration prototype #2454
• Implement OpenScanHub integration prototype #2463
• Market OpenScanHub integration prototype packit.dev#899

[lachmanfrantisek]

I am going to mark this epic as finished since we've accomplished what we wanted to do. Thanks everyone involved (mainly @siteshwar and @lbarcziova)!

I've created a new epic for the logical next step:

• Report OpenScanHub results #2516

[lachmanfrantisek]

Related:

• interface to pass custom options to osh-cli packit#2391
  • partially solved by Add --csmock-args option to scan-in-osh packit#2402