build: auto start Jenkins CI via PR labels

[mmarchini]

Add an Action that will find every PR with the request-ci label and
will start a Jenkins CI for each of these Pull Requests. The scheduler
event is used to circumvent GitHub Actions limitations on Pull Requests
from forks (where secrets are not accessible and the GITHUB_TOKEN is
read-only).

If the Action fails to start a CI, it will add a request-ci-failed
label and will leave a comment with the error message from NCU.

Requirements to land

• Create a Jenkins token for @nodejs-github-bot
• Add JENKINS_USER and JENKINS_TOKEN secrets to this repository (or to the entire org, if we want this to work on forks such as quic and node-auto-test as well)
• Land ncu-ci: command to start CI for PRs node-core-utils#445 and wait for the next NCU release
• Test more extensively on node-auto-test before landing
• Create request-ci and request-ci-failed labels in this repository

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• documentation is changed or added
• commit message follows commit guidelines

[mmarchini]

We probably should provide a way to set ncu configs via environment variables, so we don't have to worry about writing to disk here.

[mmarchini]

If we're worried about the number of concurrent Jenkins jobs running, we could reduce this to 5 and increase the scheduler to 15-30 minutes.

[mscdex]

If we add something like this, shouldn't we just get rid of the "CERTIFY_SAFE" checkbox in CI then, since there is no way to make such a confirmation explicit when applying the new label to a PR?

[mmarchini]

That's a good question. We could consider that adding the label means the collaborator is certifying that this PR is safe (same could be said about starting a CI though)

[mmarchini]

We could also have two labels, but that seems unnecessary

[Trott]

@nodejs/build

[mmarchini]

Not sure who I should ping to get consensus on adding the secrets to the repo (or if I need to do it) and to create the labels. @nodejs/tsc maybe?

Also don't know who has access to the github-bot account to create a Jenkins token for it.

[cclauss]

RSLGTM Impressive work!

[mmarchini]

Ok, figured out the github-bot bits, will create the tokens on the repository before landing it.

Removed the blocked label, but it would be good to have some more reviews (especially on the general approach), I intend to land on friday or saturday to give folks a bit more time to review. I also ask to let me land it since there are other tasks that need to be accomplished while landing (create labels, add secrets to the repo)

(I'd like to land this before the commit queue since both use a similar approach, but this action won't make changes to our main branch)

[phillipj]

Really nice work 👍

[mmarchini]

@nodejs/build @nodejs/tsc any other reviews/comments/suggestions/objections before I land this tomorrow? (I thought about pinging collaborators but that might be too much :) )

[mmarchini]

Labels created:

[mmarchini]

Landed in 6cab3b0