Workers and manager to handle GitHub check runs

pyproject.toml

@@ -161,6 +161,7 @@ ignore = [
     "TID252",  # if we're going to use relative imports, use them always
     "TRY003",  # good general advice but lint is way too aggressive
     "TRY301",  # sometimes raising exceptions inside try is the best flow
+    "UP040",   # Python 3.12 supports `type` alias kw, but mypy doesn't yet
 
     # The following settings should be disabled when using ruff format
     # per https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules

src/mobu/config.py

@@ -11,11 +11,65 @@
 
 __all__ = [
     "Configuration",
+    "GitHubCiApp",
     "GitHubRefreshApp",
     "config",
 ]
 
 
+class GitHubCiApp(BaseSettings):
+    """Configuration for GitHub CI app functionality."""
+
+    enabled: bool = Field(
+        False,
+        title="Whether to enable the GitHub CI app functionality",
+        validation_alias="MOBU_GITHUB_CI_APP_ENABLED",
+    )
+
+    id: int | None = Field(
+        None,
+        title="Github CI app id",
+        description=(
+            "Found on the GitHub app's settings page (NOT the installation"
+            " configuration page). For example:"
+            " https://github.com/organizations/lsst-sqre/settings/apps/mobu-ci-data-dev-lsst-cloud"
+        ),
+        validation_alias="MOBU_GITHUB_CI_APP_ID",
+        examples=[123456],
+    )
+
+    private_key: str | None = Field(
+        None,
+        title="Github CI app private key",
+        description=(
+            "Generated when the GitHub app was set up. This should NOT be"
+            " base64 enocded, and will contain newlines. You can find this"
+            " in 1Password; check the Phalanx mobu values for more details."
+        ),
+        validation_alias="MOBU_GITHUB_CI_APP_PRIVATE_KEY",
+        examples=[
+            dedent("""
+            -----BEGIN RSA PRIVATE KEY-----
+            abc123MeowMeow456abc123MeowMeow456abc123MeowMeow456abc123MeowMeo
+            abc123MeowMeow456abc123MeowMeow456abc123MeowMeow456abc123MeowMeo
+            abc123MeowMeow456abc123MeowMeow456abc123MeowMeow456abc123MeowMeo
+            etc, etc
+            -----END RSA PRIVATE KEY-----
+        """)
+        ],
+    )
+
+    webhook_secret: str | None = Field(
+        None,
+        title="Github CI app webhook secret",
+        description=(
+            "Generated when the GitHub app was set up. You can find this"
+            " in 1Password; check the Phalanx mobu values for more details."
+        ),
+        validation_alias="MOBU_GITHUB_CI_APP_WEBHOOK_SECRET",
+    )
+
+
 class GitHubRefreshApp(BaseSettings):
     """Configuration for GitHub refresh app functionality."""
 
@@ -86,7 +140,13 @@ class Configuration(BaseSettings):
         examples=["gt-vilSCi1ifK_MyuaQgMD2dQ.d6SIJhowv5Hs3GvujOyUig"],
     )
 
+    github_ci_app: GitHubCiApp = Field(GitHubCiApp())
+
+    github_config_path: Path | None = Field(
         None,
+        title="Path to YAML file defining settings for GitHub app integration",
+        validation_alias="MOBU_GITHUB_CONFIG_PATH",
+        examples=["/etc/mobu/github_config.yaml"],
     )
 
     github_refresh_app: GitHubRefreshApp = Field(GitHubRefreshApp())

src/mobu/constants.py

@@ -3,16 +3,31 @@
 from __future__ import annotations
 
 from datetime import timedelta
+from pathlib import Path
 
 __all__ = [
+    "GITHUB_CI_SCOPES",
+    "GITHUB_REPO_CONFIG_PATH",
     "GITHUB_WEBHOOK_WAIT_SECONDS",
-    "NOTEBOOK_REPO_URL",
     "NOTEBOOK_REPO_BRANCH",
+    "NOTEBOOK_REPO_URL",
     "TOKEN_LIFETIME",
     "USERNAME_REGEX",
     "WEBSOCKET_OPEN_TIMEOUT",
 ]
 
+
+GITHUB_CI_SCOPES = [
+    "exec:notebook",
+    "exec:portal",
+    "read:image",
+    "read:tap",
+]
+"""All NotebookRunner business run via GitHub CI get these scopes."""
+
+GITHUB_REPO_CONFIG_PATH = Path("mobu.yaml")
+"""The path to a config file with repo-specific configuration."""
+
 GITHUB_WEBHOOK_WAIT_SECONDS = 1
 """GithHub needs some time to actually be in the state in a webhook payload."""
 

src/mobu/exceptions.py

@@ -34,6 +34,7 @@
     "FlockNotFoundError",
     "GafaelfawrParseError",
     "GafaelfawrWebError",
+    "GitHubFileNotFoundError",
     "JupyterProtocolError",
     "JupyterTimeoutError",
     "JupyterWebError",
@@ -347,6 +348,12 @@ def to_slack(self) -> SlackMessage:
         )
 
 
+class GitHubFileNotFoundError(Exception):
+    """Tried to retrieve contents for a non-existent file in a GitHub
+    repo.
+    """
+
+
 class JupyterProtocolError(MobuSlackException):
     """Some error occurred when talking to JupyterHub or JupyterLab."""
 

src/mobu/models/repo.py

@@ -0,0 +1,25 @@
+"""Models related to GitHub repos for the GitHub CI app functionality."""
+
+from pathlib import Path
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class RepoConfig(BaseModel):
+    """In-repo configuration for mobu behavior.
+
+    This can be placed into a yaml file in the root of a repo to configure
+    certain mobu behavior.
+    """
+
+    exclude_dirs: set[Path] = Field(
+        set(),
+        title="Any notebooks in these directories will not be run",
+        description=(
+            " These directories are relative to the repo root. Any notebooks"
+            " in child directories of these directories will also be excluded."
+        ),
+        examples=["some-dir", "some-dir/some-other-dir"],
+    )
+
+    model_config = ConfigDict(extra="forbid")