Add code_freeze_maintainers_team option to milestone prow plugin

The new option allows to set a specific team (like the
release-team-leads) to  be milestone maintainer when code freeze is in
place. For that we extend the milestone plugin to be able to validate
codefreeze based on the tide configuration of the repository.

Ref:

- kubernetes/sig-release#2386

PRs for code freeze updates:
- kubernetes#31164
- kubernetes#29259

Signed-off-by: Sascha Grunert <[email protected]>

prow/plugins/config.go

@@ -491,6 +491,8 @@ type Milestone struct {
 	MaintainersID           int    `json:"maintainers_id,omitempty"`
 	MaintainersTeam         string `json:"maintainers_team,omitempty"`
 	MaintainersFriendlyName string `json:"maintainers_friendly_name,omitempty"`
+	// CodeFreezeMaintainersTeam is the GitHub team allowed to set milestones if code freeze is in place.
+	CodeFreezeMaintainersTeam string `json:"code_freeze_maintainers_team,omitempty"`
 }
 
 // BranchToMilestone is a map of the branch name to the configured milestone for that branch.

prow/plugins/milestone/codefreezechecker/codefreezechecker.go

@@ -0,0 +1,101 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package codefreezechecker
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/test-infra/prow/config"
+	"sigs.k8s.io/yaml"
+)
+
+const defaultConfigFile = "config/prow/config.yaml"
+
+var defaultBranches = []string{"master", "main"}
+
+// CodeFreezeChecker is the main structure of checking if we're in Code Freeze.
+type CodeFreezeChecker struct {
+	impl impl
+}
+
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//counterfeiter:generate . impl
+type impl interface {
+	ReadFile(name string) ([]byte, error)
+	YAMLUnmarshal(y []byte) (*config.Config, error)
+}
+
+// New creates a new CodeFreezeChecker instance.
+func New() *CodeFreezeChecker {
+	return &CodeFreezeChecker{
+		impl: &defaultImpl{},
+	}
+}
+
+// InCodeFreeze returns true if we're in Code Freeze:
+// https://github.com/kubernetes/sig-release/blob/2d8a1cc/releases/release_phases.md#code-freeze
+// This is being checked if the prow tide configuration has milestone restrictions applied like:
+// https://github.com/kubernetes/test-infra/pull/31164/files
+// It errors in case of any issue.
+func (c *CodeFreezeChecker) InCodeFreeze(org, repo string) (bool, error) {
+	configData, err := c.impl.ReadFile(defaultConfigFile)
+	if err != nil {
+		return false, fmt.Errorf("read config file %s: %w", defaultConfigFile, err)
+	}
+
+	prowConfig, err := c.impl.YAMLUnmarshal(configData)
+	if err != nil {
+		return false, fmt.Errorf("unmarshal prow config: %w", err)
+	}
+
+	orgRepo := config.OrgRepo{Org: org, Repo: repo}
+	queries := prowConfig.Tide.Queries.QueryMap().ForRepo(orgRepo)
+
+	for _, query := range queries {
+		if query.Milestone == "" {
+			continue
+		}
+
+		includedBranches := sets.New(query.IncludedBranches...)
+		releaseBranchFromMilestone := fmt.Sprintf("release-%s", strings.TrimPrefix(query.Milestone, "v"))
+
+		if includedBranches.Has(releaseBranchFromMilestone) && includedBranches.HasAny(defaultBranches...) {
+			logrus.Infof("Found code freeze for milestone %s", query.Milestone)
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+type defaultImpl struct{}
+
+func (*defaultImpl) ReadFile(name string) ([]byte, error) {
+	return os.ReadFile(name)
+}
+
+func (*defaultImpl) YAMLUnmarshal(y []byte) (*config.Config, error) {
+	prowConfig := &config.Config{}
+	if err := yaml.Unmarshal(y, prowConfig); err != nil {
+		return nil, err
+	}
+	return prowConfig, nil
+}

prow/plugins/milestone/codefreezechecker/codefreezechecker_test.go

@@ -0,0 +1,79 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package codefreezechecker
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/test-infra/prow/config"
+	"k8s.io/test-infra/prow/plugins/milestone/codefreezechecker/codefreezecheckerfakes"
+)
+
+func TestInCodeFreeze(t *testing.T) {
+	const (
+		testOrg           = "org"
+		testRepo          = "repo"
+		testMilestone     = "v1.29"
+		testReleaseBranch = "release-1.29"
+	)
+	t.Parallel()
+	for _, tc := range []struct {
+		name    string
+		prepare func(*codefreezecheckerfakes.FakeImpl)
+		assert  func(bool, error)
+	}{
+		{
+			name: "success in code freez",
+			prepare: func(mock *codefreezecheckerfakes.FakeImpl) {
+				mock.YAMLUnmarshalReturns(&config.Config{
+					ProwConfig: config.ProwConfig{
+						Tide: config.Tide{
+							TideGitHubConfig: config.TideGitHubConfig{
+								Queries: config.TideQueries{
+									{
+										Milestone:        testMilestone,
+										Orgs:             []string{testOrg},
+										Repos:            []string{testRepo},
+										IncludedBranches: []string{testReleaseBranch, defaultBranches[0]},
+									},
+								},
+							},
+						},
+					},
+				}, nil)
+			},
+			assert: func(res bool, err error) {
+				assert.True(t, res)
+				assert.NoError(t, err)
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mock := &codefreezecheckerfakes.FakeImpl{}
+			tc.prepare(mock)
+
+			sut := New()
+			sut.impl = mock
+
+			res, err := sut.InCodeFreeze(testOrg, testRepo)
+
+			tc.assert(res, err)
+		})
+	}
+}