docs: changing "struture" to "structure" (#29497)

PR Close #29497

.bazelignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+aio/content
+aio/node_modules
+aio/tools/examples/shared/node_modules
+integration/bazel

.bazelrc

@@ -0,0 +1,121 @@
+################################
+# Settings for Angular team members only
+################################
+# To enable this feature check the "Remote caching" section in docs/BAZEL.md.
+build:angular-team --remote_http_cache=https://storage.googleapis.com/angular-team-cache
+
+###############################
+# Typescript / Angular / Sass #
+###############################
+
+# Make compilation fast, by keeping a few copies of the compilers
+# running as daemons, and cache SourceFile AST's to reduce parse time.
+build --strategy=TypeScriptCompile=worker
+build --strategy=AngularTemplateCompile=worker
+
+# Enable debugging tests with --config=debug
+test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results
+
+###############################
+# Filesystem interactions     #
+###############################
+
+# Create symlinks in the project:
+# - dist/bin for outputs
+# - dist/testlogs, dist/genfiles
+# - bazel-out
+# NB: bazel-out should be excluded from the editor configuration.
+# The checked-in /.vscode/settings.json does this for VSCode.
+# Other editors may require manual config to ignore this directory.
+# In the past, we say a problem where VSCode traversed a massive tree, opening file handles and
+# eventually a surprising failure with auto-discovery of the C++ toolchain in
+# MacOS High Sierra.
+# See https://github.com/bazelbuild/bazel/issues/4603
+build --symlink_prefix=dist/
+
+# Performance: avoid stat'ing input files
+build --watchfs
+
+# Turn off legacy external runfiles
+run --nolegacy_external_runfiles
+test --nolegacy_external_runfiles
+
+# Turn on --incompatible_strict_action_env which was on by default
+# in Bazel 0.21.0 but turned off again in 0.22.0. Follow
+# https://github.com/bazelbuild/bazel/issues/7026 for more details.
+# This flag is needed to so that the bazel cache is not invalidated
+# when running bazel via `yarn bazel`.
+# See https://github.com/angular/angular/issues/27514.
+build --incompatible_strict_action_env
+run --incompatible_strict_action_env
+test --incompatible_strict_action_env
+
+###############################
+# Release support             #
+# Turn on these settings with #
+#  --config=release           #
+###############################
+
+# Releases should always be stamped with version control info
+build:release --workspace_status_command=./tools/bazel_stamp_vars.sh
+
+###############################
+# Output                      #
+###############################
+
+# A more useful default output mode for bazel query
+# Prints eg. "ng_module rule //foo:bar" rather than just "//foo:bar"
+query --output=label_kind
+
+# By default, failing tests don't print any output, it goes to the log file
+test --test_output=errors
+
+# Show which actions are run under workers,
+# and print all the actions running in parallel.
+# Helps to demonstrate that bazel uses all the cores on the machine.
+build --experimental_ui
+test --experimental_ui
+
+################################
+# Settings for CircleCI        #
+################################
+
+# Bazel flags for CircleCI are in /.circleci/bazel.rc
+
+################################
+# Temporary Settings for Ivy   #
+################################
+# to determine if the compiler used should be Ivy or ViewEngine one can use `--define=compile=aot` on
+# any bazel target. This is a temporary flag until codebase is permanently switched to Ivy.
+build --define=compile=legacy
+
+###############################
+# Remote Build Execution support
+# Turn on these settings with
+#  --config=remote
+###############################
+
+# Load default settings for Remote Build Execution
+# When updating, the URLs of bazel_toolchains in packages/bazel/package.bzl
+# may also need to be updated (see https://github.com/angular/angular/pull/27935)
+import %workspace%/third_party/github.com/bazelbuild/bazel-toolchains/bazelrc/bazel-0.21.0.bazelrc
+
+# Increase the default number of jobs by 50% because our build has lots of
+# parallelism
+build:remote --jobs=150
+
+# Point to our custom execution platform; see tools/BUILD.bazel
+build:remote --extra_execution_platforms=//tools:rbe_ubuntu1604-angular
+build:remote --host_platform=//tools:rbe_ubuntu1604-angular
+build:remote --platforms=//tools:rbe_ubuntu1604-angular
+
+# Remote instance.
+build:remote --remote_instance_name=projects/internal-200822/instances/default_instance
+
+# Do not accept remote cache.
+# We need to understand the security risks of using prior build artifacts.
+build:remote --remote_accept_cached=false
+
+# Load any settings specific to the current user. Needs to be last statement in this
+# config, as the user configuration should be able to overwrite flags from this file.
+try-import .bazelrc.user

.bowerrc

@@ -1,3 +0,0 @@
-{
-  "directory" : "bower_components"
-}

.buildkite/Dockerfile

@@ -0,0 +1,42 @@
+# Heavily based on https://github.com/StefanScherer/dockerfiles-windows/ images.
+# Combines the node windowsservercore image with the Bazel Prerequisites (https://docs.bazel.build/versions/master/install-windows.html).
+# msys install taken from https://github.com/StefanScherer/dockerfiles-windows/issues/30
+# VS redist install taken from https://github.com/StefanScherer/dockerfiles-windows/blob/master/apache/Dockerfile
+# The nanoserver image won't work because MSYS2 does not run in it https://github.com/Alexpux/MSYS2-packages/issues/1493
+
+# Before building this image, you must locally build node-windows:10.13.0-windowsservercore-1803.
+# Clone https://github.com/StefanScherer/dockerfiles-windows/commit/4ce7101a766b9b880ac262479dd9126b64d656cf and build using
+# docker build -t node-windows:10.13.0-windowsservercore-1803 --build-arg core=microsoft/windowsservercore:1803 --build-arg target=microsoft/windowsservercore:1803 .
+FROM node-windows:10.13.0-windowsservercore-1803
+
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+# Install 7zip to extract msys2
+RUN Invoke-WebRequest -UseBasicParsing 'https://www.7-zip.org/a/7z1805-x64.exe' -OutFile 7z.exe
+# For some reason the last letter in the destination directory is lost. So '/D=C:\\7zip0' will extract to '/D=C:\\7zip'.
+RUN Start-Process -FilePath 'C:\\7z.exe' -ArgumentList '/S', '/D=C:\\7zip0' -NoNewWindow -Wait
+
+# Extract msys2
+RUN Invoke-WebRequest -UseBasicParsing 'http://repo.msys2.org/distrib/x86_64/msys2-base-x86_64-20180531.tar.xz' -OutFile msys2.tar.xz
+RUN Start-Process -FilePath 'C:\\7zip\\7z' -ArgumentList 'e', 'msys2.tar.xz' -Wait
+RUN Start-Process -FilePath 'C:\\7zip\\7z' -ArgumentList 'x', 'msys2.tar', '-oC:\\' -Wait
+RUN Remove-Item msys2.tar.xz
+RUN Remove-Item msys2.tar
+RUN Remove-Item 7z.exe
+RUN Remove-Item -Recurse 7zip
+
+# Add MSYS2 to PATH, and set BAZEL_SH
+RUN [Environment]::SetEnvironmentVariable('Path', $env:Path + ';C:\msys64\usr\bin', [System.EnvironmentVariableTarget]::Machine)
+RUN [Environment]::SetEnvironmentVariable('BAZEL_SH', 'C:\msys64\usr\bin\bash.exe', [System.EnvironmentVariableTarget]::Machine)
+
+# Install Microsoft Visual C++ Redistributable for Visual Studio 2015
+RUN Invoke-WebRequest -UseBasicParsing 'https://download.microsoft.com/download/9/3/F/93FCF1E7-E6A4-478B-96E7-D4B285925B00/vc_redist.x64.exe' -OutFile vc_redist.x64.exe
+RUN Start-Process 'c:\\vc_redist.x64.exe' -ArgumentList '/Install', '/Passive', '/NoRestart' -NoNewWindow -Wait
+RUN Remove-Item vc_redist.x64.exe
+
+# Add a fix for https://github.com/docker/for-win/issues/2920 as entry point to the container.
+SHELL ["cmd", "/c"]
+COPY "fix-msys64.cmd" "C:\\fix-msys64.cmd"
+ENTRYPOINT cmd /C C:\\fix-msys64.cmd && cmd /c
+
+CMD ["cmd.exe"]

.buildkite/README.md

@@ -0,0 +1,96 @@
+# BuildKite configuration
+
+This folder contains configuration for the [BuildKite](https://buildkite.com) based CI checks for 
+this repository.
+
+BuildKite is a CI provider that provides build coordination and reports while we provide the 
+infrastructure.
+
+CI runs are triggered by new PRs and will show up on the GitHub checks interface, along with the 
+other current CI solutions.
+
+Currently it is only used for tests on Windows platforms.
+
+
+## The build pipeline
+
+BuildKite uses a pipeline for each repository. The `pipeline.yml` file defines pipeline 
+[build steps](https://buildkite.com/docs/pipelines/defining-steps) for this repository.
+
+Run results can be seen in the GitHub checks interface and in the 
+[pipeline dashboard](https://buildkite.com/angular/angular).
+
+Although most configuration is done via `pipeline.yml`, some options are only available
+in the online [pipeline settings](https://buildkite.com/angular/angular/settings).
+
+
+## Infrastructure
+
+BuildKite does not provide the host machines where the builds runs, providing instead the
+[BuildKite Agent](https://buildkite.com/docs/agent/v3) that should be run our own infrastructure.
+
+
+### Agents
+
+This agent polls the BuildKite API for builds, runs them, and reports back the results.
+Agents are the unit of concurrency: each agent can run one build at any given time. 
+Adding agents allows more builds to be ran at the same time.
+
+Individual agents can have tags, and pipeline steps can target only agents with certain tags via the
+`agents` field in `pipeline.yml`.
+For example: agents on Windows machines are tagged as `windows`, and the Windows specific build 
+steps list `windows: true` in their `agents` field.
+
+You can see the current agent pool, along with their tags, in the 
+[agents list](https://buildkite.com/organizations/angular/agents).
+
+
+### Our host machines
+
+We use [Google Cloud](https://cloud.google.com/) as our cloud provider, under the 
+[Angular project](https://console.cloud.google.com/home/dashboard?project=internal-200822).
+To access this project you need need to be logged in with a Google account that's a member of 
+team@angular.io. 
+For googlers this may be your google.com account, for others it is an angular.io account.
+
+In this project we have a number of Windows VMs running, each of them with several agents.
+The `provision-windows-buildkite.ps1` file contains instructions on how to create new host VMs that
+are fully configured to run the BuildKite agents as services.
+
+Our pipeline uses [docker-buildkite-plugin](https://github.com/buildkite-plugins/docker-buildkite-plugin)
+to run build steps inside docker containers.
+This way we achieve isolation and hermeticity.
+
+The `Dockerfile` file describes a custom Docker image that includes NodeJs, Yarn, and the Bazel 
+pre-requisites on Windows.
+
+To upload a new version of the docker image, follow any build instructions in `Dockerfile` and then
+run `docker build -t angular/node-bazel-windows:NEW_VERSION`, followed by 
+`docker push angular/node-bazel-windows:NEW_VERSION`. 
+After being pushed it should be available online, and you can use the new version in `pipeline.yml`.
+
+
+## Caretaker 
+
+BuildKite status can be found at https://www.buildkitestatus.com/.
+
+Issues related to the BuildKite setup should be escalated to the Tools Team via the current 
+caretaker, followed by Alex Eagle and Filipe Silva.
+
+Support requests should be submitted via email to support@buildkite.com and cc Igor, Misko, Alex,
+Jeremy and Manu
+
+
+## Rollout strategy
+
+At the moment our BuildKite CI uses 1 host VM running 4 agents, thus being capable of 4 concurrent 
+builds.
+The only test running is `bazel test //tools/ts-api-guardian:all`, and the PR check is not 
+mandatory.
+
+In the future we should add cache support to speed up the initial `yarn` install, and also Bazel
+remote caching to speed up Bazel builds.
+
+After the current setup is verified as stable and reliable the GitHub PR check can become mandatory.
+
+The tests ran should also be expanded to cover most, if not all, of the Bazel tests.

.buildkite/fix-msys64.cmd

@@ -0,0 +1,6 @@
+@echo off
+REM Fix for https://github.com/docker/for-win/issues/2920
+REM echo "Fixing msys64 folder..."
+REM Touch all .dll files inside C:\msys64\
+forfiles /p C:\msys64\ /s /m *.dll /c "cmd /c Copy /B @path+,, >NUL"
+REM echo "Fixed msys64 folder."

.buildkite/pipeline.yml

@@ -0,0 +1,10 @@
+steps:
+  - label: windows-test
+    commands:
+      - "yarn install --frozen-lockfile --non-interactive --network-timeout 100000"
+      - "yarn bazel test //tools/ts-api-guardian:all --noshow_progress"
+    plugins:
+      - docker#v2.1.0:
+          image: "filipesilva/node-bazel-windows:0.0.2"
+    agents:
+      windows: true

.buildkite/provision-windows-buildkite.ps1

@@ -0,0 +1,92 @@
+# PowerShell script to provision a Windows Server with BuildKite
+# This script follows https://buildkite.com/docs/agent/v3/windows.
+
+# Instructions
+
+# VM creation:
+# In Google Cloud Platform, create a Compute Engine instance.
+# We recommend machine type n1-highcpu-16 (16 vCPUs, 14.4 GB memory).
+# Use a windows boot disk with container support such as
+# "Windows Server version 1803 Datacenter Core for Containers".
+# Give it a name, then click "Create".
+
+# VM setup:
+# In the Compute Engine menu, select "VM Instances". Click on the VM name you chose before.
+# Click "Set Windows Password" to choose a username and password.
+# Click RDP to open a remote desktop via browser, using the username and password.
+# In the Windows command prompt start an elevated powershell by inputing
+# "powershell -Command "Start-Process PowerShell -Verb RunAs" followed by Enter.
+# Download and execute this script from GitHub, passing the token (mandatory), tags (optional)
+# and number of agents (optional) as args:
+# ```
+# Invoke-WebRequest -Uri https://raw.githubusercontent.com/angular/angular/master/.buildkite/provision-windows-buildkite.ps1 -OutFile provision.ps1
+# .\provision.ps1 -token "MY_TOKEN" -tags "windows=true,another_tag=true" -agents 4
+# ```
+# The VM should restart and be fully configured.
+
+# Creating extra VMs
+# You can create an image of the current VM by following the instructions below.
+# https://cloud.google.com/compute/docs/instances/windows/creating-windows-os-image
+# Then create a new VM and choose "Custom images".
+
+
+# Script proper.
+
+# Get the token and tags from arguments.
+param (
+  [Parameter(Mandatory=$true)][string]$token,
+  [string]$tags = ""
+  [Int]$agents = 1
+)
+
+# Allow HTTPS
+[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"
+
+# Helper to add to PATH.
+# Will take current PATH so avoid running it after anything to modifies only the powershell session path.
+function Add-Path ([string]$newPathItem) {
+  $Env:Path+= ";" +  $newPathItem + ";"
+  [Environment]::SetEnvironmentVariable("Path",$env:Path, [System.EnvironmentVariableTarget]::Machine)
+}
+
+# Install Git for Windows
+Write-Host "Installing Git for Windows."
+Invoke-WebRequest -Uri https://github.com/git-for-windows/git/releases/download/v2.19.1.windows.1/Git-2.19.1-64-bit.exe -OutFile git.exe
+.\git.exe /VERYSILENT /NORESTART /NOCANCEL /SP- /CLOSEAPPLICATIONS /RESTARTAPPLICATIONS /COMPONENTS="icons,ext\reg\shellhere,assoc,assoc_sh" /DIR="C:\git"
+Add-Path "C:\git\bin"
+Remove-Item git.exe
+
+# Download NSSM (https://nssm.cc/) to run the BuildKite agent as a service.
+Write-Host "Downloading NSSM."
+Invoke-WebRequest -Uri https://nssm.cc/ci/nssm-2.24-101-g897c7ad.zip -OutFile nssm.zip
+Expand-Archive -Path nssm.zip -DestinationPath C:\nssm
+Add-Path "C:\nssm\nssm-2.24-101-g897c7ad\win64"
+Remove-Item nssm.zip
+
+# Run the BuildKite agent install script
+Write-Host "Installing BuildKite agent."
+$env:buildkiteAgentToken = $token
+$env:buildkiteAgentTags = $tags
+Set-ExecutionPolicy Bypass -Scope Process -Force
+iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/buildkite/agent/master/install.ps1'))
+
+# Configure the BuildKite agent clone and timestamp behavior
+Add-Content C:\buildkite-agent\buildkite-agent.cfg "`ngit-clone-flags=--config core.autocrlf=input --config core.eol=lf --config core.longpaths=true --config core.symlinks=true`n"
+Add-Content C:\buildkite-agent\buildkite-agent.cfg "`ntimestamp-lines=true`n"
+
+# Register the BuildKite agent service using NSSM, so that it persists through restarts and is
+# restarted if the process dies.
+for ($i=1; $i -le $agents; $i++)
+{
+  $agentName = "buildkite-agent-$i"
+  Write-Host "Registering $agentName as a service."
+  nssm.exe install $agentName "C:\buildkite-agent\bin\buildkite-agent.exe" "start"
+  nssm.exe set $agentName AppStdout "C:\buildkite-agent\$agentName.log"
+  nssm.exe set $agentName AppStderr "C:\buildkite-agent\$agentName.log"
+  nssm.exe status $agentName
+  nssm.exe start $agentName
+  nssm.exe status $agentName
+}
+
+# Restart the machine.
+Restart-Computer

.circleci/README.md

@@ -0,0 +1,19 @@
+# Encryption
+
+Based on https://github.com/circleci/encrypted-files
+
+In the CircleCI web UI, we have a secret variable called `KEY`
+https://circleci.com/gh/angular/angular/edit#env-vars
+which is only exposed to non-fork builds
+(see "Pass secrets to builds from forked pull requests" under
+https://circleci.com/gh/angular/angular/edit#advanced-settings)
+
+We use this as a symmetric AES encryption key to encrypt tokens like
+a GitHub token that enables publishing snapshots.
+
+To create the github_token file, we take this approach:
+- Find the angular-builds:token in http://valentine
+- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime: `docker run --rm -it circleci/node:10.12`
+- echo "https://[token]:@github.com" > credentials
+- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
+- If needed, base64-encode the result so you can copy-paste it out of docker: `base64 github_token`

.circleci/bazel.rc

@@ -0,0 +1,30 @@
+# These options are enabled when running on CI
+# We do this by copying this file to /etc/bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Save downloaded repositories in a location that can be cached by CircleCI. This helps us
+# speeding up the analysis time significantly with Bazel managed node dependencies on the CI.
+build --repository_cache=/home/circleci/bazel_repository_cache
+
+# Don't be spammy in the logs
+# TODO(gmagolan): Hide progress again once build performance improves
+# Presently, CircleCI can timeout during bazel test ... with the following
+# error: Too long with no output (exceeded 10m0s)
+# build --noshow_progress
+
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# Workaround https://github.com/bazelbuild/bazel/issues/3645
+# Bazel doesn't calculate the memory ceiling correctly when running under Docker.
+# Limit Bazel to consuming resources that fit in CircleCI "xlarge" class
+# https://circleci.com/docs/2.0/configuration-reference/#resource_class
+build --local_resources=14336,8.0,1.0
+
+# Retry in the event of flakes, eg. https://circleci.com/gh/angular/angular/31309
+test --flaky_test_attempts=2
+
+# More details on failures
+build --verbose_failures=true

.circleci/config.yml

@@ -0,0 +1,618 @@
+# Configuration file for https://circleci.com/gh/angular/angular
+
+# Note: YAML anchors allow an object to be re-used, reducing duplication.
+# The ampersand declares an alias for an object, then later the `<<: *name`
+# syntax dereferences it.
+# See http://blog.daemonl.com/2016/02/yaml.html
+# To validate changes, use an online parser, eg.
+# http://yaml-online-parser.appspot.com/
+
+# Note that the browser docker image comes with Chrome and Firefox preinstalled. This is just
+# needed for jobs that run tests without Bazel. Bazel runs tests with browsers that will be
+# fetched by the Webtesting rules. Therefore for jobs that run tests with Bazel, we don't need a
+# docker image with browsers pre-installed.
+# **NOTE 1**: If you change the version of the `*-browsers` docker image, make sure the
+#             `CI_CHROMEDRIVER_VERSION_ARG` env var (in `.circleci/env.sh`) points to a ChromeDriver
+#             version that is compatible with the Chrome version in the image.
+# **NOTE 2**: If you change the version of the docker images, also change the `cache_key` suffix.
+var_1: &default_docker_image circleci/node:10.12
+var_2: &browsers_docker_image circleci/node:10.12-browsers
+# We don't want to include the current branch name in the cache key because that would prevent
+# PRs from being able to restore the cache since the branch names are always different for PRs.
+# The cache key should only consist of dynamic values that change whenever something in the
+# cache changes. For example:
+# 1) yarn lock file changes --> cached "node_modules" are different.
+# 2) bazel repository definitions change --> cached bazel repositories are different.
+# **NOTE 1 **: If you change the cache key prefix, also sync the restore_cache fallback to match.
+# **NOTE 2 **: Keep the static part of the cache key as prefix to enable correct fallbacks.
+# See https://circleci.com/docs/2.0/caching/#restoring-cache for how prefixes work in CircleCI.
+var_3: &cache_key v3-angular-node-10.12-{{ checksum "yarn.lock" }}-{{ checksum "WORKSPACE" }}-{{ checksum "packages/bazel/package.bzl" }}-{{ checksum "aio/yarn.lock" }}
+
+# Initializes the CI environment by setting up common environment variables.
+var_4: &init_environment
+  run:
+    name: Initializing environment (setting up variables, overwriting Yarn)
+    # Overwrite the yarn installed in the docker container with our own version.
+    command: |
+      ./.circleci/env.sh
+      ourYarn=$(realpath ./third_party/github.com/yarnpkg/yarn/releases/download/v1.13.0/bin/yarn.js)
+      sudo chmod a+x $ourYarn
+      sudo ln -fs $ourYarn /usr/local/bin/yarn
+      echo "Yarn version: $(yarn --version)"
+
+      # Add GitHub to known hosts.
+      mkdir -p ~/.ssh
+      echo 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==' >> ~/.ssh/known_hosts
+
+      # use git+ssh instead of https
+      git config --global url."ssh://git@github.com".insteadOf "https://github.com" || true
+      git config --global gc.auto 0 || true
+
+
+var_5: &setup_bazel_remote_execution
+  run:
+    name: "Setup bazel RBE remote execution"
+    command: |
+      openssl aes-256-cbc -d -in .circleci/gcp_token -k "$CI_REPO_NAME" -out /home/circleci/.gcp_credentials
+      echo "export GOOGLE_APPLICATION_CREDENTIALS=/home/circleci/.gcp_credentials" >> $BASH_ENV
+      sudo bash -c "echo 'build --config=remote' >> /etc/bazel.bazelrc"
+
+# Settings common to each job
+var_6: &job_defaults
+  working_directory: ~/ng
+  docker:
+  - image: *default_docker_image
+
+# After checkout, rebase on top of target branch.
+var_7: &post_checkout
+  run:
+    name: Rebase PR on target branch
+    command: >
+      if [[ -n "${CIRCLE_PR_NUMBER}" ]]; then
+        # User is required for rebase.
+        git config user.name "angular-ci"
+        git config user.email "angular-ci"
+        # Rebase PR on top of target branch.
+        node tools/rebase-pr.js angular/angular ${CIRCLE_PR_NUMBER}
+      else
+        echo "This build is not over a PR, nothing to do."
+      fi
+
+var_8: &yarn_install
+  run:
+    name: Running Yarn install
+    command: |
+      # Yarn's requests sometimes take more than 10mins to complete.
+      # Print something to stdout, to prevent CircleCI from failing due to not output.
+      while true; do sleep 60; echo "[`date`] Keeping alive..."; done &
+      KEEP_ALIVE_PID=$!
+      yarn install --frozen-lockfile --non-interactive
+      kill $KEEP_ALIVE_PID
+
+var_9: &setup_circleci_bazel_config
+  run:
+    name: Setting up CircleCI bazel configuration
+    command: sudo cp .circleci/bazel.rc /etc/bazel.bazelrc
+
+var_10: &restore_cache
+  restore_cache:
+    keys:
+      - *cache_key
+      # This fallback should be the cache_key without variables.
+      - v3-angular-node-10.12-
+
+# Branch filter that can be specified for jobs that should only run on publish branches
+# (e.g. master or the patch branch)
+var_12: &publish_branches_filter
+  branches:
+    only:
+      - master
+      # e.g. 7.0.x, 7.1.x, etc.
+      - /\d+\.\d+\.x/
+
+# Workspace initially persisted by the `install` job, and then enhanced by `test_aio` and
+# `build-npm-packages`.
+# https://circleci.com/docs/2.0/workflows/#using-workspaces-to-share-data-among-jobs
+# https://circleci.com/blog/deep-diving-into-circleci-workspaces/
+var_13: &attach_workspace
+  attach_workspace:
+    at: ~/
+
+version: 2
+jobs:
+  setup:
+    <<: *job_defaults
+    steps:
+      - checkout
+      - *post_checkout
+      # This cache is saved in the build-npm-packages so that Bazel cache is also included.
+      - *restore_cache
+      - *init_environment
+      - *yarn_install
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive
+      # Make the bazel directories and add a file to them if they don't exist already so that
+      # persist_to_workspace does not fail.
+      - run: |
+          if [ ! -d ~/bazel_repository_cache ]; then
+            mkdir ~/bazel_repository_cache
+            touch ~/bazel_repository_cache/MARKER
+          fi
+      # Persist any changes at this point to be reused by further jobs.
+      # **NOTE 1 **: Folders persisted here should be kept in sync with `var_13: &attach_workspace`.
+      # **NOTE 2 **: To add new content to the workspace, always persist on the same root.
+      - persist_to_workspace:
+          root: ~/
+          paths:
+            - ./ng
+            - ./bazel_repository_cache
+
+  lint:
+    <<: *job_defaults
+    steps:
+      - *attach_workspace
+      - *init_environment
+
+      - run: 'yarn bazel:format -mode=check ||
+              (echo "BUILD files not formatted. Please run ''yarn bazel:format''" ; exit 1)'
+      # Run the skylark linter to check our Bazel rules
+      - run: 'yarn bazel:lint ||
+              (echo -e "\n.bzl files have lint errors. Please run ''yarn bazel:lint-fix''"; exit 1)'
+
+      - run: yarn gulp lint
+
+  test:
+    <<: *job_defaults
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - *setup_circleci_bazel_config
+
+      # Setup remote execution and run RBE-compatible tests.
+      - *setup_bazel_remote_execution
+      - run: yarn bazel test //... --build_tag_filters=-ivy-only --test_tag_filters=-ivy-only,-local
+      # Now run RBE incompatible tests locally.
+      - run: sudo cp .circleci/bazel.rc /etc/bazel.bazelrc
+      - run: yarn bazel test //... --build_tag_filters=-ivy-only,local --test_tag_filters=-ivy-only,local
+
+  # Temporary job to test what will happen when we flip the Ivy flag to true
+  test_ivy_aot:
+    <<: *job_defaults
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - *setup_circleci_bazel_config
+      - *setup_bazel_remote_execution
+
+        # We need to explicitly specify the --symlink_prefix option because otherwise we would
+        # not be able to easily find the output bin directory when uploading artifacts for size
+        # measurements.
+      - run: yarn test-ivy-aot //... --symlink_prefix=dist/
+
+        # Publish bundle artifacts which will be used to calculate the size change. **Note**: Make
+        # sure that the size plugin from the Angular robot fetches the artifacts from this CircleCI
+        # job (see .github/angular-robot.yml). Additionally any artifacts need to be stored with the
+        # following path format: "{projectName}/{context}/{fileName}". This format is necessary
+        # because otherwise the bot is not able to pick up the artifacts from CircleCI. See:
+        # https://github.com/angular/github-robot/blob/master/functions/src/plugins/size.ts#L392-L394
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/hello_world/bundle.min.js
+          destination: core/hello_world/bundle
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/todo/bundle.min.js
+          destination: core/todo/bundle
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/hello_world/bundle.min.js.br
+          destination: core/hello_world/bundle.br
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/todo/bundle.min.js.br
+          destination: core/todo/bundle.br
+
+  test_aio:
+    <<: *job_defaults
+    docker:
+      # Needed because the AIO tests and the PWA score test depend on Chrome being available.
+      - image: *browsers_docker_image
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Build aio
+      - run: yarn --cwd aio build --progress=false
+        # Lint the code
+      - run: yarn --cwd aio lint
+        # Run PWA-score tests
+        # (Run before unit and e2e tests, which destroy the `dist/` directory.)
+      - run: yarn --cwd aio test-pwa-score-localhost $CI_AIO_MIN_PWA_SCORE
+        # Check the bundle sizes.
+        # (Run before unit and e2e tests, which destroy the `dist/` directory.)
+      - run: yarn --cwd aio payload-size
+        # Run unit tests
+      - run: yarn --cwd aio test --progress=false --watch=false
+        # Run e2e tests
+      - run: yarn --cwd aio e2e --configuration=ci
+        # Run unit tests for Firebase redirects
+      - run: yarn --cwd aio redirects-test
+
+  deploy_aio:
+    <<: *job_defaults
+    docker:
+    # Needed because before deploying the deploy-production script runs the PWA score tests.
+    - image: *browsers_docker_image
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Deploy angular.io to production (if necessary)
+      - run: setPublicVar CI_STABLE_BRANCH "$(npm info @angular/core dist-tags.latest | sed -r 's/^\s*([0-9]+\.[0-9]+)\.[0-9]+.*$/\1.x/')"
+      - run: yarn --cwd aio deploy-production
+
+  test_aio_local:
+    <<: *job_defaults
+    docker:
+      # Needed because the AIO tests and the PWA score test depend on Chrome being available.
+      - image: *browsers_docker_image
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Build aio (with local Angular packages)
+      - run: yarn --cwd aio build-local --progress=false
+        # Run PWA-score tests
+        # (Run before unit and e2e tests, which destroy the `dist/` directory.)
+      - run: yarn --cwd aio test-pwa-score-localhost $CI_AIO_MIN_PWA_SCORE
+        # Run unit tests
+      - run: yarn --cwd aio test --progress=false --watch=false
+        # Run e2e tests
+      - run: yarn --cwd aio e2e --configuration=ci
+
+  test_aio_local_ivy:
+    <<: *job_defaults
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Rename the Ivy packages dist folder to "dist/packages-dist" as the AIO
+        # package installer picks up the locally built packages from that location.
+        # *Note*: We could also adjust the packages installer, but given we won't have
+        # two different folders of Angular distributions in the future, it's likely not
+        # worth the efforts to change the AIO packages installer.
+      - run: mv dist/packages-dist-ivy-aot dist/packages-dist
+        # Build aio with Ivy (using local Angular packages)
+      - run: yarn --cwd aio build-with-ivy --progress=false
+
+  test_aio_tools:
+    <<: *job_defaults
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Install
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive
+      - run: yarn --cwd aio extract-cli-command-docs
+        # Run tools tests
+      - run: yarn --cwd aio tools-test
+      - run: ./aio/aio-builds-setup/scripts/test.sh
+
+  test_docs_examples:
+    <<: *job_defaults
+    docker:
+      # Needed because the example e2e tests depend on Chrome.
+      - image: *browsers_docker_image
+    parallelism: 4
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Install aio
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive
+        # Run examples tests. The "CIRCLE_NODE_INDEX" will be set if "parallelism" is enabled.
+        # Since the parallelism is set to "3", there will be three parallel CircleCI containers
+        # with either "0", "1" or "2" as node index. This can be passed to the "--shard" argument.
+      - run: yarn --cwd aio example-e2e --setup --local --cliSpecsConcurrency=5 --shard=${CIRCLE_NODE_INDEX}/${CIRCLE_NODE_TOTAL}
+
+  test_docs_examples_ivy:
+    <<: *job_defaults
+    docker:
+      # Needed because the example e2e tests depend on Chrome.
+      - image: *browsers_docker_image
+    resource_class: xlarge
+    # We increase the parallelism here to five while the "test_docs_examples" job runs with
+    # a parallelism of four. This is necessary because this job also need to run NGCC which
+    # takes up more time and we don't want these jobs to impact the overall CI turnaround.
+    parallelism: 5
+    steps:
+      - *attach_workspace
+      - *init_environment
+        # Install aio
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive
+        # Rename the Ivy packages dist folder to "dist/packages-dist" as the AIO
+        # package installer picks up the locally built packages from that location.
+        # *Note*: We could also adjust the packages installer, but given we won't have
+        # two different folders of Angular distributions in the future, we should keep
+        # the packages installer unchanged.
+      - run: mv dist/packages-dist-ivy-aot dist/packages-dist
+        # Run examples tests with ivy. The "CIRCLE_NODE_INDEX" will be set if "parallelism" is enabled.
+        # Since the parallelism is set to "3", there will be three parallel CircleCI containers
+        # with either "0", "1" or "2" as node index. This can be passed to the "--shard" argument.
+      - run: yarn --cwd aio example-e2e --setup --local --ivy --cliSpecsConcurrency=5 --shard=${CIRCLE_NODE_INDEX}/${CIRCLE_NODE_TOTAL}
+
+  # This job should only be run on PR builds, where `CI_PULL_REQUEST` is not `false`.
+  aio_preview:
+    <<: *job_defaults
+    environment:
+       AIO_SNAPSHOT_ARTIFACT_PATH: &aio_preview_artifact_path 'aio/tmp/snapshot.tgz'
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - run: ./aio/scripts/build-artifacts.sh $AIO_SNAPSHOT_ARTIFACT_PATH $CI_PULL_REQUEST $CI_COMMIT
+      - store_artifacts:
+          path: *aio_preview_artifact_path
+          # The `destination` needs to be kept in synch with the value of
+          # `AIO_ARTIFACT_PATH` in `aio/aio-builds-setup/Dockerfile`
+          destination: aio/dist/aio-snapshot.tgz
+      - run: node ./aio/scripts/create-preview $CIRCLE_BUILD_NUM
+
+  # This job should only be run on PR builds, where `CI_PULL_REQUEST` is not `false`.
+  test_aio_preview:
+    <<: *job_defaults
+    docker:
+      # Needed because the test-preview script runs e2e tests and the PWA score test with Chrome.
+      - image: *browsers_docker_image
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive
+      - run:
+          name: Wait for preview and run tests
+          command: node aio/scripts/test-preview.js $CI_PULL_REQUEST $CI_COMMIT $CI_AIO_MIN_PWA_SCORE
+
+
+  # The `build-npm-packages` tasks exist for backwards-compatibility with old scripts and
+  # tests that rely on the pre-Bazel `dist/packages-dist` output structure (build.sh).
+  # Having multiple jobs that independently build in this manner duplicates some work; we build
+  # the bazel packages more than once. Even though we have a remote cache, these jobs will
+  # typically run in parallel so up-to-date outputs will not be available at the time the build
+  # starts.
+
+  # Build the view engine npm packages. No new jobs should depend on this.
+  build-npm-packages:
+    <<: *job_defaults
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - *setup_circleci_bazel_config
+      - *setup_bazel_remote_execution
+
+      - run: scripts/build-packages-dist.sh
+
+      # Save the npm packages from //packages/... for other workflow jobs to read
+      - persist_to_workspace:
+          root: ~/
+          paths:
+            - ng/dist/packages-dist
+
+      # Save dependencies and bazel repository cache to use on subsequent runs.
+      - save_cache:
+          key: *cache_key
+          paths:
+            - "node_modules"
+            - "aio/node_modules"
+            - "~/bazel_repository_cache"
+
+  # Build the ivy npm packages.
+  build-ivy-npm-packages:
+    <<: *job_defaults
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - *setup_circleci_bazel_config
+      - *setup_bazel_remote_execution
+
+      - run: scripts/build-ivy-npm-packages.sh
+
+      # Save the npm packages from //packages/... for other workflow jobs to read
+      - persist_to_workspace:
+          root: ~/
+          paths:
+            - ng/dist/packages-dist-ivy-aot
+
+  # We run the integration tests outside of Bazel for now.
+  # They are a separate workflow job so that they can be easily re-run.
+  # When the tests are ported to bazel test targets, they should move to the "test"
+  # job above, as part of the bazel test command. That has flaky_test_attempts so the
+  # need to re-run manually should be alleviated.
+  # See comments inside the integration/run_tests.sh script.
+  integration_test:
+    <<: *job_defaults
+    parallelism: 4
+    docker:
+      # Needed because the integration tests expect Chrome to be installed (e.g cli-hello-world)
+      - image: *browsers_docker_image
+    # Note: we run Bazel in one of the integration tests, and it can consume >2G
+    # of memory. Together with the system under test, this can exhaust the RAM
+    # on a 4G worker so we use a larger machine here too.
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      # Runs the integration tests in parallel across multiple CircleCI container instances. The
+      # amount of container nodes for this job is controlled by the "parallelism" option.
+      - run: ./integration/run_tests.sh ${CIRCLE_NODE_INDEX} ${CIRCLE_NODE_TOTAL}
+
+  # This job updates the content of repos like github.com/angular/core-builds
+  # for every green build on angular/angular.
+  publish_snapshot:
+    <<: *job_defaults
+    steps:
+      # See below - ideally this job should not trigger for non-upstream builds.
+      # But since it does, we have to check this condition.
+      - run:
+          name: Skip this job for Pull Requests and Fork builds
+          # Note: Using `CIRCLE_*` env variables (instead of those defined in `env.sh` so that this
+          #       step can be run before `init_environment`.
+          command: >
+            if [[ -n "${CIRCLE_PR_NUMBER}" ]] ||
+                [[ "$CIRCLE_PROJECT_USERNAME" != "angular" ]] ||
+                [[ "$CIRCLE_PROJECT_REPONAME" != "angular" ]]; then
+              circleci step halt
+            fi
+      - *attach_workspace
+      - *init_environment
+      # CircleCI has a config setting to force SSH for all github connections
+      # This is not compatible with our mechanism of using a Personal Access Token
+      # Clear the global setting
+      - run: git config --global --unset "url.ssh://git@github.com.insteadof"
+      - run:
+          name: Decrypt github credentials
+          command: 'openssl aes-256-cbc -d -in .circleci/github_token -k "${KEY}" -out ~/.git_credentials'
+      - run: ./scripts/ci/publish-build-artifacts.sh
+
+  aio_monitoring:
+    <<: *job_defaults
+    docker:
+      # This job needs Chrome to be globally installed because the tests run with Protractor
+      # which does not load the browser through the Bazel webtesting rules.
+      - image: *browsers_docker_image
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - run:
+          name: Run tests against the deployed apps
+          command: ./aio/scripts/test-production.sh $CI_AIO_MIN_PWA_SCORE
+      - run:
+          name: Notify caretaker about failure
+          # `$SLACK_CARETAKER_WEBHOOK_URL` is a secret env var defined in CircleCI project settings.
+          # The URL comes from https://angular-team.slack.com/apps/A0F7VRE7N-circleci.
+          command: 'curl --request POST --header "Content-Type: application/json" --data "{\"text\":\":x: \`$CIRCLE_JOB\` job failed on build $CIRCLE_BUILD_NUM: $CIRCLE_BUILD_URL :scream:\"}" $SLACK_CARETAKER_WEBHOOK_URL'
+          when: on_fail
+
+  legacy-unit-tests-saucelabs:
+    <<: *job_defaults
+    # In order to avoid the bottleneck of having a slow host machine, we acquire a better
+    # container for this job. This is necessary because we launch a lot of browsers concurrently
+    # and therefore the tunnel and Karma need to process a lot of file requests and tests.
+    resource_class: xlarge
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - run:
+          name: Preparing environment for running tests on Saucelabs.
+          command: |
+            setPublicVar KARMA_JS_BROWSERS $(node -e 'console.log(require("./browser-providers.conf").sauceAliases.CI_REQUIRED.join(","))')
+            setSecretVar SAUCE_ACCESS_KEY $(echo $SAUCE_ACCESS_KEY | rev)
+      - run:
+          name: Starting Saucelabs tunnel
+          command: ./scripts/saucelabs/start-tunnel.sh
+          background: true
+      - run: yarn tsc -p packages
+      - run: yarn tsc -p modules
+        # Waits for the Saucelabs tunnel to be ready. This ensures that we don't run tests
+        # too early without Saucelabs not being ready.
+      - run: ./scripts/saucelabs/wait-for-tunnel.sh
+      - run: yarn karma start ./karma-js.conf.js --single-run --browsers=${KARMA_JS_BROWSERS}
+      - run: ./scripts/saucelabs/stop-tunnel.sh
+
+  legacy-misc-tests:
+    <<: *job_defaults
+    steps:
+      - *attach_workspace
+      - *init_environment
+      - run: yarn gulp check-cycle
+      # TODO: disabled because the Bazel packages-dist does not seem to have map files for
+      # the ESM5/ES2015 output. See: https://github.com/angular/angular/issues/27966
+      # - run: yarn gulp source-map-test
+
+workflows:
+  version: 2
+  default_workflow:
+    jobs:
+      - setup
+      - lint:
+          requires:
+          - setup
+      - test:
+          requires:
+          - setup
+      - test_ivy_aot:
+          requires:
+          - setup
+      - build-npm-packages:
+          requires:
+          - setup
+      - test_aio:
+          requires:
+          - setup
+      - legacy-unit-tests-saucelabs:
+          requires:
+          - setup
+      - deploy_aio:
+          requires:
+            - test_aio
+      - legacy-misc-tests:
+          requires:
+            - build-npm-packages
+      - test_aio_local:
+          requires:
+            - build-npm-packages
+      # - test_aio_local_ivy:
+      #     requires:
+      #       - build-ivy-npm-packages
+      - test_aio_tools:
+          requires:
+            - build-npm-packages
+      - test_docs_examples:
+          requires:
+            - build-npm-packages
+      # - test_docs_examples_ivy:
+      #     requires:
+      #       - build-ivy-npm-packages
+      - aio_preview:
+          requires:
+            - setup
+          # Only run on PR builds. (There can be no previews for non-PR builds.)
+          filters:
+            branches:
+              only: /pull\/\d+/
+      - test_aio_preview:
+          requires:
+            - aio_preview
+      - integration_test:
+          requires:
+            - build-npm-packages
+      - publish_snapshot:
+          # Note: no filters on this job because we want it to run for all upstream branches
+          # We'd really like to filter out pull requests here, but not yet available:
+          # https://discuss.circleci.com/t/workflows-pull-request-filter/14396/4
+          # Instead, the job just exits immediately at the first step.
+          requires:
+            # Only publish if tests and integration tests pass
+            - test
+            - test_ivy_aot
+            - integration_test
+            # Only publish if `aio`/`docs` tests using the locally built Angular packages pass
+            - test_aio_local
+            # - test_aio_local_ivy
+            - test_docs_examples
+            # - test_docs_examples_ivy
+            # Get the artifacts to publish from the build-packages-dist job
+            # since the publishing script expects the legacy outputs layout.
+            - build-npm-packages
+            - legacy-unit-tests-saucelabs
+            - legacy-misc-tests
+
+  aio_monitoring:
+    jobs:
+      - aio_monitoring
+    triggers:
+      - schedule:
+          # Runs AIO monitoring job at 00:00AM every day.
+          cron: "0 0 * * *"
+          filters:
+            branches:
+              only:
+                - master
+
+# TODO:
+# - don't build the g3 branch
+# - verify that we are bootstrapping with the right yarn version coming from the docker image
+# - check local chrome version pulled from docker image
+# - remove /tools/ngcontainer

.circleci/env-helpers.inc.sh

@@ -0,0 +1,38 @@
+####################################################################################################
+# Helpers for defining environment variables for CircleCI.
+#
+# In CircleCI, each step runs in a new shell. The way to share ENV variables across steps is to
+# export them from `$BASH_ENV`, which is automatically sourced at the beginning of every step (for
+# the default `bash` shell).
+#
+# See also https://circleci.com/docs/2.0/env-vars/#using-bash_env-to-set-environment-variables.
+####################################################################################################
+
+# Set and print an environment variable.
+#
+# Use this function for setting environment variables that are public, i.e. it is OK for them to be
+# visible to anyone through the CI logs.
+#
+# Usage: `setPublicVar <name> <value>`
+function setPublicVar() {
+  setSecretVar $1 "$2";
+  echo "$1=$2";
+}
+
+# Set (without printing) an environment variable.
+#
+# Use this function for setting environment variables that are secret, i.e. should not be visible to
+# everyone through the CI logs.
+#
+# Usage: `setSecretVar <name> <value>`
+function setSecretVar() {
+  # WARNING: Secrets (e.g. passwords, access tokens) should NOT be printed.
+  # (Keep original shell options to restore at the end.)
+  local -r originalShellOptions=$(set +o);
+  set +x -eu -o pipefail;
+
+  echo "export $1=\"${2:-}\";" >> $BASH_ENV;
+
+  # Restore original shell options.
+  eval "$originalShellOptions";
+}

.circleci/env.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Variables
+readonly projectDir=$(realpath "$(dirname ${BASH_SOURCE[0]})/..")
+readonly envHelpersPath="$projectDir/.circleci/env-helpers.inc.sh";
+readonly getCommitRangePath="$projectDir/.circleci/get-commit-range.js";
+
+# Load helpers and make them available everywhere (through `$BASH_ENV`).
+source $envHelpersPath;
+echo "source $envHelpersPath;" >> $BASH_ENV;
+
+
+####################################################################################################
+# Define PUBLIC environment variables for CircleCI.
+####################################################################################################
+# See https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables for more info.
+####################################################################################################
+setPublicVar PROJECT_ROOT "$projectDir";
+setPublicVar CI_AIO_MIN_PWA_SCORE "95";
+# This is the branch being built; e.g. `pull/12345` for PR builds.
+setPublicVar CI_BRANCH "$CIRCLE_BRANCH";
+# ChromeDriver version compatible with the Chrome version included in the docker image used in
+# `.circleci/config.yml`. See http://chromedriver.chromium.org/downloads for a list of versions.
+# This variable is intended to be passed as an arg to the `webdriver-manager update` command (e.g.
+# `"postinstall": "webdriver-manager update $CI_CHROMEDRIVER_VERSION_ARG"`).
+setPublicVar CI_CHROMEDRIVER_VERSION_ARG "--versions.chrome 2.45";
+setPublicVar CI_COMMIT "$CIRCLE_SHA1";
+# `CI_COMMIT_RANGE` will only be available when `CIRCLE_COMPARE_URL` is also available (or can be
+# retrieved via `get-compare-url.js`), i.e. on push builds (a.k.a. non-PR, non-scheduled builds and
+# rerun workflows of such builds). That is fine, since we only need it in push builds.
+setPublicVar CI_COMMIT_RANGE "`[[ ${CIRCLE_PR_NUMBER:-false} != false ]] && echo "" || node $getCommitRangePath "$CIRCLE_BUILD_NUM" "$CIRCLE_COMPARE_URL"`";
+setPublicVar CI_PULL_REQUEST "${CIRCLE_PR_NUMBER:-false}";
+setPublicVar CI_REPO_NAME "$CIRCLE_PROJECT_REPONAME";
+setPublicVar CI_REPO_OWNER "$CIRCLE_PROJECT_USERNAME";
+
+
+####################################################################################################
+# Define SECRET environment variables for CircleCI.
+####################################################################################################
+setSecretVar CI_SECRET_AIO_DEPLOY_FIREBASE_TOKEN "$AIO_DEPLOY_TOKEN";
+setSecretVar CI_SECRET_PAYLOAD_FIREBASE_TOKEN "$ANGULAR_PAYLOAD_TOKEN";
+
+
+####################################################################################################
+# Define SauceLabs environment variables for CircleCI.
+####################################################################################################
+# In order to have a meaningful SauceLabs badge on the repo page,
+# the angular2-ci account is used only when pushing commits to master;
+# in all other cases, the regular angular-ci account is used.
+if [ "${CI_PULL_REQUEST}" = "false" ] && [ "${CI_REPO_OWNER}" = "angular" ] && [ "${CI_BRANCH}" = "master" ]; then
+  setPublicVar SAUCE_USERNAME "angular2-ci";
+  setSecretVar SAUCE_ACCESS_KEY "693ebc16208a-0b5b-1614-8d66-a2662f4e";
+else
+  setPublicVar SAUCE_USERNAME "angular-ci";
+  setSecretVar SAUCE_ACCESS_KEY "9b988f434ff8-fbca-8aa4-4ae3-35442987";
+fi
+setPublicVar SAUCE_LOG_FILE /tmp/angular/sauce-connect.log
+setPublicVar SAUCE_READY_FILE /tmp/angular/sauce-connect-ready-file.lock
+setPublicVar SAUCE_PID_FILE /tmp/angular/sauce-connect-pid-file.lock
+setPublicVar SAUCE_TUNNEL_IDENTIFIER "angular-${CIRCLE_BUILD_NUM}-${CIRCLE_NODE_INDEX}"
+# Amount of seconds we wait for sauceconnect to establish a tunnel instance. In order to not
+# acquire CircleCI instances for too long if sauceconnect failed, we need a connect timeout.
+setPublicVar SAUCE_READY_FILE_TIMEOUT 120
+
+
+# Source `$BASH_ENV` to make the variables available immediately.
+source $BASH_ENV;

.circleci/get-commit-range.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+
+/**
+ * **Usage:**
+ * ```
+ * node get-commit-range <build-number> [<compare-url> [<circle-token>]]
+ * ```
+ *
+ * Returns the value of the `CIRCLE_COMPARE_URL` environment variable (if defined) or, if this is
+ * not a PR build (i.e. `CIRCLE_PR_NUMBER` is not defined), retrieves the equivalent of
+ * `CIRCLE_COMPARE_URL` for jobs that are part of a rerun workflow.
+ *
+ * **Context:**
+ * CircleCI sets the `CIRCLE_COMPARE_URL` environment variable (from which we can extract the commit
+ * range) on push builds (a.k.a. non-PR, non-scheduled builds). Yet, when a workflow is rerun
+ * (either from the beginning or from failed jobs) - e.g. when a job flakes - CircleCI does not set
+ * the `CIRCLE_COMPARE_URL`.
+ *
+ * **Implementation details:**
+ * This script relies on the fact that all rerun workflows share the same CircleCI workspace and the
+ * (undocumented) fact that the workspace ID happens to be the same as the workflow ID that first
+ * created it.
+ *
+ * For example, for a job on push build workflow, the CircleCI API will return data that look like:
+ * ```js
+ * {
+ *   compare: 'THE_COMPARE_URL_WE_ARE_LOOKING_FOR',
+ *   //...
+ *   previous: {
+ *     // ...
+ *     build_num: 12345,
+ *   },
+ *   //...
+ *   workflows: {
+ *     //...
+ *     workflow_id: 'SOME_ID_A',
+ *     workspace_id: 'SOME_ID_A',  // Same as `workflow_id`.
+ *   }
+ * }
+ * ```
+ *
+ * If the workflow is rerun, the data for jobs on the new workflow will look like:
+ * ```js
+ * {
+ *   compare: null,  // ¯\_(ツ)_/¯
+ *   //...
+ *   previous: {
+ *     // ...
+ *     build_num: 23456,
+ *   },
+ *   //...
+ *   workflows: {
+ *     //...
+ *     workflow_id: 'SOME_ID_B',
+ *     workspace_id: 'SOME_ID_A',  // Different from current `workflow_id`.
+ *                                 // Same as original `workflow_id`. \o/
+ *   }
+ * }
+ * ```
+ *
+ * This script uses the `previous.build_num` (which points to the previous build number on the same
+ * branch) to traverse the jobs backwards, until it finds a job from the original workflow. Such a
+ * job (if found) should also contain the compare URL.
+ *
+ * **NOTE 1:**
+ * This is only useful on workflows which are created by rerunning a workflow for which
+ * `CIRCLE_COMPARE_URL` was defined.
+ *
+ * **NOTE 2:**
+ * The `circleToken` will be used for CircleCI API requests if provided, but it is not needed for
+ * accessing the read-only endpoints that we need (as long as the current project is FOSS and the
+ * corresponding setting is turned on in "Advanced Settings" in the project dashboard).
+ *
+ * ---
+ * Inspired by https://circleci.com/orbs/registry/orb/iynere/compare-url
+ * (source code: https://github.com/iynere/compare-url-orb).
+ *
+ * We are not using the `compare-url` orb for the following reasons:
+ * 1. (By looking at the code) it would only work if the rerun workflow is the latest workflow on
+ *    the branch (which is not guaranteed to be true).
+ * 2. It is less efficient (e.g. makes unnecessary CircleCI API requests for builds on different
+ *    branches, installs extra dependencies, persists files to the workspace (as a means of passing
+ *    the result to the calling job), etc.).
+ * 3. It is slightly more complicated to setup and consume than our own script.
+ * 4. Its implementation is more complicated than needed for our usecase (e.g. handles different git
+ *    providers, handles newly created branches, etc.).
+ */
+
+// Imports
+const {get: httpsGet} = require('https');
+
+// Constants
+const API_URL_BASE = 'https://circleci.com/api/v1.1/project/github/angular/angular';
+const COMPARE_URL_RE = /^.*\/([0-9a-f]+\.\.\.[0-9a-f]+)$/i;
+
+// Run
+_main(process.argv.slice(2));
+
+// Helpers
+async function _main([buildNumber, compareUrl = '', circleToken = '']) {
+  try {
+    if (!buildNumber || isNaN(buildNumber)) {
+      throw new Error(
+          'Missing or invalid arguments.\n' +
+          'Expected: buildNumber (number), compareUrl? (string), circleToken? (string)');
+    }
+
+    if (!compareUrl) {
+      compareUrl = await getCompareUrl(buildNumber, circleToken);
+    }
+
+    const commitRangeMatch = COMPARE_URL_RE.exec(compareUrl)
+    const commitRange = commitRangeMatch ? commitRangeMatch[1] : '';
+
+    console.log(commitRange);
+  } catch (err) {
+    console.error(err);
+    process.exit(1);
+  }
+}
+
+function getBuildInfo(buildNumber, circleToken) {
+  console.error(`BUILD ${buildNumber}`);
+  const url = `${API_URL_BASE}/${buildNumber}?circle-token=${circleToken}`;
+  return getJson(url);
+}
+
+async function getCompareUrl(buildNumber, circleToken) {
+  let info = await getBuildInfo(buildNumber, circleToken);
+  const targetWorkflowId = info.workflows.workspace_id;
+
+  while (info.workflows.workflow_id !== targetWorkflowId) {
+    info = await getBuildInfo(info.previous.build_num, circleToken);
+  }
+
+  return info.compare || '';
+}
+
+function getJson(url) {
+  return new Promise((resolve, reject) => {
+    const opts = {headers: {Accept: 'application/json'}};
+    const onResponse = res => {
+      const statusCode = res.statusCode || -1;
+      const isSuccess = (200 <= statusCode) && (statusCode <= 400);
+      let responseText = '';
+
+      res.
+        on('error', reject).
+        on('data', d => responseText += d).
+        on('end', () => isSuccess ?
+          resolve(JSON.parse(responseText)) :
+          reject(`Error getting '${url}' (status ${statusCode}):\n${responseText}`));
+    };
+
+    httpsGet(url, opts, onResponse).
+      on('error', reject).
+      end();
+  });
+}

.circleci/setup_cache.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Install bazel remote cache proxy
+# This is temporary until the feature is no longer experimental on CircleCI.
+# See remote cache documentation in /docs/BAZEL.md
+
+set -u -e
+
+readonly DOWNLOAD_URL="https://5-116431813-gh.circle-artifacts.com/0/pkg/bazel-remote-proxy-$(uname -s)_$(uname -m)"
+
+curl --fail -o ~/bazel-remote-proxy "$DOWNLOAD_URL"
+chmod +x ~/bazel-remote-proxy

.circleci/trigger-webhook.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Usage (cli):
+ * ```
+ * node create-preview <build-number> <job-name> <webhook-url>
+ * ```
+ *
+ * Usage (JS):
+ * ```js
+ * require('./trigger-webhook').
+ *   triggerWebhook(buildNumber, jobName, webhookUrl).
+ *   then(...);
+ * ```
+ *
+ * Triggers a notification webhook with CircleCI specific info.
+ *
+ * It can be used for notifying external servers and trigger operations based on CircleCI job status
+ * (e.g. triggering the creation of a preview based on previously stored build atrifacts).
+ *
+ * The body of the sent payload is of the form:
+ * ```json
+ * {
+ *   "payload": {
+ *     "build_num": ${buildNumber}
+ *     "build_parameters": {
+ *       "CIRCLE_JOB": "${jobName}"
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * When used from JS, it returns a promise which resolves to an object of the form:
+ * ```json
+ * {
+ *   "statucCode": ${statusCode},
+ *   "responseText": "${responseText}"
+ * }
+ * ```
+ *
+ * NOTE:
+ * - When used from the cli, the command will exit with an error code if the response's status code
+ *   is outside the [200, 400) range.
+ * - When used from JS, the returned promise will be resolved, even if the response's status code is
+ *   outside the [200, 400) range. It is up to the caller to decide how this should be handled.
+ */
+
+// Imports
+const {request} = require('https');
+
+// Exports
+module.exports = {
+  triggerWebhook,
+};
+
+// Run
+if (require.resolve === module) {
+  _main(process.argv.slice(2));
+}
+
+// Helpers
+function _main(args) {
+  triggerWebhook(...args).
+    then(({statusCode, responseText}) => (200 <= statusCode && statusCode < 400) ?
+      console.log(`Status: ${statusCode}\n${responseText}`) :
+      Promise.reject(new Error(`Request failed (status: ${statusCode}): ${responseText}`))).
+    catch(err => {
+      console.error(err);
+      process.exit(1);
+    });
+}
+
+function postJson(url, data) {
+  return new Promise((resolve, reject) => {
+    const opts = {method: 'post', headers: {'Content-Type': 'application/json'}};
+    const onResponse = res => {
+      const statusCode = res.statusCode || -1;
+      let responseText = '';
+
+      res.
+        on('error', reject).
+        on('data', d => responseText += d).
+        on('end', () => resolve({statusCode, responseText}));
+    };
+
+    request(url, opts, onResponse).
+      on('error', reject).
+      end(JSON.stringify(data));
+  });
+}
+
+async function triggerWebhook(buildNumber, jobName, webhookUrl) {
+  if (!buildNumber || !jobName || !webhookUrl || isNaN(buildNumber)) {
+    throw new Error(
+        'Missing or invalid arguments.\n' +
+        'Expected: buildNumber (number), jobName (string), webhookUrl (string)');
+  }
+
+  const data = {
+    payload: {
+      build_num: +buildNumber,
+      build_parameters: {CIRCLE_JOB: jobName},
+    },
+  };
+
+  return postJson(webhookUrl, data);
+}

.editorconfig

@@ -1,4 +1,4 @@
-# http://editorconfig.org
+# https://editorconfig.org
 
 root = true
 

.github/CODEOWNERS

@@ -0,0 +1,852 @@
+# ==================================================================================
+# ==================================================================================
+#                                Angular CODEOWNERS
+# ==================================================================================
+# ==================================================================================
+#
+#  Configuration of code ownership and review approvals for the angular/angular repo.
+#
+#  More info: https://help.github.com/articles/about-codeowners/
+#
+
+
+# ================================================
+#  General rules / philosophy
+# ================================================
+#
+#  - we trust that people do the right thing and not approve changes they don't feel confident reviewing
+#  - we use github teams so that we funnel code reviews to the most appropriate reviewer, this is why the team structure is fine-grained
+#  - we enforce that only approved PRs get merged to ensure that unreviewed code doesn't get accidentally merged
+#  - we delegate approval rights as much as possible so that we can scale better
+#  - each group must have at least one person, but several people are preferable to avoid a single point of failure issues
+#  - most file groups have one or two global approvers groups as fallbacks:
+#    - @angular/fw-global-approvers: for approving minor changes, large-scale refactorings, and emergency situations.
+#    - @angular/fw-global-approvers-for-docs-only-changes: for approving minor documentation-only changes that don't require engineering review
+#  - a small number of file groups have very limited number of reviewers because incorrect changes to the files they guard would have serious consequences (e.g. security, public api)
+#
+#  Configuration nuances:
+#
+#  - This configuration works in conjunction with the protected branch settings that require all changes to be made via pull requests with at least one approval.
+#  - This approval can come from an appropriate codeowner, or any repo collaborator (person with write access) if the PR is authored by a codeowner.
+#  - Each codeowners team must have write access to the repo, otherwise their reviews won't count.
+#
+#  In the case of emergency, the repo administrators which include angular-caretaker can bypass this requirement.
+
+
+
+# ================================================
+#  GitHub username registry
+#  (just to make this file easier to understand)
+# ================================================
+
+#  alan-agius4 - Alan Agius
+#  alexeagle - Alex Eagle
+#  alxhub - Alex Rickabaugh
+#  AndrewKushnir - Andrew Kushnir
+#  andrewseguin - Andrew Seguin
+#  benlesh - Ben Lesh
+#  brandonroberts - Brandon Roberts
+#  devversion - Paul Gschwendtner
+#  filipesilva - Filipe Silva
+#  gkalpak - George Kalpakas
+#  hansl - Hans Larsen
+#  IgorMinar - Igor Minar
+#  jasonaden - Jason Aden
+#  jenniferfell - Jennifer Fell
+#  kara - Kara Erickson
+#  kyliau - Keen Yee Liau
+#  matsko - Matias Niemelä
+#  mgechev - Minko Gechev
+#  mhevery - Misko Hevery
+#  ocombe - Olivier Combe
+#  petebacondarwin - Pete Bacon Darwin
+#  pkozlowski-opensource - Pawel Kozlowski
+#  robwormald - Rob Wormald
+#  stephenfluin - Stephen Fluin
+#  vikerman - Vikram Subramanian
+
+
+
+######################################################################################################
+#
+#  Team structure and memberships
+#  ------------------------------
+#
+#  This section is here just because the GitHub UI is too hard to navigate and audit.
+#
+#  Any changes to team structure or memberships must first be made in this file and only then
+#  implemented in the GitHub UI.
+#######################################################################################################
+
+
+# ===========================================================
+#  @angular/framework-global-approvers
+# ===========================================================
+#  Used for approving minor changes, large-scale refactorings, and emergency situations.
+#  (secret team to avoid review requests, it also doesn't inherit from @angular/framework because nested teams can't be secret)
+#
+#   - IgorMinar
+#   - kara
+#   - mhevery
+#   - alexeagle
+
+
+# ===========================================================
+#  @angular/framework-global-approvers-for-docs-only-changes
+# ===========================================================
+#  Used for approving minor documentation-only changes that don't require engineering review.
+#  (secret team to avoid review requests, it also doesn't inherit from @angular/framework because nested teams can't be secret)
+#
+#   - brandonroberts
+#   - gkalpak
+#   - jenniferfell
+#   - petebacondarwin
+
+
+# ===========================================================
+#  @angular/fw-animations
+# ===========================================================
+#
+#   - matsko
+
+
+# ===========================================================
+#  @angular/tools-bazel
+# ===========================================================
+#
+#   - alexeagle
+#   - kyliau
+#   - IgorMinar
+#   - mgechev
+
+
+# ===========================================================
+#  @angular/tools-cli
+# ===========================================================
+#
+#   - alexeagle
+#   - filipesilva
+#   - hansl
+#   - mgechev
+
+
+# ===========================================================
+#  @angular/fw-compiler
+# ===========================================================
+#
+#   - alxhub
+
+
+# ===========================================================
+#  @angular/fw-ngcc
+# ===========================================================
+#
+#   - alxhub
+#   - gkalpak
+#   - petebacondarwin
+
+
+# ===========================================================
+#  @angular/fw-core
+# ===========================================================
+#
+#   - alxhub
+#   - AndrewKushnir
+#   - kara
+#   - mhevery
+#   - pkozlowski-opensource
+
+
+# ===========================================================
+#  @angular/fw-http
+# ===========================================================
+#
+#   - alxhub
+#   - IgorMinar
+
+
+# ===========================================================
+#  @angular/fw-elements
+# ===========================================================
+#
+#   - andrewseguin
+#   - gkalpak
+#   - robwormald
+
+
+# ===========================================================
+#  @angular/fw-forms
+# ===========================================================
+#
+#   - kara
+
+
+# ===========================================================
+#  @angular/tools-language-service
+# ===========================================================
+#
+#   - kyliau
+
+
+# ===========================================================
+#  @angular/fw-server
+# ===========================================================
+#
+#   - alxhub
+#   - vikerman
+
+
+# ===========================================================
+#  @angular/fw-router
+# ===========================================================
+#
+#   - jasonaden
+
+
+# ===========================================================
+#  @angular/fw-service-worker
+# ===========================================================
+#
+#   - alxhub
+#   - gkalpak
+#   - IgorMinar
+
+
+# ===========================================================
+#  @angular/fw-upgrade
+# ===========================================================
+#
+#   - gkalpak
+#   - petebacondarwin
+
+
+# ===========================================================
+#  @angular/fw-testing
+# ===========================================================
+#
+#   - vikerman
+
+
+# ===========================================================
+#  @angular/fw-i18n
+# ===========================================================
+#
+#   - AndrewKushnir
+#   - mhevery
+#   - ocombe
+#   - vikerman
+
+
+# ===========================================================
+#  @angular/fw-security
+# ===========================================================
+#
+#   - IgorMinar
+#   - mhevery
+
+
+# ===========================================================
+#  @angular/tools-benchpress
+# ===========================================================
+#
+#   - alxhub
+
+
+# ===========================================================
+#  @angular/fw-integration
+# ===========================================================
+#
+#   - alexeagle
+#   - IgorMinar
+#   - mhevery
+
+
+# ===========================================================
+#  @angular/docs-infra
+# ===========================================================
+#
+#   - brandonroberts
+#   - gkalpak
+#   - IgorMinar
+#   - petebacondarwin
+
+
+# ===========================================================
+#  @angular/fw-docs-intro
+# ===========================================================
+#
+#   - brandonroberts
+#   - IgorMinar
+#   - stephenfluin
+
+
+# ===========================================================
+#  @angular/fw-docs-observables
+# ===========================================================
+#
+#   - benlesh
+#   - jasonaden
+
+
+# ===========================================================
+#  @angular/fw-docs-packaging
+# ===========================================================
+#
+#   - alexeagle
+#   - IgorMinar
+
+
+# ===========================================================
+#  @angular/tools-docs-libraries
+# ===========================================================
+#
+#   - alan-agius4
+#   - alexeagle
+#   - hansl
+#   - IgorMinar
+#   - mgechev
+
+
+# ===========================================================
+#  @angular/fw-docs-marketing
+# ===========================================================
+#
+#   - IgorMinar
+#   - stephenfluin
+
+
+# ===========================================================
+#  @angular/fw-public-api
+# ===========================================================
+#
+#   - IgorMinar
+
+
+# ===========================================================
+#  @angular/fw-dev-infra
+# ===========================================================
+#
+#   - alexeagle
+#   - devversion
+#   - filipesilva
+#   - gkalpak
+#   - IgorMinar
+
+
+
+
+
+######################################################################################################
+#
+# CODEOWNERS rules
+# -----------------
+#
+# All the following rules are applied in the order specified in this file.
+# The last rule that matches wins!
+#
+# See https://git-scm.com/docs/gitignore#_pattern_format for pattern syntax docs.
+#
+######################################################################################################
+
+
+# ================================================
+#  Default Owners
+# (in case no pattern matches a path in a PR - this should be treated as a bug and result in adding the path to CODEOWNERS)
+# ================================================
+
+* @IgorMinar @angular/framework-global-approvers
+
+
+
+# ================================================
+#  @angular/animations
+# ================================================
+
+/packages/animations/**                                         @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/platform-browser/animations/**                        @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/animations.md                                @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/animations/**                             @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/animations/**                         @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/complex-animation-sequences.md               @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/reusable-animations.md                       @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/route-animations.md                          @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/transition-and-triggers.md                   @angular/fw-animations @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/bazel
+# ================================================
+
+/packages/bazel/**                                              @angular/tools-bazel @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/compiler
+#  @angular/compiler-cli
+# ================================================
+
+/packages/compiler/**                                           @angular/fw-compiler @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/compiler-cli/**                                       @angular/fw-compiler @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/aot-compiler.md                              @angular/fw-compiler @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  packages/compiler-cli/src/ngcc/
+# ================================================
+
+/packages/compiler-cli/src/ngcc/**                              @angular/fw-ngcc @angular/framework-global-approvers
+
+
+
+# ================================================
+#  Framework/cli integration
+#
+#  a rule to control API changes between @angular/compiler-cli and @angular/cli
+# ================================================
+
+/packages/compiler-cli/src/ngtools/**                           @angular/tools-cli @angular/framework-global-approvers
+/aio/content/guide/ivy.md                                       @angular/tools-cli @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/core
+#  @angular/common (except @angular/common/http)
+#  @angular/platform-browser
+#  @angular/platform-browser-dynamic
+#  @angular/platform-webworker
+#  @angular/platform-webworker-dynamic
+# ================================================
+
+/packages/core/**                                               @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/**                                             @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/platform-browser/**                                   @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/platform-browser-dynamic/**                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/platform-webworker/**                                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/platform-webworker-dynamic/**                         @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/architecture-components.md                   @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/architecture-modules.md                      @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/architecture-next-steps.md                   @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/architecture-services.md                     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/architecture.md                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/architecture/**                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/architecture/**                       @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/attribute-directives.md                      @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/attribute-directives/**                   @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/attribute-directives/**               @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/bootstrapping.md                             @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/bootstrapping/**                          @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/cheatsheet.md                                @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/component-interaction.md                     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/component-interaction/**                  @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/component-interaction/**              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/component-styles.md                          @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/component-styles/**                       @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/dependency-injection.md                      @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/dependency-injection/**                   @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/dependency-injection/**               @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/dependency-injection-in-action.md            @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/dependency-injection-in-action/**         @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/dependency-injection-in-action/**     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/dependency-injection-navtree.md              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/dependency-injection-providers.md            @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/displaying-data.md                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/displaying-data/**                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/displaying-data/**                    @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/dynamic-component-loader.md                  @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/dynamic-component-loader/**               @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/dynamic-component-loader/**           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/entry-components.md                          @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/feature-modules.md                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/feature-modules/**                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/feature-modules/**                    @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/frequent-ngmodules.md                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/frequent-ngmodules/**                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/hierarchical-dependency-injection.md         @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/hierarchical-dependency-injection/**      @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/lazy-loading-ngmodules.md                    @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/lazy-loading-ngmodules/**                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/lazy-loading-ngmodules/**             @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/lifecycle-hooks.md                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/lifecycle-hooks/**                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/lifecycle-hooks/**                    @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/examples/ngcontainer/**                            @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/ngmodules.md                                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/ngmodules/**                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/ngmodule-api.md                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/ngmodule-faq.md                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/ngmodule-faq/**                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/ngmodule-vs-jsmodule.md                      @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/module-types.md                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/template-syntax.md                           @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/event-binding/**                          @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/interpolation/**                          @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/template-syntax/**                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/template-syntax/**                    @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/pipes.md                                     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/pipes/**                                  @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/pipes/**                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/providers.md                                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/providers/**                              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/singleton-services.md                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/set-document-title.md                        @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/set-document-title/**                     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/set-document-title/**                 @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/sharing-ngmodules.md                         @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/structural-directives.md                     @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/structural-directives/**                  @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/structural-directives/**              @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+/aio/content/guide/user-input.md                                @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/user-input/**                             @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/user-input/**                         @angular/fw-core @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/common/http
+#  @angular/http
+# ================================================
+
+/packages/common/http/**                                        @angular/fw-http @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/http/**                                               @angular/fw-http @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/http.md                                      @angular/fw-http @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/http/**                                   @angular/fw-http @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/http/**                               @angular/fw-http @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/elements
+# ================================================
+
+/packages/elements/**                                           @angular/fw-elements @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/elements/**                               @angular/fw-elements @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/elements/**                           @angular/fw-elements @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/elements.md                                  @angular/fw-elements @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/forms
+# ================================================
+
+/packages/forms/**                                              @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/forms.md                                     @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/forms/**                                  @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/forms/**                              @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/forms-overview.md                            @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/forms-overview/**                         @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/forms-overview/**                     @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/form-validation.md                           @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/form-validation/**                        @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/form-validation/**                    @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/dynamic-form.md                              @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/dynamic-form/**                           @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/dynamic-form/**                       @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/reactive-forms.md                            @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/reactive-forms/**                         @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/reactive-forms/**                     @angular/fw-forms @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/language-service
+# ================================================
+
+/packages/language-service/**                                   @angular/tools-language-service @angular/framework-global-approvers
+/aio/content/guide/language-service.md                          @angular/tools-language-service @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/language-service/**                   @angular/tools-language-service @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/platform-server
+# ================================================
+
+/packages/platform-server/**                                    @angular/fw-server @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/universal.md                                 @angular/fw-server @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/universal/**                              @angular/fw-server @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/router
+# ================================================
+
+/packages/router/**                                             @angular/fw-router @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/router.md                                    @angular/fw-router @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/router/**                                 @angular/fw-router @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/router/**                             @angular/fw-router @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/service-worker
+# ================================================
+
+/packages/service-worker/**                                     @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/service-worker-getting-started.md            @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/service-worker-getting-started/**         @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/service-worker-communications.md             @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/service-worker-config.md                     @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/service-worker-devops.md                     @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/service-worker-intro.md                      @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/service-worker/**                     @angular/fw-service-worker @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/upgrade
+# ================================================
+
+/packages/upgrade/**                                            @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/examples/upgrade/**                                   @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/upgrade.md                                   @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/upgrade-module/**                         @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/upgrade/**                            @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/upgrade-phonecat-1-typescript/**          @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/upgrade-phonecat-2-hybrid/**              @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/upgrade-phonecat-3-final/**               @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/upgrade-performance.md                       @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/ajs-quick-reference.md                       @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/ajs-quick-reference/**                    @angular/fw-upgrade @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular/**/testing
+# ================================================
+
+testing/**                                                      @angular/fw-testing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/testing.md                                   @angular/fw-testing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/testing/**                                @angular/fw-testing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/testing/**                            @angular/fw-testing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular i18n
+# ================================================
+
+/packages/core/src/i18n/**                                      @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/core/src/render3/i18n.ts                              @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/core/src/render3/i18n.md                              @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/core/src/render3/interfaces/i18n.ts                   @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/locales/**                                     @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/src/i18n/**                                    @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/src/pipes/date_pipe.ts                         @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/src/pipes/i18n_plural_pipe.ts                  @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/src/pipes/i18n_select_pipe.ts                  @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/common/src/pipes/number_pipe.ts                       @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/compiler/src/i18n/**                                  @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/compiler/src/render3/view/i18n/**                     @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/packages/compiler-cli/src/extract_i18n.ts                      @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/i18n.md                                      @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/i18n/**                                   @angular/fw-i18n @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  @angular security
+# ================================================
+
+/packages/core/src/sanitization/**                              @angular/fw-security
+/packages/core/test/linker/security_integration_spec.ts         @angular/fw-security
+/packages/compiler/src/schema/**                                @angular/fw-security
+/packages/platform-browser/src/security/**                      @angular/fw-security
+/aio/content/guide/security.md                                  @angular/fw-security @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/security/**                               @angular/fw-security @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/security/**                           @angular/fw-security @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  benchpress
+# ================================================
+
+/packages/benchpress/**                                         @angular/tools-benchpress @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  /integration/*
+# ================================================
+
+/integration/**                                                 @angular/fw-integration @angular/framework-global-approvers
+
+
+
+# ================================================
+#  docs-infra
+# ================================================
+
+/aio/*                                                          @angular/docs-infra @angular/framework-global-approvers
+/aio/aio-builds-setup/**                                        @angular/docs-infra @angular/framework-global-approvers
+/aio/scripts/**                                                 @angular/docs-infra @angular/framework-global-approvers
+/aio/src/**                                                     @angular/docs-infra @angular/framework-global-approvers
+/aio/tests/**                                                   @angular/docs-infra @angular/framework-global-approvers
+/aio/tools/**                                                   @angular/docs-infra @angular/framework-global-approvers
+
+# Hidden docs
+/aio/content/guide/change-log.md                                @angular/docs-infra @angular/framework-global-approvers
+/aio/content/guide/docs-style-guide.md                          @angular/docs-infra @angular/framework-global-approvers
+/aio/content/examples/docs-style-guide/**                       @angular/docs-infra @angular/framework-global-approvers
+/aio/content/images/guide/docs-style-guide/**                   @angular/docs-infra @angular/framework-global-approvers
+/aio/content/guide/visual-studio-2015.md                        @angular/docs-infra @angular/framework-global-approvers
+/aio/content/examples/visual-studio-2015/**                     @angular/docs-infra @angular/framework-global-approvers
+
+
+
+# ================================================
+#  Docs: getting started & tutorial
+# ================================================
+
+/aio/content/guide/quickstart.md                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/cli-quickstart/**                         @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/cli-quickstart/**                     @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/tutorial/**                                        @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/toh/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt0/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt1/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt2/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt3/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt4/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt5/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/toh-pt6/**                                @angular/fw-docs-intro @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  Docs: observables
+# ================================================
+
+/aio/content/guide/observables.md                               @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/observables/**                            @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/comparing-observables.md                     @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/observables-in-angular.md                    @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/observables-in-angular/**                 @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/practical-observable-usage.md                @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/practical-observable-usage/**             @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/rx-library.md                                @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/rx-library/**                             @angular/fw-docs-observables @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  Docs: packaging, tooling, releasing
+# ================================================
+
+/aio/content/guide/npm-packages.md                              @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/browser-support.md                           @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/typescript-configuration.md                  @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/quickstart/**                             @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/setup.md                                     @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/examples/setup/**                                  @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/build.md                                     @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/guide/build/**                              @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/deployment.md                                @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/file-structure.md                            @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/releases.md                                  @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/updating.md                                  @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/workspace-config.md                          @angular/fw-docs-packaging @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  Docs: libraries
+# ================================================
+
+/aio/content/guide/creating-libraries.md                        @angular/tools-docs-libraries @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/libraries.md                                 @angular/tools-docs-libraries @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/guide/using-libraries.md                           @angular/tools-docs-libraries @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  Docs: marketing
+# ================================================
+
+/aio/content/marketing/**                                       @angular/fw-docs-marketing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/bios/**                                     @angular/fw-docs-marketing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/images/marketing/**                                @angular/fw-docs-marketing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/navigation.json                                    @angular/fw-docs-marketing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+/aio/content/license.md                                         @angular/fw-docs-marketing @angular/framework-global-approvers @angular/framework-global-approvers-for-docs-only-changes
+
+
+
+# ================================================
+#  Build & CI Owners
+# ================================================
+
+/*                                                              @angular/fw-dev-infra
+/.buildkite/**                                                  @angular/fw-dev-infra
+/.circleci/**                                                   @angular/fw-dev-infra
+/.codefresh/**                                                  @angular/fw-dev-infra
+/.github/**                                                     @angular/fw-dev-infra
+/.vscode/**                                                     @angular/fw-dev-infra
+/docs/BAZEL.md                                                  @angular/fw-dev-infra
+/packages/*                                                     @angular/fw-dev-infra
+/scripts/**                                                     @angular/fw-dev-infra
+/third_party/**                                                 @angular/fw-dev-infra
+/tools/**                                                       @angular/fw-dev-infra
+*.bzl                                                           @angular/fw-dev-infra
+
+
+
+# ================================================
+#  Public API
+# ================================================
+
+/tools/public_api_guard/**                                      @angular/fw-public-api
+/aio/content/guide/glossary.md                                  @angular/fw-public-api
+/aio/content/guide/styleguide.md                                @angular/fw-public-api
+/aio/content/examples/styleguide/**                             @angular/fw-public-api
+/aio/content/images/guide/styleguide/**                         @angular/fw-public-api
+
+
+
+# ================================================
+#  CODEOWNERS Owners owners ...
+# ================================================
+
+/.github/CODEOWNERS                                             @IgorMinar @angular/framework-global-approvers

.github/ISSUE_TEMPLATE.md

@@ -1,39 +1,10 @@
-<!--
-IF YOU DON'T FILL OUT THE FOLLOWING INFORMATION WE MIGHT CLOSE YOUR ISSUE WITHOUT INVESTIGATING
--->
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
 
-**I'm submitting a ...**  (check one with "x")
-```
-[ ] bug report => search github for a similar issue or PR before submitting
-[ ] feature request
-[ ] support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
-```
+Please help us process issues more efficiently by filing an
+issue using one of the following templates:
 
-**Current behavior**
-<!-- Describe how the bug manifests. -->
+https://github.com/angular/angular/issues/new/choose
 
-**Expected behavior**
-<!-- Describe what the behavior would be without the bug. -->
+Thank you!
 
-**Minimal reproduction of the problem with instructions**
-<!--
-If the current behavior is a bug or you can illustrate your feature request better with an example, 
-please provide the *STEPS TO REPRODUCE* and if possible a *MINIMAL DEMO* of the problem via
-https://plnkr.co or similar (you can use this template as a starting point: http://plnkr.co/edit/tpl:AvJOMERrnz94ekVua0u5).
--->
-
-**What is the motivation / use case for changing the behavior?**
-<!-- Describe the motivation or the concrete use case -->
-
-**Please tell us about your environment:**
-<!-- Operating system, IDE, package manager, HTTP server, ... -->
-
-* **Angular version:** 2.0.X
-<!-- Check whether this is still an issue in the most recent Angular version -->
-
-* **Browser:** [all | Chrome XX | Firefox XX | IE XX | Safari XX | Mobile Chrome XX | Android X.X Web Browser | iOS XX Safari | iOS XX UIWebView | iOS XX WKWebView ]
-<!-- All browsers where this could be reproduced -->
- 
-* **Language:** [all | TypeScript X.X | ES6/7 | ES5]
-
-* **Node (for AoT issues):** `node --version` =   
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

.github/ISSUE_TEMPLATE/1-bug-report.md

@@ -0,0 +1,69 @@
+---
+name: "\U0001F41EBug report"
+about: Report a bug in the Angular Framework
+---
+<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅
+
+Oh hi there! 😄
+
+To expedite issue processing please search open and closed issues before submitting a new one.
+Existing issues often contain information about workarounds, resolution, or progress updates.
+
+🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅-->
+
+
+# 🐞 bug report
+
+### Affected Package
+<!-- Can you pin-point one or more @angular/* packages as the source of the bug? -->
+<!-- ✍️edit: --> The issue is caused by package @angular/....
+
+
+### Is this a regression?
+
+<!-- Did this behavior use to work in the previous version? -->
+<!-- ✍️--> Yes, the previous version in which this bug was not present was: ....
+
+
+### Description
+
+<!-- ✍️--> A clear and concise description of the problem...
+
+
+## 🔬 Minimal Reproduction
+<!--
+Please create and share minimal reproduction of the issue starting with this template: https://stackblitz.com/fork/angular-issue-repro2
+-->
+<!-- ✍️--> https://stackblitz.com/...
+
+<!--
+If StackBlitz is not suitable for reproduction of your issue, please create a minimal GitHub repository with the reproduction of the issue.
+A good way to make a minimal reproduction is to create a new app via `ng new repro-app` and add the minimum possible code to show the problem. 
+Share the link to the repo below along with step-by-step instructions to reproduce the problem, as well as expected and actual behavior.
+
+Issues that don't have enough info and can't be reproduced will be closed.
+
+You can read more about issue submission guidelines here: https://github.com/angular/angular/blob/master/CONTRIBUTING.md#-submitting-an-issue
+-->
+
+## 🔥 Exception or Error
+<pre><code>
+<!-- If the issue is accompanied by an exception or an error, please share it below: -->
+<!-- ✍️-->
+
+</code></pre>
+
+
+## 🌍  Your Environment
+
+**Angular Version:**
+<pre><code>
+<!-- run `ng version` and paste output below -->
+<!-- ✍️-->
+
+</code></pre>
+
+**Anything else relevant?**
+<!-- ✍️Is this a browser specific issue? If so, please specify the browser and version. -->
+
+<!-- ✍️Do any of these matter: operating system, IDE, package manager, HTTP server, ...? If so, please mention it below. -->

.github/ISSUE_TEMPLATE/2-feature-request.md

@@ -0,0 +1,32 @@
+---
+name: "\U0001F680Feature request"
+about: Suggest a feature for Angular Framework
+
+---
+<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅
+
+Oh hi there! 😄 
+
+To expedite issue processing please search open and closed issues before submitting a new one.
+Existing issues often contain information about workarounds, resolution, or progress updates.
+
+🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅-->
+
+
+# 🚀 feature request
+
+### Relevant Package
+<!-- Can you pin-point one or more @angular/* packages the are relevant for this feature request? -->
+<!-- ✍️edit: --> This feature request is for @angular/....
+
+
+### Description
+<!-- ✍️--> A clear and concise description of the problem or missing capability...
+
+
+### Describe the solution you'd like
+<!-- ✍️--> If you have a solution in mind, please describe it.
+
+
+### Describe alternatives you've considered
+<!-- ✍️--> Have you considered any alternative solutions or workarounds?

.github/ISSUE_TEMPLATE/3-docs-bug.md

@@ -0,0 +1,55 @@
+---
+name: "📚 Docs or angular.io issue report"
+about: Report an issue in Angular's documentation or angular.io application
+
+---
+<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅
+
+Oh hi there! 😄
+
+To expedite issue processing please search open and closed issues before submitting a new one.
+Existing issues often contain information about workarounds, resolution, or progress updates.
+
+🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅-->
+
+# 📚 Docs or angular.io bug report
+
+### Description
+
+<!-- ✍️edit:--> A clear and concise description of the problem...
+
+
+## 🔬 Minimal Reproduction
+
+### What's the affected URL?**
+<!-- ✍️edit:--> https://angular.io/...
+
+### Reproduction Steps**
+<!-- If applicable please list the steps to take to reproduce the issue -->
+<!-- ✍️edit:-->
+
+### Expected vs Actual Behavior**
+<!-- If applicable please describe the difference between the expected and actual behavior after following the repro steps. -->
+<!-- ✍️edit:-->
+
+
+## 📷Screenshot
+<!-- Often a screenshot can help to capture the issue better than a long description. -->
+<!-- ✍️upload a screenshot:-->
+
+
+## 🔥 Exception or Error
+<pre><code>
+<!-- If the issue is accompanied by an exception or an error, please share it below: -->
+<!-- ✍️-->
+
+</code></pre>
+
+
+## 🌍  Your Environment
+
+### Browser info
+<!-- ✍️Is this a browser specific issue? If so, please specify the device, browser, and version. -->
+
+### Anything else relevant?
+<!-- ✍️Please provide additional info if necessary. -->

.github/ISSUE_TEMPLATE/4-security-issue-disclosure.md

@@ -0,0 +1,11 @@
+---
+name: ⚠️ Security issue disclosure
+about: Report a security issue in Angular Framework, Material, or CLI
+
+---
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
+
+Please read https://angular.io/guide/security#report-issues on how to disclose security related issues.
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

.github/ISSUE_TEMPLATE/5-support-request.md

@@ -0,0 +1,16 @@
+---
+name: "❓Support request"
+about: Questions and requests for support
+
+---
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
+
+Please do not file questions or support requests on the GitHub issues tracker.
+
+You can get your questions answered using other communication channels. Please see: 
+https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
+
+Thank you!
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

.github/ISSUE_TEMPLATE/6-angular-cli.md

@@ -0,0 +1,13 @@
+---
+name: "\U0001F6E0️Angular CLI"
+about: Issues and feature requests for Angular CLI
+
+---
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
+
+Please file any Angular CLI issues at: https://github.com/angular/angular-cli/issues/new
+
+For the time being, we keep Angular CLI issues in a separate repository.
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

.github/ISSUE_TEMPLATE/7-angular-material.md

@@ -0,0 +1,13 @@
+---
+name: "\U0001F48EAngular Material"
+about: Issues and feature requests for Angular Material
+
+---
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
+
+Please file any Angular Material issues at: https://github.com/angular/material2/issues/new
+
+For the time being, we keep Angular Material issues in a separate repository.
+
+🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,36 +1,43 @@
-**Please check if the PR fulfills these requirements**
+## PR Checklist
+Please check if your PR fulfills the following requirements:
+
 - [ ] The commit message follows our guidelines: https://github.com/angular/angular/blob/master/CONTRIBUTING.md#commit
 - [ ] Tests for the changes have been added (for bug fixes / features)
 - [ ] Docs have been added / updated (for bug fixes / features)
 
 
-**What kind of change does this PR introduce?** (check one with "x")
-```
-[ ] Bugfix
-[ ] Feature
-[ ] Code style update (formatting, local variables)
-[ ] Refactoring (no functional changes, no api changes)
-[ ] Build related changes
-[ ] CI related changes
-[ ] Other... Please describe:
-```
+## PR Type
+What kind of change does this PR introduce?
 
-**What is the current behavior?** (You can also link to an open issue here)
+<!-- Please check the one that applies to this PR using "x". -->
+
+- [ ] Bugfix
+- [ ] Feature
+- [ ] Code style update (formatting, local variables)
+- [ ] Refactoring (no functional changes, no api changes)
+- [ ] Build related changes
+- [ ] CI related changes
+- [ ] Documentation content changes
+- [ ] angular.io application / infrastructure changes
+- [ ] Other... Please describe:
 
 
+## What is the current behavior?
+<!-- Please describe the current behavior that you are modifying, or link to a relevant issue. -->
 
-**What is the new behavior?**
+Issue Number: N/A
 
 
-
-**Does this PR introduce a breaking change?** (check one with "x")
-```
-[ ] Yes
-[ ] No
-```
-
-If this PR contains a breaking change, please describe the impact and migration path for existing applications: ...
+## What is the new behavior?
 
 
-**Other information**:
+## Does this PR introduce a breaking change?
 
+- [ ] Yes
+- [ ] No
+
+
+<!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->
+
+
+## Other information

.github/angular-robot.yml

@@ -0,0 +1,167 @@
+# Configuration for angular-robot
+
+#options for the size plugin
+size:
+  disabled: false
+  maxSizeIncrease: 2000
+  circleCiStatusName: "ci/circleci: test_ivy_aot"
+
+# options for the merge plugin
+merge:
+  # the status will be added to your pull requests
+  status:
+    # set to true to disable
+    disabled: false
+    # the name of the status
+    context: "ci/angular: merge status"
+    # text to show when all checks pass
+    successText: "All checks passed!"
+    # text to show when some checks are failing
+    failureText: "The following checks are failing:"
+
+  # the g3 status will be added to your pull requests if they include files that match the patterns
+  g3Status:
+    # set to true to disable
+    disabled: false
+    # the name of the status
+    context: "google3"
+    # text to show when the status is pending, {{PRNumber}} will be replaced by the PR number
+    pendingDesc: "Googler: run g3sync presubmit {{PRNumber}}"
+    # text to show when the status is success
+    successDesc: "Does not affect google3"
+    # link to use for the details
+    url: "http://go/angular-g3sync"
+    # list of patterns to check for the files changed by the PR
+    # this list must be manually kept in sync with google3/third_party/javascript/angular2/copy.bara.sky
+    include:
+      - "LICENSE"
+      - "modules/**"
+      - "packages/**"
+    # list of patterns to ignore for the files changed by the PR
+    exclude:
+      - "packages/*"
+      - "packages/bazel/*"
+      - "packages/bazel/src/builders/**"
+      - "packages/bazel/src/ng_package/**"
+      - "packages/bazel/src/protractor/**"
+      - "packages/bazel/src/schematics/**"
+      - "packages/compiler-cli/src/ngcc/**"
+      - "packages/docs/**"
+      - "packages/elements/schematics/**"
+      - "packages/examples/**"
+      - "packages/language-service/**"
+      - "packages/private/**"
+      - "packages/service-worker/**"
+      - "**/.gitignore"
+      - "**/.gitkeep"
+      - "**/yarn.lock"
+      - "**/package.json"
+      - "**/third_party/**"
+      - "**/tsconfig-build.json"
+      - "**/tsconfig.json"
+      - "**/BUILD.bazel"
+      - "**/*.md"
+      - "packages/**/integrationtest/**"
+      - "packages/**/test/**"
+
+  # comment that will be added to a PR when there is a conflict, leave empty or set to false to disable
+  mergeConflictComment: "Hi @{{PRAuthor}}! This PR has merge conflicts due to recent upstream merges.
+\nPlease help to unblock it by resolving these conflicts. Thanks!"
+
+  # label to monitor
+  mergeLabel: "PR action: merge"
+
+  # adding any of these labels will also add the merge label
+  mergeLinkedLabels:
+    - "PR action: merge-assistance"
+
+  # list of checks that will determine if the merge label can be added
+  checks:
+
+    # require that the PR has reviews from all requested reviewers
+    #
+    # This enables us to request reviews from both eng and tech writers, or multiple eng folks, and prevents accidental merges.
+    # Rather than merging PRs with pending reviews, if all approvals are obtained and additional reviews are not needed, any pending reviewers should be removed via GitHub UI (this also leaves an audit trail behind these decisions).
+    requireReviews: true,
+
+    # whether the PR shouldn't have a conflict with the base branch
+    noConflict: true
+    # list of labels that a PR needs to have, checked with a regexp (e.g. "PR target:" will work for the label "PR target: master")
+    requiredLabels:
+      - "PR target: *"
+      - "cla: yes"
+
+    # list of labels that a PR shouldn't have, checked after the required labels with a regexp
+    forbiddenLabels:
+      - "PR target: TBD"
+      - "PR action: cleanup"
+      - "PR action: review"
+      - "PR state: blocked"
+      - "cla: no"
+
+    # list of PR statuses that need to be successful
+    requiredStatuses:
+      - "ci/circleci: build"
+      - "ci/circleci: lint"
+      - "ci/circleci: publish_snapshot"
+      - "ci/angular: size"
+      - "cla/google"
+      - "google3"
+
+
+  # the comment that will be added when the merge label is added despite failing checks, leave empty or set to false to disable
+  # {{MERGE_LABEL}} will be replaced by the value of the mergeLabel option
+  # {{PLACEHOLDER}} will be replaced by the list of failing checks
+  mergeRemovedComment: "I see that you just added the `{{MERGE_LABEL}}` label, but the following checks are still failing:
+\n{{PLACEHOLDER}}
+\n
+\n**If you want your PR to be merged, it has to pass all the CI checks.**
+\n
+\nIf you can't get the PR to a green state due to flakes or broken master, please try rebasing to master and/or restarting the CI job. If that fails and you believe that the issue is not due to your change, please contact the caretaker and ask for help."
+
+# options for the triage plugin
+triage:
+  # number of the milestone to apply when the issue has not been triaged yet
+  needsTriageMilestone: 83,
+  # number of the milestone to apply when the issue is triaged
+  defaultMilestone: 82,
+  # arrays of labels that determine if an issue has been triaged by the caretaker
+  l1TriageLabels:
+    -
+      - "comp: *"
+  # arrays of labels that determine if an issue has been fully triaged
+  l2TriageLabels:
+    -
+      - "type: bug/fix"
+      - "severity*"
+      - "freq*"
+      - "comp: *"
+    -
+      - "type: feature"
+      - "comp: *"
+    -
+      - "type: refactor"
+      - "comp: *"
+    -
+      - "type: RFC / Discussion / question"
+      - "comp: *"
+
+# options for the triage PR plugin
+triagePR:
+  # set to true to disable
+  disabled: false
+  # number of the milestone to apply when the PR has not been triaged yet
+  needsTriageMilestone: 83,
+  # number of the milestone to apply when the PR is triaged
+  defaultMilestone: 82,
+  # arrays of labels that determine if a PR has been triaged by the caretaker
+  l1TriageLabels:
+    -
+      - "comp: *"
+  # arrays of labels that determine if a PR has been fully triaged
+  l2TriageLabels:
+    -
+      - "type: *"
+      - "effort*"
+      - "risk*"
+      - "comp: *"

.gitignore

@@ -1,17 +1,21 @@
 .DS_STORE
 
 /dist/
+/bazel-out/
+/integration/bazel/bazel-*
+e2e_test.*
 node_modules
 bower_components
+tools/gulp-tasks/cldr/cldr-data/
 
 # Include when developing application packages.
 pubspec.lock
 .c9
 .idea/
 .settings/
+.vscode/launch.json
 *.swo
 modules/.settings
-.vscode
 modules/.vscode
 
 # Don't check in secret files
@@ -26,3 +30,7 @@ yarn-error.log
 
 # rollup-test output
 /modules/rollup-test/dist/
+
+# User specific bazel settings
+.bazelrc.user
+

.mailmap

@@ -0,0 +1 @@
+Michał Gołębiowski-Owczarek <m.goleb@gmail.com>

.nvmrc

@@ -1 +1 @@
-6.9.5
+10.9.0

.pullapprove.yml

@@ -1,257 +0,0 @@
-# Configuration for pullapprove.com
-#
-# Approval access and primary role is determined by info in the project ownership spreadsheet:
-# https://docs.google.com/spreadsheets/d/1-HIlzfbPYGsPr9KuYMe6bLfc4LXzPjpoALqtYRYTZB0/edit?pli=1#gid=0&vpid=A5
-#
-# === GitHub username to Full name map ===
-#
-# alexeagle - Alex Eagle
-# alxhub - Alex Rickabaugh
-# chuckjaz - Chuck Jazdzewski
-# gkalpak - George Kalpakas
-# IgorMinar - Igor Minar
-# jasonaden - Jason Aden
-# kara - Kara Erickson
-# matsko - Matias Niemelä
-# mhevery - Misko Hevery
-# petebacondarwin - Pete Bacon Darwin
-# pkozlowski-opensource - Pawel Kozlowski
-# robwormald - Rob Wormald
-# tbosch - Tobias Bosch
-# vicb - Victor Berchet
-# vikerman - Vikram Subramanian
-# wardbell - Ward Bell
-# tinayuangao - Tina Gao
-
-version: 2
-
-group_defaults:
-  required: 1
-  reset_on_reopened:
-    enabled: true
-  approve_by_comment:
-    enabled: false
-
-groups:
-  root:
-    conditions:
-      files:
-        include:
-          - "*"
-        exclude:
-          - "aio/*"
-          - "integration/*"
-          - "modules/*"
-          - "packages/*"
-          - "tools/*"
-    users:
-      - IgorMinar
-      - mhevery
-
-  public-api:
-    conditions:
-      files:
-        include:
-          - "tools/public_api_guard/*"
-    users:
-      - IgorMinar
-      - mhevery
-
-  build-and-ci:
-    conditions:
-      files:
-        include:
-          - "*.yml"
-          - "*.json"
-          - "*.lock"
-          - "tools/*"
-        exclude:
-          - "tools/@angular/tsc-wrapped/*"
-          - "tools/public_api_guard/*"
-          - "aio/*"
-    users:
-      - IgorMinar #primary
-      - alexeagle
-      - jasonaden
-      - mhevery #fallback
-
-  integration:
-    conditions:
-      files:
-        - "integration/*"
-    users:
-      - alexeagle
-      - mhevery
-      - tbosch
-      - vicb
-      - IgorMinar #fallback
-
-
-  core:
-    conditions:
-      files:
-        - "packages/core/*"
-    users:
-      - tbosch #primary
-      - mhevery
-      - vicb
-      - IgorMinar #fallback
-
-  compiler/animations:
-    conditions:
-      files:
-        - "packages/compiler/src/animation/*"
-    users:
-      - matsko #primary
-      - tbosch
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  compiler/i18n:
-    conditions:
-      files:
-        - "packages/compiler/src/i18n/*"
-    users:
-      - vicb #primary
-      - tbosch
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  compiler:
-    conditions:
-      files:
-        - "packages/compiler/*"
-    users:
-      - tbosch #primary
-      - vicb
-      - chuckjaz
-      - mhevery
-      - IgorMinar #fallback
-
-  compiler-cli:
-    conditions:
-      files:
-        - "tools/@angular/tsc-wrapped/*"
-        - "packages/compiler-cli/*"
-    users:
-      - alexeagle
-      - chuckjaz
-      - tbosch
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  common:
-    conditions:
-      files:
-        - "packages/common/*"
-    users:
-      - pkozlowski-opensource #primary
-      - vicb
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  forms:
-    conditions:
-      files:
-        - "packages/forms/*"
-    users:
-      - kara #primary
-      - tinayuangao #secondary
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  http:
-    conditions:
-      files:
-        - "packages/http/*"
-    users:
-      - vikerman #primary
-      - alxhub
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  language-service:
-    conditions:
-      files:
-        - "packages/language-service/*"
-    users:
-      - chuckjaz #primary
-      - tbosch #secondary
-      - vicb
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  router:
-    conditions:
-      files:
-        - "packages/router/*"
-    users:
-      - jasonaden
-      - vicb
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  upgrade:
-    conditions:
-      files:
-        - "packages/upgrade/*"
-    users:
-      - petebacondarwin #primary
-      - gkalpak
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  platform-browser:
-    conditions:
-      files:
-        - "packages/platform-browser/*"
-    users:
-      - tbosch #primary
-      - vicb #secondary
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  platform-server:
-    conditions:
-      files:
-        - "packages/platform-server/*"
-    users:
-      - vikerman #primary
-      - alxhub
-      - vicb
-      - tbosch
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  platform-webworker:
-    conditions:
-      files:
-        - "packages/platform-webworker/*"
-    users:
-      - vicb #primary
-      - tbosch #secondary
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-
-
-  benchpress:
-    conditions:
-      files:
-        - "packages/benchpress/*"
-    users:
-      - tbosch #primary
-      # needs secondary
-      - IgorMinar #fallback
-      - mhevery #fallback
-
-  angular.io:
-    conditions:
-      files:
-        - "aio/*"
-    users:
-      - IgorMinar #primary
-      - petebacondarwin #secondary
-      - gkalpak
-      - wardbell
-      - mhevery #fallback

.travis.yml

@@ -1,75 +0,0 @@
-language: node_js
-sudo: false
-node_js:
-  - '6.9.5'
-
-addons:
-#  firefox: "38.0"
-  apt:
-    sources:
-      # needed to install g++ that is used by npms's native modules
-      - ubuntu-toolchain-r-test
-    packages:
-      # needed to install g++ that is used by npms's native modules
-      - g++-4.8
-  # https://docs.travis-ci.com/user/jwt
-  jwt:
-    # SAUCE_ACCESS_KEY<=secret for NGBUILDS_IO_KEY to work around travis-ci/travis-ci#7223, unencrypted value in valentine as NGBUILDS_IO_KEY>
-    # we alias NGBUILDS_IO_KEY to $SAUCE_ACCESS_KEY in env.sh and set the SAUCE_ACCESS_KEY there
-    - secure: "L7nrZwkAtFtYrP2DykPXgZvEKjkv0J/TwQ/r2QGxFTaBq4VZn+2Dw0YS7uCxoMqYzDwH0aAOqxoutibVpk8Z/16nE3tNmU5RzltMd6Xmt3qU2f/JDQLMo6PSlBodnjOUsDHJgmtrcbjhqrx/znA237BkNUu6UZRT7mxhXIZpn0U="
-branches:
-  except:
-    - g3
-
-cache:
-  yarn: true
-  directories:
-     - ./node_modules
-     - ./.chrome/chromium
-     - ./aio/node_modules
-
-env:
-  global:
-    # GITHUB_TOKEN_ANGULAR=<github token, a personal access token of the angular-builds account, account access in valentine>
-    # This is needed for the e2e Travis matrix task to publish packages to github for continuous packages delivery.
-    - secure: "aCdHveZuY8AT4Jr1JoJB4LxZsnGWRe/KseZh1YXYe5UtufFCtTVHvUcLn0j2aLBF0KpdyS+hWf0i4np9jthKu2xPKriefoPgCMpisYeC0MFkwbmv+XlgkUbgkgVZMGiVyX7DCYXVahxIoOUjVMEDCbNiHTIrfEuyq24U3ok2tHc="
-    # FIREBASE_TOKEN
-    # This is needed for publishing builds to the "aio-staging" firebase site.
-    # TODO(i): the token was generated using the iminar@google account, we should switch to a shared/role-base account.
-    - secure: "MPx3UM77o5IlhT75PKHL0FXoB5tSXDc3vnCXCd1sRy4XUTZ9vjcV6nNuyqEf+SOw659bGbC1FI4mACGx1Q+z7MQDR85b1mcA9uSgHDkh+IR82CnCVdaX9d1RXafdJIArahxfmorbiiPPLyPIKggo7ituRm+2c+iraoCkE/pXxYg="
-  matrix:
-    # Order: a slower build first, so that we don't occupy an idle travis worker waiting for others to complete.
-    - CI_MODE=e2e
-    - CI_MODE=e2e_2
-    - CI_MODE=js
-    - CI_MODE=saucelabs_required
-    - CI_MODE=browserstack_required
-    - CI_MODE=saucelabs_optional
-    - CI_MODE=browserstack_optional
-    - CI_MODE=docs_test
-    - CI_MODE=aio
-    - CI_MODE=aio_e2e
-
-matrix:
-  fast_finish: true
-  allow_failures:
-    - env: "CI_MODE=saucelabs_optional"
-    - env: "CI_MODE=browserstack_optional"
-    - env: "CI_MODE=aio_e2e"
-
-before_install:
-  # source the env.sh script so that the exported variables are available to other scripts later on
-  - source ./scripts/ci/env.sh print
-
-install:
-  - ./scripts/ci/install.sh
-
-script:
-  - ./scripts/ci/build.sh
-  - ./scripts/ci/test.sh
-  # deploy is part of 'script' and not 'after_success' so that we fail the build if the deployment fails
-  - ./scripts/ci/deploy.sh
-  - ./scripts/ci/angular.sh
-  # all the scripts under this line will not quickly abort in case ${TRAVIS_TEST_RESULT} is 1 (job failure)
-  - ./scripts/ci/cleanup.sh
-  - ./scripts/ci/print-logs.sh

.vscode/extensions.json

@@ -0,0 +1,12 @@
+{
+  // See http://go.microsoft.com/fwlink/?LinkId=827846 to learn about workspace recommendations.
+  // Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
+
+  // List of extensions which should be recommended for users of this workspace.
+  "recommendations": [
+    "devondcarew.bazel-code",
+    "gkalpak.aio-docs-utils",
+    "ms-vscode.vscode-typescript-tslint-plugin",
+    "xaver.clang-format",
+  ],
+}

.vscode/settings.json

@@ -0,0 +1,27 @@
+{
+  "[javascript]": {
+    "editor.formatOnSave": true,
+  },
+  "[typescript]": {
+    "editor.formatOnSave": true,
+  },
+  // Please install https://marketplace.visualstudio.com/items?itemName=xaver.clang-format to take advantage of `clang-format` in VSCode.
+  // (See https://clang.llvm.org/docs/ClangFormat.html for more info `clang-format`.)
+  "clang-format.executable": "${workspaceRoot}/node_modules/.bin/clang-format",
+  "files.watcherExclude": {
+    "**/.git/objects/**": true,
+    "**/.git/subtree-cache/**": true,
+    "**/node_modules/**": true,
+    "**/bazel-out/**": true,
+    "**/dist/**": true,
+    "**/aio/src/generated/**": true,
+  },
+  "search.exclude": {
+    "**/node_modules": true,
+    "**/bower_components": true,
+    "**/bazel-out": true,
+    "**/dist": true,
+    "**/aio/src/generated": true,
+  },
+  "git.ignoreLimitWarning": true,
+}

BUILD.bazel

@@ -0,0 +1,36 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files([
+    "tsconfig.json",
+    "LICENSE",
+    "protractor-perf.conf.js",
+])
+
+filegroup(
+    name = "web_test_bootstrap_scripts",
+    # do not sort
+    srcs = [
+        "@npm//node_modules/reflect-metadata:Reflect.js",
+        "@npm//node_modules/zone.js:dist/zone.js",
+        "@npm//node_modules/zone.js:dist/zone-testing.js",
+        "@npm//node_modules/zone.js:dist/task-tracking.js",
+        "//:test-events.js",
+    ],
+)
+
+filegroup(
+    name = "angularjs_scripts",
+    srcs = [
+        # We also declare the unminfied AngularJS files since these can be used for
+        # local debugging (e.g. see: packages/upgrade/test/common/test_helpers.ts)
+        "@npm//node_modules/angular:angular.js",
+        "@npm//node_modules/angular:angular.min.js",
+        "@npm//node_modules/angular-1.5:angular.js",
+        "@npm//node_modules/angular-1.5:angular.min.js",
+        "@npm//node_modules/angular-1.6:angular.js",
+        "@npm//node_modules/angular-1.6:angular.min.js",
+        "@npm//node_modules/angular-mocks:angular-mocks.js",
+        "@npm//node_modules/angular-mocks-1.5:angular-mocks.js",
+        "@npm//node_modules/angular-mocks-1.6:angular-mocks.js",
+    ],
+)

CODE_OF_CONDUCT.md

@@ -0,0 +1,12 @@
+# Contributor Code of Conduct
+## Version 0.3b-angular
+
+As contributors and maintainers of the Angular project, we pledge to respect everyone who contributes by posting issues, updating documentation, submitting pull requests, providing feedback in comments, and any other activities.
+
+Communication through any of Angular's channels (GitHub, Gitter, IRC, mailing lists, Google+, Twitter, etc.) must be constructive and never resort to personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct.
+
+We promise to extend courtesy and respect to everyone involved in this project regardless of gender, gender identity, sexual orientation, disability, age, race, ethnicity, religion, or level of experience. We expect anyone contributing to the Angular project to do the same.
+
+If any member of the community violates this code of conduct, the maintainers of the Angular project may take action, removing issues, comments, and PRs or blocking accounts as deemed appropriate.
+
+If you are subject to or witness unacceptable behavior, or have any other concerns, please email us at [conduct@angular.io](mailto:conduct@angular.io).

CONTRIBUTING.md

@@ -17,15 +17,15 @@ Help us keep Angular open and inclusive. Please read and follow our [Code of Con
 
 ## <a name="question"></a> Got a Question or Problem?
 
-Please, do not open issues for the general support questions as we want to keep GitHub issues for bug reports and feature requests. You've got much better chances of getting your question answered on [StackOverflow](https://stackoverflow.com/questions/tagged/angular) where the questions should be tagged with tag `angular`.
+Do not open issues for general support questions as we want to keep GitHub issues for bug reports and feature requests. You've got much better chances of getting your question answered on [Stack Overflow](https://stackoverflow.com/questions/tagged/angular) where the questions should be tagged with tag `angular`.
 
-StackOverflow is a much better place to ask questions since:
+Stack Overflow is a much better place to ask questions since:
 
-- there are thousands of people willing to help on StackOverflow
+- there are thousands of people willing to help on Stack Overflow
 - questions and answers stay available for public viewing so your question / answer might help someone else
-- StackOverflow's voting system assures that the best answers are prominently visible.
+- Stack Overflow's voting system assures that the best answers are prominently visible.
 
-To save your and our time we will be systematically closing all the issues that are requests for general support and redirecting people to StackOverflow.
+To save your and our time, we will systematically close all issues that are requests for general support and redirect people to Stack Overflow.
 
 If you would like to chat about the question in real-time, you can reach out via [our gitter channel][gitter].
 
@@ -51,54 +51,53 @@ and help you to craft the change so that it is successfully accepted into the pr
 
 Before you submit an issue, please search the issue tracker, maybe an issue for your problem already exists and the discussion might inform you of workarounds readily available.
 
-We want to fix all the issues as soon as possible, but before fixing a bug we need to reproduce and confirm it. In order to reproduce bugs we will systematically ask you to provide a minimal reproduction scenario using http://plnkr.co. Having a live, reproducible scenario gives us wealth of important information without going back & forth to you with additional questions like:
+We want to fix all the issues as soon as possible, but before fixing a bug we need to reproduce and confirm it. In order to reproduce bugs, we will systematically ask you to provide a minimal reproduction. Having a minimal reproducible scenario gives us a wealth of important information without going back & forth to you with additional questions.
 
-- version of Angular used
-- 3rd-party libraries and their versions
-- and most importantly - a use-case that fails
+A minimal reproduction allows us to quickly confirm a bug (or point out a coding problem) as well as confirm that we are fixing the right problem.
 
-A minimal reproduce scenario using http://plnkr.co/ allows us to quickly confirm a bug (or point out coding problem) as well as confirm that we are fixing the right problem. If plunker is not a suitable way to demonstrate the problem (for example for issues related to our npm packaging), please create a standalone git repository demonstrating the problem.
+We will be insisting on a minimal reproduction scenario in order to save maintainers time and ultimately be able to fix more bugs. Interestingly, from our experience users often find coding problems themselves while preparing a minimal reproduction. We understand that sometimes it might be hard to extract essential bits of code from a larger code-base but we really need to isolate the problem before we can fix it.
 
-We will be insisting on a minimal reproduce scenario in order to save maintainers time and ultimately be able to fix more bugs. Interestingly, from our experience users often find coding problems themselves while preparing a minimal plunk. We understand that sometimes it might be hard to extract essentials bits of code from a larger code-base but we really need to isolate the problem before we can fix it.
+Unfortunately, we are not able to investigate / fix bugs without a minimal reproduction, so if we don't hear back from you we are going to close an issue that doesn't have enough info to be reproduced.
 
-Unfortunately we are not able to investigate / fix bugs without a minimal reproduction, so if we don't hear back from you we are going to close an issue that don't have enough info to be reproduced.
-
-You can file new issues by filling out our [new issue form](https://github.com/angular/angular/issues/new).
+You can file new issues by selecting from our [new issue templates](https://github.com/angular/angular/issues/new/choose) and filling out the issue template.
 
 
 ### <a name="submit-pr"></a> Submitting a Pull Request (PR)
 Before you submit your Pull Request (PR) consider the following guidelines:
 
-* Search [GitHub](https://github.com/angular/angular/pulls) for an open or closed PR
+1. Search [GitHub](https://github.com/angular/angular/pulls) for an open or closed PR
   that relates to your submission. You don't want to duplicate effort.
-* Please sign our [Contributor License Agreement (CLA)](#cla) before sending PRs.
-  We cannot accept code without this.
-* Make your changes in a new git branch:
+1. Be sure that an issue describes the problem you're fixing, or documents the design for the feature you'd like to add.
+  Discussing the design up front helps to ensure that we're ready to accept your work.
+1. Please sign our [Contributor License Agreement (CLA)](#cla) before sending PRs.
+  We cannot accept code without this. Make sure you sign with the primary email address of the Git identity that has been granted access to the Angular repository.
+1. Fork the angular/angular repo.
+1. Make your changes in a new git branch:
 
      ```shell
      git checkout -b my-fix-branch master
      ```
 
-* Create your patch, **including appropriate test cases**.
-* Follow our [Coding Rules](#rules).
-* Run the full Angular test suite, as described in the [developer documentation][dev-doc],
+1. Create your patch, **including appropriate test cases**.
+1. Follow our [Coding Rules](#rules).
+1. Run the full Angular test suite, as described in the [developer documentation][dev-doc],
   and ensure that all tests pass.
-* Commit your changes using a descriptive commit message that follows our
+1. Commit your changes using a descriptive commit message that follows our
   [commit message conventions](#commit). Adherence to these conventions
   is necessary because release notes are automatically generated from these messages.
 
      ```shell
      git commit -a
      ```
-  Note: the optional commit `-a` command line option will automatically "add" and "rm" edited files.
+    Note: the optional commit `-a` command line option will automatically "add" and "rm" edited files.
 
-* Push your branch to GitHub:
+1. Push your branch to GitHub:
 
     ```shell
     git push origin my-fix-branch
     ```
 
-* In GitHub, send a pull request to `angular:master`.
+1. In GitHub, send a pull request to `angular:master`.
 * If we suggest changes then:
   * Make the required updates.
   * Re-run the Angular test suites to ensure tests are still passing.
@@ -172,12 +171,12 @@ The **header** is mandatory and the **scope** of the header is optional.
 Any line of the commit message cannot be longer 100 characters! This allows the message to be easier
 to read on GitHub as well as in various git tools.
 
-Footer should contain a [closing reference to an issue](https://help.github.com/articles/closing-issues-via-commit-messages/) if any.
+The footer should contain a [closing reference to an issue](https://help.github.com/articles/closing-issues-via-commit-messages/) if any.
 
 Samples: (even more [samples](https://github.com/angular/angular/commits/master))
 
 ```
-docs(changelog): update change log to beta.5
+docs(changelog): update changelog to beta.5
 ```
 ```
 fix(release): need to depend on latest rxjs and zone.js
@@ -192,25 +191,26 @@ If the commit reverts a previous commit, it should begin with `revert: `, follow
 Must be one of the following:
 
 * **build**: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
-* **ci**: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
+* **ci**: Changes to our CI configuration files and scripts (example scopes: Circle, BrowserStack, SauceLabs)
 * **docs**: Documentation only changes
 * **feat**: A new feature
 * **fix**: A bug fix
 * **perf**: A code change that improves performance
 * **refactor**: A code change that neither fixes a bug nor adds a feature
-* **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing
-  semi-colons, etc)
+* **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 * **test**: Adding missing tests or correcting existing tests
 
 ### Scope
-The scope should be the name of the npm package affected (as perceived by person reading changelog generated from commit messages.
+The scope should be the name of the npm package affected (as perceived by the person reading the changelog generated from commit messages.
 
 The following is the list of supported scopes:
 
+* **animations**
 * **common**
 * **compiler**
 * **compiler-cli**
 * **core**
+* **elements**
 * **forms**
 * **http**
 * **language-service**
@@ -220,21 +220,26 @@ The following is the list of supported scopes:
 * **platform-webworker**
 * **platform-webworker-dynamic**
 * **router**
+* **service-worker**
 * **upgrade**
-* **tsc-wrapped**
 
-There is currently few exception to the "use package name" rule:
+There are currently a few exceptions to the "use package name" rule:
 
-* **packaging**: used for changes that change the npm package layout in all of our packages, e.g. public path changes, package.json changes done to all packages, d.ts file/format changes, changes to bundles, etc.
+* **packaging**: used for changes that change the npm package layout in all of our packages, e.g.
+  public path changes, package.json changes done to all packages, d.ts file/format changes, changes
+  to bundles, etc.
 * **changelog**: used for updating the release notes in CHANGELOG.md
-* **aio**: used for docs-app (angular.io) related changes within the /aio directory of the repo
-* none/empty string: useful for `style`, `test` and `refactor` changes that are done across all packages (e.g. `style: add missing semicolons`)
+* **docs-infra**: used for docs-app (angular.io) related changes within the /aio directory of the
+  repo
+* none/empty string: useful for `style`, `test` and `refactor` changes that are done across all
+  packages (e.g. `style: add missing semicolons`) and for docs changes that are not related to a
+  specific package (e.g. `docs: fix typo in tutorial`).
 
 ### Subject
-The subject contains succinct description of the change:
+The subject contains a succinct description of the change:
 
 * use the imperative, present tense: "change" not "changed" nor "changes"
-* don't capitalize first letter
+* don't capitalize the first letter
 * no dot (.) at the end
 
 ### Body
@@ -258,6 +263,19 @@ changes to be accepted, the CLA must be signed. It's a quick process, we promise
 * For corporations we'll need you to
   [print, sign and one of scan+email, fax or mail the form][corporate-cla].
 
+<hr>
+
+  If you have more than one Git identity, you must make sure that you sign the CLA using the primary email address associated with the ID that has been granted access to the Angular repository. Git identities can be associated with more than one email address, and only one is primary. Here are some links to help you sort out multiple Git identities and email addresses:
+
+  * https://help.github.com/articles/setting-your-commit-email-address-in-git/
+  * https://stackoverflow.com/questions/37245303/what-does-usera-committed-with-userb-13-days-ago-on-github-mean
+  * https://help.github.com/articles/about-commit-email-addresses/
+  * https://help.github.com/articles/blocking-command-line-pushes-that-expose-your-personal-email-address/
+
+  Note that if you have more than one Git identity, it is important to verify that you are logged in with the same ID with which you signed the CLA, before you commit changes. If not, your PR will fail the CLA check.
+
+<hr>
+
 
 [angular-group]: https://groups.google.com/forum/#!forum/angular
 [coc]: https://github.com/angular/code-of-conduct/blob/master/CODE_OF_CONDUCT.md

LICENSE

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright (c) 2014-2017 Google, Inc. http://angular.io
+Copyright (c) 2010-2019 Google LLC. http://angular.io/license
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,30 +1,28 @@
-[![Build Status](https://travis-ci.org/angular/angular.svg?branch=master)](https://travis-ci.org/angular/angular)
 [![CircleCI](https://circleci.com/gh/angular/angular/tree/master.svg?style=shield)](https://circleci.com/gh/angular/angular/tree/master)
+[![BrowserStack Status](https://www.browserstack.com/automate/badge.svg?badge_key=LzF3RzBVVGt6VWE2S0hHaC9uYllOZz09LS1BVjNTclBKV0x4eVRlcjA4QVY1M0N3PT0=--eb4ce8c8dc2c1c5b2b5352d473ee12a73ac20e06)](https://www.browserstack.com/automate/public-build/LzF3RzBVVGt6VWE2S0hHaC9uYllOZz09LS1BVjNTclBKV0x4eVRlcjA4QVY1M0N3PT0=--eb4ce8c8dc2c1c5b2b5352d473ee12a73ac20e06)
 [![Join the chat at https://gitter.im/angular/angular](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/angular/angular?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Issue Stats](http://issuestats.com/github/angular/angular/badge/pr?style=flat)](http://issuestats.com/github/angular/angular)
-[![Issue Stats](http://issuestats.com/github/angular/angular/badge/issue?style=flat)](http://issuestats.com/github/angular/angular)
-[![npm version](https://badge.fury.io/js/%40angular%2Fcore.svg)](https://badge.fury.io/js/%40angular%2Fcore)
+[![npm version](https://badge.fury.io/js/%40angular%2Fcore.svg)](https://www.npmjs.com/@angular/core)
 
-[![Sauce Test Status](https://saucelabs.com/browser-matrix/angular2-ci.svg)](https://saucelabs.com/u/angular2-ci)
-*Safari (7+), iOS (7+), Edge (14) and IE mobile (11) are tested on [BrowserStack][browserstack].*
 
-Angular
-=========
-
-Angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript (JS) and other languages.
+# Angular
 
+Angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript and other languages.
 
 ## Quickstart
 
 [Get started in 5 minutes][quickstart].
 
+## Changelog
+
+[Learn about the latest improvements][changelog]. 
 
 ## Want to help?
 
 Want to file a bug, contribute some code, or improve documentation? Excellent! Read up on our
 guidelines for [contributing][contributing] and then check out one of our issues in the [hotlist: community-help](https://github.com/angular/angular/labels/hotlist%3A%20community-help).
 
-[browserstack]: https://www.browserstack.com/
-[contributing]: http://github.com/angular/angular/blob/master/CONTRIBUTING.md
-[quickstart]: https://angular.io/docs/ts/latest/quickstart.html
-[ng]: http://angular.io
+[browserstack]: https://www.browserstack.com/automate/public-build/LzF3RzBVVGt6VWE2S0hHaC9uYllOZz09LS1BVjNTclBKV0x4eVRlcjA4QVY1M0N3PT0=--eb4ce8c8dc2c1c5b2b5352d473ee12a73ac20e06
+[contributing]: https://github.com/angular/angular/blob/master/CONTRIBUTING.md
+[quickstart]: https://angular.io/guide/quickstart
+[changelog]: https://github.com/angular/angular/blob/master/CHANGELOG.md
+[ng]: https://angular.io

WORKSPACE

@@ -0,0 +1,114 @@
+workspace(name = "angular")
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+# Uncomment for local bazel rules development
+#local_repository(
+#    name = "build_bazel_rules_nodejs",
+#    path = "../rules_nodejs",
+#)
+#local_repository(
+#    name = "npm_bazel_typescript",
+#    path = "../rules_typescript",
+#)
+
+# Fetch rules_nodejs so we can install our npm dependencies
+http_archive(
+    name = "build_bazel_rules_nodejs",
+    sha256 = "5c86b055c57e15bf32d9009a15bcd6d8e190c41b1ff2fb18037b75e0012e4e7c",
+    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/0.26.0/rules_nodejs-0.26.0.tar.gz"],
+)
+
+# Check the bazel version and download npm dependencies
+load("@build_bazel_rules_nodejs//:defs.bzl", "check_bazel_version", "node_repositories", "yarn_install")
+load("@build_bazel_rules_nodejs//:package.bzl", "check_rules_nodejs_version")
+
+# Bazel version must be at least v0.21.0 because:
+#   - 0.21.0 Using --incompatible_strict_action_env flag fixes cache when running `yarn bazel`
+#            (see https://github.com/angular/angular/issues/27514#issuecomment-451438271)
+check_bazel_version(
+    message = """
+You no longer need to install Bazel on your machine.
+Angular has a dependency on the @bazel/bazel package which supplies it.
+Try running `yarn bazel` instead.
+    (If you did run that, check that you've got a fresh `yarn install`)
+
+""",
+    minimum_bazel_version = "0.21.0",
+)
+
+# The NodeJS rules version must be at least v0.15.3 because:
+#   - 0.15.2 Re-introduced the prod_only attribute on yarn_install
+#   - 0.15.3 Includes a fix for the `jasmine_node_test` rule ignoring target tags
+#   - 0.16.8 Supports npm installed bazel workspaces
+#   - 0.26.0 Fix for data files in yarn_install and npm_install
+check_rules_nodejs_version("0.26.0")
+
+# Setup the Node.js toolchain
+node_repositories(
+    node_version = "10.9.0",
+    package_json = ["//:package.json"],
+    preserve_symlinks = True,
+    yarn_version = "1.12.1",
+)
+
+yarn_install(
+    name = "npm",
+    data = [
+        "//:tools/npm/@angular_bazel/index.js",
+        "//:tools/npm/@angular_bazel/package.json",
+        "//:tools/postinstall-patches.js",
+        "//:tools/yarn/check-yarn.js",
+    ],
+    package_json = "//:package.json",
+    # Don't install devDependencies, they are large and not used under Bazel
+    prod_only = True,
+    yarn_lock = "//:yarn.lock",
+)
+
+yarn_install(
+    name = "ts-api-guardian_deps",
+    package_json = "@angular//tools/ts-api-guardian:package.json",
+    yarn_lock = "@angular//tools/ts-api-guardian:yarn.lock",
+)
+
+# Install all bazel dependencies of the @npm npm packages
+load("@npm//:install_bazel_dependencies.bzl", "install_bazel_dependencies")
+
+install_bazel_dependencies()
+
+# Load angular dependencies
+load("//packages/bazel:package.bzl", "rules_angular_dev_dependencies")
+
+rules_angular_dev_dependencies()
+
+# Load karma dependencies
+load("@npm_bazel_karma//:package.bzl", "rules_karma_dependencies")
+
+rules_karma_dependencies()
+
+# Setup the rules_webtesting toolchain
+load("@io_bazel_rules_webtesting//web:repositories.bzl", "web_test_repositories")
+
+web_test_repositories()
+
+# Temporary work-around for https://github.com/angular/angular/issues/28681
+# TODO(gregmagolan): go back to @io_bazel_rules_webtesting browser_repositories
+load("@npm_bazel_karma//:browser_repositories.bzl", "browser_repositories")
+
+browser_repositories()
+
+# Setup the rules_typescript tooolchain
+load("@npm_bazel_typescript//:index.bzl", "ts_setup_workspace")
+
+ts_setup_workspace()
+
+# Setup the rules_sass toolchain
+load("@io_bazel_rules_sass//sass:sass_repositories.bzl", "sass_repositories")
+
+sass_repositories()
+
+# Setup the skydoc toolchain
+load("@io_bazel_skydoc//skylark:skylark.bzl", "skydoc_repositories")
+
+skydoc_repositories()

aio/.angular-cli.json

@@ -1,65 +0,0 @@
-{
-  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
-  "project": {
-    "name": "site"
-  },
-  "apps": [
-    {
-      "root": "src",
-      "outDir": "dist",
-      "assets": [
-        "assets",
-        "generated",
-        "app/search/search-worker.js",
-        "favicon.ico",
-        "pwa-manifest.json"
-      ],
-      "index": "index.html",
-      "main": "main.ts",
-      "polyfills": "polyfills.ts",
-      "test": "test.ts",
-      "tsconfig": "tsconfig.app.json",
-      "testTsconfig": "tsconfig.spec.json",
-      "prefix": "aio",
-      "serviceWorker": true,
-      "styles": [
-        "styles.scss"
-      ],
-      "scripts": [
-
-      ],
-      "environmentSource": "environments/environment.ts",
-      "environments": {
-        "dev": "environments/environment.ts",
-        "prod": "environments/environment.prod.ts"
-      }
-    }
-  ],
-  "e2e": {
-    "protractor": {
-      "config": "./protractor.conf.js"
-    }
-  },
-  "lint": [
-    {
-      "project": "src/tsconfig.app.json"
-    },
-    {
-      "project": "src/tsconfig.spec.json"
-    },
-    {
-      "project": "e2e/tsconfig.e2e.json"
-    }
-  ],
-  "test": {
-    "karma": {
-      "config": "./karma.conf.js"
-    }
-  },
-  "defaults": {
-    "styleExt": "scss",
-    "component": {
-      "inlineStyle": true
-    }
-  }
-}

aio/.firebaserc

@@ -1,5 +0,0 @@
-{
-  "projects": {
-    "staging": "aio-staging"
-  }
-}

aio/.gitignore

@@ -26,10 +26,13 @@
 !.vscode/extensions.json
 
 # misc
+/.firebase/
 /.sass-cache
 /connect.lock
 /coverage
 /libpeerconnection.log
+debug.log
+firebase-debug.log
 npm-debug.log
 testem.log
 /typings

aio/README.md

@@ -4,20 +4,26 @@ Everything in this folder is part of the documentation project. This includes
 
 * the web site for displaying the documentation
 * the dgeni configuration for converting source files to rendered files that can be viewed in the web site.
-* the tooling for setting up examples for development; and generating plunkers and zip files from the examples.
+* the tooling for setting up examples for development; and generating live-example and zip files from the examples.
 
 ## Developer tasks
 
-We use `yarn` to manage the dependencies and to run build tasks.
+We use [Yarn](https://yarnpkg.com) to manage the dependencies and to run build tasks.
 You should run all these tasks from the `angular/aio` folder.
 Here are the most important tasks you might need to use:
 
 * `yarn` - install all the dependencies.
-* `yarn setup` - Install all the dependencies, boilerplate, plunkers, zips and runs dgeni on the docs.
+* `yarn setup` - install all the dependencies, boilerplate, stackblitz, zips and run dgeni on the docs.
+* `yarn setup-local` - same as `setup`, but use the locally built Angular packages for aio and docs examples boilerplate.
+
+* `yarn build` - create a production build of the application (after installing dependencies, boilerplate, etc).
+* `yarn build-local` - same as `build`, but use `setup-local` instead of `setup`.
 
 * `yarn start` - run a development web server that watches the files; then builds the doc-viewer and reloads the page, as necessary.
+* `yarn serve-and-sync` - run both the `docs-watch` and `start` in the same console.
 * `yarn lint` - check that the doc-viewer code follows our style rules.
 * `yarn test` - watch all the source files, for the doc-viewer, and run all the unit tests when any change.
+* `yarn test --watch=false` - run all the unit tests once.
 * `yarn e2e` - run all the e2e tests for the doc-viewer.
 
 * `yarn docs` - generate all the docs from the source files.
@@ -25,15 +31,37 @@ Here are the most important tasks you might need to use:
 * `yarn docs-lint` - check that the doc gen code follows our style rules.
 * `yarn docs-test` - run the unit tests for the doc generation code.
 
-* `yarn boilerplate:add` - generate all the boilerplate code for the examples, so that they can be run locally.
+* `yarn boilerplate:add` - generate all the boilerplate code for the examples, so that they can be run locally. Add the option `--local` to use your local version of Angular contained in the "dist" folder.
 * `yarn boilerplate:remove` - remove all the boilerplate code that was added via `yarn boilerplate:add`.
-* `yarn generate-plunkers` - generate the plunker files that are used by the `live-example` tags in the docs.
+* `yarn generate-stackblitz` - generate the stackblitz files that are used by the `live-example` tags in the docs.
 * `yarn generate-zips` - generate the zip files from the examples. Zip available via the `live-example` tags in the docs.
 
+* `yarn example-e2e` - run all e2e tests for examples
+  - `yarn example-e2e --setup` - force webdriver update & other setup, then run tests
+  - `yarn example-e2e --filter=foo` - limit e2e tests to those containing the word "foo"
+  - `yarn example-e2e --setup --local` - run e2e tests with the local version of Angular contained in the "dist" folder
+
+## Developing on Windows
+The `packages/` directory may contain Linux-specific symlinks, which are not recognized by Windows.
+These unresolved links cause the docs generation process to fail because it cannot locate certain files.
+
+> Hint: The following steps require administration rights or [Windows Developer Mode](https://docs.microsoft.com/en-us/windows/uwp/get-started/enable-your-device-for-development) enabled!
+
+To fix this problem, run `scripts/windows/create-symlinks.sh`. This command creates temporary files where the symlinks used to be. Make sure not to commit those files with your documentation changes.
+When you are done making and testing your documentation changes, you can restore the original symlinks and delete the temporary files by running `scripts/windows/remove-symlinks.sh`.
+
+It's necessary to remove the temporary files, because otherwise they're displayed as local changes in your git working copy and certain operations are blocked.
+
+## Using ServiceWorker locally
+
+Running `yarn start` (even when explicitly targeting production mode) does not set up the
+ServiceWorker. If you want to test the ServiceWorker locally, you can use `yarn build` and then
+serve the files in `dist/` with `yarn http-server dist -p 4200`.
+
 
 ## Guide to authoring
 
-There are two types of content in the documentatation:
+There are two types of content in the documentation:
 
 * **API docs**: descriptions of the modules, classes, interfaces, decorators, etc that make up the Angular platform.
 API docs are generated directly from the source code.
@@ -45,8 +73,16 @@ The content is written in markdown.
 All other content is written using markdown in text files, located in the `angular/aio/content` folder.
 More specifically, there are sub-folders that contain particular types of content: guides, tutorial and marketing.
 
+* **Code examples**: code examples need to be testable to ensure their accuracy.
+Also, our examples have a specific look and feel and allow the user to copy the source code. For larger
+examples they are rendered in a tabbed interface (e.g. template, HTML, and TypeScript on separate
+tabs). Additionally, some are live examples, which provide links where the code can be edited, executed, and/or downloaded. For details on working with code examples, please read the [Code snippets](https://angular.io/guide/docs-style-guide#code-snippets), [Source code markup](https://angular.io/guide/docs-style-guide#source-code-markup), and [Live examples](https://angular.io/guide/docs-style-guide#live-examples) pages of the [Authors Style Guide](https://angular.io/guide/docs-style-guide).
+
 We use the [dgeni](https://github.com/angular/dgeni) tool to convert these files into docs that can be viewed in the doc-viewer.
 
+The [Authors Style Guide](https://angular.io/guide/docs-style-guide) prescribes guidelines for
+writing guide pages, explains how to use the documentation classes and components, and how to markup sample source code to produce code snippets.
+
 ### Generating the complete docs
 
 The main task for generating the docs is `yarn docs`. This will process all the source files (API and other),
@@ -56,7 +92,7 @@ extracting the documentation and generating JSON files that can be consumed by t
 
 Full doc generation can take up to one minute. That's too slow for efficient document creation and editing.
 
-You can make small changes in a smart editor that displays formatted markdown: 
+You can make small changes in a smart editor that displays formatted markdown:
 >In VS Code, _Cmd-K, V_ opens markdown preview in side pane; _Cmd-B_ toggles left sidebar
 
 You also want to see those changes displayed properly in the doc viewer
@@ -74,8 +110,7 @@ The general setup is as follows:
 * Open a terminal, ensure the dependencies are installed; run an initial doc generation; then start the doc-viewer:
 
 ```bash
-yarn
-yarn docs
+yarn setup
 yarn start
 ```
 
@@ -85,8 +120,16 @@ yarn start
 yarn docs-watch
 ```
 
+>Alternatively, try the consolidated `serve-and-sync` command that builds, watches and serves in the same terminal window
+```bash
+yarn serve-and-sync
+```
+
 * Open a browser at https://localhost:4200/ and navigate to the document on which you want to work.
-You can automatically open the browser by using `yarn start -- -o` in the first terminal.
+You can automatically open the browser by using `yarn start -o` in the first terminal.
 
 * Make changes to the page's associated doc or example files. Every time a file is saved, the doc will
 be regenerated, the app will rebuild and the page will reload.
+
+* If you get a build error complaining about examples or any other odd behavior, be sure to consult
+the [Authors Style Guide](https://angular.io/guide/docs-style-guide).

aio/aio-builds-setup/dockerbuild/Dockerfile

@@ -8,49 +8,62 @@ LABEL name="angular.io PR preview" \
 
 VOLUME /aio-secrets
 VOLUME /var/www/aio-builds
+VOLUME /dockerbuild
 
 EXPOSE 80 443
 
 
 # Build-time args and env vars
+# The AIO_ARTIFACT_PATH path needs to be kept in synch with the value of
+# `aio_preview->steps->store_artifacts->destination` property in `.circleci/config.yml`
+ARG      AIO_ARTIFACT_PATH=aio/dist/aio-snapshot.tgz
+ARG TEST_AIO_ARTIFACT_PATH=$AIO_ARTIFACT_PATH
 ARG      AIO_BUILDS_DIR=/var/www/aio-builds
 ARG TEST_AIO_BUILDS_DIR=/tmp/aio-builds
 ARG      AIO_DOMAIN_NAME=ngbuilds.io
 ARG TEST_AIO_DOMAIN_NAME=$AIO_DOMAIN_NAME.localhost
 ARG      AIO_GITHUB_ORGANIZATION=angular
-ARG TEST_AIO_GITHUB_ORGANIZATION=angular
-ARG      AIO_GITHUB_TEAM_SLUGS=angular-core,aio-contributors
-ARG TEST_AIO_GITHUB_TEAM_SLUGS=angular-core,aio-contributors
+ARG TEST_AIO_GITHUB_ORGANIZATION=test-org
+ARG      AIO_GITHUB_REPO=angular
+ARG TEST_AIO_GITHUB_REPO=test-repo
+ARG      AIO_GITHUB_TEAM_SLUGS=aio-auto-previews,aio-contributors
+ARG TEST_AIO_GITHUB_TEAM_SLUGS=test-team-1,test-team-2
 ARG      AIO_NGINX_HOSTNAME=$AIO_DOMAIN_NAME
 ARG TEST_AIO_NGINX_HOSTNAME=$TEST_AIO_DOMAIN_NAME
 ARG      AIO_NGINX_PORT_HTTP=80
 ARG TEST_AIO_NGINX_PORT_HTTP=8080
 ARG      AIO_NGINX_PORT_HTTPS=443
 ARG TEST_AIO_NGINX_PORT_HTTPS=4433
-ARG      AIO_REPO_SLUG=angular/angular
-ARG TEST_AIO_REPO_SLUG=test-repo/test-slug
-ARG      AIO_UPLOAD_HOSTNAME=upload.localhost
-ARG TEST_AIO_UPLOAD_HOSTNAME=upload.localhost
-ARG      AIO_UPLOAD_MAX_SIZE=20971520
-ARG TEST_AIO_UPLOAD_MAX_SIZE=20971520
-ARG      AIO_UPLOAD_PORT=3000
-ARG TEST_AIO_UPLOAD_PORT=3001
+ARG      AIO_SIGNIFICANT_FILES_PATTERN='^(?:aio|packages)/(?!.*[._]spec\\.[jt]s$)'
+ARG TEST_AIO_SIGNIFICANT_FILES_PATTERN=$AIO_SIGNIFICANT_FILES_PATTERN
+ARG      AIO_TRUSTED_PR_LABEL="aio: preview"
+ARG TEST_AIO_TRUSTED_PR_LABEL="aio: preview"
+ARG      AIO_PREVIEW_SERVER_HOSTNAME=preview.localhost
+ARG TEST_AIO_PREVIEW_SERVER_HOSTNAME=preview.localhost
+ARG      AIO_ARTIFACT_MAX_SIZE=20971520
+ARG TEST_AIO_ARTIFACT_MAX_SIZE=200
+ARG      AIO_PREVIEW_SERVER_PORT=3000
+ARG TEST_AIO_PREVIEW_SERVER_PORT=3001
 
-ENV AIO_BUILDS_DIR=$AIO_BUILDS_DIR                     TEST_AIO_BUILDS_DIR=$TEST_AIO_BUILDS_DIR                     \
-    AIO_DOMAIN_NAME=$AIO_DOMAIN_NAME                   TEST_AIO_DOMAIN_NAME=$TEST_AIO_DOMAIN_NAME                   \
-    AIO_GITHUB_ORGANIZATION=$AIO_GITHUB_ORGANIZATION   TEST_AIO_GITHUB_ORGANIZATION=$TEST_AIO_GITHUB_ORGANIZATION   \
-    AIO_GITHUB_TEAM_SLUGS=$AIO_GITHUB_TEAM_SLUGS       TEST_AIO_GITHUB_TEAM_SLUGS=$TEST_AIO_GITHUB_TEAM_SLUGS       \
-    AIO_LOCALCERTS_DIR=/etc/ssl/localcerts             TEST_AIO_LOCALCERTS_DIR=/etc/ssl/localcerts-test             \
-    AIO_NGINX_HOSTNAME=$AIO_NGINX_HOSTNAME             TEST_AIO_NGINX_HOSTNAME=$TEST_AIO_NGINX_HOSTNAME             \
-    AIO_NGINX_LOGS_DIR=/var/log/aio/nginx              TEST_AIO_NGINX_LOGS_DIR=/var/log/aio/nginx-test              \
-    AIO_NGINX_PORT_HTTP=$AIO_NGINX_PORT_HTTP           TEST_AIO_NGINX_PORT_HTTP=$TEST_AIO_NGINX_PORT_HTTP           \
-    AIO_NGINX_PORT_HTTPS=$AIO_NGINX_PORT_HTTPS         TEST_AIO_NGINX_PORT_HTTPS=$TEST_AIO_NGINX_PORT_HTTPS         \
-    AIO_REPO_SLUG=$AIO_REPO_SLUG                       TEST_AIO_REPO_SLUG=$TEST_AIO_REPO_SLUG                       \
-    AIO_SCRIPTS_JS_DIR=/usr/share/aio-scripts-js                                                                    \
-    AIO_SCRIPTS_SH_DIR=/usr/share/aio-scripts-sh                                                                    \
-    AIO_UPLOAD_HOSTNAME=$AIO_UPLOAD_HOSTNAME           TEST_AIO_UPLOAD_HOSTNAME=$TEST_AIO_UPLOAD_HOSTNAME           \
-    AIO_UPLOAD_MAX_SIZE=$AIO_UPLOAD_MAX_SIZE           TEST_AIO_UPLOAD_MAX_SIZE=$TEST_AIO_UPLOAD_MAX_SIZE           \
-    AIO_UPLOAD_PORT=$AIO_UPLOAD_PORT                   TEST_AIO_UPLOAD_PORT=$TEST_AIO_UPLOAD_PORT                   \
+ENV AIO_ARTIFACT_PATH=$AIO_ARTIFACT_PATH                          TEST_AIO_ARTIFACT_PATH=$TEST_AIO_ARTIFACT_PATH                          \
+    AIO_BUILDS_DIR=$AIO_BUILDS_DIR                                TEST_AIO_BUILDS_DIR=$TEST_AIO_BUILDS_DIR                                \
+    AIO_DOMAIN_NAME=$AIO_DOMAIN_NAME                              TEST_AIO_DOMAIN_NAME=$TEST_AIO_DOMAIN_NAME                              \
+    AIO_GITHUB_ORGANIZATION=$AIO_GITHUB_ORGANIZATION              TEST_AIO_GITHUB_ORGANIZATION=$TEST_AIO_GITHUB_ORGANIZATION              \
+    AIO_GITHUB_REPO=$AIO_GITHUB_REPO                              TEST_AIO_GITHUB_REPO=$TEST_AIO_GITHUB_REPO                              \
+    AIO_GITHUB_TEAM_SLUGS=$AIO_GITHUB_TEAM_SLUGS                  TEST_AIO_GITHUB_TEAM_SLUGS=$TEST_AIO_GITHUB_TEAM_SLUGS                  \
+    AIO_LOCALCERTS_DIR=/etc/ssl/localcerts                        TEST_AIO_LOCALCERTS_DIR=/etc/ssl/localcerts-test                        \
+    AIO_NGINX_HOSTNAME=$AIO_NGINX_HOSTNAME                        TEST_AIO_NGINX_HOSTNAME=$TEST_AIO_NGINX_HOSTNAME                        \
+    AIO_NGINX_LOGS_DIR=/var/log/aio/nginx                         TEST_AIO_NGINX_LOGS_DIR=/var/log/aio/nginx-test                         \
+    AIO_NGINX_PORT_HTTP=$AIO_NGINX_PORT_HTTP                      TEST_AIO_NGINX_PORT_HTTP=$TEST_AIO_NGINX_PORT_HTTP                      \
+    AIO_NGINX_PORT_HTTPS=$AIO_NGINX_PORT_HTTPS                    TEST_AIO_NGINX_PORT_HTTPS=$TEST_AIO_NGINX_PORT_HTTPS                    \
+    AIO_SCRIPTS_JS_DIR=/usr/share/aio-scripts-js                                                                                          \
+    AIO_SCRIPTS_SH_DIR=/usr/share/aio-scripts-sh                                                                                          \
+    AIO_SIGNIFICANT_FILES_PATTERN=$AIO_SIGNIFICANT_FILES_PATTERN  TEST_AIO_SIGNIFICANT_FILES_PATTERN=$TEST_AIO_SIGNIFICANT_FILES_PATTERN  \
+    AIO_TRUSTED_PR_LABEL=$AIO_TRUSTED_PR_LABEL                    TEST_AIO_TRUSTED_PR_LABEL=$TEST_AIO_TRUSTED_PR_LABEL                    \
+    AIO_PREVIEW_SERVER_HOSTNAME=$AIO_PREVIEW_SERVER_HOSTNAME                      TEST_AIO_PREVIEW_SERVER_HOSTNAME=$TEST_AIO_PREVIEW_SERVER_HOSTNAME                      \
+    AIO_ARTIFACT_MAX_SIZE=$AIO_ARTIFACT_MAX_SIZE                      TEST_AIO_ARTIFACT_MAX_SIZE=$TEST_AIO_ARTIFACT_MAX_SIZE                      \
+    AIO_PREVIEW_SERVER_PORT=$AIO_PREVIEW_SERVER_PORT                              TEST_AIO_PREVIEW_SERVER_PORT=$TEST_AIO_PREVIEW_SERVER_PORT                              \
+    AIO_WWW_USER=www-data                                                                                                                 \
     NODE_ENV=production
 
 
@@ -60,9 +73,10 @@ RUN mkdir /var/log/aio
 
 # Add extra package sources
 RUN apt-get update -y && apt-get install -y curl
-RUN curl --silent --show-error --location https://deb.nodesource.com/setup_6.x | bash -
+RUN curl --silent --show-error --location https://deb.nodesource.com/setup_10.x | bash -
 RUN curl --silent --show-error https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
 RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
+RUN echo "deb http://ftp.debian.org/debian jessie-backports main" | tee /etc/apt/sources.list.d/backports.list
 
 
 # Install packages
@@ -71,11 +85,11 @@ RUN apt-get update -y && apt-get install -y \
     cron \
     dnsmasq \
     nano \
-    nginx \
     nodejs \
     openssl \
     rsyslog \
     yarn
+RUN apt-get install -t jessie-backports -y nginx
 RUN yarn global add pm2@2
 
 
@@ -94,9 +108,9 @@ RUN printenv | grep AIO_ >> /etc/environment
 # Set up dnsmasq
 COPY dnsmasq/dnsmasq.conf /etc/
 RUN sed -i "s|{{\$AIO_NGINX_HOSTNAME}}|$AIO_NGINX_HOSTNAME|g" /etc/dnsmasq.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$AIO_UPLOAD_HOSTNAME|g" /etc/dnsmasq.conf
+RUN sed -i "s|{{\$AIO_PREVIEW_SERVER_HOSTNAME}}|$AIO_PREVIEW_SERVER_HOSTNAME|g" /etc/dnsmasq.conf
 RUN sed -i "s|{{\$TEST_AIO_NGINX_HOSTNAME}}|$TEST_AIO_NGINX_HOSTNAME|g" /etc/dnsmasq.conf
-RUN sed -i "s|{{\$TEST_AIO_UPLOAD_HOSTNAME}}|$TEST_AIO_UPLOAD_HOSTNAME|g" /etc/dnsmasq.conf
+RUN sed -i "s|{{\$TEST_AIO_PREVIEW_SERVER_HOSTNAME}}|$TEST_AIO_PREVIEW_SERVER_HOSTNAME|g" /etc/dnsmasq.conf
 
 
 # Set up SSL/TLS certificates
@@ -109,31 +123,31 @@ RUN update-ca-certificates
 
 
 # Set up nginx (for production and testing)
-RUN rm /etc/nginx/sites-enabled/*
+RUN sed -i -E "s|^user\s+\S+;|user $AIO_WWW_USER;|" /etc/nginx/nginx.conf
+RUN rm -f /etc/nginx/conf.d/*
+RUN rm -f /etc/nginx/sites-enabled/*
 
-COPY nginx/aio-builds.conf /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$AIO_BUILDS_DIR|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$AIO_DOMAIN_NAME|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$AIO_LOCALCERTS_DIR|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$AIO_NGINX_LOGS_DIR|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$AIO_NGINX_PORT_HTTP|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$AIO_NGINX_PORT_HTTPS|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$AIO_UPLOAD_HOSTNAME|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_MAX_SIZE}}|$AIO_UPLOAD_MAX_SIZE|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_PORT}}|$AIO_UPLOAD_PORT|g" /etc/nginx/sites-available/aio-builds-prod.conf
-RUN ln -s /etc/nginx/sites-available/aio-builds-prod.conf /etc/nginx/sites-enabled/aio-builds-prod.conf
+COPY nginx/aio-builds.conf /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$AIO_BUILDS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$AIO_DOMAIN_NAME|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$AIO_LOCALCERTS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$AIO_NGINX_LOGS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$AIO_NGINX_PORT_HTTP|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$AIO_NGINX_PORT_HTTPS|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_PREVIEW_SERVER_HOSTNAME}}|$AIO_PREVIEW_SERVER_HOSTNAME|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_ARTIFACT_MAX_SIZE}}|$AIO_ARTIFACT_MAX_SIZE|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_PREVIEW_SERVER_PORT}}|$AIO_PREVIEW_SERVER_PORT|g" /etc/nginx/conf.d/aio-builds-prod.conf
 
-COPY nginx/aio-builds.conf /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$TEST_AIO_BUILDS_DIR|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$TEST_AIO_DOMAIN_NAME|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$TEST_AIO_LOCALCERTS_DIR|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$TEST_AIO_NGINX_LOGS_DIR|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$TEST_AIO_NGINX_PORT_HTTP|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$TEST_AIO_NGINX_PORT_HTTPS|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$TEST_AIO_UPLOAD_HOSTNAME|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_MAX_SIZE}}|$TEST_AIO_UPLOAD_MAX_SIZE|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN sed -i "s|{{\$AIO_UPLOAD_PORT}}|$TEST_AIO_UPLOAD_PORT|g" /etc/nginx/sites-available/aio-builds-test.conf
-RUN ln -s /etc/nginx/sites-available/aio-builds-test.conf /etc/nginx/sites-enabled/aio-builds-test.conf
+COPY nginx/aio-builds.conf /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$TEST_AIO_BUILDS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$TEST_AIO_DOMAIN_NAME|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$TEST_AIO_LOCALCERTS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$TEST_AIO_NGINX_LOGS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$TEST_AIO_NGINX_PORT_HTTP|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$TEST_AIO_NGINX_PORT_HTTPS|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_PREVIEW_SERVER_HOSTNAME}}|$TEST_AIO_PREVIEW_SERVER_HOSTNAME|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_ARTIFACT_MAX_SIZE}}|$TEST_AIO_ARTIFACT_MAX_SIZE|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_PREVIEW_SERVER_PORT}}|$TEST_AIO_PREVIEW_SERVER_PORT|g" /etc/nginx/conf.d/aio-builds-test.conf
 
 
 # Set up pm2
@@ -151,7 +165,7 @@ RUN find $AIO_SCRIPTS_SH_DIR -maxdepth 1 -type f -printf "%P\n" \
 # Set up the Node.js scripts
 COPY scripts-js/ $AIO_SCRIPTS_JS_DIR/
 WORKDIR $AIO_SCRIPTS_JS_DIR/
-RUN yarn install --production
+RUN yarn install --production --frozen-lockfile
 
 
 # Set up health check

aio/aio-builds-setup/dockerbuild/cronjobs/aio-builds-cleanup

@@ -1,2 +1,2 @@
 # Periodically clean up builds that do not correspond to currently open PRs
-0 12 * * * root /usr/local/bin/aio-clean-up >> /var/log/cron.log 2>&1
+0 12 * * * /usr/local/bin/aio-clean-up >> /var/log/cron.log 2>&1

aio/aio-builds-setup/dockerbuild/dnsmasq/dnsmasq.conf

@@ -6,11 +6,11 @@ server=8.8.4.4
 # Listen for DHCP and DNS requests only on this address.
 listen-address=127.0.0.1
 
-# Force an IP addres for these domains.
+# Force an IP address for these domains.
 address=/{{$AIO_NGINX_HOSTNAME}}/127.0.0.1
-address=/{{$AIO_UPLOAD_HOSTNAME}}/127.0.0.1
+address=/{{$AIO_PREVIEW_SERVER_HOSTNAME}}/127.0.0.1
 address=/{{$TEST_AIO_NGINX_HOSTNAME}}/127.0.0.1
-address=/{{$TEST_AIO_UPLOAD_HOSTNAME}}/127.0.0.1
+address=/{{$TEST_AIO_PREVIEW_SERVER_HOSTNAME}}/127.0.0.1
 
 # Run as root (required from inside docker container).
 user=root

aio/aio-builds-setup/dockerbuild/logrotate/aio-preview-server

@@ -0,0 +1,9 @@
+/var/log/aio/preview-server-*.log {
+  compress
+  copytruncate
+  delaycompress
+  missingok
+  monthly
+  notifempty
+  rotate 6
+}

aio/aio-builds-setup/dockerbuild/logrotate/aio-upload-server

@@ -1,9 +0,0 @@
-/var/log/aio/upload-server-*.log {
-  compress
-  copytruncate
-  delaycompress
-  missingok
-  monthly
-  notifempty
-  rotate 6
-}

aio/aio-builds-setup/dockerbuild/nginx/aio-builds.conf

@@ -15,21 +15,32 @@ server {
 
 # Serve PR-preview requests
 server {
-  server_name "~^pr(?<pr>[1-9][0-9]*)-(?<sha>[0-9a-f]{40})\.";
+  server_name "~^pr(?<pr>[1-9][0-9]*)-(?<sha>[0-9a-f]{7,40})\.";
 
-  listen {{$AIO_NGINX_PORT_HTTPS}} ssl;
-  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl;
+  listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2;
+  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
 
-  ssl_certificate     {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
-  ssl_certificate_key {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_certificate           {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
+  ssl_certificate_key       {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers               EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
 
   root             {{$AIO_BUILDS_DIR}}/$pr/$sha;
   disable_symlinks on from=$document_root;
   index            index.html;
 
+  gzip            on;
+  gzip_comp_level 7;
+  gzip_types      *;
+
   access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
   error_log  {{$AIO_NGINX_LOGS_DIR}}/error.log;
 
+  error_page 404 /404.html;
+  location "=/404.html" {
+    internal;
+  }
+
   location "~/[^/]+\.[^/]+$" {
     try_files $uri $uri/ =404;
   }
@@ -43,11 +54,13 @@ server {
 server {
   server_name _;
 
-  listen {{$AIO_NGINX_PORT_HTTPS}} ssl default_server;
-  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl;
+  listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2 default_server;
+  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
 
-  ssl_certificate     {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
-  ssl_certificate_key {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_certificate           {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
+  ssl_certificate_key       {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers               EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
 
   access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
   error_log  {{$AIO_NGINX_LOGS_DIR}}/error.log;
@@ -58,24 +71,47 @@ server {
     return 200 '';
   }
 
-  # Upload builds
-  location "~^/create-build/(?<pr>[1-9][0-9]*)/(?<sha>[0-9a-f]{40})/?$" {
+  # Check PRs previewability
+  location "~^/can-have-public-preview/\d+/?$" {
+    if ($request_method != "GET") {
+      add_header Allow "GET";
+      return 405;
+    }
+
+    proxy_pass_request_headers on;
+    proxy_redirect             off;
+    proxy_method               GET;
+    proxy_pass                 http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
+
+    resolver 127.0.0.1;
+  }
+
+  # Notify about CircleCI builds
+  location "~^/circle-build/?$" {
     if ($request_method != "POST") {
       add_header Allow "POST";
       return 405;
     }
 
-    client_body_temp_path    /tmp/aio-create-builds;
-    client_body_buffer_size  128K;
-    client_max_body_size     {{$AIO_UPLOAD_MAX_SIZE}};
-    client_body_in_file_only on;
+    proxy_pass_request_headers on;
+    proxy_redirect             off;
+    proxy_method               POST;
+    proxy_pass                 http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
+
+    resolver 127.0.0.1;
+  }
+
+  # Notify about PR changes
+  location "~^/pr-updated/?$" {
+    if ($request_method != "POST") {
+      add_header Allow "POST";
+      return 405;
+    }
 
     proxy_pass_request_headers on;
-    proxy_set_header           X-FILE $request_body_file;
-    proxy_set_body             off;
     proxy_redirect             off;
-    proxy_method               GET;
-    proxy_pass                 http://{{$AIO_UPLOAD_HOSTNAME}}:{{$AIO_UPLOAD_PORT}}$request_uri;
+    proxy_method               POST;
+    proxy_pass                 http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
 
     resolver 127.0.0.1;
   }

aio/aio-builds-setup/dockerbuild/scripts-js/lib/clean-up/build-cleaner.ts

@@ -2,70 +2,126 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as shell from 'shelljs';
+import {HIDDEN_DIR_PREFIX} from '../common/constants';
+import {GithubApi} from '../common/github-api';
 import {GithubPullRequests} from '../common/github-pull-requests';
-import {assertNotMissingOrEmpty} from '../common/utils';
+import {assertNotMissingOrEmpty, getPrInfoFromDownloadPath, Logger} from '../common/utils';
 
 // Classes
 export class BuildCleaner {
+
+  private logger = new Logger('BuildCleaner');
+
   // Constructor
-  constructor(protected buildsDir: string, protected repoSlug: string, protected githubToken: string) {
+  constructor(protected buildsDir: string, protected githubOrg: string, protected githubRepo: string,
+              protected githubToken: string, protected downloadsDir: string, protected artifactPath: string) {
     assertNotMissingOrEmpty('buildsDir', buildsDir);
-    assertNotMissingOrEmpty('repoSlug', repoSlug);
+    assertNotMissingOrEmpty('githubOrg', githubOrg);
+    assertNotMissingOrEmpty('githubRepo', githubRepo);
     assertNotMissingOrEmpty('githubToken', githubToken);
+    assertNotMissingOrEmpty('downloadsDir', downloadsDir);
+    assertNotMissingOrEmpty('artifactPath', artifactPath);
   }
 
   // Methods - Public
-  public cleanUp(): Promise<void> {
-    return Promise.all([
-      this.getExistingBuildNumbers(),
-      this.getOpenPrNumbers(),
-    ]).then(([existingBuilds, openPrs]) => this.removeUnnecessaryBuilds(existingBuilds, openPrs));
+  public async cleanUp(): Promise<void> {
+    try {
+      this.logger.log('Cleaning up builds and downloads');
+      const openPrs = await this.getOpenPrNumbers();
+      this.logger.log(`Open pull requests: ${openPrs.length}`);
+      await Promise.all([
+        this.cleanBuilds(openPrs),
+        this.cleanDownloads(openPrs),
+      ]);
+    } catch (error) {
+      this.logger.error('ERROR:', error);
+    }
   }
 
-  // Methods - Protected
-  protected getExistingBuildNumbers(): Promise<number[]> {
-    return new Promise((resolve, reject) => {
+  public async cleanBuilds(openPrs: number[]): Promise<void> {
+    const existingBuilds = await this.getExistingBuildNumbers();
+    await this.removeUnnecessaryBuilds(existingBuilds, openPrs);
+  }
+
+  public async cleanDownloads(openPrs: number[]): Promise<void> {
+    const existingDownloads = await this.getExistingDownloads();
+    await this.removeUnnecessaryDownloads(existingDownloads, openPrs);
+  }
+
+  public getExistingBuildNumbers(): Promise<number[]> {
+    return new Promise<number[]>((resolve, reject) => {
       fs.readdir(this.buildsDir, (err, files) => {
         if (err) {
           return reject(err);
         }
 
         const buildNumbers = files.
-          map(Number).       // Convert string to number
-          filter(Boolean);   // Ignore NaN (or 0), because they are not builds
+          map(name => name.replace(HIDDEN_DIR_PREFIX, '')).   // Remove the "hidden dir" prefix
+          map(Number).                                        // Convert string to number
+          filter(Boolean);                                    // Ignore NaN (or 0), because they are not builds
 
         resolve(buildNumbers);
       });
     });
   }
 
-  protected getOpenPrNumbers(): Promise<number[]> {
-    const githubPullRequests = new GithubPullRequests(this.githubToken, this.repoSlug);
-
-    return githubPullRequests.
-      fetchAll('open').
-      then(prs => prs.map(pr => pr.number));
+  public async getOpenPrNumbers(): Promise<number[]> {
+    const api = new GithubApi(this.githubToken);
+    const githubPullRequests = new GithubPullRequests(api, this.githubOrg, this.githubRepo);
+    const prs = await githubPullRequests.fetchAll('open');
+    return prs.map(pr => pr.number);
   }
 
-  protected removeDir(dir: string) {
+  public removeDir(dir: string): void {
     try {
-      // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
-      (shell as any).chmod('-R', 'a+w', dir);
-      shell.rm('-rf', dir);
+      if (shell.test('-d', dir)) {
+        shell.chmod('-R', 'a+w', dir);
+        shell.rm('-rf', dir);
+      }
     } catch (err) {
-      console.error(`ERROR: Unable to remove '${dir}' due to:`, err);
+      this.logger.error(`ERROR: Unable to remove '${dir}' due to:`, err);
     }
   }
 
-  protected removeUnnecessaryBuilds(existingBuildNumbers: number[], openPrNumbers: number[]) {
+  public removeUnnecessaryBuilds(existingBuildNumbers: number[], openPrNumbers: number[]): void {
     const toRemove = existingBuildNumbers.filter(num => !openPrNumbers.includes(num));
 
-    console.log(`Existing builds: ${existingBuildNumbers.length}`);
-    console.log(`Open pull requests: ${openPrNumbers.length}`);
-    console.log(`Removing ${toRemove.length} build(s): ${toRemove.join(', ')}`);
+    this.logger.log(`Existing builds: ${existingBuildNumbers.length}`);
+    this.logger.log(`Removing ${toRemove.length} build(s): ${toRemove.join(', ')}`);
 
+    // Try removing public dirs.
     toRemove.
       map(num => path.join(this.buildsDir, String(num))).
       forEach(dir => this.removeDir(dir));
+
+    // Try removing hidden dirs.
+    toRemove.
+      map(num => path.join(this.buildsDir, HIDDEN_DIR_PREFIX + String(num))).
+      forEach(dir => this.removeDir(dir));
+  }
+
+  public getExistingDownloads(): Promise<string[]> {
+    const artifactFile = path.basename(this.artifactPath);
+    return new Promise<string[]>((resolve, reject) => {
+      fs.readdir(this.downloadsDir, (err, files) => {
+        if (err) {
+          return reject(err);
+        }
+        files = files.filter(file => file.endsWith(artifactFile));
+        resolve(files);
+      });
+    });
+  }
+
+  public removeUnnecessaryDownloads(existingDownloads: string[], openPrNumbers: number[]): void {
+    const toRemove = existingDownloads.filter(filePath => {
+      const {pr} = getPrInfoFromDownloadPath(filePath);
+      return !openPrNumbers.includes(pr);
+    });
+
+    this.logger.log(`Existing downloads: ${existingDownloads.length}`);
+    this.logger.log(`Removing ${toRemove.length} download(s): ${toRemove.join(', ')}`);
+
+    toRemove.forEach(filePath => shell.rm(path.join(this.downloadsDir, filePath)));
   }
 }

aio/aio-builds-setup/dockerbuild/scripts-js/lib/clean-up/index.ts

@@ -1,23 +1,26 @@
 // Imports
-import {getEnvVar} from '../common/utils';
+import {AIO_DOWNLOADS_DIR} from '../common/constants';
+import {
+  AIO_ARTIFACT_PATH,
+  AIO_BUILDS_DIR,
+  AIO_GITHUB_ORGANIZATION,
+  AIO_GITHUB_REPO,
+  AIO_GITHUB_TOKEN,
+} from '../common/env-variables';
 import {BuildCleaner} from './build-cleaner';
 
-// Constants
-const AIO_BUILDS_DIR = getEnvVar('AIO_BUILDS_DIR');
-const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN', true);
-const AIO_REPO_SLUG = getEnvVar('AIO_REPO_SLUG');
-
 // Run
 _main();
 
 // Functions
-function _main() {
-  console.log(`[${new Date()}] - Cleaning up builds...`);
+function _main(): void {
+  const buildCleaner = new BuildCleaner(
+    AIO_BUILDS_DIR,
+    AIO_GITHUB_ORGANIZATION,
+    AIO_GITHUB_REPO,
+    AIO_GITHUB_TOKEN,
+    AIO_DOWNLOADS_DIR,
+    AIO_ARTIFACT_PATH);
 
-  const buildCleaner = new BuildCleaner(AIO_BUILDS_DIR, AIO_REPO_SLUG, AIO_GITHUB_TOKEN);
-
-  buildCleaner.cleanUp().catch(err => {
-    console.error('ERROR:', err);
-    process.exit(1);
-  });
+  buildCleaner.cleanUp().catch(() => process.exit(1));
 }

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/circle-ci-api.ts

@@ -0,0 +1,90 @@
+// Imports
+import fetch from 'node-fetch';
+import {assertNotMissingOrEmpty} from './utils';
+
+// Constants
+const CIRCLE_CI_API_URL = 'https://circleci.com/api/v1.1/project/github';
+
+// Interfaces - Types
+export interface ArtifactInfo {
+  path: string;
+  pretty_path: string;
+  node_index: number;
+  url: string;
+}
+
+export type ArtifactResponse = ArtifactInfo[];
+
+export interface BuildInfo {
+  reponame: string;
+  failed: boolean;
+  branch: string;
+  username: string;
+  build_num: number;
+  has_artifacts: boolean;
+  outcome: string; // e.g. 'success'
+  vcs_revision: string; // HEAD SHA
+  // there are other fields but they are not used in this code
+}
+
+/**
+ * A Helper that can interact with the CircleCI API.
+ */
+export class CircleCiApi {
+
+  private tokenParam = `circle-token=${this.circleCiToken}`;
+
+  /**
+   * Construct a helper that can interact with the CircleCI REST API.
+   * @param githubOrg The Github organisation whose repos we want to access in CircleCI (e.g. angular).
+   * @param githubRepo The Github repo whose builds we want to access in CircleCI (e.g. angular).
+   * @param circleCiToken The CircleCI API access token (secret).
+   */
+  constructor(
+    private githubOrg: string,
+    private githubRepo: string,
+    private circleCiToken: string,
+  ) {
+    assertNotMissingOrEmpty('githubOrg', githubOrg);
+    assertNotMissingOrEmpty('githubRepo', githubRepo);
+    assertNotMissingOrEmpty('circleCiToken', circleCiToken);
+  }
+
+  /**
+   * Get the info for a build from the CircleCI API
+   * @param buildNumber The CircleCI build number that generated the artifact.
+   * @returns A promise to the info about the build
+   */
+  public async getBuildInfo(buildNumber: number): Promise<BuildInfo> {
+    try {
+      const baseUrl = `${CIRCLE_CI_API_URL}/${this.githubOrg}/${this.githubRepo}/${buildNumber}`;
+      const response = await fetch(`${baseUrl}?${this.tokenParam}`);
+      if (response.status !== 200) {
+        throw new Error(`${baseUrl}: ${response.status} - ${response.statusText}`);
+      }
+      return response.json();
+    } catch (error) {
+        throw new Error(`CircleCI build info request failed (${error.message})`);
+    }
+  }
+
+  /**
+   * Query the CircleCI API to get a URL for a specified artifact from a specified build.
+   * @param artifactPath The path, within the build to the artifact.
+   * @returns A promise to the URL that can be requested to download the actual build artifact file.
+   */
+  public async getBuildArtifactUrl(buildNumber: number, artifactPath: string): Promise<string> {
+    const baseUrl = `${CIRCLE_CI_API_URL}/${this.githubOrg}/${this.githubRepo}/${buildNumber}`;
+    try {
+      const response = await fetch(`${baseUrl}/artifacts?${this.tokenParam}`);
+      const artifacts = await response.json() as ArtifactResponse;
+      const artifact = artifacts.find(item => item.path === artifactPath);
+      if (!artifact) {
+        throw new Error(`Missing artifact (${artifactPath}) for CircleCI build: ${buildNumber}`);
+      }
+      return artifact.url;
+    } catch (error) {
+      throw new Error(`CircleCI artifact URL request failed (${error.message})`);
+    }
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/constants.ts

@@ -0,0 +1,4 @@
+// Constants
+export const AIO_DOWNLOADS_DIR = '/tmp/aio-downloads';
+export const HIDDEN_DIR_PREFIX = 'hidden--';
+export const SHORT_SHA_LEN = 7;

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/env-variables.ts

@@ -0,0 +1,19 @@
+import {getEnvVar} from './utils';
+
+export const AIO_ARTIFACT_PATH = getEnvVar('AIO_ARTIFACT_PATH');
+export const AIO_BUILDS_DIR = getEnvVar('AIO_BUILDS_DIR');
+export const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN');
+export const AIO_CIRCLE_CI_TOKEN = getEnvVar('AIO_CIRCLE_CI_TOKEN');
+export const AIO_DOMAIN_NAME = getEnvVar('AIO_DOMAIN_NAME');
+export const AIO_GITHUB_ORGANIZATION = getEnvVar('AIO_GITHUB_ORGANIZATION');
+export const AIO_GITHUB_REPO = getEnvVar('AIO_GITHUB_REPO');
+export const AIO_GITHUB_TEAM_SLUGS = getEnvVar('AIO_GITHUB_TEAM_SLUGS');
+export const AIO_NGINX_HOSTNAME = getEnvVar('AIO_NGINX_HOSTNAME');
+export const AIO_NGINX_PORT_HTTP = +getEnvVar('AIO_NGINX_PORT_HTTP');
+export const AIO_NGINX_PORT_HTTPS = +getEnvVar('AIO_NGINX_PORT_HTTPS');
+export const AIO_SIGNIFICANT_FILES_PATTERN = getEnvVar('AIO_SIGNIFICANT_FILES_PATTERN');
+export const AIO_TRUSTED_PR_LABEL = getEnvVar('AIO_TRUSTED_PR_LABEL');
+export const AIO_PREVIEW_SERVER_HOSTNAME = getEnvVar('AIO_PREVIEW_SERVER_HOSTNAME');
+export const AIO_PREVIEW_SERVER_PORT = +getEnvVar('AIO_PREVIEW_SERVER_PORT');
+export const AIO_ARTIFACT_MAX_SIZE = +getEnvVar('AIO_ARTIFACT_MAX_SIZE');
+export const AIO_WWW_USER = getEnvVar('AIO_WWW_USER');

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-api.ts

@@ -28,29 +28,18 @@ export class GithubApi {
   }
 
   // Methods - Public
-  public get<T>(pathname: string, params?: RequestParamsOrNull): Promise<T> {
+  public get<T = any>(pathname: string, params?: RequestParamsOrNull): Promise<T> {
     const path = this.buildPath(pathname, params);
     return this.request<T>('get', path);
   }
 
-  public post<T>(pathname: string, params?: RequestParamsOrNull, data?: any): Promise<T> {
+  public post<T = any>(pathname: string, params?: RequestParamsOrNull, data?: any): Promise<T> {
     const path = this.buildPath(pathname, params);
     return this.request<T>('post', path, data);
   }
 
-  // Methods - Protected
-  protected buildPath(pathname: string, params?: RequestParamsOrNull): string {
-    if (params == null) {
-      return pathname;
-    }
-
-    const search = (params === null) ? '' : this.serializeSearchParams(params);
-    const joiner = search && '?';
-
-    return `${pathname}${joiner}${search}`;
-  }
-
-  protected getPaginated<T>(pathname: string, baseParams: RequestParams = {}, currentPage: number = 0): Promise<T[]> {
+  // In GitHub API paginated requests, page numbering is 1-based. (https://developer.github.com/v3/#pagination)
+  public getPaginated<T>(pathname: string, baseParams: RequestParams = {}, currentPage: number = 1): Promise<T[]> {
     const perPage = 100;
     const params = {
       ...baseParams,
@@ -63,10 +52,22 @@ export class GithubApi {
         return items;
       }
 
-      return this.getPaginated(pathname, baseParams, currentPage + 1).then(moreItems => [...items, ...moreItems]);
+      return this.getPaginated<T>(pathname, baseParams, currentPage + 1).then(moreItems => [...items, ...moreItems]);
     });
   }
 
+  // Methods - Protected
+  protected buildPath(pathname: string, params?: RequestParamsOrNull): string {
+    if (params == null) {
+      return pathname;
+    }
+
+    const search = (params === null) ? '' : this.serializeSearchParams(params);
+    const joiner = search && '?';
+
+    return `${pathname}${joiner}${search}`;
+  }
+
   protected request<T>(method: string, path: string, data: any = null): Promise<T> {
     return new Promise<T>((resolve, reject) => {
       const options = {
@@ -81,7 +82,7 @@ export class GithubApi {
         reject(`Request to '${url}' failed (status: ${statusCode}): ${responseText}`);
       };
       const onSuccess = (responseText: string) => {
-        try { resolve(JSON.parse(responseText)); } catch (err) { reject(err); }
+        try { resolve(responseText && JSON.parse(responseText)); } catch (err) { reject(err); }
       };
       const onResponse = (res: IncomingMessage) => {
         const statusCode = res.statusCode || -1;

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-pull-requests.ts

@@ -1,44 +1,79 @@
-// Imports
-import {assertNotMissingOrEmpty} from '../common/utils';
 import {GithubApi} from './github-api';
+import {assert, assertNotMissingOrEmpty} from './utils';
 
-// Interfaces - Types
-export interface PullRequest  {
+export interface PullRequest {
   number: number;
   user: {login: string};
+  labels: {name: string}[];
+}
+
+export interface FileInfo {
+  sha: string;
+  filename: string;
 }
 
 export type PullRequestState = 'all' | 'closed' | 'open';
 
-// Classes
-export class GithubPullRequests extends GithubApi {
-  // Constructor
-  constructor(githubToken: string, protected repoSlug: string) {
-    super(githubToken);
-    assertNotMissingOrEmpty('repoSlug', repoSlug);
+/**
+ * Access pull requests on GitHub.
+ */
+export class GithubPullRequests {
+  public repoSlug: string;
+
+  /**
+   * Create an instance of this helper
+   * @param api An instance of the Github API helper.
+   * @param githubOrg The organisation on GitHub whose repo we will interrogate.
+   * @param githubRepo The repository on Github with whose PRs we will interact.
+   */
+  constructor(private api: GithubApi, githubOrg: string, githubRepo: string) {
+    assertNotMissingOrEmpty('githubOrg', githubOrg);
+    assertNotMissingOrEmpty('githubRepo', githubRepo);
+    this.repoSlug = `${githubOrg}/${githubRepo}`;
   }
 
-  // Methods - Public
-  public addComment(pr: number, body: string): Promise<void> {
-    if (!(pr > 0)) {
-      throw new Error(`Invalid PR number: ${pr}`);
-    } else if (!body) {
-      throw new Error(`Invalid or empty comment body: ${body}`);
-    }
-
-    return this.post<void>(`/repos/${this.repoSlug}/issues/${pr}/comments`, null, {body});
+  /**
+   * Post a comment on a PR.
+   * @param pr The number of the PR on which to comment.
+   * @param body The body of the comment to post.
+   * @returns A promise that resolves when the comment has been posted.
+   */
+  public addComment(pr: number, body: string): Promise<any> {
+    assert(pr > 0, `Invalid PR number: ${pr}`);
+    assert(!!body, `Invalid or empty comment body: ${body}`);
+    return this.api.post<any>(`/repos/${this.repoSlug}/issues/${pr}/comments`, null, {body});
   }
 
+  /**
+   * Request information about a PR.
+   * @param pr The number of the PR for which to request info.
+   * @returns A promise that is resolves with information about the specified PR.
+   */
   public fetch(pr: number): Promise<PullRequest> {
-    return this.get<PullRequest>(`/repos/${this.repoSlug}/pulls/${pr}`);
+    assert(pr > 0, `Invalid PR number: ${pr}`);
+    // Using the `/issues/` URL, because the `/pulls/` one does not provide labels.
+    return this.api.get<PullRequest>(`/repos/${this.repoSlug}/issues/${pr}`);
   }
 
+  /**
+   * Request information about all PRs that match the given state.
+   * @param state Only retrieve PRs that have this state.
+   * @returns A promise that is resolved with information about the requested PRs.
+   */
   public fetchAll(state: PullRequestState = 'all'): Promise<PullRequest[]> {
-    console.log(`Fetching ${state} pull requests...`);
-
     const pathname = `/repos/${this.repoSlug}/pulls`;
     const params = {state};
 
-    return this.getPaginated<PullRequest>(pathname, params);
+    return this.api.getPaginated<PullRequest>(pathname, params);
+  }
+
+  /**
+   * Request a list of files for the given PR.
+   * @param pr The number of the PR for which to request files.
+   * @returns A promise that resolves to an array of file information
+   */
+  public fetchFiles(pr: number): Promise<FileInfo[]> {
+    assert(pr > 0, `Invalid PR number: ${pr}`);
+    return this.api.getPaginated<FileInfo>(`/repos/${this.repoSlug}/pulls/${pr}/files`);
   }
 }

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-teams.ts

@@ -1,45 +1,72 @@
-// Imports
-import {assertNotMissingOrEmpty} from '../common/utils';
 import {GithubApi} from './github-api';
+import {assertNotMissingOrEmpty} from './utils';
 
-// Interfaces - Types
-interface Team {
+export interface Team {
   id: number;
   slug: string;
 }
 
-interface TeamMembership {
+export interface TeamMembership {
   state: string;
 }
 
-// Classes
-export class GithubTeams extends GithubApi {
-  // Constructor
-  constructor(githubToken: string, protected organization: string) {
-    super(githubToken);
-    assertNotMissingOrEmpty('organization', organization);
+export class GithubTeams {
+  /**
+   * Create an instance of this helper
+   * @param api An instance of the Github API helper.
+   * @param githubOrg The organisation on GitHub whose repo we will interrogate.
+   */
+  constructor(private api: GithubApi, protected githubOrg: string) {
+    assertNotMissingOrEmpty('githubOrg', githubOrg);
   }
 
-  // Methods - Public
+  /**
+   * Request information about all the organisation's teams in GitHub.
+   * @returns A promise that is resolved with information about the teams.
+   */
   public fetchAll(): Promise<Team[]> {
-    return this.getPaginated<Team>(`/orgs/${this.organization}/teams`);
+    return this.api.getPaginated<Team>(`/orgs/${this.githubOrg}/teams`);
   }
 
-  public isMemberById(username: string, teamIds: number[]): Promise<boolean> {
-    const getMembership = (teamId: number) =>
-      this.get<TeamMembership>(`/teams/${teamId}/memberships/${username}`).
-        then(membership => membership.state === 'active').
-        catch(() => false);
-    const reduceFn = (promise: Promise<boolean>, teamId: number) =>
-      promise.then(isMember => isMember || getMembership(teamId));
+  /**
+   * Check whether the specified username is a member of the specified team.
+   * @param username The usernane to check for in the team.
+   * @param teamIds The team to check for the username.
+   * @returns a Promise that resolves to `true` if the username is a member of the team.
+   */
+  public async isMemberById(username: string, teamIds: number[]): Promise<boolean> {
 
-    return teamIds.reduce(reduceFn, Promise.resolve(false));
+    const getMembership = async (teamId: number) => {
+      try {
+        const {state} = await this.api.get<TeamMembership>(`/teams/${teamId}/memberships/${username}`);
+        return state === 'active';
+      } catch (error) {
+        return false;
+      }
+    };
+
+    for (const teamId of teamIds) {
+      if (await getMembership(teamId)) {
+        return true;
+      }
+    }
+
+    return false;
   }
 
-  public isMemberBySlug(username: string, teamSlugs: string[]): Promise<boolean> {
-    return this.fetchAll().
-      then(teams => teams.filter(team => teamSlugs.includes(team.slug)).map(team => team.id)).
-      then(teamIds => this.isMemberById(username, teamIds)).
-      catch(() => false);
+  /**
+   * Check whether the given username is a member of the teams specified by the team slugs.
+   * @param username The username to check for in the teams.
+   * @param teamSlugs A collection of slugs that represent the teams to check for the the username.
+   * @returns a Promise that resolves to `true` if the usernane is a member of at least one of the specified teams.
+   */
+  public async isMemberBySlug(username: string, teamSlugs: string[]): Promise<boolean> {
+    try {
+      const teams = await this.fetchAll();
+      const teamIds = teams.filter(team => teamSlugs.includes(team.slug)).map(team => team.id);
+      return await this.isMemberById(username, teamIds);
+    } catch (error) {
+      return false;
+    }
   }
 }

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/run-tests.ts

@@ -1,14 +1,14 @@
-export const runTests = (specFiles: string[], helpers?: string[]) => {
-  // We can't use `import` here, because of the following mess:
-  // - GitHub project `jasmine/jasmine` is `jasmine-core` on npm and its typings `@types/jasmine`.
-  // - GitHub project `jasmine/jasmine-npm` is `jasmine` on npm and has no typings.
-  //
-  // Using `import...from 'jasmine'` here, would import from `@types/jasmine` (which refers to the
-  // `jasmine-core` module and the `jasmine` module).
-  // tslint:disable-next-line: no-var-requires variable-name
-  const Jasmine = require('jasmine');
+// We can't use `import...from` here, because of the following mess:
+// - GitHub project `jasmine/jasmine` is `jasmine-core` on npm and its typings `@types/jasmine`.
+// - GitHub project `jasmine/jasmine-npm` is `jasmine` on npm and has no typings.
+//
+// Using `import...from 'jasmine'` here, would import from `@types/jasmine` (which refers to the
+// `jasmine-core` module and the `jasmine` module).
+import Jasmine = require('jasmine');
+import 'source-map-support/register';
+
+export const runTests = (specFiles: string[]) => {
   const config = {
-    helpers,
     random: true,
     spec_files: specFiles,
     stopSpecOnExpectationFailure: true,
@@ -16,7 +16,7 @@ export const runTests = (specFiles: string[], helpers?: string[]) => {
 
   process.on('unhandledRejection', (reason: any) => console.log('Unhandled rejection:', reason));
 
-  const runner = new Jasmine();
+  const runner = new Jasmine({});
   runner.loadConfig(config);
   runner.onComplete((passed: boolean) => process.exit(passed ? 0 : 1));
   runner.execute();

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/utils.ts

@@ -1,17 +1,98 @@
-// Functions
-export const assertNotMissingOrEmpty = (name: string, value: string | null | undefined) => {
+import {basename, resolve as resolvePath} from 'path';
+import {SHORT_SHA_LEN} from './constants';
+
+/**
+ * Shorten a SHA to make it more readable
+ * @param sha The SHA to shorten.
+ */
+export function computeShortSha(sha: string) {
+  return sha.substr(0, SHORT_SHA_LEN);
+}
+
+/**
+ * Compute the path for a downloaded artifact file.
+ * @param downloadsDir The directory where artifacts are downloaded
+ * @param pr The PR associated with this artifact.
+ * @param sha The SHA associated with the build for this artifact.
+ * @param artifactPath The path to the artifact on CircleCI.
+ * @returns The fully resolved location for the specified downloaded artifact.
+ */
+export function computeArtifactDownloadPath(downloadsDir: string, pr: number, sha: string, artifactPath: string) {
+  return resolvePath(downloadsDir, `${pr}-${computeShortSha(sha)}-${basename(artifactPath)}`);
+}
+
+/**
+ * Extract the PR number and latest commit SHA from a downloaded file path.
+ * @param downloadPath the path to the downloaded file.
+ * @returns An object whose keys are the PR and SHA extracted from the file path.
+ */
+export function getPrInfoFromDownloadPath(downloadPath: string) {
+  const file = basename(downloadPath);
+  const [pr, sha] = file.split('-');
+  return {pr: +pr, sha};
+}
+
+/**
+ * Assert that a value is true.
+ * @param value The value to assert.
+ * @param message The message if the value is not true.
+ */
+export function assert(value: boolean, message: string) {
   if (!value) {
-    throw new Error(`Missing or empty required parameter '${name}'!`);
+    throw new Error(message);
   }
+}
+
+/**
+ * Assert that a parameter is not equal to "".
+ * @param name The name of the parameter.
+ * @param value The value of the parameter.
+ */
+export const assertNotMissingOrEmpty = (name: string, value: string | null | undefined) => {
+  assert(!!value, `Missing or empty required parameter '${name}'!`);
 };
 
+/**
+ * Get an environment variable.
+ * @param name The name of the environment variable.
+ * @param isOptional True if the variable is optional.
+ * @returns The value of the variable or "" if it is optional and falsy.
+ * @throws `Error` if the variable is falsy and not optional.
+ */
 export const getEnvVar = (name: string, isOptional = false): string => {
   const value = process.env[name];
 
   if (!isOptional && !value) {
-    console.error(`ERROR: Missing required environment variable '${name}'!`);
-    process.exit(1);
+    try {
+     throw new Error(`ERROR: Missing required environment variable '${name}'!`);
+    } catch (error) {
+      console.error(error.stack);
+      process.exit(1);
+    }
   }
 
   return value || '';
 };
+
+/**
+ * A basic logger implementation.
+ * Delegates to `console`, but prepends each message with the current date and specified scope (i.e caller).
+ */
+export class Logger {
+  private padding = ' '.repeat(20 - this.scope.length);
+
+  /**
+   * Create a new `Logger` instance for the specified `scope`.
+   * @param scope The logger's scope (added to all messages).
+   */
+  constructor(private scope: string) {}
+
+  public error(...args: any[]) { this.callMethod('error', args); }
+  public info(...args: any[]) { this.callMethod('info', args); }
+  public log(...args: any[]) { this.callMethod('log', args); }
+  public warn(...args: any[]) { this.callMethod('warn', args); }
+
+  private callMethod(method: 'error' | 'info' | 'log' | 'warn', args: any[]) {
+    console[method](`[${new Date()}]`, `${this.scope}:${this.padding}`, ...args);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/build-creator.ts

@@ -0,0 +1,144 @@
+// Imports
+import * as cp from 'child_process';
+import {EventEmitter} from 'events';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as shell from 'shelljs';
+import {HIDDEN_DIR_PREFIX} from '../common/constants';
+import {assertNotMissingOrEmpty, computeShortSha, Logger} from '../common/utils';
+import {ChangedPrVisibilityEvent, CreatedBuildEvent} from './build-events';
+import {PreviewServerError} from './preview-error';
+
+// Classes
+export class BuildCreator extends EventEmitter {
+
+  private logger = new Logger('BuildCreator');
+
+  // Constructor
+  constructor(protected buildsDir: string) {
+    super();
+    assertNotMissingOrEmpty('buildsDir', buildsDir);
+  }
+
+  // Methods - Public
+  public create(pr: number, sha: string, archivePath: string, isPublic: boolean): Promise<void> {
+    // Use only part of the SHA for more readable URLs.
+    sha = computeShortSha(sha);
+
+    const {newPrDir: prDir} = this.getCandidatePrDirs(pr, isPublic);
+    const shaDir = path.join(prDir, sha);
+    let dirToRemoveOnError: string;
+
+    return Promise.resolve().
+      // If the same PR exists with different visibility, update the visibility first.
+      then(() => this.updatePrVisibility(pr, isPublic)).
+      then(() => Promise.all([this.exists(prDir), this.exists(shaDir)])).
+      then(([prDirExisted, shaDirExisted]) => {
+        if (shaDirExisted) {
+          const publicOrNot = isPublic ? 'public' : 'non-public';
+          throw new PreviewServerError(409, `Request to overwrite existing ${publicOrNot} directory: ${shaDir}`);
+        }
+
+        dirToRemoveOnError = prDirExisted ? shaDir : prDir;
+
+        return Promise.resolve().
+          then(() => shell.mkdir('-p', shaDir)).
+          then(() => this.extractArchive(archivePath, shaDir)).
+          then(() => this.emit(CreatedBuildEvent.type, new CreatedBuildEvent(+pr, sha, isPublic))).
+          then(() => undefined);
+      }).
+      catch(err => {
+        if (dirToRemoveOnError) {
+          shell.rm('-rf', dirToRemoveOnError);
+        }
+
+        if (!(err instanceof PreviewServerError)) {
+          err = new PreviewServerError(500, `Error while creating preview at: ${shaDir}\n${err}`);
+        }
+
+        throw err;
+      });
+  }
+
+  public updatePrVisibility(pr: number, makePublic: boolean): Promise<boolean> {
+    const {oldPrDir: otherVisPrDir, newPrDir: targetVisPrDir} = this.getCandidatePrDirs(pr, makePublic);
+
+    return Promise.
+      all([this.exists(otherVisPrDir), this.exists(targetVisPrDir)]).
+      then(([otherVisPrDirExisted, targetVisPrDirExisted]) => {
+        if (!otherVisPrDirExisted) {
+          // No visibility change: Either the visibility is up-to-date or the PR does not exist.
+          return false;
+        } else if (targetVisPrDirExisted) {
+          // Error: Directories for both visibilities exist.
+          throw new PreviewServerError(409,
+              `Request to move '${otherVisPrDir}' to existing directory '${targetVisPrDir}'.`);
+        }
+
+        // Visibility change: Moving `otherVisPrDir` to `targetVisPrDir`.
+        return Promise.resolve().
+          then(() => shell.mv(otherVisPrDir, targetVisPrDir)).
+          then(() => this.listShasByDate(targetVisPrDir)).
+          then(shas => this.emit(ChangedPrVisibilityEvent.type, new ChangedPrVisibilityEvent(+pr, shas, makePublic))).
+          then(() => true);
+      }).
+      catch(err => {
+        if (!(err instanceof PreviewServerError)) {
+          err = new PreviewServerError(500, `Error while making PR ${pr} ${makePublic ? 'public' : 'hidden'}.\n${err}`);
+        }
+
+        throw err;
+      });
+  }
+
+  // Methods - Protected
+  protected exists(fileOrDir: string): Promise<boolean> {
+    return new Promise(resolve => fs.access(fileOrDir, err => resolve(!err)));
+  }
+
+  protected extractArchive(inputFile: string, outputDir: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      const cmd = `tar --extract --gzip --directory "${outputDir}" --file "${inputFile}"`;
+
+      cp.exec(cmd, (err, _stdout, stderr) => {
+        if (err) {
+          return reject(err);
+        }
+
+        if (stderr) {
+          this.logger.warn(stderr);
+        }
+
+        try {
+          shell.chmod('-R', 'a-w', outputDir);
+          shell.rm('-f', inputFile);
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }
+
+  protected getCandidatePrDirs(pr: number, isPublic: boolean): {oldPrDir: string, newPrDir: string} {
+    const hiddenPrDir = path.join(this.buildsDir, HIDDEN_DIR_PREFIX + pr);
+    const publicPrDir = path.join(this.buildsDir, `${pr}`);
+
+    const oldPrDir = isPublic ? hiddenPrDir : publicPrDir;
+    const newPrDir = isPublic ? publicPrDir : hiddenPrDir;
+
+    return {oldPrDir, newPrDir};
+  }
+
+  protected listShasByDate(inputDir: string): Promise<string[]> {
+    return Promise.resolve().
+      then(() => shell.ls('-l', inputDir) as any as Promise<(fs.Stats & {name: string})[]>).
+      // Keep directories only.
+      // (Also, convert to standard Array - ShellJS provides custom `sort()` method for sorting file contents.)
+      then(items => items.filter(item => item.isDirectory())).
+      // Sort by modification date.
+      then(items => items.sort((a, b) => a.mtime.getTime() - b.mtime.getTime())).
+      // Return directory names.
+      then(items => items.map(item => item.name));
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/build-events.ts

@@ -0,0 +1,16 @@
+// Classes
+export class ChangedPrVisibilityEvent {
+  // Properties - Public, Static
+  public static type = 'pr.changedVisibility';
+
+  // Constructor
+  constructor(public pr: number, public shas: string[], public isPublic: boolean) {}
+}
+
+export class CreatedBuildEvent {
+  // Properties - Public, Static
+  public static type = 'build.created';
+
+  // Constructor
+  constructor(public pr: number, public sha: string, public isPublic: boolean) {}
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/build-retriever.ts

@@ -0,0 +1,83 @@
+import * as fs from 'fs';
+import fetch from 'node-fetch';
+import {dirname} from 'path';
+import {mkdir} from 'shelljs';
+import {promisify} from 'util';
+import {CircleCiApi} from '../common/circle-ci-api';
+import {assert, assertNotMissingOrEmpty, computeArtifactDownloadPath, Logger} from '../common/utils';
+import {PreviewServerError} from './preview-error';
+
+export interface GithubInfo {
+  org: string;
+  pr: number;
+  repo: string;
+  sha: string;
+  success: boolean;
+}
+
+/**
+ * A helper that can get information about builds and download build artifacts.
+ */
+export class BuildRetriever {
+  private logger = new Logger('BuildRetriever');
+  constructor(private api: CircleCiApi, private downloadSizeLimit: number, private downloadDir: string) {
+    assert(downloadSizeLimit > 0, 'Invalid parameter "downloadSizeLimit" should be a number greater than 0.');
+    assertNotMissingOrEmpty('downloadDir', downloadDir);
+  }
+
+  /**
+   * Get GitHub information about a build
+   * @param buildNum The number of the build for which to retrieve the info.
+   * @returns The Github org, repo, PR and latest SHA for the specified build.
+   */
+  public async getGithubInfo(buildNum: number): Promise<GithubInfo> {
+    const buildInfo = await this.api.getBuildInfo(buildNum);
+    const githubInfo: GithubInfo = {
+      org: buildInfo.username,
+      pr: getPrFromBranch(buildInfo.branch),
+      repo: buildInfo.reponame,
+      sha: buildInfo.vcs_revision,
+      success: !buildInfo.failed,
+    };
+    return githubInfo;
+  }
+
+  /**
+   * Make a request to the given URL for a build artifact and store it locally.
+   * @param buildNum the number of the CircleCI build whose artifact we want to download.
+   * @param pr the number of the PR that triggered the CircleCI build.
+   * @param sha the commit in the PR that triggered the CircleCI build.
+   * @param artifactPath the path on CircleCI where the artifact was stored.
+   * @returns A promise to the file path where the downloaded file was stored.
+   */
+  public async downloadBuildArtifact(buildNum: number, pr: number, sha: string, artifactPath: string): Promise<string> {
+    try {
+      const outPath = computeArtifactDownloadPath(this.downloadDir, pr, sha, artifactPath);
+      const downloadExists = await new Promise(resolve => fs.exists(outPath, exists => resolve(exists)));
+      if (!downloadExists) {
+        const url = await this.api.getBuildArtifactUrl(buildNum, artifactPath);
+        const response = await fetch(url, {size: this.downloadSizeLimit});
+        if (response.status !== 200) {
+          throw new PreviewServerError(response.status, `Error ${response.status} - ${response.statusText}`);
+        }
+        const buffer = await response.buffer();
+        mkdir('-p', dirname(outPath));
+        await promisify(fs.writeFile)(outPath, buffer);
+      }
+      return outPath;
+    } catch (error) {
+      this.logger.warn(error);
+      const status = (error.type === 'max-size') ? 413 : 500;
+      throw new PreviewServerError(status, `CircleCI artifact download failed (${error.message || error})`);
+    }
+  }
+}
+
+function getPrFromBranch(branch: string): number {
+  // CircleCI only exposes PR numbers via the `branch` field :-(
+  const match = /^pull\/(\d+)$/.exec(branch);
+  if (!match) {
+    throw new Error(`No PR found in branch field: ${branch}`);
+  }
+  return +match[1];
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/build-verifier.ts

@@ -0,0 +1,46 @@
+import {GithubPullRequests, PullRequest} from '../common/github-pull-requests';
+import {GithubTeams} from '../common/github-teams';
+import {assertNotMissingOrEmpty} from '../common/utils';
+
+/**
+ * A helper to verify whether builds are trusted.
+ */
+export class BuildVerifier {
+  /**
+   * Construct a new BuildVerifier instance.
+   * @param prs A helper to access PR information.
+   * @param teams A helper to access Github team information.
+   * @param allowedTeamSlugs The teams that are trusted.
+   * @param trustedPrLabel The github label that indicates that a PR is trusted.
+   */
+  constructor(protected prs: GithubPullRequests, protected teams: GithubTeams,
+              protected allowedTeamSlugs: string[], protected trustedPrLabel: string) {
+    assertNotMissingOrEmpty('allowedTeamSlugs', allowedTeamSlugs && allowedTeamSlugs.join(''));
+    assertNotMissingOrEmpty('trustedPrLabel', trustedPrLabel);
+  }
+
+  /**
+   * Check whether a PR contains files that are significant to the build.
+   * @param pr The number of the PR to check
+   * @param significantFilePattern A regex that selects files that are significant.
+   */
+  public async getSignificantFilesChanged(pr: number, significantFilePattern: RegExp): Promise<boolean> {
+    const files = await this.prs.fetchFiles(pr);
+    return files.some(file => significantFilePattern.test(file.filename));
+  }
+
+  /**
+   * Check whether a PR is trusted.
+   * @param pr The number of the PR to check.
+   * @returns true if the PR is trusted.
+   */
+  public async getPrIsTrusted(pr: number): Promise<boolean> {
+    const prInfo = await this.prs.fetch(pr);
+    return this.hasLabel(prInfo, this.trustedPrLabel) ||
+           (await this.teams.isMemberBySlug(prInfo.user.login, this.allowedTeamSlugs));
+  }
+
+  protected hasLabel(prInfo: PullRequest, label: string): boolean {
+    return prInfo.labels.some(labelObj => labelObj.name === label);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/index.ts

@@ -0,0 +1,41 @@
+// Imports
+import {AIO_DOWNLOADS_DIR} from '../common/constants';
+import {
+  AIO_ARTIFACT_MAX_SIZE,
+  AIO_ARTIFACT_PATH,
+  AIO_BUILDS_DIR,
+  AIO_CIRCLE_CI_TOKEN,
+  AIO_DOMAIN_NAME,
+  AIO_GITHUB_ORGANIZATION,
+  AIO_GITHUB_REPO,
+  AIO_GITHUB_TEAM_SLUGS,
+  AIO_GITHUB_TOKEN,
+  AIO_PREVIEW_SERVER_HOSTNAME,
+  AIO_PREVIEW_SERVER_PORT,
+  AIO_SIGNIFICANT_FILES_PATTERN,
+  AIO_TRUSTED_PR_LABEL,
+} from '../common/env-variables';
+import {PreviewServerFactory} from './preview-server-factory';
+
+// Run
+_main();
+
+// Functions
+function _main(): void {
+  PreviewServerFactory
+    .create({
+      buildArtifactPath: AIO_ARTIFACT_PATH,
+      buildsDir: AIO_BUILDS_DIR,
+      circleCiToken: AIO_CIRCLE_CI_TOKEN,
+      domainName: AIO_DOMAIN_NAME,
+      downloadSizeLimit: AIO_ARTIFACT_MAX_SIZE,
+      downloadsDir: AIO_DOWNLOADS_DIR,
+      githubOrg: AIO_GITHUB_ORGANIZATION,
+      githubRepo: AIO_GITHUB_REPO,
+      githubTeamSlugs: AIO_GITHUB_TEAM_SLUGS.split(','),
+      githubToken: AIO_GITHUB_TOKEN,
+      significantFilesPattern: AIO_SIGNIFICANT_FILES_PATTERN,
+      trustedPrLabel: AIO_TRUSTED_PR_LABEL,
+    })
+    .listen(AIO_PREVIEW_SERVER_PORT, AIO_PREVIEW_SERVER_HOSTNAME);
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/preview-error.ts

@@ -0,0 +1,8 @@
+// Classes
+export class PreviewServerError extends Error {
+  // Constructor
+  constructor(public status: number = 500, message?: string) {
+    super(message);
+    Object.setPrototypeOf(this, PreviewServerError.prototype);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/preview-server-factory.ts

@@ -0,0 +1,213 @@
+// Imports
+import * as bodyParser from 'body-parser';
+import * as express from 'express';
+import * as http from 'http';
+import {AddressInfo} from 'net';
+import {CircleCiApi} from '../common/circle-ci-api';
+import {GithubApi} from '../common/github-api';
+import {GithubPullRequests} from '../common/github-pull-requests';
+import {GithubTeams} from '../common/github-teams';
+import {assert, assertNotMissingOrEmpty, computeShortSha, Logger} from '../common/utils';
+import {BuildCreator} from './build-creator';
+import {ChangedPrVisibilityEvent, CreatedBuildEvent} from './build-events';
+import {BuildRetriever} from './build-retriever';
+import {BuildVerifier} from './build-verifier';
+import {respondWithError, throwRequestError} from './utils';
+
+const AIO_PREVIEW_JOB = 'aio_preview';
+
+// Interfaces - Types
+export interface PreviewServerConfig {
+  downloadsDir: string;
+  downloadSizeLimit: number;
+  buildArtifactPath: string;
+  buildsDir: string;
+  domainName: string;
+  githubOrg: string;
+  githubRepo: string;
+  githubTeamSlugs: string[];
+  circleCiToken: string;
+  githubToken: string;
+  significantFilesPattern: string;
+  trustedPrLabel: string;
+}
+
+const logger = new Logger('PreviewServer');
+
+// Classes
+export class PreviewServerFactory {
+  // Methods - Public
+  public static create(cfg: PreviewServerConfig): http.Server {
+    assertNotMissingOrEmpty('domainName', cfg.domainName);
+
+    const circleCiApi = new CircleCiApi(cfg.githubOrg, cfg.githubRepo, cfg.circleCiToken);
+    const githubApi = new GithubApi(cfg.githubToken);
+    const prs = new GithubPullRequests(githubApi, cfg.githubOrg, cfg.githubRepo);
+    const teams = new GithubTeams(githubApi, cfg.githubOrg);
+
+    const buildRetriever = new BuildRetriever(circleCiApi, cfg.downloadSizeLimit, cfg.downloadsDir);
+    const buildVerifier = new BuildVerifier(prs, teams, cfg.githubTeamSlugs, cfg.trustedPrLabel);
+    const buildCreator = PreviewServerFactory.createBuildCreator(prs, cfg.buildsDir, cfg.domainName);
+
+    const middleware = PreviewServerFactory.createMiddleware(buildRetriever, buildVerifier, buildCreator, cfg);
+    const httpServer = http.createServer(middleware as any);
+
+    httpServer.on('listening', () => {
+      const info = httpServer.address() as AddressInfo;
+      logger.info(`Up and running (and listening on ${info.address}:${info.port})...`);
+    });
+
+    return httpServer;
+  }
+
+  public static createMiddleware(buildRetriever: BuildRetriever, buildVerifier: BuildVerifier,
+                                 buildCreator: BuildCreator, cfg: PreviewServerConfig): express.Express {
+    const middleware = express();
+    const jsonParser = bodyParser.json();
+    const significantFilesRe = new RegExp(cfg.significantFilesPattern);
+
+    // RESPOND TO IS-ALIVE PING
+    middleware.get(/^\/health-check\/?$/, (_req, res) => res.sendStatus(200));
+
+    // RESPOND TO CAN-HAVE-PUBLIC-PREVIEW CHECK
+    const canHavePublicPreviewRe = /^\/can-have-public-preview\/(\d+)\/?$/;
+    middleware.get(canHavePublicPreviewRe, async (req, res) => {
+      try {
+        const pr = +canHavePublicPreviewRe.exec(req.url)![1];
+
+        if (!await buildVerifier.getSignificantFilesChanged(pr, significantFilesRe)) {
+          // Cannot have preview: PR did not touch relevant files: `aio/` or `packages/` (except for spec files).
+          res.send({canHavePublicPreview: false, reason: 'No significant files touched.'});
+          logger.log(`PR:${pr} - Cannot have a public preview, because it did not touch any significant files.`);
+        } else if (!await buildVerifier.getPrIsTrusted(pr)) {
+          // Cannot have preview: PR not automatically verifiable as "trusted".
+          res.send({canHavePublicPreview: false, reason: 'Not automatically verifiable as "trusted".'});
+          logger.log(`PR:${pr} - Cannot have a public preview, because not automatically verifiable as "trusted".`);
+        } else {
+          // Can have preview.
+          res.send({canHavePublicPreview: true, reason: null});
+          logger.log(`PR:${pr} - Can have a public preview.`);
+        }
+      } catch (err) {
+        logger.error('Previewability check error', err);
+        respondWithError(res, err);
+      }
+    });
+
+    // CIRCLE_CI BUILD COMPLETE WEBHOOK
+    middleware.post(/^\/circle-build\/?$/, jsonParser, async (req, res) => {
+      try {
+        if (!(
+          req.is('json') &&
+          req.body &&
+          req.body.payload &&
+          req.body.payload.build_num > 0 &&
+          req.body.payload.build_parameters &&
+          req.body.payload.build_parameters.CIRCLE_JOB
+        )) {
+          throwRequestError(400, `Incorrect body content. Expected JSON`, req);
+        }
+
+        const job = req.body.payload.build_parameters.CIRCLE_JOB;
+        const buildNum = req.body.payload.build_num;
+
+        logger.log(`Build:${buildNum}, Job:${job} - processing web-hook trigger`);
+
+        if (job !== AIO_PREVIEW_JOB) {
+          res.sendStatus(204);
+          logger.log(`Build:${buildNum}, Job:${job} -`,
+                     `Skipping preview processing because this is not the "${AIO_PREVIEW_JOB}" job.`);
+          return;
+        }
+
+        const { pr, sha, org, repo, success } = await buildRetriever.getGithubInfo(buildNum);
+
+        if (!success) {
+          res.sendStatus(204);
+          logger.log(`PR:${pr}, Build:${buildNum} - Skipping preview processing because this build did not succeed.`);
+          return;
+        }
+
+        assert(cfg.githubOrg === org,
+          `Invalid webhook: expected "githubOrg" property to equal "${cfg.githubOrg}" but got "${org}".`);
+        assert(cfg.githubRepo === repo,
+          `Invalid webhook: expected "githubRepo" property to equal "${cfg.githubRepo}" but got "${repo}".`);
+
+        // Do not deploy unless this PR has touched relevant files: `aio/` or `packages/` (except for spec files)
+        if (!await buildVerifier.getSignificantFilesChanged(pr, significantFilesRe)) {
+          res.sendStatus(204);
+          logger.log(`PR:${pr}, Build:${buildNum} - ` +
+                     `Skipping preview processing because this PR did not touch any significant files.`);
+          return;
+        }
+
+        const artifactPath = await buildRetriever.downloadBuildArtifact(buildNum, pr, sha, cfg.buildArtifactPath);
+        const isPublic = await buildVerifier.getPrIsTrusted(pr);
+        await buildCreator.create(pr, sha, artifactPath, isPublic);
+
+        res.sendStatus(isPublic ? 201 : 202);
+        logger.log(`PR:${pr}, SHA:${computeShortSha(sha)}, Build:${buildNum} - ` +
+                   `Successfully created ${isPublic ? 'public' : 'non-public'} preview.`);
+      } catch (err) {
+        logger.error('CircleCI webhook error', err);
+        respondWithError(res, err);
+      }
+    });
+
+    // GITHUB PR UPDATED WEBHOOK
+    middleware.post(/^\/pr-updated\/?$/, jsonParser, async (req, res) => {
+      const { action, number: prNo }: { action?: string, number?: number } = req.body;
+      const visMayHaveChanged = !action || (action === 'labeled') || (action === 'unlabeled');
+
+      try {
+        if (!visMayHaveChanged) {
+          res.sendStatus(200);
+        } else if (!prNo) {
+          throwRequestError(400, `Missing or empty 'number' field`, req);
+        } else {
+          const isPublic = await buildVerifier.getPrIsTrusted(prNo);
+          await buildCreator.updatePrVisibility(prNo, isPublic);
+          res.sendStatus(200);
+        }
+      } catch (err) {
+        logger.error('PR update hook error', err);
+        respondWithError(res, err);
+      }
+    });
+
+    // ALL OTHER REQUESTS
+    middleware.all('*', req => throwRequestError(404, 'Unknown resource', req));
+    middleware.use((err: any, _req: any, res: express.Response, _next: any) => {
+      const statusText = http.STATUS_CODES[err.status] || '???';
+      logger.error(`Preview server error: ${err.status} - ${statusText}:`, err.message);
+      respondWithError(res, err);
+    });
+
+    return middleware;
+  }
+
+  public static createBuildCreator(prs: GithubPullRequests, buildsDir: string, domainName: string): BuildCreator {
+    const buildCreator = new BuildCreator(buildsDir);
+    const postPreviewsComment = (pr: number, shas: string[]) => {
+      const body = shas.
+        map(sha => `You can preview ${sha} at https://pr${pr}-${sha}.${domainName}/.`).
+        join('\n');
+
+      return prs.addComment(pr, body);
+    };
+
+    buildCreator.on(CreatedBuildEvent.type, ({pr, sha, isPublic}: CreatedBuildEvent) => {
+      if (isPublic) {
+        postPreviewsComment(pr, [sha]);
+      }
+    });
+
+    buildCreator.on(ChangedPrVisibilityEvent.type, ({pr, shas, isPublic}: ChangedPrVisibilityEvent) => {
+      if (isPublic && shas.length) {
+        postPreviewsComment(pr, shas);
+      }
+    });
+
+    return buildCreator;
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/preview-server/utils.ts

@@ -0,0 +1,29 @@
+import * as express from 'express';
+import {promisify} from 'util';
+import {PreviewServerError} from './preview-error';
+
+/**
+ * Update the response to report that an error has occurred.
+ * @param res The response to configure as an error.
+ * @param err The error that needs to be reported.
+ */
+export async function respondWithError(res: express.Response, err: any): Promise<void> {
+  if (!(err instanceof PreviewServerError)) {
+    err = new PreviewServerError(500, String((err && err.message) || err));
+  }
+
+  res.status(err.status);
+  await promisify(res.end.bind(res))(err.message);
+}
+
+/**
+ * Throw an exception that describes the given error information.
+ * @param status The HTTP status code include in the error.
+ * @param error The error message to include in the error.
+ * @param req The request that triggered this error.
+ */
+export function throwRequestError(status: number, error: string, req: express.Request): never {
+  const message = `${error} in request: ${req.method} ${req.originalUrl}` +
+                  (!req.body ? '' : ` ${JSON.stringify(req.body)}`);
+  throw new PreviewServerError(status, message);
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-creator.ts

@@ -1,81 +0,0 @@
-// Imports
-import * as cp from 'child_process';
-import {EventEmitter} from 'events';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as shell from 'shelljs';
-import {assertNotMissingOrEmpty} from '../common/utils';
-import {CreatedBuildEvent} from './build-events';
-import {UploadError} from './upload-error';
-
-// Classes
-export class BuildCreator extends EventEmitter {
-  // Constructor
-  constructor(protected buildsDir: string) {
-    super();
-    assertNotMissingOrEmpty('buildsDir', buildsDir);
-  }
-
-  // Methods - Public
-  public create(pr: string, sha: string, archivePath: string): Promise<any> {
-    const prDir = path.join(this.buildsDir, pr);
-    const shaDir = path.join(prDir, sha);
-    let dirToRemoveOnError: string;
-
-    return Promise.
-      all([this.exists(prDir), this.exists(shaDir)]).
-      then(([prDirExisted, shaDirExisted]) => {
-        if (shaDirExisted) {
-          throw new UploadError(409, `Request to overwrite existing directory: ${shaDir}`);
-        }
-
-        dirToRemoveOnError = prDirExisted ? shaDir : prDir;
-
-        return Promise.resolve().
-          then(() => shell.mkdir('-p', shaDir)).
-          then(() => this.extractArchive(archivePath, shaDir)).
-          then(() => this.emit(CreatedBuildEvent.type, new CreatedBuildEvent(+pr, sha)));
-      }).
-      catch(err => {
-        if (dirToRemoveOnError) {
-          shell.rm('-rf', dirToRemoveOnError);
-        }
-
-        if (!(err instanceof UploadError)) {
-          err = new UploadError(500, `Error while uploading to directory: ${shaDir}\n${err}`);
-        }
-
-        throw err;
-      });
-  }
-
-  // Methods - Protected
-  protected exists(fileOrDir: string): Promise<boolean> {
-    return new Promise(resolve => fs.access(fileOrDir, err => resolve(!err)));
-  }
-
-  protected extractArchive(inputFile: string, outputDir: string): Promise<void> {
-    return new Promise<void>((resolve, reject) => {
-      const cmd = `tar --extract --gzip --directory "${outputDir}" --file "${inputFile}"`;
-
-      cp.exec(cmd, (err, _stdout, stderr) => {
-        if (err) {
-          return reject(err);
-        }
-
-        if (stderr) {
-          console.warn(stderr);
-        }
-
-        try {
-          // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
-          (shell as any).chmod('-R', 'a-w', outputDir);
-          shell.rm('-f', inputFile);
-          resolve();
-        } catch (err) {
-          reject(err);
-        }
-      });
-    });
-  }
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-events.ts

@@ -1,15 +0,0 @@
-// Classes
-export class BuildEvent {
-  // Constructor
-  constructor(public type: string, public pr: number, public sha: string) {}
-}
-
-export class CreatedBuildEvent extends BuildEvent {
-  // Properties - Public, Static
-  public static type = 'build.created';
-
-  // Constructor
-  constructor(pr: number, sha: string) {
-    super(CreatedBuildEvent.type, pr, sha);
-  }
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-verifier.ts

@@ -1,78 +0,0 @@
-// Imports
-import * as jwt from 'jsonwebtoken';
-import {GithubPullRequests} from '../common/github-pull-requests';
-import {GithubTeams} from '../common/github-teams';
-import {assertNotMissingOrEmpty} from '../common/utils';
-import {UploadError} from './upload-error';
-
-// Interfaces - Types
-interface JwtPayload {
-  slug: string;
-  'pull-request': number;
-}
-
-// Classes
-export class BuildVerifier {
-  // Properties - Protected
-  protected githubPullRequests: GithubPullRequests;
-  protected githubTeams: GithubTeams;
-
-  // Constructor
-  constructor(protected secret: string, githubToken: string, protected repoSlug: string, organization: string,
-              protected allowedTeamSlugs: string[]) {
-    assertNotMissingOrEmpty('secret', secret);
-    assertNotMissingOrEmpty('githubToken', githubToken);
-    assertNotMissingOrEmpty('repoSlug', repoSlug);
-    assertNotMissingOrEmpty('organization', organization);
-    assertNotMissingOrEmpty('allowedTeamSlugs', allowedTeamSlugs && allowedTeamSlugs.join(''));
-
-    this.githubPullRequests = new GithubPullRequests(githubToken, repoSlug);
-    this.githubTeams = new GithubTeams(githubToken, organization);
-  }
-
-  // Methods - Public
-  public getPrAuthorTeamMembership(pr: number): Promise<{author: string, isMember: boolean}> {
-    return Promise.resolve().
-      then(() => this.githubPullRequests.fetch(pr)).
-      then(prInfo => prInfo.user.login).
-      then(author => this.githubTeams.isMemberBySlug(author, this.allowedTeamSlugs).
-        then(isMember => ({author, isMember})));
-  }
-
-  public verify(expectedPr: number, authHeader: string): Promise<void> {
-    return Promise.resolve().
-      then(() => this.extractJwtString(authHeader)).
-      then(jwtString => this.verifyJwt(expectedPr, jwtString)).
-      then(jwtPayload => this.verifyPr(jwtPayload['pull-request'])).
-      catch(err => { throw new UploadError(403, `Error while verifying upload for PR ${expectedPr}: ${err}`); });
-  }
-
-  // Methods - Protected
-  protected extractJwtString(input: string): string {
-    return input.replace(/^token +/i, '');
-  }
-
-  protected verifyJwt(expectedPr: number, token: string): Promise<JwtPayload> {
-    return new Promise((resolve, reject) => {
-      jwt.verify(token, this.secret, {issuer: 'Travis CI, GmbH'}, (err, payload) => {
-        if (err) {
-          reject(err.message || err);
-        } else if (payload.slug !== this.repoSlug) {
-          reject(`jwt slug invalid. expected: ${this.repoSlug}`);
-        } else if (payload['pull-request'] !== expectedPr) {
-          reject(`jwt pull-request invalid. expected: ${expectedPr}`);
-        } else {
-          resolve(payload);
-        }
-      });
-    });
-  }
-
-  protected verifyPr(pr: number): Promise<void> {
-    return this.getPrAuthorTeamMembership(pr).
-      then(({author, isMember}) => isMember ? Promise.resolve() : Promise.reject(
-        `User '${author}' is not an active member of any of the following teams: ` +
-        `${this.allowedTeamSlugs.join(', ')}`,
-      ));
-  }
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index-preverify-pr.ts

@@ -1,39 +0,0 @@
-// Imports
-import {getEnvVar} from '../common/utils';
-import {BuildVerifier} from './build-verifier';
-
-// Run
-_main();
-
-// Functions
-function _main() {
-  const secret = 'unused';
-  const githubToken = getEnvVar('AIO_GITHUB_TOKEN');
-  const repoSlug = getEnvVar('AIO_REPO_SLUG');
-  const organization = getEnvVar('AIO_GITHUB_ORGANIZATION');
-  const allowedTeamSlugs = getEnvVar('AIO_GITHUB_TEAM_SLUGS').split(',');
-  const pr = +getEnvVar('AIO_PREVERIFY_PR');
-
-  const buildVerifier = new BuildVerifier(secret, githubToken, repoSlug, organization, allowedTeamSlugs);
-
-  // Exit codes:
-  // - 0: The PR author is a member.
-  // - 1: The PR author is not a member.
-  // - 2: An error occurred.
-  buildVerifier.getPrAuthorTeamMembership(pr).
-    then(({author, isMember}) => {
-      if (isMember) {
-        process.exit(0);
-      } else {
-        const errorMessage = `User '${author}' is not an active member of any of the following teams: ` +
-                             `${allowedTeamSlugs.join(', ')}`;
-        onError(errorMessage, 1);
-      }
-    }).
-    catch(err => onError(err, 2));
-}
-
-function onError(err: string, exitCode: number) {
-  console.error(err);
-  process.exit(exitCode || 1);
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index-test.ts

@@ -1,10 +0,0 @@
-// Imports
-import {GithubPullRequests} from '../common/github-pull-requests';
-import {BuildVerifier} from './build-verifier';
-
-// Run
-// TODO(gkalpak): Add e2e tests to cover these interactions as well.
-GithubPullRequests.prototype.addComment = () => Promise.resolve();
-BuildVerifier.prototype.verify = () => Promise.resolve();
-// tslint:disable-next-line: no-var-requires
-require('./index');

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index.ts

@@ -1,35 +0,0 @@
-// TODO(gkalpak): Find more suitable way to run as `www-data`.
-process.setuid('www-data');
-
-// Imports
-import {getEnvVar} from '../common/utils';
-import {uploadServerFactory} from './upload-server-factory';
-
-// Constants
-const AIO_BUILDS_DIR = getEnvVar('AIO_BUILDS_DIR');
-const AIO_DOMAIN_NAME = getEnvVar('AIO_DOMAIN_NAME');
-const AIO_GITHUB_ORGANIZATION = getEnvVar('AIO_GITHUB_ORGANIZATION');
-const AIO_GITHUB_TEAM_SLUGS = getEnvVar('AIO_GITHUB_TEAM_SLUGS');
-const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN');
-const AIO_PREVIEW_DEPLOYMENT_TOKEN = getEnvVar('AIO_PREVIEW_DEPLOYMENT_TOKEN');
-const AIO_REPO_SLUG = getEnvVar('AIO_REPO_SLUG');
-const AIO_UPLOAD_HOSTNAME = getEnvVar('AIO_UPLOAD_HOSTNAME');
-const AIO_UPLOAD_PORT = +getEnvVar('AIO_UPLOAD_PORT');
-
-// Run
-_main();
-
-// Functions
-function _main() {
-  uploadServerFactory.
-    create({
-      buildsDir: AIO_BUILDS_DIR,
-      domainName: AIO_DOMAIN_NAME,
-      githubOrganization: AIO_GITHUB_ORGANIZATION,
-      githubTeamSlugs: AIO_GITHUB_TEAM_SLUGS.split(','),
-      githubToken: AIO_GITHUB_TOKEN,
-      repoSlug: AIO_REPO_SLUG,
-      secret: AIO_PREVIEW_DEPLOYMENT_TOKEN,
-    }).
-    listen(AIO_UPLOAD_PORT, AIO_UPLOAD_HOSTNAME);
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/upload-error.ts

@@ -1,8 +0,0 @@
-// Classes
-export class UploadError extends Error {
-  // Constructor
-  constructor(public status: number = 500, message?: string) {
-    super(message);
-    Object.setPrototypeOf(this, UploadError.prototype);
-  }
-}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/upload-server-factory.ts

@@ -1,117 +0,0 @@
-// Imports
-import * as express from 'express';
-import * as http from 'http';
-import {GithubPullRequests} from '../common/github-pull-requests';
-import {assertNotMissingOrEmpty} from '../common/utils';
-import {BuildCreator} from './build-creator';
-import {CreatedBuildEvent} from './build-events';
-import {BuildVerifier} from './build-verifier';
-import {UploadError} from './upload-error';
-
-// Constants
-const AUTHORIZATION_HEADER = 'AUTHORIZATION';
-const X_FILE_HEADER = 'X-FILE';
-
-// Interfaces - Types
-interface UploadServerConfig {
-  buildsDir: string;
-  domainName: string;
-  githubOrganization: string;
-  githubTeamSlugs: string[];
-  githubToken: string;
-  repoSlug: string;
-  secret: string;
-}
-
-// Classes
-class UploadServerFactory {
-  // Methods - Public
-  public create({
-    buildsDir,
-    domainName,
-    githubOrganization,
-    githubTeamSlugs,
-    githubToken,
-    repoSlug,
-    secret,
-  }: UploadServerConfig): http.Server {
-    assertNotMissingOrEmpty('domainName', domainName);
-
-    const buildVerifier = new BuildVerifier(secret, githubToken, repoSlug, githubOrganization, githubTeamSlugs);
-    const buildCreator = this.createBuildCreator(buildsDir, githubToken, repoSlug, domainName);
-
-    const middleware = this.createMiddleware(buildVerifier, buildCreator);
-    const httpServer = http.createServer(middleware);
-
-    httpServer.on('listening', () => {
-      const info = httpServer.address();
-      console.info(`Up and running (and listening on ${info.address}:${info.port})...`);
-    });
-
-    return httpServer;
-  }
-
-  // Methods - Protected
-  protected createBuildCreator(buildsDir: string, githubToken: string, repoSlug: string,
-                               domainName: string): BuildCreator {
-    const buildCreator = new BuildCreator(buildsDir);
-    const githubPullRequests = new GithubPullRequests(githubToken, repoSlug);
-
-    buildCreator.on(CreatedBuildEvent.type, ({pr, sha}: CreatedBuildEvent) => {
-      const body = `The angular.io preview for ${sha} is available [here][1].\n\n` +
-                   `[1]: https://pr${pr}-${sha}.${domainName}/`;
-
-      githubPullRequests.addComment(pr, body);
-    });
-
-    return buildCreator;
-  }
-
-  protected createMiddleware(buildVerifier: BuildVerifier, buildCreator: BuildCreator): express.Express {
-    const middleware = express();
-
-    middleware.get(/^\/create-build\/([1-9][0-9]*)\/([0-9a-f]{40})\/?$/, (req, res) => {
-      const pr = req.params[0];
-      const sha = req.params[1];
-      const archive = req.header(X_FILE_HEADER);
-      const authHeader = req.header(AUTHORIZATION_HEADER);
-
-      if (!authHeader) {
-        this.throwRequestError(401, `Missing or empty '${AUTHORIZATION_HEADER}' header`, req);
-      } else if (!archive) {
-        this.throwRequestError(400, `Missing or empty '${X_FILE_HEADER}' header`, req);
-      }
-
-      buildVerifier.
-        verify(+pr, authHeader).
-        then(() => buildCreator.create(pr, sha, archive)).
-        then(() => res.sendStatus(201)).
-        catch(err => this.respondWithError(res, err));
-    });
-    middleware.get(/^\/health-check\/?$/, (_req, res) => res.sendStatus(200));
-    middleware.get('*', req => this.throwRequestError(404, 'Unknown resource', req));
-    middleware.all('*', req => this.throwRequestError(405, 'Unsupported method', req));
-    middleware.use((err: any, _req: any, res: express.Response, _next: any) => this.respondWithError(res, err));
-
-    return middleware;
-  }
-
-  protected respondWithError(res: express.Response, err: any) {
-    if (!(err instanceof UploadError)) {
-      err = new UploadError(500, String((err && err.message) || err));
-    }
-
-    const statusText = http.STATUS_CODES[err.status] || '???';
-    console.error(`Upload error: ${err.status} - ${statusText}`);
-    console.error(err.message);
-
-    res.status(err.status).end(err.message);
-  }
-
-  protected throwRequestError(status: number, error: string, req: express.Request) {
-    throw new UploadError(status, `${error} in request: ${req.method} ${req.originalUrl}`);
-  }
-}
-
-// Exports
-export const uploadServerFactory = new UploadServerFactory();

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/constants.ts

@@ -0,0 +1,37 @@
+export const enum BuildNums {
+  BUILD_INFO_ERROR = 1,
+  BUILD_INFO_404,
+  BUILD_INFO_BUILD_FAILED,
+  BUILD_INFO_INVALID_GH_ORG,
+  BUILD_INFO_INVALID_GH_REPO,
+  CHANGED_FILES_ERROR,
+  CHANGED_FILES_404,
+  CHANGED_FILES_NONE,
+  BUILD_ARTIFACTS_ERROR,
+  BUILD_ARTIFACTS_404,
+  BUILD_ARTIFACTS_EMPTY,
+  BUILD_ARTIFACTS_MISSING,
+  DOWNLOAD_ARTIFACT_ERROR,
+  DOWNLOAD_ARTIFACT_404,
+  DOWNLOAD_ARTIFACT_TOO_BIG,
+  TRUST_CHECK_ERROR,
+  TRUST_CHECK_UNTRUSTED,
+  TRUST_CHECK_TRUSTED_LABEL,
+  TRUST_CHECK_ACTIVE_TRUSTED_USER,
+  TRUST_CHECK_INACTIVE_TRUSTED_USER,
+}
+
+export const enum PrNums {
+  CHANGED_FILES_ERROR = 1,
+  CHANGED_FILES_404,
+  CHANGED_FILES_NONE,
+  TRUST_CHECK_ERROR,
+  TRUST_CHECK_UNTRUSTED,
+  TRUST_CHECK_TRUSTED_LABEL,
+  TRUST_CHECK_ACTIVE_TRUSTED_USER,
+  TRUST_CHECK_INACTIVE_TRUSTED_USER,
+}
+
+export const SHA = '1234567890'.repeat(4);
+export const ALT_SHA = 'abcde'.repeat(8);
+export const SIMILAR_SHA = SHA.slice(0, -1) + 'A';

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/delete-empty.d.ts

@@ -0,0 +1,10 @@
+declare module 'delete-empty' {
+  interface Options {
+    dryRun: boolean;
+    verbose: boolean;
+    filter: (filePath: string) => boolean;
+  }
+  export default function deleteEmpty(cwd: string, options?: Options): Promise<string[]>;
+  export default function deleteEmpty(cwd: string, options?: Options, callback?: (err: any, deleted: string[]) => void): void;
+  export function sync(cwd: string, options?: Options): string[];
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/helper.ts

@@ -4,20 +4,17 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as path from 'path';
 import * as shell from 'shelljs';
-import {getEnvVar} from '../common/utils';
-
-// Constans
-const SERVER_USER = 'www-data';
-const TEST_AIO_BUILDS_DIR = getEnvVar('TEST_AIO_BUILDS_DIR');
-const TEST_AIO_NGINX_HOSTNAME = getEnvVar('TEST_AIO_NGINX_HOSTNAME');
-const TEST_AIO_NGINX_PORT_HTTP = +getEnvVar('TEST_AIO_NGINX_PORT_HTTP');
-const TEST_AIO_NGINX_PORT_HTTPS = +getEnvVar('TEST_AIO_NGINX_PORT_HTTPS');
-const TEST_AIO_UPLOAD_HOSTNAME = getEnvVar('TEST_AIO_UPLOAD_HOSTNAME');
-const TEST_AIO_UPLOAD_MAX_SIZE = +getEnvVar('TEST_AIO_UPLOAD_MAX_SIZE');
-const TEST_AIO_UPLOAD_PORT = +getEnvVar('TEST_AIO_UPLOAD_PORT');
+import {AIO_DOWNLOADS_DIR, HIDDEN_DIR_PREFIX} from '../common/constants';
+import {
+  AIO_BUILDS_DIR,
+  AIO_NGINX_PORT_HTTP,
+  AIO_NGINX_PORT_HTTPS,
+  AIO_WWW_USER,
+} from '../common/env-variables';
+import {computeShortSha, Logger} from '../common/utils';
 
 // Interfaces - Types
-export interface CmdResult { success: boolean; err: Error; stdout: string; stderr: string; }
+export interface CmdResult { success: boolean; err: Error | null; stdout: string; stderr: string; }
 export interface FileSpecs { content?: string; size?: number; }
 
 export type CleanUpFn = () => void;
@@ -26,79 +23,74 @@ export type VerifyCmdResultFn = (result: CmdResult) => void;
 
 // Classes
 class Helper {
-  // Properties - Public
-  public get buildsDir() { return TEST_AIO_BUILDS_DIR; }
-  public get nginxHostname() { return TEST_AIO_NGINX_HOSTNAME; }
-  public get nginxPortHttp() { return TEST_AIO_NGINX_PORT_HTTP; }
-  public get nginxPortHttps() { return TEST_AIO_NGINX_PORT_HTTPS; }
-  public get serverUser() { return SERVER_USER; }
-  public get uploadHostname() { return TEST_AIO_UPLOAD_HOSTNAME; }
-  public get uploadPort() { return TEST_AIO_UPLOAD_PORT; }
-  public get uploadMaxSize() { return TEST_AIO_UPLOAD_MAX_SIZE; }
 
   // Properties - Protected
   protected cleanUpFns: CleanUpFn[] = [];
   protected portPerScheme: {[scheme: string]: number} = {
-    http: this.nginxPortHttp,
-    https: this.nginxPortHttps,
+    http: AIO_NGINX_PORT_HTTP,
+    https: AIO_NGINX_PORT_HTTPS,
   };
 
+  private logger = new Logger('TestHelper');
+
   // Constructor
   constructor() {
-    shell.mkdir('-p', this.buildsDir);
-    shell.exec(`chown -R ${this.serverUser} ${this.buildsDir}`);
+    shell.mkdir('-p', AIO_BUILDS_DIR);
+    shell.exec(`chown -R ${AIO_WWW_USER} ${AIO_BUILDS_DIR}`);
+    shell.mkdir('-p', AIO_DOWNLOADS_DIR);
+    shell.exec(`chown -R ${AIO_WWW_USER} ${AIO_DOWNLOADS_DIR}`);
   }
 
   // Methods - Public
-  public cleanUp() {
+  public cleanUp(): void {
     while (this.cleanUpFns.length) {
       // Clean-up fns remove themselves from the list.
       this.cleanUpFns[0]();
     }
 
-    if (fs.readdirSync(this.buildsDir).length) {
-      throw new Error(`Directory '${this.buildsDir}' is not empty after clean-up.`);
+    const leftoverDownloads = fs.readdirSync(AIO_DOWNLOADS_DIR);
+    const leftoverBuilds = fs.readdirSync(AIO_BUILDS_DIR);
+
+    if (leftoverDownloads.length) {
+      this.logger.log(`Downloads directory '${AIO_DOWNLOADS_DIR}' is not empty after clean-up.`, leftoverDownloads);
+      shell.rm('-rf', `${AIO_DOWNLOADS_DIR}/*`);
+    }
+
+    if (leftoverBuilds.length) {
+      this.logger.log(`Builds directory '${AIO_BUILDS_DIR}' is not empty after clean-up.`, leftoverBuilds);
+      shell.rm('-rf', `${AIO_BUILDS_DIR}/*`);
+    }
+
+    if (leftoverBuilds.length || leftoverDownloads.length) {
+      throw new Error(`Unexpected test files not cleaned up.`);
     }
   }
 
-  public createDummyArchive(pr: string, sha: string, archivePath: string): CleanUpFn {
-    const inputDir = path.join(this.buildsDir, 'uploaded', pr, sha);
-    const cmd1 = `tar --create --gzip --directory "${inputDir}" --file "${archivePath}" .`;
-    const cmd2 = `chown ${this.serverUser} ${archivePath}`;
-
-    const cleanUpTemp = this.createDummyBuild(`uploaded/${pr}`, sha, true);
-    shell.exec(cmd1);
-    shell.exec(cmd2);
-    cleanUpTemp();
-
-    return this.createCleanUpFn(() => shell.rm('-rf', archivePath));
-  }
-
-  public createDummyBuild(pr: string, sha: string, force = false): CleanUpFn {
-    const prDir = path.join(this.buildsDir, pr);
-    const shaDir = path.join(prDir, sha);
+  public createDummyBuild(pr: number, sha: string, isPublic = true, force = false, legacy = false): CleanUpFn {
+    const prDir = this.getPrDir(pr, isPublic);
+    const shaDir = this.getShaDir(prDir, sha, legacy);
     const idxPath = path.join(shaDir, 'index.html');
     const barPath = path.join(shaDir, 'foo', 'bar.js');
 
     this.writeFile(idxPath, {content: `PR: ${pr} | SHA: ${sha} | File: /index.html`}, force);
     this.writeFile(barPath, {content: `PR: ${pr} | SHA: ${sha} | File: /foo/bar.js`}, force);
-    shell.exec(`chown -R ${this.serverUser} ${prDir}`);
+    shell.exec(`chown -R ${AIO_WWW_USER} ${prDir}`);
 
     return this.createCleanUpFn(() => shell.rm('-rf', prDir));
   }
 
-  public deletePrDir(pr: string) {
-    const prDir = path.join(this.buildsDir, pr);
-
-    if (fs.existsSync(prDir)) {
-      // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
-      (shell as any).chmod('-R', 'a+w', prDir);
-      shell.rm('-rf', prDir);
-    }
+  public getPrDir(pr: number, isPublic: boolean): string {
+    const prDirName = isPublic ? '' + pr : HIDDEN_DIR_PREFIX + pr;
+    return path.join(AIO_BUILDS_DIR, prDirName);
   }
 
-  public readBuildFile(pr: string, sha: string, relFilePath: string): string {
-    const absFilePath = path.join(this.buildsDir, pr, sha, relFilePath);
+  public getShaDir(prDir: string, sha: string, legacy = false): string {
+    return path.join(prDir, legacy ? sha : computeShortSha(sha));
+  }
+
+  public readBuildFile(pr: number, sha: string, relFilePath: string, isPublic = true, legacy = false): string {
+    const shaDir = this.getShaDir(this.getPrDir(pr, isPublic), sha, legacy);
+    const absFilePath = path.join(shaDir, relFilePath);
     return fs.readFileSync(absFilePath, 'utf8');
   }
 
@@ -109,11 +101,11 @@ class Helper {
     });
   }
 
-  public runForAllSupportedSchemes(suiteFactory: TestSuiteFactory) {
+  public runForAllSupportedSchemes(suiteFactory: TestSuiteFactory): void {
     Object.keys(this.portPerScheme).forEach(scheme => suiteFactory(scheme, this.portPerScheme[scheme]));
   }
 
-  public verifyResponse(status: number | [number, string], regex = /^/): VerifyCmdResultFn {
+  public verifyResponse(status: number | [number, string], regex: string | RegExp = /^/): VerifyCmdResultFn {
     let statusCode: number;
     let statusText: string;
 
@@ -122,19 +114,20 @@ class Helper {
       statusText = status[1];
     } else {
       statusCode = status;
-      statusText = http.STATUS_CODES[statusCode];
+      statusText = http.STATUS_CODES[statusCode] || 'UNKNOWN_STATUS_CODE';
     }
 
     return (result: CmdResult) => {
       const [headers, body] = result.stdout.
         split(/(?:\r?\n){2,}/).
         map(s => s.trim()).
-        slice(-2);
+        slice(-2);   // In case of redirect, discard the previous headers.
+                     // Only keep the last to sections (final headers and body).
 
       if (!result.success) {
-        console.log('Stdout:', result.stdout);
-        console.log('Stderr:', result.stderr);
-        console.log('Error:', result.err);
+        this.logger.log('Stdout:', result.stdout);
+        this.logger.error('Stderr:', result.stderr);
+        this.logger.error('Error:', result.err);
       }
 
       expect(result.success).toBe(true);
@@ -143,12 +136,14 @@ class Helper {
     };
   }
 
-  public writeBuildFile(pr: string, sha: string, relFilePath: string, content: string): CleanUpFn {
-    const absFilePath = path.join(this.buildsDir, pr, sha, relFilePath);
-    return this.writeFile(absFilePath, {content}, true);
+  public writeBuildFile(pr: number, sha: string, relFilePath: string, content: string, isPublic = true,
+                        legacy = false): void {
+    const shaDir = this.getShaDir(this.getPrDir(pr, isPublic), sha, legacy);
+    const absFilePath = path.join(shaDir, relFilePath);
+    this.writeFile(absFilePath, {content}, true);
   }
 
-  public writeFile(filePath: string, {content, size}: FileSpecs, force = false): CleanUpFn {
+  public writeFile(filePath: string, {content, size}: FileSpecs, force = false): void {
     if (!force && fs.existsSync(filePath)) {
       throw new Error(`Refusing to overwrite existing file '${filePath}'.`);
     }
@@ -166,13 +161,11 @@ class Helper {
       // Create a file with the specified content.
       fs.writeFileSync(filePath, content || '');
     }
-    shell.exec(`chown ${this.serverUser} ${filePath}`);
-
-    return this.createCleanUpFn(() => shell.rm('-rf', cleanUpTarget));
+    shell.exec(`chown ${AIO_WWW_USER} ${filePath}`);
   }
 
   // Methods - Protected
-  protected createCleanUpFn(fn: Function): CleanUpFn {
+  protected createCleanUpFn(fn: () => void): CleanUpFn {
     const cleanUpFn = () => {
       const idx = this.cleanUpFns.indexOf(cleanUpFn);
       if (idx !== -1) {
@@ -187,5 +180,70 @@ class Helper {
   }
 }
 
+interface DefaultCurlOptions {
+  defaultMethod?: CurlOptions['method'];
+  defaultOptions?: CurlOptions['options'];
+  defaultHeaders?: CurlOptions['headers'];
+  defaultData?: CurlOptions['data'];
+  defaultExtraPath?: CurlOptions['extraPath'];
+}
+
+interface CurlOptions {
+  method?: string;
+  options?: string;
+  headers?: string[];
+  data?: any;
+  url?: string;
+  extraPath?: string;
+}
+
+export function makeCurl(baseUrl: string, {
+  defaultMethod = 'POST',
+  defaultOptions = '',
+  defaultHeaders = ['Content-Type: application/json'],
+  defaultData = {},
+  defaultExtraPath = '',
+}: DefaultCurlOptions = {}) {
+  return function curl({
+    method = defaultMethod,
+    options = defaultOptions,
+    headers = defaultHeaders,
+    data = defaultData,
+    url = baseUrl,
+    extraPath = defaultExtraPath,
+  }: CurlOptions) {
+    const dataString = data ? JSON.stringify(data) : '';
+    const cmd = `curl -iLX ${method} ` +
+                `${options} ` +
+                headers.map(header => `--header "${header}" `).join('') +
+                `--data '${dataString}' ` +
+                `${url}${extraPath}`;
+    return helper.runCmd(cmd);
+  };
+}
+
+export interface PayloadData {
+  data: {
+    payload: {
+      build_num: number,
+      build_parameters: {
+        CIRCLE_JOB: string;
+      };
+    };
+  };
+}
+
+export function payload(buildNum: number): PayloadData {
+  return {
+    data: {
+      payload: {
+        build_num: buildNum,
+        build_parameters: { CIRCLE_JOB: 'aio_preview' },
+      },
+    },
+  };
+}
+
+
 // Exports
 export const helper = new Helper();

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/jasmine-custom-matchers-types.d.ts

@@ -0,0 +1,7 @@
+declare module jasmine {
+  interface Matchers {
+    toExistAsAFile(remove = true): boolean;
+    toExistAsABuild(remove = true): boolean;
+    toExistAsAnArtifact(remove = true): boolean;
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/jasmine-custom-matchers.ts

@@ -0,0 +1,88 @@
+import {sync as deleteEmpty} from 'delete-empty';
+import {existsSync, unlinkSync} from 'fs';
+import {join} from 'path';
+import {AIO_DOWNLOADS_DIR} from '../common/constants';
+import {computeShortSha} from '../common/utils';
+import {SHA} from './constants';
+import {helper} from './helper';
+
+function checkFile(filePath: string, remove: boolean): boolean {
+  const exists = existsSync(filePath);
+  if (exists && remove) {
+    // if we expected the file to exist then we remove it to prevent leftover file errors
+    unlinkSync(filePath);
+  }
+  return exists;
+}
+
+function getArtifactPath(prNum: number, sha: string = SHA): string {
+  return `${AIO_DOWNLOADS_DIR}/${prNum}-${computeShortSha(sha)}-aio-snapshot.tgz`;
+}
+
+function checkFiles(prNum: number, isPublic: boolean, sha: string, isLegacy: boolean, remove: boolean) {
+  const files = ['/index.html', '/foo/bar.js'];
+  const prPath = helper.getPrDir(prNum, isPublic);
+  const shaPath = helper.getShaDir(prPath, sha, isLegacy);
+
+  const existingFiles: string[] = [];
+  const missingFiles: string[] = [];
+  files
+    .map(file => join(shaPath, file))
+    .forEach(file => (checkFile(file, remove) ? existingFiles : missingFiles).push(file));
+
+  deleteEmpty(prPath);
+
+  return { existingFiles, missingFiles };
+}
+
+class ToExistAsAFile implements jasmine.CustomMatcher {
+  public compare(actual: string, remove = true): jasmine.CustomMatcherResult {
+    const pass = checkFile(actual, remove);
+    return {
+      message: `Expected file at "${actual}" ${pass ? 'not' : ''} to exist`,
+      pass,
+    };
+  }
+}
+
+class ToExistAsAnArtifact implements jasmine.CustomMatcher {
+  public compare(actual: {prNum: number, sha?: string}, remove = true): jasmine.CustomMatcherResult {
+    const { prNum, sha = SHA } = actual;
+    const filePath = getArtifactPath(prNum, sha);
+    const pass = checkFile(filePath, remove);
+    return {
+      message: `Expected artifact "PR:${prNum}, SHA:${sha}, FILE:${filePath}" ${pass ? 'not' : '\b'} to exist`,
+      pass,
+    };
+  }
+}
+
+class ToExistAsABuild implements jasmine.CustomMatcher {
+  public compare(actual: {prNum: number, isPublic?: boolean, sha?: string, isLegacy?: boolean}, remove = true):
+      jasmine.CustomMatcherResult  {
+    const {prNum, isPublic = true, sha = SHA, isLegacy = false} = actual;
+    const {missingFiles} = checkFiles(prNum, isPublic, sha, isLegacy, remove);
+    return {
+      message: `Expected files for build "PR:${prNum}, SHA:${sha}" to exist:\n` +
+                missingFiles.map(file => ` - ${file}`).join('\n'),
+      pass: missingFiles.length === 0,
+    };
+  }
+  public negativeCompare(actual: {prNum: number, isPublic?: boolean, sha?: string, isLegacy?: boolean}):
+      jasmine.CustomMatcherResult  {
+    const {prNum, isPublic = true, sha = SHA, isLegacy = false} = actual;
+    const { existingFiles } = checkFiles(prNum, isPublic, sha, isLegacy, false);
+    return {
+      message: `Expected files for build "PR:${prNum}, SHA:${sha}" not to exist:\n` +
+                existingFiles.map(file => ` - ${file}`).join('\n'),
+      pass: existingFiles.length === 0,
+    };
+  }
+
+}
+
+export const customMatchers = {
+  toExistAsABuild: () => new ToExistAsABuild(),
+  toExistAsAFile: () => new ToExistAsAFile(),
+  toExistAsAnArtifact: () => new ToExistAsAnArtifact(),
+};

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/mock-external-apis.ts

@@ -0,0 +1,171 @@
+/* tslint:disable:max-line-length */
+import * as nock from 'nock';
+import * as tar from 'tar-stream';
+import {gzipSync} from 'zlib';
+import {getEnvVar, Logger} from '../common/utils';
+import {BuildNums, PrNums, SHA} from './constants';
+
+// We are using the `nock` library to fake responses from REST requests, when testing.
+// This is necessary, because the test preview-server runs as a separate node process to
+// the test harness, so we do not have direct access to the code (e.g. for mocking).
+// (See also 'lib/verify-setup/start-test-preview-server.ts'.)
+
+// Each of the potential requests to an external API (e.g. Github or CircleCI) are mocked
+// below and return a suitable response. This is quite complicated to setup since the
+// response from, say, CircleCI will affect what request is made to, say, Github.
+
+const logger = new Logger('mock-external-apis');
+
+const log = (...args: any[]) => {
+  // Filter out non-matching URL checks
+  if (!/^matching.+: false$/.test(args[0])) {
+    logger.log(...args);
+  }
+};
+
+const AIO_CIRCLE_CI_TOKEN = getEnvVar('AIO_CIRCLE_CI_TOKEN');
+const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN');
+
+const AIO_ARTIFACT_PATH = getEnvVar('AIO_ARTIFACT_PATH');
+const AIO_GITHUB_ORGANIZATION = getEnvVar('AIO_GITHUB_ORGANIZATION');
+const AIO_GITHUB_REPO = getEnvVar('AIO_GITHUB_REPO');
+const AIO_TRUSTED_PR_LABEL = getEnvVar('AIO_TRUSTED_PR_LABEL');
+const AIO_GITHUB_TEAM_SLUGS = getEnvVar('AIO_GITHUB_TEAM_SLUGS').split(',');
+
+const ACTIVE_TRUSTED_USER = 'active-trusted-user';
+const INACTIVE_TRUSTED_USER = 'inactive-trusted-user';
+const UNTRUSTED_USER = 'untrusted-user';
+
+const BASIC_BUILD_INFO = {
+  branch: `pull/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`,
+  failed: false,
+  reponame: AIO_GITHUB_REPO,
+  username: AIO_GITHUB_ORGANIZATION,
+  vcs_revision: SHA,
+};
+
+const ISSUE_INFO_TRUSTED_LABEL = { labels: [{ name: AIO_TRUSTED_PR_LABEL }], user: { login: UNTRUSTED_USER } };
+const ISSUE_INFO_ACTIVE_TRUSTED_USER = { labels: [], user: { login: ACTIVE_TRUSTED_USER } };
+const ISSUE_INFO_INACTIVE_TRUSTED_USER = { labels: [], user: { login: INACTIVE_TRUSTED_USER } };
+const ISSUE_INFO_UNTRUSTED = { labels: [], user: { login: UNTRUSTED_USER } };
+const ACTIVE_STATE = { state: 'active' };
+const INACTIVE_STATE = { state: 'inactive' };
+
+const TEST_TEAM_INFO = AIO_GITHUB_TEAM_SLUGS.map((slug, index) => ({ slug, id: index }));
+
+const CIRCLE_CI_API_HOST = 'https://circleci.com';
+const CIRCLE_CI_TOKEN_PARAM = `circle-token=${AIO_CIRCLE_CI_TOKEN}`;
+const ARTIFACT_1 = { path: 'artifact-1', url: `${CIRCLE_CI_API_HOST}/artifacts/artifact-1`, _urlPath: '/artifacts/artifact-1' };
+const ARTIFACT_2 = { path: 'artifact-2', url: `${CIRCLE_CI_API_HOST}/artifacts/artifact-2`, _urlPath: '/artifacts/artifact-2' };
+const ARTIFACT_3 = { path: 'artifact-3', url: `${CIRCLE_CI_API_HOST}/artifacts/artifact-3`, _urlPath: '/artifacts/artifact-3' };
+const ARTIFACT_ERROR = { path: AIO_ARTIFACT_PATH, url: `${CIRCLE_CI_API_HOST}/artifacts/error`, _urlPath: '/artifacts/error' };
+const ARTIFACT_404 = { path: AIO_ARTIFACT_PATH, url: `${CIRCLE_CI_API_HOST}/artifacts/404`, _urlPath: '/artifacts/404' };
+const ARTIFACT_VALID_TRUSTED_USER = { path: AIO_ARTIFACT_PATH, url: `${CIRCLE_CI_API_HOST}/artifacts/valid/user`, _urlPath: '/artifacts/valid/user' };
+const ARTIFACT_VALID_TRUSTED_LABEL = { path: AIO_ARTIFACT_PATH, url: `${CIRCLE_CI_API_HOST}/artifacts/valid/label`, _urlPath: '/artifacts/valid/label' };
+const ARTIFACT_VALID_UNTRUSTED = { path: AIO_ARTIFACT_PATH, url: `${CIRCLE_CI_API_HOST}/artifacts/valid/untrusted`, _urlPath: '/artifacts/valid/untrusted' };
+
+const CIRCLE_CI_BUILD_INFO_URL = `/api/v1.1/project/github/${AIO_GITHUB_ORGANIZATION}/${AIO_GITHUB_REPO}`;
+
+const buildInfoUrl = (buildNum: number) => `${CIRCLE_CI_BUILD_INFO_URL}/${buildNum}?${CIRCLE_CI_TOKEN_PARAM}`;
+const buildArtifactsUrl = (buildNum: number) => `${CIRCLE_CI_BUILD_INFO_URL}/${buildNum}/artifacts?${CIRCLE_CI_TOKEN_PARAM}`;
+const buildInfo = (prNum: number) => ({ ...BASIC_BUILD_INFO, branch: `pull/${prNum}` });
+
+const GITHUB_API_HOST = 'https://api.github.com';
+const GITHUB_ISSUES_URL = `/repos/${AIO_GITHUB_ORGANIZATION}/${AIO_GITHUB_REPO}/issues`;
+const GITHUB_PULLS_URL = `/repos/${AIO_GITHUB_ORGANIZATION}/${AIO_GITHUB_REPO}/pulls`;
+const GITHUB_TEAMS_URL = `/orgs/${AIO_GITHUB_ORGANIZATION}/teams`;
+
+const getIssueUrl = (prNum: number) => `${GITHUB_ISSUES_URL}/${prNum}`;
+const getFilesUrl = (prNum: number, pageNum = 1) => `${GITHUB_PULLS_URL}/${prNum}/files?page=${pageNum}&per_page=100`;
+const getCommentUrl = (prNum: number) => `${getIssueUrl(prNum)}/comments`;
+const getTeamMembershipUrl = (teamId: number, username: string) => `/teams/${teamId}/memberships/${username}`;
+
+const createArchive = (buildNum: number, prNum: number, sha: string) => {
+  logger.log('createArchive', buildNum, prNum, sha);
+  const pack = tar.pack();
+  pack.entry({name: 'index.html'}, `BUILD: ${buildNum} | PR: ${prNum} | SHA: ${sha} | File: /index.html`);
+  pack.entry({name: 'foo/bar.js'}, `BUILD: ${buildNum} | PR: ${prNum} | SHA: ${sha} | File: /foo/bar.js`);
+  pack.finalize();
+  const zip = gzipSync(pack.read());
+  return zip;
+};
+
+// Create request scopes
+const circleCiApi = nock(CIRCLE_CI_API_HOST).log(log).persist();
+const githubApi = nock(GITHUB_API_HOST).log(log).persist().matchHeader('Authorization', `token ${AIO_GITHUB_TOKEN}`);
+
+//////////////////////////////
+
+// GENERAL responses
+githubApi.get(GITHUB_TEAMS_URL + '?page=1&per_page=100').reply(200, TEST_TEAM_INFO);
+githubApi.post(getCommentUrl(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER)).reply(200);
+
+// BUILD_INFO errors
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_INFO_ERROR)).replyWithError('BUILD_INFO_ERROR');
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_INFO_404)).reply(404, 'BUILD_INFO_404');
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_INFO_BUILD_FAILED)).reply(200, { ...BASIC_BUILD_INFO, failed: true });
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_INFO_INVALID_GH_ORG)).reply(200, { ...BASIC_BUILD_INFO, username: 'bad' });
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_INFO_INVALID_GH_REPO)).reply(200, { ...BASIC_BUILD_INFO, reponame: 'bad' });
+
+// CHANGED FILE errors
+circleCiApi.get(buildInfoUrl(BuildNums.CHANGED_FILES_ERROR)).reply(200, buildInfo(PrNums.CHANGED_FILES_ERROR));
+githubApi.get(getFilesUrl(PrNums.CHANGED_FILES_ERROR)).replyWithError('CHANGED_FILES_ERROR');
+circleCiApi.get(buildInfoUrl(BuildNums.CHANGED_FILES_404)).reply(200, buildInfo(PrNums.CHANGED_FILES_404));
+githubApi.get(getFilesUrl(PrNums.CHANGED_FILES_404)).reply(404, 'CHANGED_FILES_404');
+circleCiApi.get(buildInfoUrl(BuildNums.CHANGED_FILES_NONE)).reply(200, buildInfo(PrNums.CHANGED_FILES_NONE));
+githubApi.get(getFilesUrl(PrNums.CHANGED_FILES_NONE)).reply(200, []);
+
+// ARTIFACT URL errors
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_ARTIFACTS_ERROR)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.BUILD_ARTIFACTS_ERROR)).replyWithError('BUILD_ARTIFACTS_ERROR');
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_ARTIFACTS_404)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.BUILD_ARTIFACTS_404)).reply(404, 'BUILD_ARTIFACTS_ERROR');
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_ARTIFACTS_EMPTY)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.BUILD_ARTIFACTS_EMPTY)).reply(200, []);
+circleCiApi.get(buildInfoUrl(BuildNums.BUILD_ARTIFACTS_MISSING)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.BUILD_ARTIFACTS_MISSING)).reply(200, [ARTIFACT_1, ARTIFACT_2, ARTIFACT_3]);
+
+// ARTIFACT DOWNLOAD errors
+circleCiApi.get(buildInfoUrl(BuildNums.DOWNLOAD_ARTIFACT_ERROR)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.DOWNLOAD_ARTIFACT_ERROR)).reply(200, [ARTIFACT_ERROR]);
+circleCiApi.get(ARTIFACT_ERROR._urlPath).replyWithError(ARTIFACT_ERROR._urlPath);
+circleCiApi.get(buildInfoUrl(BuildNums.DOWNLOAD_ARTIFACT_404)).reply(200, buildInfo(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER));
+circleCiApi.get(buildArtifactsUrl(BuildNums.DOWNLOAD_ARTIFACT_404)).reply(200, [ARTIFACT_404]);
+circleCiApi.get(ARTIFACT_ERROR._urlPath).reply(404, ARTIFACT_ERROR._urlPath);
+
+// TRUST CHECK errors
+circleCiApi.get(buildInfoUrl(BuildNums.TRUST_CHECK_ERROR)).reply(200, buildInfo(PrNums.TRUST_CHECK_ERROR));
+githubApi.get(getFilesUrl(PrNums.TRUST_CHECK_ERROR)).reply(200, [{ filename: 'aio/a' }]);
+circleCiApi.get(buildArtifactsUrl(BuildNums.TRUST_CHECK_ERROR)).reply(200, [ARTIFACT_VALID_TRUSTED_USER]);
+githubApi.get(getIssueUrl(PrNums.TRUST_CHECK_ERROR)).replyWithError('TRUST_CHECK_ERROR');
+
+// ACTIVE TRUSTED USER response
+circleCiApi.get(buildInfoUrl(BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER)).reply(200, BASIC_BUILD_INFO);
+githubApi.get(getFilesUrl(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER)).reply(200, [{ filename: 'aio/a' }]);
+circleCiApi.get(buildArtifactsUrl(BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER)).reply(200, [ARTIFACT_VALID_TRUSTED_USER]);
+circleCiApi.get(ARTIFACT_VALID_TRUSTED_USER._urlPath).reply(200, createArchive(BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, SHA));
+githubApi.get(getIssueUrl(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER)).reply(200, ISSUE_INFO_ACTIVE_TRUSTED_USER);
+githubApi.get(getTeamMembershipUrl(0, ACTIVE_TRUSTED_USER)).reply(200, ACTIVE_STATE);
+
+// TRUSTED LABEL response
+circleCiApi.get(buildInfoUrl(BuildNums.TRUST_CHECK_TRUSTED_LABEL)).reply(200, BASIC_BUILD_INFO);
+githubApi.get(getFilesUrl(PrNums.TRUST_CHECK_TRUSTED_LABEL)).reply(200, [{ filename: 'aio/a' }]);
+circleCiApi.get(buildArtifactsUrl(BuildNums.TRUST_CHECK_TRUSTED_LABEL)).reply(200, [ARTIFACT_VALID_TRUSTED_LABEL]);
+circleCiApi.get(ARTIFACT_VALID_TRUSTED_LABEL._urlPath).reply(200, createArchive(BuildNums.TRUST_CHECK_TRUSTED_LABEL, PrNums.TRUST_CHECK_TRUSTED_LABEL, SHA));
+githubApi.get(getIssueUrl(PrNums.TRUST_CHECK_TRUSTED_LABEL)).reply(200, ISSUE_INFO_TRUSTED_LABEL);
+githubApi.get(getTeamMembershipUrl(0, ACTIVE_TRUSTED_USER)).reply(200, ACTIVE_STATE);
+
+// INACTIVE TRUSTED USER response
+circleCiApi.get(buildInfoUrl(BuildNums.TRUST_CHECK_INACTIVE_TRUSTED_USER)).reply(200, BASIC_BUILD_INFO);
+githubApi.get(getFilesUrl(PrNums.TRUST_CHECK_INACTIVE_TRUSTED_USER)).reply(200, [{ filename: 'aio/a' }]);
+circleCiApi.get(buildArtifactsUrl(BuildNums.TRUST_CHECK_INACTIVE_TRUSTED_USER)).reply(200, [ARTIFACT_VALID_TRUSTED_USER]);
+githubApi.get(getIssueUrl(PrNums.TRUST_CHECK_INACTIVE_TRUSTED_USER)).reply(200, ISSUE_INFO_INACTIVE_TRUSTED_USER);
+githubApi.get(getTeamMembershipUrl(0, INACTIVE_TRUSTED_USER)).reply(200, INACTIVE_STATE);
+
+// UNTRUSTED reponse
+circleCiApi.get(buildInfoUrl(BuildNums.TRUST_CHECK_UNTRUSTED)).reply(200, buildInfo(PrNums.TRUST_CHECK_UNTRUSTED));
+githubApi.get(getFilesUrl(PrNums.TRUST_CHECK_UNTRUSTED)).reply(200, [{ filename: 'aio/a' }]);
+circleCiApi.get(buildArtifactsUrl(BuildNums.TRUST_CHECK_UNTRUSTED)).reply(200, [ARTIFACT_VALID_UNTRUSTED]);
+circleCiApi.get(ARTIFACT_VALID_UNTRUSTED._urlPath).reply(200, createArchive(BuildNums.TRUST_CHECK_UNTRUSTED, PrNums.TRUST_CHECK_UNTRUSTED, SHA));
+githubApi.get(getIssueUrl(PrNums.TRUST_CHECK_UNTRUSTED)).reply(200, ISSUE_INFO_UNTRUSTED);
+githubApi.get(getTeamMembershipUrl(0, UNTRUSTED_USER)).reply(404);

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/nginx.e2e.ts

@@ -1,17 +1,23 @@
 // Imports
 import * as path from 'path';
+import {rm} from 'shelljs';
+import {AIO_BUILDS_DIR, AIO_NGINX_HOSTNAME, AIO_NGINX_PORT_HTTP, AIO_NGINX_PORT_HTTPS} from '../common/env-variables';
+import {computeShortSha} from '../common/utils';
+import {PrNums} from './constants';
 import {helper as h} from './helper';
+import {customMatchers} from './jasmine-custom-matchers';
 
 // Tests
 describe(`nginx`, () => {
 
-  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
+  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 5000);
+  beforeEach(() => jasmine.addMatchers(customMatchers));
   afterEach(() => h.cleanUp());
 
 
   it('should redirect HTTP to HTTPS', done => {
-    const httpHost = `${h.nginxHostname}:${h.nginxPortHttp}`;
-    const httpsHost = `${h.nginxHostname}:${h.nginxPortHttps}`;
+    const httpHost = `${AIO_NGINX_HOSTNAME}:${AIO_NGINX_PORT_HTTP}`;
+    const httpsHost = `${AIO_NGINX_HOSTNAME}:${AIO_NGINX_PORT_HTTPS}`;
     const urlMap = {
       [`http://${httpHost}/`]: `https://${httpsHost}/`,
       [`http://${httpHost}/foo`]: `https://${httpsHost}/foo`,
@@ -31,111 +37,193 @@ describe(`nginx`, () => {
   });
 
 
-  h.runForAllSupportedSchemes((scheme, port) => describe(`nginx (on ${scheme.toUpperCase()})`, () => {
-    const hostname = h.nginxHostname;
+  h.runForAllSupportedSchemes((scheme, port) => describe(`(on ${scheme.toUpperCase()})`, () => {
+    const hostname = AIO_NGINX_HOSTNAME;
     const host = `${hostname}:${port}`;
-    const pr = '9';
+    const pr = 9;
     const sha9 = '9'.repeat(40);
     const sha0 = '0'.repeat(40);
+    const shortSha9 = computeShortSha(sha9);
+    const shortSha0 = computeShortSha(sha0);
 
 
     describe(`pr<pr>-<sha>.${host}/*`, () => {
 
-      beforeEach(() => {
-        h.createDummyBuild(pr, sha9);
-        h.createDummyBuild(pr, sha0);
+      describe('(for public builds)', () => {
+
+        beforeEach(() => {
+          h.createDummyBuild(pr, sha9);
+          h.createDummyBuild(pr, sha0);
+        });
+
+        afterEach(() => {
+          expect({ prNum: pr, sha: sha9 }).toExistAsABuild();
+          expect({ prNum: pr, sha: sha0 }).toExistAsABuild();
+        });
+
+
+        it('should return /index.html', done => {
+          const origin = `${scheme}://pr${pr}-${shortSha9}.${host}`;
+          const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+
+          Promise.all([
+            h.runCmd(`curl -iL ${origin}/index.html`).then(h.verifyResponse(200, bodyRegex)),
+            h.runCmd(`curl -iL ${origin}/`).then(h.verifyResponse(200, bodyRegex)),
+            h.runCmd(`curl -iL ${origin}`).then(h.verifyResponse(200, bodyRegex)),
+          ]).then(done);
+        });
+
+
+        it('should return /index.html (for legacy builds)', async () => {
+          const origin = `${scheme}://pr${pr}-${sha9}.${host}`;
+          const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+
+          h.createDummyBuild(pr, sha9, true, false, true);
+
+          await Promise.all([
+            h.runCmd(`curl -iL ${origin}/index.html`).then(h.verifyResponse(200, bodyRegex)),
+            h.runCmd(`curl -iL ${origin}/`).then(h.verifyResponse(200, bodyRegex)),
+            h.runCmd(`curl -iL ${origin}`).then(h.verifyResponse(200, bodyRegex)),
+          ]);
+
+          expect({ prNum: pr, sha: sha9, isLegacy: true }).toExistAsABuild();
+        });
+
+
+        it('should return /foo/bar.js', done => {
+          const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /foo/bar\\.js$`);
+
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}.${host}/foo/bar.js`).
+            then(h.verifyResponse(200, bodyRegex)).
+            then(done);
+        });
+
+
+        it('should return /foo/bar.js (for legacy builds)', async () => {
+          const origin = `${scheme}://pr${pr}-${sha9}.${host}`;
+          const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /foo/bar\\.js$`);
+
+          h.createDummyBuild(pr, sha9, true, false, true);
+
+          await h.runCmd(`curl -iL ${origin}/foo/bar.js`).then(h.verifyResponse(200, bodyRegex));
+
+          expect({ prNum: pr, sha: sha9, isLegacy: true }).toExistAsABuild();
+        });
+
+
+        it('should respond with 403 for directories', done => {
+          Promise.all([
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}.${host}/foo/`).then(h.verifyResponse(403)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}.${host}/foo`).then(h.verifyResponse(403)),
+          ]).then(done);
+        });
+
+
+        it('should respond with 404 for unknown paths to files', done => {
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}.${host}/foo/baz.css`).
+            then(h.verifyResponse(404)).
+            then(done);
+        });
+
+
+        it('should rewrite to \'index.html\' for unknown paths that don\'t look like files', done => {
+          const origin = `${scheme}://pr${pr}-${shortSha9}.${host}`;
+          const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+
+          Promise.all([
+            h.runCmd(`curl -iL ${origin}/foo/baz`).then(h.verifyResponse(200, bodyRegex)),
+            h.runCmd(`curl -iL ${origin}/foo/baz/`).then(h.verifyResponse(200, bodyRegex)),
+          ]).then(done);
+        });
+
+
+        it('should respond with 404 for unknown PRs/SHAs', done => {
+          const otherPr = 54321;
+          const otherShortSha = computeShortSha('8'.repeat(40));
+
+          Promise.all([
+            h.runCmd(`curl -iL ${scheme}://pr${pr}9-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${otherPr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}9.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${otherShortSha}.${host}`).then(h.verifyResponse(404)),
+          ]).then(done);
+        });
+
+
+        it('should respond with 404 if the subdomain format is wrong', done => {
+          Promise.all([
+            h.runCmd(`curl -iL ${scheme}://xpr${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://prx${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://xx${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://p${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://r${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://${pr}-${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}_${shortSha9}.${host}`).then(h.verifyResponse(404)),
+          ]).then(done);
+        });
+
+
+        it('should reject PRs with leading zeros', done => {
+          h.runCmd(`curl -iL ${scheme}://pr0${pr}-${shortSha9}.${host}`).
+            then(h.verifyResponse(404)).
+            then(done);
+        });
+
+
+        it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
+          const bodyRegex9 = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+          const bodyRegex0 = new RegExp(`^PR: ${pr} | SHA: ${sha0} | File: /index\\.html$`);
+
+          Promise.all([
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-0${shortSha9}.${host}`).then(h.verifyResponse(404)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha9}.${host}`).then(h.verifyResponse(200, bodyRegex9)),
+            h.runCmd(`curl -iL ${scheme}://pr${pr}-${shortSha0}.${host}`).then(h.verifyResponse(200, bodyRegex0)),
+          ]).then(done);
+        });
+
       });
 
 
-      it('should return /index.html', done => {
-        const origin = `${scheme}://pr${pr}-${sha9}.${host}`;
-        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+      describe('(for hidden builds)', () => {
 
-        Promise.all([
-          h.runCmd(`curl -iL ${origin}/index.html`).then(h.verifyResponse(200, bodyRegex)),
-          h.runCmd(`curl -iL ${origin}/`).then(h.verifyResponse(200, bodyRegex)),
-          h.runCmd(`curl -iL ${origin}`).then(h.verifyResponse(200, bodyRegex)),
-        ]).then(done);
-      });
+        it('should respond with 404 for any file or directory', async () => {
+          const origin = `${scheme}://pr${pr}-${shortSha9}.${host}`;
+          const assert404 = h.verifyResponse(404);
+
+          h.createDummyBuild(pr, sha9, false);
+
+          await Promise.all([
+            h.runCmd(`curl -iL ${origin}/index.html`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/`).then(assert404),
+            h.runCmd(`curl -iL ${origin}`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo/bar.js`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo/`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo`).then(assert404),
+          ]);
+
+          expect({ prNum: pr, sha: sha9, isPublic: false }).toExistAsABuild();
+        });
 
 
-      it('should return /foo/bar.js', done => {
-        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /foo/bar\\.js$`);
+        it('should respond with 404 for any file or directory (for legacy builds)', async () => {
+          const origin = `${scheme}://pr${pr}-${sha9}.${host}`;
+          const assert404 = h.verifyResponse(404);
 
-        h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/bar.js`).
-          then(h.verifyResponse(200, bodyRegex)).
-          then(done);
-      });
+          h.createDummyBuild(pr, sha9, false, false, true);
 
+          await Promise.all([
+            h.runCmd(`curl -iL ${origin}/index.html`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/`).then(assert404),
+            h.runCmd(`curl -iL ${origin}`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo/bar.js`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo/`).then(assert404),
+            h.runCmd(`curl -iL ${origin}/foo`).then(assert404),
+          ]);
 
-      it('should respond with 403 for directories', done => {
-        Promise.all([
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/`).then(h.verifyResponse(403)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo`).then(h.verifyResponse(403)),
-        ]).then(done);
-      });
+          expect({ prNum: pr, sha: sha9, isPublic: false, isLegacy: true }).toExistAsABuild();
+        });
 
-
-      it('should respond with 404 for unknown paths to files', done => {
-        h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz.css`).
-          then(h.verifyResponse(404)).
-          then(done);
-      });
-
-
-      it('should rewrite to \'index.html\' for unknown paths that don\'t look like files', done => {
-        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
-
-        Promise.all([
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz`).then(h.verifyResponse(200, bodyRegex)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz/`).then(h.verifyResponse(200, bodyRegex)),
-        ]).then(done);
-      });
-
-
-      it('should respond with 404 for unknown PRs/SHAs', done => {
-        const otherPr = 54321;
-        const otherSha = '8'.repeat(40);
-
-        Promise.all([
-          h.runCmd(`curl -iL ${scheme}://pr${pr}9-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${otherPr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}9.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${otherSha}.${host}`).then(h.verifyResponse(404)),
-        ]).then(done);
-      });
-
-
-      it('should respond with 404 if the subdomain format is wrong', done => {
-        Promise.all([
-          h.runCmd(`curl -iL ${scheme}://xpr${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://prx${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://xx${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://p${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://r${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}_${sha9}.${host}`).then(h.verifyResponse(404)),
-        ]).then(done);
-      });
-
-
-      it('should reject PRs with leading zeros', done => {
-        h.runCmd(`curl -iL ${scheme}://pr0${pr}-${sha9}.${host}`).
-          then(h.verifyResponse(404)).
-          then(done);
-      });
-
-
-      it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
-        const bodyRegex9 = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
-        const bodyRegex0 = new RegExp(`^PR: ${pr} | SHA: ${sha0} | File: /index\\.html$`);
-
-        Promise.all([
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-0${sha9}.${host}`).then(h.verifyResponse(404)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}`).then(h.verifyResponse(200, bodyRegex9)),
-          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha0}.${host}`).then(h.verifyResponse(200, bodyRegex0)),
-        ]).then(done);
       });
 
     });
@@ -165,10 +253,46 @@ describe(`nginx`, () => {
     });
 
 
-    describe(`${host}/create-build/<pr>/<sha>`, () => {
+    describe(`${host}/can-have-public-preview`, () => {
+      const baseUrl = `${scheme}://${host}/can-have-public-preview`;
+
+
+      it('should disallow non-GET requests', async () => {
+        await Promise.all([
+          h.runCmd(`curl -iLX POST ${baseUrl}/42`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PUT ${baseUrl}/42`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PATCH ${baseUrl}/42`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX DELETE ${baseUrl}/42`).then(h.verifyResponse([405, 'Not Allowed'])),
+        ]);
+      });
+
+
+      it('should pass requests through to the preview server', async () => {
+        await h.runCmd(`curl -iLX GET ${baseUrl}/${PrNums.CHANGED_FILES_ERROR}`).
+          then(h.verifyResponse(500, /CHANGED_FILES_ERROR/));
+      });
+
+
+      it('should respond with 404 for unknown paths', async () => {
+        const cmdPrefix = `curl -iLX GET ${baseUrl}`;
+
+        await Promise.all([
+          h.runCmd(`${cmdPrefix}/foo/42`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}-foo/42`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}nfoo/42`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/42/foo`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/f00`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/`).then(h.verifyResponse(404)),
+        ]);
+      });
+
+    });
+
+
+    describe(`${host}/circle-build`, () => {
 
       it('should disallow non-POST requests', done => {
-        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
+        const url = `${scheme}://${host}/circle-build`;
 
         Promise.all([
           h.runCmd(`curl -iLX GET ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
@@ -179,31 +303,9 @@ describe(`nginx`, () => {
       });
 
 
-      it(`should reject files larger than ${h.uploadMaxSize}B (according to header)`, done => {
-        const headers = `--header "Content-Length: ${1.5 * h.uploadMaxSize}"`;
-        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
-
-        h.runCmd(`curl -iLX POST ${headers} ${url}`).
-          then(h.verifyResponse([413, 'Request Entity Too Large'])).
-          then(done);
-      });
-
-
-      it(`should reject files larger than ${h.uploadMaxSize}B (without header)`, done => {
-        const filePath = path.join(h.buildsDir, 'snapshot.tar.gz');
-        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
-
-        h.writeFile(filePath, {size: 1.5 * h.uploadMaxSize});
-
-        h.runCmd(`curl -iLX POST --data-binary "@${filePath}" ${url}`).
-          then(h.verifyResponse([413, 'Request Entity Too Large'])).
-          then(done);
-      });
-
-
-      it('should pass requests through to the upload server', done => {
-        h.runCmd(`curl -iLX POST ${scheme}://${host}/create-build/${pr}/${sha9}`).
-          then(h.verifyResponse(401, /Missing or empty 'AUTHORIZATION' header/)).
+      it('should pass requests through to the preview server', done => {
+        h.runCmd(`curl -iLX POST ${scheme}://${host}/circle-build`).
+          then(h.verifyResponse(400, /Incorrect body content. Expected JSON/)).
           then(done);
       });
 
@@ -212,32 +314,55 @@ describe(`nginx`, () => {
         const cmdPrefix = `curl -iLX POST ${scheme}://${host}`;
 
         Promise.all([
-          h.runCmd(`${cmdPrefix}/foo/create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/foo-create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/fooncreate-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/create-build/foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/create-build-foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/create-buildnfoo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/create-build/pr${pr}/${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/create-build/${pr}/${sha9}42`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/foo/circle-build/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/foo-circle-build/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/fooncircle-build/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/circle-build/foo/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/circle-build-foo/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/circle-buildnfoo/`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/circle-build/pr`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/circle-build/42`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+    });
+
+
+    describe(`${host}/pr-updated`, () => {
+      const url = `${scheme}://${host}/pr-updated`;
+
+
+      it('should disallow non-POST requests', done => {
+        Promise.all([
+          h.runCmd(`curl -iLX GET ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PUT ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PATCH ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX DELETE ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
         ]).then(done);
       });
 
 
-      it('should reject PRs with leading zeros', done => {
-        h.runCmd(`curl -iLX POST ${scheme}://${host}/create-build/0${pr}/${sha9}`).
-          then(h.verifyResponse(404)).
-          then(done);
+      it('should pass requests through to the preview server', done => {
+        const cmdPrefix = `curl -iLX POST --header "Content-Type: application/json"`;
+
+        const cmd1 = `${cmdPrefix} ${url}`;
+
+        Promise.all([
+          h.runCmd(cmd1).then(h.verifyResponse(400, /Missing or empty 'number' field/)),
+        ]).then(done);
       });
 
 
-      it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
-        const cmdPrefix = `curl -iLX POST  ${scheme}://${host}/create-build/${pr}`;
-        const bodyRegex = /Missing or empty 'AUTHORIZATION' header/;
+      it('should respond with 404 for unknown paths', done => {
+        const cmdPrefix = `curl -iLX POST ${scheme}://${host}`;
 
         Promise.all([
-          h.runCmd(`${cmdPrefix}/0${sha9}`).then(h.verifyResponse(404)),
-          h.runCmd(`${cmdPrefix}/${sha0}`).then(h.verifyResponse(401, bodyRegex)),
+          h.runCmd(`${cmdPrefix}/foo/pr-updated`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/foo-pr-updated`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/foonpr-updated`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/pr-updated/foo`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/pr-updated-foo`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/pr-updatednfoo`).then(h.verifyResponse(404)),
         ]).then(done);
       });
 
@@ -246,13 +371,15 @@ describe(`nginx`, () => {
 
     describe(`${host}/*`, () => {
 
-      it('should respond with 404 for unkown URLs (even if the resource exists)', done => {
+      beforeEach(() => {
         ['index.html', 'foo.js', 'foo/index.html'].forEach(relFilePath => {
-          const absFilePath = path.join(h.buildsDir, relFilePath);
-          h.writeFile(absFilePath, {content: `File: /${relFilePath}`});
+          const absFilePath = path.join(AIO_BUILDS_DIR, relFilePath);
+          return h.writeFile(absFilePath, {content: `File: /${relFilePath}`});
         });
+      });
 
-        Promise.all([
+      it('should respond with 404 for unknown URLs (even if the resource exists)', async () => {
+        await Promise.all([
           h.runCmd(`curl -iL ${scheme}://${host}/index.html`).then(h.verifyResponse(404)),
           h.runCmd(`curl -iL ${scheme}://${host}/`).then(h.verifyResponse(404)),
           h.runCmd(`curl -iL ${scheme}://${host}`).then(h.verifyResponse(404)),
@@ -261,7 +388,14 @@ describe(`nginx`, () => {
           h.runCmd(`curl -iL ${scheme}://foo.${host}`).then(h.verifyResponse(404)),
           h.runCmd(`curl -iL ${scheme}://${host}/foo.js`).then(h.verifyResponse(404)),
           h.runCmd(`curl -iL ${scheme}://${host}/foo/index.html`).then(h.verifyResponse(404)),
-        ]).then(done);
+        ]);
+      });
+
+      afterEach(() => {
+        ['index.html', 'foo.js', 'foo/index.html', 'foo'].forEach(relFilePath => {
+          const absFilePath = path.join(AIO_BUILDS_DIR, relFilePath);
+          rm('-r', absFilePath);
+        });
       });
 
     });

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/preview-server.e2e.ts

@@ -0,0 +1,569 @@
+// Imports
+import * as fs from 'fs';
+import {join} from 'path';
+import {AIO_PREVIEW_SERVER_HOSTNAME, AIO_PREVIEW_SERVER_PORT, AIO_WWW_USER} from '../common/env-variables';
+import {computeShortSha} from '../common/utils';
+import {ALT_SHA, BuildNums, PrNums, SHA, SIMILAR_SHA} from './constants';
+import {helper as h, makeCurl, payload} from './helper';
+import {customMatchers} from './jasmine-custom-matchers';
+
+// Tests
+describe('preview-server', () => {
+  const hostname = AIO_PREVIEW_SERVER_HOSTNAME;
+  const port = AIO_PREVIEW_SERVER_PORT;
+  const host = `http://${hostname}:${port}`;
+
+  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 5000);
+  beforeEach(() => jasmine.addMatchers(customMatchers));
+  afterEach(() => h.cleanUp());
+
+
+  describe(`${host}/can-have-public-preview`, () => {
+    const curl = makeCurl(`${host}/can-have-public-preview`, {
+      defaultData: null,
+      defaultExtraPath: `/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`,
+      defaultHeaders: [],
+      defaultMethod: 'GET',
+    });
+
+
+    it('should disallow non-GET requests', async () => {
+      const bodyRegex = /^Unknown resource in request/;
+
+      await Promise.all([
+        curl({method: 'POST'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PUT'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PATCH'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'DELETE'}).then(h.verifyResponse(404, bodyRegex)),
+      ]);
+    });
+
+
+    it('should respond with 404 for unknown paths', async () => {
+      const bodyRegex = /^Unknown resource in request/;
+
+      await Promise.all([
+        curl({extraPath: `/foo/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`}).then(h.verifyResponse(404, bodyRegex)),
+        curl({extraPath: `-foo/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`}).then(h.verifyResponse(404, bodyRegex)),
+        curl({extraPath: `nfoo/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`}).then(h.verifyResponse(404, bodyRegex)),
+        curl({extraPath: `/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}/foo`}).then(h.verifyResponse(404, bodyRegex)),
+        curl({extraPath: '/f00'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({extraPath: '/'}).then(h.verifyResponse(404, bodyRegex)),
+      ]);
+    });
+
+
+    it('should respond with 500 if checking for significant file changes fails', async () => {
+      await Promise.all([
+        curl({extraPath: `/${PrNums.CHANGED_FILES_404}`}).then(h.verifyResponse(500, /CHANGED_FILES_404/)),
+        curl({extraPath: `/${PrNums.CHANGED_FILES_ERROR}`}).then(h.verifyResponse(500, /CHANGED_FILES_ERROR/)),
+      ]);
+    });
+
+
+    it('should respond with 200 (false) if no significant files were touched', async () => {
+      const expectedResponse = JSON.stringify({
+        canHavePublicPreview: false,
+        reason: 'No significant files touched.',
+      });
+
+      await curl({extraPath: `/${PrNums.CHANGED_FILES_NONE}`}).then(h.verifyResponse(200, expectedResponse));
+    });
+
+
+    it('should respond with 500 if checking "trusted" status fails', async () => {
+      await curl({extraPath: `/${PrNums.TRUST_CHECK_ERROR}`}).then(h.verifyResponse(500, 'TRUST_CHECK_ERROR'));
+    });
+
+
+    it('should respond with 200 (false) if the PR is not automatically verifiable as "trusted"', async () => {
+      const expectedResponse = JSON.stringify({
+        canHavePublicPreview: false,
+        reason: 'Not automatically verifiable as \\"trusted\\".',
+      });
+
+      await Promise.all([
+        curl({extraPath: `/${PrNums.TRUST_CHECK_INACTIVE_TRUSTED_USER}`}).then(h.verifyResponse(200, expectedResponse)),
+        curl({extraPath: `/${PrNums.TRUST_CHECK_UNTRUSTED}`}).then(h.verifyResponse(200, expectedResponse)),
+      ]);
+    });
+
+
+    it('should respond with 200 (true) if the PR can have a public preview', async () => {
+      const expectedResponse = JSON.stringify({
+        canHavePublicPreview: true,
+        reason: null,
+      });
+
+      await Promise.all([
+        curl({extraPath: `/${PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER}`}).then(h.verifyResponse(200, expectedResponse)),
+        curl({extraPath: `/${PrNums.TRUST_CHECK_TRUSTED_LABEL}`}).then(h.verifyResponse(200, expectedResponse)),
+      ]);
+    });
+
+  });
+
+
+  describe(`${host}/circle-build`, () => {
+
+    const curl = makeCurl(`${host}/circle-build`);
+
+    it('should disallow non-POST requests', async () => {
+      const bodyRegex = /^Unknown resource/;
+
+      await Promise.all([
+        curl({method: 'GET'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PUT'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PATCH'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'DELETE'}).then(h.verifyResponse(404, bodyRegex)),
+      ]);
+    });
+
+
+    it('should respond with 404 for unknown paths', async () => {
+      await Promise.all([
+        curl({url: `${host}/foo/circle-build`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/foo-circle-build`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/fooncircle-build`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/circle-build/foo`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/circle-build-foo`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/circle-buildnfoo`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/circle-build/pr`}).then(h.verifyResponse(404)),
+        curl({url: `${host}/circle-build42`}).then(h.verifyResponse(404)),
+      ]);
+    });
+
+    it('should respond with 400 if the body is not valid', async () => {
+      await Promise.all([
+        curl({ data: '' }).then(h.verifyResponse(400)),
+        curl({ data: {} }).then(h.verifyResponse(400)),
+        curl({ data: { payload: {} } }).then(h.verifyResponse(400)),
+        curl({ data: { payload: { build_num: 1 } } }).then(h.verifyResponse(400)),
+        curl({ data: { payload: { build_num: 1, build_parameters: {} } } }).then(h.verifyResponse(400)),
+        curl(payload(0)).then(h.verifyResponse(400)),
+        curl(payload(-1)).then(h.verifyResponse(400)),
+      ]);
+    });
+
+    it('should respond with 500 if the CircleCI API request errors', async () => {
+      await curl(payload(BuildNums.BUILD_INFO_ERROR)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.BUILD_INFO_404)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 204 if the build on CircleCI failed', async () => {
+      await curl(payload(BuildNums.BUILD_INFO_BUILD_FAILED)).then(h.verifyResponse(204));
+    });
+
+    it('should respond with 500 if the github org from CircleCI does not match what is configured', async () => {
+      await curl(payload(BuildNums.BUILD_INFO_INVALID_GH_ORG)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 500 if the github repo from CircleCI does not match what is configured', async () => {
+      await curl(payload(BuildNums.BUILD_INFO_INVALID_GH_REPO)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 500 if the github files API errors', async () => {
+      await curl(payload(BuildNums.CHANGED_FILES_ERROR)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.CHANGED_FILES_404)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 204 if no significant files are changed by the PR', async () => {
+      await curl(payload(BuildNums.CHANGED_FILES_NONE)).then(h.verifyResponse(204));
+    });
+
+    it('should respond with 500 if the CircleCI artifact API fails', async () => {
+      await curl(payload(BuildNums.BUILD_ARTIFACTS_ERROR)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.BUILD_ARTIFACTS_404)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.BUILD_ARTIFACTS_EMPTY)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.BUILD_ARTIFACTS_MISSING)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 500 if fetching the artifact errors', async () => {
+      await curl(payload(BuildNums.DOWNLOAD_ARTIFACT_ERROR)).then(h.verifyResponse(500));
+      await curl(payload(BuildNums.DOWNLOAD_ARTIFACT_404)).then(h.verifyResponse(500));
+    });
+
+    it('should respond with 500 if the GH trusted API fails', async () => {
+      await curl(payload(BuildNums.TRUST_CHECK_ERROR)).then(h.verifyResponse(500));
+      expect({ prNum: PrNums.TRUST_CHECK_ERROR }).toExistAsAnArtifact();
+    });
+
+    it('should respond with 201 if a new public build is created', async () => {
+      await curl(payload(BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER))
+        .then(h.verifyResponse(201));
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER }).toExistAsABuild();
+    });
+
+    it('should respond with 202 if a new private build is created', async () => {
+      await curl(payload(BuildNums.TRUST_CHECK_UNTRUSTED)).then(h.verifyResponse(202));
+      expect({ prNum: PrNums.TRUST_CHECK_UNTRUSTED, isPublic: false }).toExistAsABuild();
+    });
+
+    [true].forEach(isPublic => {
+      const build = isPublic ? BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER : BuildNums.TRUST_CHECK_UNTRUSTED;
+      const prNum = isPublic ? PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER : PrNums.TRUST_CHECK_UNTRUSTED;
+      const label = isPublic ? 'public' : 'non-public';
+      const overwriteRe = RegExp(`^Request to overwrite existing ${label} directory`);
+      const statusCode = isPublic ? 201 : 202;
+
+      describe(`for ${label} builds`, () => {
+
+        it('should extract the contents of the build artifact', async () => {
+          await curl(payload(build))
+            .then(h.verifyResponse(statusCode));
+          expect(h.readBuildFile(prNum, SHA, 'index.html', isPublic))
+            .toContain(`PR: ${prNum} | SHA: ${SHA} | File: /index.html`);
+          expect(h.readBuildFile(prNum, SHA, 'foo/bar.js', isPublic))
+            .toContain(`PR: ${prNum} | SHA: ${SHA} | File: /foo/bar.js`);
+          expect({ prNum, isPublic }).toExistAsABuild();
+        });
+
+        it(`should create files/directories owned by '${AIO_WWW_USER}'`, async () => {
+          await curl(payload(build))
+            .then(h.verifyResponse(statusCode));
+
+          const shaDir = h.getShaDir(h.getPrDir(prNum, isPublic), SHA);
+          const { stdout: allFiles } = await h.runCmd(`find ${shaDir}`);
+          const { stdout: userFiles } = await h.runCmd(`find ${shaDir} -user ${AIO_WWW_USER}`);
+
+          expect(userFiles).toBe(allFiles);
+          expect(userFiles).toContain(shaDir);
+          expect(userFiles).toContain(join(shaDir, 'index.html'));
+          expect(userFiles).toContain(join(shaDir, 'foo', 'bar.js'));
+
+          expect({ prNum, isPublic }).toExistAsABuild();
+        });
+
+        it('should delete the build artifact file', async () => {
+          await curl(payload(build))
+            .then(h.verifyResponse(statusCode));
+          expect({ prNum, SHA }).not.toExistAsAnArtifact();
+          expect({ prNum, isPublic }).toExistAsABuild();
+        });
+
+        it('should make the build directory non-writable', async () => {
+          await curl(payload(build))
+            .then(h.verifyResponse(statusCode));
+
+          // See https://github.com/nodejs/node-v0.x-archive/issues/3045#issuecomment-4862588.
+          const isNotWritable = (fileOrDir: string) => {
+            const mode = fs.statSync(fileOrDir).mode;
+            // tslint:disable-next-line: no-bitwise
+            return !(mode & parseInt('222', 8));
+          };
+
+          const shaDir = h.getShaDir(h.getPrDir(prNum, isPublic), SHA);
+          expect(isNotWritable(shaDir)).toBe(true);
+          expect(isNotWritable(join(shaDir, 'index.html'))).toBe(true);
+          expect(isNotWritable(join(shaDir, 'foo', 'bar.js'))).toBe(true);
+
+          expect({ prNum, isPublic }).toExistAsABuild();
+        });
+
+        it('should ignore a legacy 40-chars long build directory (even if it starts with the same chars)',
+          async () => {
+          // It is possible that 40-chars long build directories exist, if they had been deployed
+          // before implementing the shorter build directory names. In that case, we don't want the
+          // second (shorter) name to be considered the same as the old one (even if they originate
+          // from the same SHA).
+
+          h.createDummyBuild(prNum, SHA, isPublic, false, true);
+          h.writeBuildFile(prNum, SHA, 'index.html', 'My content', isPublic, true);
+          expect(h.readBuildFile(prNum, SHA, 'index.html', isPublic, true)).toBe('My content');
+
+          await curl(payload(build))
+            .then(h.verifyResponse(statusCode));
+
+          expect(h.readBuildFile(prNum, SHA, 'index.html', isPublic, false)).toContain('index.html');
+          expect(h.readBuildFile(prNum, SHA, 'index.html', isPublic, true)).toBe('My content');
+
+          expect({ prNum, isPublic, sha: SHA, isLegacy: false }).toExistAsABuild();
+          expect({ prNum, isPublic, sha: SHA, isLegacy: true }).toExistAsABuild();
+        });
+
+        it(`should not overwrite existing builds`, async () => {
+          // setup a build already in place
+          h.createDummyBuild(prNum, SHA, isPublic);
+          // distinguish this build from the downloaded one
+          h.writeBuildFile(prNum, SHA, 'index.html', 'My content', isPublic);
+          await curl(payload(build)).then(h.verifyResponse(409, overwriteRe));
+          expect(h.readBuildFile(prNum, SHA, 'index.html', isPublic)).toBe('My content');
+          expect({ prNum, isPublic }).toExistAsABuild();
+          expect({ prNum }).toExistAsAnArtifact();
+        });
+
+        it(`should not overwrite existing builds (even if the SHA is different)`, async () => {
+          // Since only the first few characters of the SHA are used, it is possible for two different
+          // SHAs to correspond to the same directory. In that case, we don't want the second SHA to
+          // overwrite the first.
+          expect(SIMILAR_SHA).not.toEqual(SHA);
+          expect(computeShortSha(SIMILAR_SHA)).toEqual(computeShortSha(SHA));
+          h.createDummyBuild(prNum, SIMILAR_SHA, isPublic);
+          expect(h.readBuildFile(prNum, SIMILAR_SHA, 'index.html', isPublic)).toContain('index.html');
+          h.writeBuildFile(prNum, SIMILAR_SHA, 'index.html', 'My content', isPublic);
+          expect(h.readBuildFile(prNum, SIMILAR_SHA, 'index.html', isPublic)).toBe('My content');
+
+          await curl(payload(build)).then(h.verifyResponse(409, overwriteRe));
+          expect(h.readBuildFile(prNum, SIMILAR_SHA, 'index.html', isPublic)).toBe('My content');
+          expect({ prNum, isPublic, sha: SIMILAR_SHA }).toExistAsABuild();
+          expect({ prNum, sha: SIMILAR_SHA }).toExistAsAnArtifact();
+        });
+
+        it('should only delete the SHA directory on error (for existing PR)', async () => {
+          h.createDummyBuild(prNum, ALT_SHA, isPublic);
+          await curl(payload(BuildNums.TRUST_CHECK_ERROR)).then(h.verifyResponse(500));
+          expect({ prNum: PrNums.TRUST_CHECK_ERROR }).toExistAsAnArtifact();
+          expect({ prNum, isPublic, sha: SHA }).not.toExistAsABuild();
+          expect({ prNum, isPublic, sha: ALT_SHA }).toExistAsABuild();
+        });
+
+        describe('when the PR\'s visibility has changed', () => {
+
+          it('should update the PR\'s visibility', async () => {
+            h.createDummyBuild(prNum, ALT_SHA, !isPublic);
+            await curl(payload(build)).then(h.verifyResponse(statusCode));
+            expect({ prNum, isPublic }).toExistAsABuild();
+            expect({ prNum, isPublic, sha: ALT_SHA }).toExistAsABuild();
+          });
+
+
+          it('should not overwrite existing builds (but keep the updated visibility)', async () => {
+            h.createDummyBuild(prNum, SHA, !isPublic);
+            await curl(payload(build)).then(h.verifyResponse(409));
+            expect({ prNum, isPublic }).toExistAsABuild();
+            expect({ prNum, isPublic: !isPublic }).not.toExistAsABuild();
+            // since it errored we didn't clear up the downloaded artifact - perhaps we should?
+            expect({ prNum }).toExistAsAnArtifact();
+          });
+
+
+          it('should reject the request if it fails to update the PR\'s visibility', async () => {
+            // One way to cause an error is to have both a public and a hidden directory for the same PR.
+            h.createDummyBuild(prNum, ALT_SHA, isPublic);
+            h.createDummyBuild(prNum, ALT_SHA, !isPublic);
+
+            const errorRegex = new RegExp(`^Request to move '${h.getPrDir(prNum, !isPublic)}' ` +
+                                          `to existing directory '${h.getPrDir(prNum, isPublic)}'.`);
+
+            await curl(payload(build)).then(h.verifyResponse(409, errorRegex));
+
+            expect({ prNum, isPublic }).not.toExistAsABuild();
+
+            // The bad folders should have been deleted
+            expect({ prNum, sha: ALT_SHA, isPublic }).toExistAsABuild();
+            expect({ prNum, sha: ALT_SHA, isPublic: !isPublic }).toExistAsABuild();
+
+            // since it errored we didn't clear up the downloaded artifact - perhaps we should?
+            expect({ prNum }).toExistAsAnArtifact();
+          });
+        });
+      });
+    });
+  });
+
+
+  describe(`${host}/health-check`, () => {
+
+    it('should respond with 200', done => {
+      Promise.all([
+        h.runCmd(`curl -iL ${host}/health-check`).then(h.verifyResponse(200)),
+        h.runCmd(`curl -iL ${host}/health-check/`).then(h.verifyResponse(200)),
+      ]).then(done);
+    });
+
+
+    it('should respond with 404 if the path does not match exactly', done => {
+      Promise.all([
+        h.runCmd(`curl -iL ${host}/health-check/foo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL ${host}/health-check-foo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL ${host}/health-checknfoo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL ${host}/foo/health-check`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL ${host}/foo-health-check`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL ${host}/foonhealth-check`).then(h.verifyResponse(404)),
+      ]).then(done);
+    });
+
+  });
+
+
+  describe(`${host}/pr-updated`, () => {
+    const curl = makeCurl(`${host}/pr-updated`);
+
+    it('should disallow non-POST requests', async () => {
+      const bodyRegex = /^Unknown resource in request/;
+
+      await Promise.all([
+        curl({method: 'GET'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PUT'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'PATCH'}).then(h.verifyResponse(404, bodyRegex)),
+        curl({method: 'DELETE'}).then(h.verifyResponse(404, bodyRegex)),
+      ]);
+    });
+
+
+    it('should respond with 400 for requests without a payload', async () => {
+      const bodyRegex = /^Missing or empty 'number' field in request/;
+
+      await Promise.all([
+        curl({ data: '' }).then(h.verifyResponse(400, bodyRegex)),
+        curl({ data: {} }).then(h.verifyResponse(400, bodyRegex)),
+      ]);
+    });
+
+
+    it('should respond with 400 for requests without a \'number\' field', async () => {
+      const bodyRegex = /^Missing or empty 'number' field in request/;
+
+      await Promise.all([
+        curl({ data: {} }).then(h.verifyResponse(400, bodyRegex)),
+        curl({ data: { number: null} }).then(h.verifyResponse(400, bodyRegex)),
+      ]);
+    });
+
+
+    it('should reject requests for which checking the PR visibility fails', async () => {
+       await curl({ data: { number: PrNums.TRUST_CHECK_ERROR } }).then(h.verifyResponse(500, /TRUST_CHECK_ERROR/));
+    });
+
+
+    it('should respond with 404 for unknown paths', done => {
+      const mockPayload = JSON.stringify({number: 1}); // MockExternalApiFlags.TRUST_CHECK_ACTIVE_TRUSTED_USER });
+      const cmdPrefix = `curl -iLX POST --data "${mockPayload}" ${host}`;
+
+      Promise.all([
+        h.runCmd(`${cmdPrefix}/foo/pr-updated`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/foo-pr-updated`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/foonpr-updated`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/pr-updated/foo`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/pr-updated-foo`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/pr-updatednfoo`).then(h.verifyResponse(404)),
+      ]).then(done);
+    });
+
+
+    it('should do nothing if PR\'s visibility is already up-to-date', async () => {
+      const publicPr = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const hiddenPr = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      const checkVisibilities = (remove: boolean) => {
+        // Public build is already public.
+        expect({ prNum: publicPr, isPublic: false }).not.toExistAsABuild(remove);
+        expect({ prNum: publicPr, isPublic: true }).toExistAsABuild(remove);
+        // Hidden build is already hidden.
+        expect({ prNum: hiddenPr, isPublic: false }).toExistAsABuild(remove);
+        expect({ prNum: hiddenPr, isPublic: true }).not.toExistAsABuild(remove);
+      };
+
+      h.createDummyBuild(publicPr, SHA, true);
+      h.createDummyBuild(hiddenPr, SHA, false);
+      checkVisibilities(false);
+
+      await Promise.all([
+        curl({ data: {number: +publicPr, action: 'foo' } }).then(h.verifyResponse(200)),
+        curl({ data: {number: +hiddenPr, action: 'foo' } }).then(h.verifyResponse(200)),
+      ]);
+
+      // Visibilities should not have changed, because the specified action could not have triggered a change.
+      checkVisibilities(true);
+    });
+
+
+    it('should do nothing if \'action\' implies no visibility change', async () => {
+      const publicPr = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const hiddenPr = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      const checkVisibilities = (remove: boolean) => {
+        // Public build is hidden atm.
+        expect({ prNum: publicPr, isPublic: false }).toExistAsABuild(remove);
+        expect({ prNum: publicPr, isPublic: true }).not.toExistAsABuild(remove);
+        // Hidden build is public atm.
+        expect({ prNum: hiddenPr, isPublic: false }).not.toExistAsABuild(remove);
+        expect({ prNum: hiddenPr, isPublic: true }).toExistAsABuild(remove);
+      };
+
+      h.createDummyBuild(publicPr, SHA, false);
+      h.createDummyBuild(hiddenPr, SHA, true);
+      checkVisibilities(false);
+
+      await Promise.all([
+        curl({ data: {number: +publicPr, action: 'foo' } }).then(h.verifyResponse(200)),
+        curl({ data: {number: +hiddenPr, action: 'foo' } }).then(h.verifyResponse(200)),
+      ]);
+      // Visibilities should not have changed, because the specified action could not have triggered a change.
+      checkVisibilities(true);
+    });
+
+
+    describe('when the visiblity has changed', () => {
+      const publicPr = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const hiddenPr = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      beforeEach(() => {
+        // Create initial PR builds with opposite visibilities as the ones that will be reported:
+        // - The now public PR was previously hidden.
+        // - The now hidden PR was previously public.
+        h.createDummyBuild(publicPr, SHA, false);
+        h.createDummyBuild(hiddenPr, SHA, true);
+
+        expect({ prNum: publicPr, isPublic: false }).toExistAsABuild(false);
+        expect({ prNum: publicPr, isPublic: true }).not.toExistAsABuild(false);
+        expect({ prNum: hiddenPr, isPublic: false }).not.toExistAsABuild(false);
+        expect({ prNum: hiddenPr, isPublic: true }).toExistAsABuild(false);
+      });
+      afterEach(() => {
+        // Expect PRs' visibility to have been updated:
+        // - The public PR should be actually public (previously it was hidden).
+        // - The hidden PR should be actually hidden (previously it was public).
+        expect({ prNum: publicPr, isPublic: false }).not.toExistAsABuild();
+        expect({ prNum: publicPr, isPublic: true }).toExistAsABuild();
+        expect({ prNum: hiddenPr, isPublic: false }).toExistAsABuild();
+        expect({ prNum: hiddenPr, isPublic: true }).not.toExistAsABuild();
+      });
+
+
+      it('should update the PR\'s visibility (action: undefined)', async () => {
+        await Promise.all([
+          curl({ data: {number: +publicPr } }).then(h.verifyResponse(200)),
+          curl({ data: {number: +hiddenPr } }).then(h.verifyResponse(200)),
+        ]);
+      });
+
+
+      it('should update the PR\'s visibility (action: labeled)', async () => {
+        await Promise.all([
+          curl({ data: {number: +publicPr, action: 'labeled' } }).then(h.verifyResponse(200)),
+          curl({ data: {number: +hiddenPr, action: 'labeled' } }).then(h.verifyResponse(200)),
+        ]);
+      });
+
+
+      it('should update the PR\'s visibility (action: unlabeled)', async () => {
+        await Promise.all([
+          curl({ data: {number: +publicPr, action: 'unlabeled' } }).then(h.verifyResponse(200)),
+          curl({ data: {number: +hiddenPr, action: 'unlabeled' } }).then(h.verifyResponse(200)),
+        ]);
+      });
+
+    });
+
+  });
+
+
+  describe(`${host}/*`, () => {
+
+    it('should respond with 404 for requests to unknown URLs', done => {
+      const bodyRegex = /^Unknown resource/;
+
+      Promise.all([
+        h.runCmd(`curl -iL ${host}/index.html`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iL ${host}/`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iL ${host}`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iLX PUT ${host}`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iLX POST ${host}`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iLX PATCH ${host}`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iLX DELETE ${host}`).then(h.verifyResponse(404, bodyRegex)),
+      ]).then(done);
+    });
+
+  });
+});

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/server-integration.e2e.ts

@@ -1,84 +1,269 @@
 // Imports
-import * as path from 'path';
-import {helper as h} from './helper';
+import {AIO_NGINX_HOSTNAME} from '../common/env-variables';
+import {computeShortSha} from '../common/utils';
+import {ALT_SHA, BuildNums, PrNums, SHA} from './constants';
+import {helper as h, makeCurl, payload} from './helper';
+import {customMatchers} from './jasmine-custom-matchers';
 
 // Tests
 h.runForAllSupportedSchemes((scheme, port) => describe(`integration (on ${scheme.toUpperCase()})`, () => {
-  const hostname = h.nginxHostname;
+  const hostname = AIO_NGINX_HOSTNAME;
   const host = `${hostname}:${port}`;
-  const pr9 = '9';
-  const sha9 = '9'.repeat(40);
-  const sha0 = '0'.repeat(40);
-  const archivePath = path.join(h.buildsDir, 'snapshot.tar.gz');
+  const curlPrUpdated = makeCurl(`${scheme}://${host}/pr-updated`);
 
-  const getFile = (pr: string, sha: string, file: string) =>
-    h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha}.${host}/${file}`);
-  const uploadBuild = (pr: string, sha: string, archive: string) => {
-    const curlPost = 'curl -iLX POST --header "Authorization: Token FOO"';
-    return h.runCmd(`${curlPost} --data-binary "@${archive}" ${scheme}://${host}/create-build/${pr}/${sha}`);
-  };
+  const getFile = (pr: number, sha: string, file: string) =>
+    h.runCmd(`curl -iL ${scheme}://pr${pr}-${computeShortSha(sha)}.${host}/${file}`);
+  const prUpdated = (prNum: number, action?: string) => curlPrUpdated({ data: { number: prNum, action } });
+  const circleBuild = makeCurl(`${scheme}://${host}/circle-build`);
+
+  beforeEach(() => {
+    jasmine.DEFAULT_TIMEOUT_INTERVAL = 5000;
+    jasmine.addMatchers(customMatchers);
+  });
+  afterEach(() => h.cleanUp());
+
+
+  describe('for a new/non-existing PR', () => {
+
+    it('should be able to create and serve a public preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const PR = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+
+      const regexPrefix = `^BUILD: ${BUILD} \\| PR: ${PR} \\| SHA: ${SHA} \\| File:`;
+      const idxContentRegex = new RegExp(`${regexPrefix} \\/index\\.html$`);
+      const barContentRegex = new RegExp(`${regexPrefix} \\/foo\\/bar\\.js$`);
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(201));
+      await Promise.all([
+        getFile(PR, SHA, 'index.html').then(h.verifyResponse(200, idxContentRegex)),
+        getFile(PR, SHA, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex)),
+      ]);
+
+      expect({ prNum: PR }).toExistAsABuild();
+      expect({ prNum: PR, isPublic: false }).not.toExistAsABuild();
+    });
+
+
+    it('should be able to create but not serve a hidden preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_UNTRUSTED;
+      const PR = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(202));
+      await Promise.all([
+        getFile(PR, SHA, 'index.html').then(h.verifyResponse(404)),
+        getFile(PR, SHA, 'foo/bar.js').then(h.verifyResponse(404)),
+      ]);
+
+      expect({ prNum: PR }).not.toExistAsABuild();
+      expect({ prNum: PR, isPublic: false }).toExistAsABuild();
+    });
+
+
+    it('should reject if verification fails', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_ERROR;
+      const PR = PrNums.TRUST_CHECK_ERROR;
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(500));
+      expect({ prNum: PR }).toExistAsAnArtifact();
+      expect({ prNum: PR }).not.toExistAsABuild();
+      expect({ prNum: PR, isPublic: false }).not.toExistAsABuild();
+    });
+
+
+    it('should be able to notify that a PR has been updated (and do nothing)', async () => {
+      await prUpdated(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER).then(h.verifyResponse(200));
+      // The PR should still not exist.
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: false }).not.toExistAsABuild();
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: true }).not.toExistAsABuild();
+    });
 
-  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
-  afterEach(() => {
-    h.deletePrDir(pr9);
-    h.cleanUp();
   });
 
 
-  it('should be able to upload and serve a build for a new PR', done => {
-    const regexPrefix9 = `^PR: uploaded\\/${pr9} \\| SHA: ${sha9} \\| File:`;
-    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
-    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+  describe('for an existing PR', () => {
 
-    h.createDummyArchive(pr9, sha9, archivePath);
+    it('should be able to create and serve a public preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const PR = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
 
-    uploadBuild(pr9, sha9, archivePath).
-      then(() => Promise.all([
-        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
-        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
-      ])).
-      then(done);
-  });
+      const regexPrefix1 = `^PR: ${PR} \\| SHA: ${ALT_SHA} \\| File:`;
+      const idxContentRegex1 = new RegExp(`${regexPrefix1} \\/index\\.html$`);
+      const barContentRegex1 = new RegExp(`${regexPrefix1} \\/foo\\/bar\\.js$`);
+
+      const regexPrefix2 = `^BUILD: ${BUILD} \\| PR: ${PR} \\| SHA: ${SHA} \\| File:`;
+      const idxContentRegex2 = new RegExp(`${regexPrefix2} \\/index\\.html$`);
+      const barContentRegex2 = new RegExp(`${regexPrefix2} \\/foo\\/bar\\.js$`);
+
+      h.createDummyBuild(PR, ALT_SHA);
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(201));
+      await Promise.all([
+        getFile(PR, ALT_SHA, 'index.html').then(h.verifyResponse(200, idxContentRegex1)),
+        getFile(PR, ALT_SHA, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex1)),
+        getFile(PR, SHA, 'index.html').then(h.verifyResponse(200, idxContentRegex2)),
+        getFile(PR, SHA, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex2)),
+      ]);
+
+      expect({ prNum: PR, sha: SHA }).toExistAsABuild();
+      expect({ prNum: PR, sha: ALT_SHA }).toExistAsABuild();
+    });
 
 
-  it('should be able to upload and serve a build for an existing PR', done => {
-    const regexPrefix0 = `^PR: ${pr9} \\| SHA: ${sha0} \\| File:`;
-    const idxContentRegex0 = new RegExp(`${regexPrefix0} \\/index\\.html$`);
-    const barContentRegex0 = new RegExp(`${regexPrefix0} \\/foo\\/bar\\.js$`);
+    it('should be able to create but not serve a hidden preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_UNTRUSTED;
+      const PR = PrNums.TRUST_CHECK_UNTRUSTED;
 
-    const regexPrefix9 = `^PR: uploaded\\/${pr9} \\| SHA: ${sha9} \\| File:`;
-    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
-    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+      h.createDummyBuild(PR, ALT_SHA, false);
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(202));
 
-    h.createDummyBuild(pr9, sha0);
-    h.createDummyArchive(pr9, sha9, archivePath);
+      await Promise.all([
+        getFile(PR, ALT_SHA, 'index.html').then(h.verifyResponse(404)),
+        getFile(PR, ALT_SHA, 'foo/bar.js').then(h.verifyResponse(404)),
+        getFile(PR, SHA, 'index.html').then(h.verifyResponse(404)),
+        getFile(PR, SHA, 'foo/bar.js').then(h.verifyResponse(404)),
+      ]);
 
-    uploadBuild(pr9, sha9, archivePath).
-      then(() => Promise.all([
-        getFile(pr9, sha0, 'index.html').then(h.verifyResponse(200, idxContentRegex0)),
-        getFile(pr9, sha0, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex0)),
-        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
-        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
-      ])).
-      then(done);
-  });
+      expect({ prNum: PR, sha: SHA }).not.toExistAsABuild();
+      expect({ prNum: PR, sha: SHA, isPublic: false }).toExistAsABuild();
+      expect({ prNum: PR, sha: ALT_SHA }).not.toExistAsABuild();
+      expect({ prNum: PR, sha: ALT_SHA, isPublic: false }).toExistAsABuild();
+    });
 
 
-  it('should not be able to overwrite a build', done => {
-    const regexPrefix9 = `^PR: ${pr9} \\| SHA: ${sha9} \\| File:`;
-    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
-    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+    it('should reject if verification fails', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_ERROR;
+      const PR = PrNums.TRUST_CHECK_ERROR;
 
-    h.createDummyBuild(pr9, sha9);
-    h.createDummyArchive(pr9, sha9, archivePath);
+      h.createDummyBuild(PR, ALT_SHA, false);
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(500));
+
+      expect({ prNum: PR }).toExistAsAnArtifact();
+      expect({ prNum: PR }).not.toExistAsABuild();
+      expect({ prNum: PR, isPublic: false }).not.toExistAsABuild();
+      expect({ prNum: PR, sha: ALT_SHA, isPublic: false }).toExistAsABuild();
+    });
+
+
+    it('should not be able to overwrite an existing public preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const PR = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+
+      const regexPrefix = `^PR: ${PR} \\| SHA: ${SHA} \\| File:`;
+      const idxContentRegex = new RegExp(`${regexPrefix} \\/index\\.html$`);
+      const barContentRegex = new RegExp(`${regexPrefix} \\/foo\\/bar\\.js$`);
+
+      h.createDummyBuild(PR, SHA);
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(409));
+      await Promise.all([
+        getFile(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, SHA, 'index.html').then(h.verifyResponse(200, idxContentRegex)),
+        getFile(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, SHA, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex)),
+      ]);
+
+      expect({ prNum: PR }).toExistAsAnArtifact();
+      expect({ prNum: PR }).toExistAsABuild();
+    });
+
+
+    it('should not be able to overwrite an existing hidden preview', async () => {
+      const BUILD = BuildNums.TRUST_CHECK_UNTRUSTED;
+      const PR = PrNums.TRUST_CHECK_UNTRUSTED;
+      h.createDummyBuild(PR, SHA, false);
+
+      await circleBuild(payload(BUILD)).then(h.verifyResponse(409));
+
+      expect({ prNum: PR }).toExistAsAnArtifact();
+      expect({ prNum: PR, isPublic: false }).toExistAsABuild();
+    });
+
+
+    it('should be able to request re-checking visibility (if outdated)', async () => {
+      const publicPr = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const hiddenPr = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      h.createDummyBuild(publicPr, SHA, false);
+      h.createDummyBuild(hiddenPr, SHA, true);
+
+      // PR visibilities are outdated (i.e. the opposte of what the should).
+      expect({ prNum: publicPr, sha: SHA, isPublic: false }).toExistAsABuild(false);
+      expect({ prNum: publicPr, sha: SHA, isPublic: true }).not.toExistAsABuild(false);
+      expect({ prNum: hiddenPr, sha: SHA, isPublic: false }).not.toExistAsABuild(false);
+      expect({ prNum: hiddenPr, sha: SHA, isPublic: true }).toExistAsABuild(false);
+
+      await Promise.all([
+        prUpdated(publicPr).then(h.verifyResponse(200)),
+        prUpdated(hiddenPr).then(h.verifyResponse(200)),
+      ]);
+
+      // PR visibilities should have been updated.
+      expect({ prNum: publicPr, isPublic: false }).not.toExistAsABuild();
+      expect({ prNum: publicPr, isPublic: true }).toExistAsABuild();
+      expect({ prNum: hiddenPr, isPublic: false }).toExistAsABuild();
+      expect({ prNum: hiddenPr, isPublic: true }).not.toExistAsABuild();
+    });
+
+
+    it('should be able to request re-checking visibility (if up-to-date)', async () => {
+      const publicPr = PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER;
+      const hiddenPr = PrNums.TRUST_CHECK_UNTRUSTED;
+
+      h.createDummyBuild(publicPr, SHA, true);
+      h.createDummyBuild(hiddenPr, SHA, false);
+
+      // PR visibilities are already up-to-date.
+      expect({ prNum: publicPr, sha: SHA, isPublic: false }).not.toExistAsABuild(false);
+      expect({ prNum: publicPr, sha: SHA, isPublic: true }).toExistAsABuild(false);
+      expect({ prNum: hiddenPr, sha: SHA, isPublic: false }).toExistAsABuild(false);
+      expect({ prNum: hiddenPr, sha: SHA, isPublic: true }).not.toExistAsABuild(false);
+
+      await Promise.all([
+        prUpdated(publicPr).then(h.verifyResponse(200)),
+        prUpdated(hiddenPr).then(h.verifyResponse(200)),
+      ]);
+
+      // PR visibilities are still up-to-date.
+      expect({ prNum: publicPr, isPublic: true }).toExistAsABuild();
+      expect({ prNum: publicPr, isPublic: false }).not.toExistAsABuild();
+      expect({ prNum: hiddenPr, isPublic: true }).not.toExistAsABuild();
+      expect({ prNum: hiddenPr, isPublic: false }).toExistAsABuild();
+    });
+
+
+    it('should reject a request if re-checking visibility fails', async () => {
+      const errorPr = PrNums.TRUST_CHECK_ERROR;
+
+      h.createDummyBuild(errorPr, SHA, true);
+
+      expect({ prNum: errorPr, isPublic: false }).not.toExistAsABuild(false);
+      expect({ prNum: errorPr, isPublic: true }).toExistAsABuild(false);
+
+      await prUpdated(errorPr).then(h.verifyResponse(500, /TRUST_CHECK_ERROR/));
+
+      // PR visibility should not have been updated.
+      expect({ prNum: errorPr, isPublic: false }).not.toExistAsABuild();
+      expect({ prNum: errorPr, isPublic: true }).toExistAsABuild();
+    });
+
+
+    it('should reject a request if updating visibility fails', async () => {
+      // One way to cause an error is to have both a public and a hidden directory for the same PR.
+      h.createDummyBuild(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, SHA, false);
+      h.createDummyBuild(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, SHA, true);
+
+      const hiddenPrDir = h.getPrDir(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, false);
+      const publicPrDir = h.getPrDir(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, true);
+      const bodyRegex = new RegExp(`Request to move '${hiddenPrDir}' to existing directory '${publicPrDir}'`);
+
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: false }).toExistAsABuild(false);
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: true }).toExistAsABuild(false);
+
+      await prUpdated(PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER).then(h.verifyResponse(409, bodyRegex));
+
+      // PR visibility should not have been updated.
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: false }).toExistAsABuild();
+      expect({ prNum: PrNums.TRUST_CHECK_ACTIVE_TRUSTED_USER, isPublic: true }).toExistAsABuild();
+    });
 
-    uploadBuild(pr9, sha9, archivePath).
-      then(h.verifyResponse(409)).
-      then(() => Promise.all([
-        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
-        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
-      ])).
-      then(done);
   });
 
 }));

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/start-test-preview-server.ts

@@ -0,0 +1,2 @@
+import '../preview-server';
+import './mock-external-apis';

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/tar-stream.d.ts

@@ -0,0 +1,30 @@
+declare module 'tar-stream' {
+
+  import {Readable, Writable} from 'stream';
+
+  export interface Pack extends Readable {
+    entry(header: Header, callback?: (err?: any) => {}): Writable;
+    entry(header: Header, contents: string, callback?: (err?: any) => {}): Writable;
+    entry(header: Header, buffer: Buffer, callback?: (err?: any) => {}): Writable;
+    entry(header: Header, buffer: string|Buffer, callback?: (err?: any) => {}): Writable;
+    finalize();
+    destroy(err: any);
+  }
+
+  export interface Header {
+    name: string;
+    mode?: number;
+    uid?: number;
+    gid?: number;
+    size?: number;
+    mtime?: Date;
+    type?: type;
+    linkname?: string;
+    uname?: string;
+    gname?: string;
+    devmajor?: number;
+    devminor?: number;
+  }
+
+  export function pack(): Pack;
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/upload-server.e2e.ts

@@ -1,266 +0,0 @@
-// Imports
-import * as fs from 'fs';
-import * as path from 'path';
-import {CmdResult, helper as h} from './helper';
-
-// Tests
-describe('upload-server (on HTTP)', () => {
-  const hostname = h.uploadHostname;
-  const port = h.uploadPort;
-  const host = `${hostname}:${port}`;
-  const pr = '9';
-  const sha9 = '9'.repeat(40);
-  const sha0 = '0'.repeat(40);
-
-  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
-  afterEach(() => h.cleanUp());
-
-
-  describe(`${host}/create-build/<pr>/<sha>`, () => {
-    const authorizationHeader = `--header "Authorization: Token FOO"`;
-    const xFileHeader = `--header "X-File: ${h.buildsDir}/snapshot.tar.gz"`;
-    const curl = `curl -iL ${authorizationHeader} ${xFileHeader}`;
-
-
-    it('should disallow non-GET requests', done => {
-      const url = `http://${host}/create-build/${pr}/${sha9}`;
-      const bodyRegex = /^Unsupported method/;
-
-      Promise.all([
-        h.runCmd(`curl -iLX PUT ${url}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX POST ${url}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX PATCH ${url}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX DELETE ${url}`).then(h.verifyResponse(405, bodyRegex)),
-      ]).then(done);
-    });
-
-
-    it('should reject requests without an \'AUTHORIZATION\' header', done => {
-      const headers1 = '';
-      const headers2 = '--header "AUTHORIXATION: "';
-      const url = `http://${host}/create-build/${pr}/${sha9}`;
-      const bodyRegex = /^Missing or empty 'AUTHORIZATION' header/;
-
-      Promise.all([
-        h.runCmd(`curl -iL ${headers1} ${url}`).then(h.verifyResponse(401, bodyRegex)),
-        h.runCmd(`curl -iL  ${headers2} ${url}`).then(h.verifyResponse(401, bodyRegex)),
-      ]).then(done);
-    });
-
-
-    it('should reject requests without an \'X-FILE\' header', done => {
-      const headers1 = authorizationHeader;
-      const headers2 = `${authorizationHeader} --header "X-FILE: "`;
-      const url = `http://${host}/create-build/${pr}/${sha9}`;
-      const bodyRegex = /^Missing or empty 'X-FILE' header/;
-
-      Promise.all([
-        h.runCmd(`curl -iL ${headers1} ${url}`).then(h.verifyResponse(400, bodyRegex)),
-        h.runCmd(`curl -iL ${headers2} ${url}`).then(h.verifyResponse(400, bodyRegex)),
-      ]).then(done);
-    });
-
-
-    it('should respond with 404 for unknown paths', done => {
-      const cmdPrefix = `${curl} http://${host}`;
-
-      Promise.all([
-        h.runCmd(`${cmdPrefix}/foo/create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/foo-create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/fooncreate-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/create-build/foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/create-build-foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/create-buildnfoo/${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/create-build/pr${pr}/${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${cmdPrefix}/create-build/${pr}/${sha9}42`).then(h.verifyResponse(404)),
-      ]).then(done);
-    });
-
-
-    it('should reject PRs with leading zeros', done => {
-      h.runCmd(`${curl} http://${host}/create-build/0${pr}/${sha9}`).
-        then(h.verifyResponse(404)).
-        then(done);
-    });
-
-
-    it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
-      Promise.all([
-        h.runCmd(`${curl} http://${host}/create-build/${pr}/0${sha9}`).then(h.verifyResponse(404)),
-        h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).then(h.verifyResponse(500)),
-        h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha0}`).then(h.verifyResponse(500)),
-      ]).then(done);
-    });
-
-
-    it('should not overwrite existing builds', done => {
-      h.createDummyBuild(pr, sha9);
-      expect(h.readBuildFile(pr, sha9, 'index.html')).toContain('index.html');
-
-      h.writeBuildFile(pr, sha9, 'index.html', 'My content');
-      expect(h.readBuildFile(pr, sha9, 'index.html')).toBe('My content');
-
-      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
-        then(h.verifyResponse(409, /^Request to overwrite existing directory/)).
-        then(() => expect(h.readBuildFile(pr, sha9, 'index.html')).toBe('My content')).
-        then(done);
-    });
-
-
-    it('should delete the PR directory on error (for new PR)', done => {
-      const prDir = path.join(h.buildsDir, pr);
-
-      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
-        then(h.verifyResponse(500)).
-        then(() => expect(fs.existsSync(prDir)).toBe(false)).
-        then(done);
-    });
-
-
-    it('should only delete the SHA directory on error (for existing PR)', done => {
-      const prDir = path.join(h.buildsDir, pr);
-      const shaDir = path.join(prDir, sha9);
-
-      h.createDummyBuild(pr, sha0);
-
-      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
-        then(h.verifyResponse(500)).
-        then(() => {
-          expect(fs.existsSync(shaDir)).toBe(false);
-          expect(fs.existsSync(prDir)).toBe(true);
-        }).
-        then(done);
-    });
-
-
-    describe('on successful upload', () => {
-      const archivePath = path.join(h.buildsDir, 'snapshot.tar.gz');
-      let uploadPromise: Promise<CmdResult>;
-
-      beforeEach(() => {
-        h.createDummyArchive(pr, sha9, archivePath);
-        uploadPromise = h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`);
-      });
-      afterEach(() => h.deletePrDir(pr));
-
-
-      it('should respond with 201', done => {
-        uploadPromise.then(h.verifyResponse(201)).then(done);
-      });
-
-
-      it('should extract the contents of the uploaded file', done => {
-        uploadPromise.
-          then(() => {
-            expect(h.readBuildFile(pr, sha9, 'index.html')).toContain(`uploaded/${pr}`);
-            expect(h.readBuildFile(pr, sha9, 'foo/bar.js')).toContain(`uploaded/${pr}`);
-          }).
-          then(done);
-      });
-
-
-      it(`should create files/directories owned by '${h.serverUser}'`, done => {
-        const shaDir = path.join(h.buildsDir, pr, sha9);
-        const idxPath = path.join(shaDir, 'index.html');
-        const barPath = path.join(shaDir, 'foo', 'bar.js');
-
-        uploadPromise.
-          then(() => Promise.all([
-            h.runCmd(`find ${shaDir}`),
-            h.runCmd(`find ${shaDir} -user ${h.serverUser}`),
-          ])).
-          then(([{stdout: allFiles}, {stdout: userFiles}]) => {
-            expect(userFiles).toBe(allFiles);
-            expect(userFiles).toContain(shaDir);
-            expect(userFiles).toContain(idxPath);
-            expect(userFiles).toContain(barPath);
-          }).
-          then(done);
-      });
-
-
-      it('should delete the uploaded file', done => {
-        expect(fs.existsSync(archivePath)).toBe(true);
-        uploadPromise.
-          then(() => expect(fs.existsSync(archivePath)).toBe(false)).
-          then(done);
-      });
-
-
-      it('should make the build directory non-writable', done => {
-        const shaDir = path.join(h.buildsDir, pr, sha9);
-        const idxPath = path.join(shaDir, 'index.html');
-        const barPath = path.join(shaDir, 'foo', 'bar.js');
-
-        // See https://github.com/nodejs/node-v0.x-archive/issues/3045#issuecomment-4862588.
-        const isNotWritable = (fileOrDir: string) => {
-          const mode = fs.statSync(fileOrDir).mode;
-          // tslint:disable-next-line: no-bitwise
-          return !(mode & parseInt('222', 8));
-        };
-
-        uploadPromise.
-          then(() => {
-            expect(isNotWritable(shaDir)).toBe(true);
-            expect(isNotWritable(idxPath)).toBe(true);
-            expect(isNotWritable(barPath)).toBe(true);
-          }).
-          then(done);
-      });
-
-    });
-
-  });
-
-
-  describe(`${host}/health-check`, () => {
-
-    it('should respond with 200', done => {
-      Promise.all([
-        h.runCmd(`curl -iL http://${host}/health-check`).then(h.verifyResponse(200)),
-        h.runCmd(`curl -iL http://${host}/health-check/`).then(h.verifyResponse(200)),
-      ]).then(done);
-    });
-
-
-    it('should respond with 404 if the path does not match exactly', done => {
-      Promise.all([
-        h.runCmd(`curl -iL http://${host}/health-check/foo`).then(h.verifyResponse(404)),
-        h.runCmd(`curl -iL http://${host}/health-check-foo`).then(h.verifyResponse(404)),
-        h.runCmd(`curl -iL http://${host}/health-checknfoo`).then(h.verifyResponse(404)),
-        h.runCmd(`curl -iL http://${host}/foo/health-check`).then(h.verifyResponse(404)),
-        h.runCmd(`curl -iL http://${host}/foo-health-check`).then(h.verifyResponse(404)),
-        h.runCmd(`curl -iL http://${host}/foonhealth-check`).then(h.verifyResponse(404)),
-      ]).then(done);
-    });
-
-  });
-
-
-  describe(`${host}/*`, () => {
-
-    it('should respond with 404 for GET requests to unknown URLs', done => {
-      const bodyRegex = /^Unknown resource/;
-
-      Promise.all([
-        h.runCmd(`curl -iL http://${host}/index.html`).then(h.verifyResponse(404, bodyRegex)),
-        h.runCmd(`curl -iL http://${host}/`).then(h.verifyResponse(404, bodyRegex)),
-        h.runCmd(`curl -iL http://${host}`).then(h.verifyResponse(404, bodyRegex)),
-      ]).then(done);
-    });
-
-
-    it('should respond with 405 for non-GET requests to any URL', done => {
-      const bodyRegex = /^Unsupported method/;
-
-      Promise.all([
-        h.runCmd(`curl -iLX PUT http://${host}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX POST http://${host}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX PATCH http://${host}`).then(h.verifyResponse(405, bodyRegex)),
-        h.runCmd(`curl -iLX DELETE http://${host}`).then(h.verifyResponse(405, bodyRegex)),
-      ]).then(done);
-    });
-
-  });
-
-});

aio/aio-builds-setup/dockerbuild/scripts-js/package.json

@@ -6,38 +6,50 @@
   "author": "Angular",
   "license": "MIT",
   "scripts": {
-    "prebuild": "yarn run clean",
-    "build": "tsc",
-    "build-watch": "yarn run tsc -- --watch",
-    "clean": "node --eval \"require('shelljs').rm('-rf', 'dist')\"",
-    "dev": "concurrently --kill-others --raw --success first \"yarn run build-watch\" \"yarn run test-watch\"",
+    "prebuild": "yarn clean-dist",
+    "build": "yarn ~~build",
+    "prebuild-watch": "yarn prebuild",
+    "build-watch": "yarn ~~build-watch",
+    "clean-dist": "node --eval \"require('shelljs').rm('-rf', 'dist')\"",
+    "predev": "yarn build || true",
+    "dev": "run-p ~~build-watch ~~test-watch",
     "lint": "tslint --project tsconfig.json",
-    "pre~~test-only": "yarn run lint",
+    "pretest": "yarn build",
+    "test": "yarn ~~test-only",
+    "pretest-watch": "yarn pretest",
+    "test-watch": "yarn ~~test-watch",
+    "~~build": "tsc",
+    "~~build-watch": "yarn ~~build --watch",
+    "pre~~test-only": "yarn lint",
     "~~test-only": "node dist/test",
-    "pretest": "yarn run build",
-    "test": "yarn run ~~test-only",
-    "pretest-watch": "yarn run build",
-    "test-watch": "nodemon --exec \"yarn run ~~test-only\" --watch dist"
+    "~~test-watch": "nodemon --delay 1 --exec \"yarn ~~test-only\" --watch dist"
   },
   "dependencies": {
-    "express": "^4.14.1",
-    "jasmine": "^2.5.3",
-    "jsonwebtoken": "^7.3.0",
-    "shelljs": "^0.7.6"
+    "body-parser": "^1.18.3",
+    "delete-empty": "^2.0.0",
+    "express": "^4.16.3",
+    "jasmine": "^3.2.0",
+    "nock": "^9.6.1",
+    "node-fetch": "^2.2.0",
+    "shelljs": "^0.8.2",
+    "source-map-support": "^0.5.9",
+    "tar-stream": "^1.6.1",
+    "tslib": "^1.9.3"
   },
   "devDependencies": {
-    "@types/express": "^4.0.35",
-    "@types/jasmine": "^2.5.43",
-    "@types/jsonwebtoken": "^7.2.0",
-    "@types/node": "^7.0.5",
-    "@types/shelljs": "^0.7.0",
-    "@types/supertest": "^2.0.0",
-    "concurrently": "^3.3.0",
-    "eslint": "^3.15.0",
-    "eslint-plugin-jasmine": "^2.2.0",
-    "nodemon": "^1.11.0",
-    "supertest": "^3.0.0",
-    "tslint": "^4.4.2",
-    "typescript": "^2.1.6"
+    "@types/body-parser": "^1.17.0",
+    "@types/express": "^4.16.0",
+    "@types/jasmine": "^2.8.8",
+    "@types/nock": "^9.3.0",
+    "@types/node": "^10.9.2",
+    "@types/node-fetch": "^2.1.2",
+    "@types/shelljs": "^0.8.0",
+    "@types/supertest": "^2.0.5",
+    "nodemon": "^1.18.3",
+    "npm-run-all": "^4.1.5",
+    "supertest": "^3.1.0",
+    "tslint": "^5.11.0",
+    "tslint-jasmine-noSkipOrFocus": "^1.0.9",
+    "typescript": "^3.0.1"
   }
 }

aio/aio-builds-setup/dockerbuild/scripts-js/test/clean-up/build-cleaner.spec.ts

@@ -1,133 +1,186 @@
 // Imports
 import * as fs from 'fs';
+import {normalize} from 'path';
 import * as shell from 'shelljs';
 import {BuildCleaner} from '../../lib/clean-up/build-cleaner';
+import {HIDDEN_DIR_PREFIX} from '../../lib/common/constants';
 import {GithubPullRequests} from '../../lib/common/github-pull-requests';
+import {Logger} from '../../lib/common/utils';
+
+const EXISTING_BUILDS = [10, 20, 30, 40];
+const EXISTING_DOWNLOADS = [
+  '10-ABCDEF0-build.zip',
+  '10-1234567-build.zip',
+  '20-ABCDEF0-build.zip',
+  '20-1234567-build.zip',
+];
+const OPEN_PRS = [10, 40];
+const ANY_DATE = jasmine.any(String);
 
 // Tests
 describe('BuildCleaner', () => {
+  let loggerErrorSpy: jasmine.Spy;
+  let loggerLogSpy: jasmine.Spy;
   let cleaner: BuildCleaner;
 
-  beforeEach(() => cleaner = new BuildCleaner('/foo/bar', 'baz/qux', '12345'));
-
+  beforeEach(() => {
+    loggerErrorSpy = spyOn(Logger.prototype, 'error');
+    loggerLogSpy = spyOn(Logger.prototype, 'log');
+    cleaner = new BuildCleaner('/foo/bar', 'baz', 'qux', '12345', '/downloads', 'build.zip');
+  });
 
   describe('constructor()', () => {
 
     it('should throw if \'buildsDir\' is empty', () => {
-      expect(() => new BuildCleaner('', '/baz/qux', '12345')).
+      expect(() => new BuildCleaner('', 'baz', 'qux', '12345', 'downloads', 'build.zip')).
         toThrowError('Missing or empty required parameter \'buildsDir\'!');
     });
 
 
-    it('should throw if \'repoSlug\' is empty', () => {
-      expect(() => new BuildCleaner('/foo/bar', '', '12345')).
-        toThrowError('Missing or empty required parameter \'repoSlug\'!');
+    it('should throw if \'githubOrg\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', '', 'qux', '12345', 'downloads', 'build.zip')).
+        toThrowError('Missing or empty required parameter \'githubOrg\'!');
+    });
+
+
+    it('should throw if \'githubRepo\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', 'baz', '', '12345', 'downloads', 'build.zip')).
+        toThrowError('Missing or empty required parameter \'githubRepo\'!');
     });
 
 
     it('should throw if \'githubToken\' is empty', () => {
-      expect(() => new BuildCleaner('/foo/bar', 'baz/qux', '')).
+      expect(() => new BuildCleaner('/foo/bar', 'baz', 'qux', '', 'downloads', 'build.zip')).
         toThrowError('Missing or empty required parameter \'githubToken\'!');
     });
 
+
+    it('should throw if \'downloadsDir\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', 'baz', 'qux', '12345', '', 'build.zip')).
+        toThrowError('Missing or empty required parameter \'downloadsDir\'!');
+    });
+
+
+    it('should throw if \'artifactPath\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', 'baz', 'qux', '12345', 'downloads', '')).
+        toThrowError('Missing or empty required parameter \'artifactPath\'!');
+    });
+
   });
 
 
   describe('cleanUp()', () => {
     let cleanerGetExistingBuildNumbersSpy: jasmine.Spy;
     let cleanerGetOpenPrNumbersSpy: jasmine.Spy;
+    let cleanerGetExistingDownloadsSpy: jasmine.Spy;
     let cleanerRemoveUnnecessaryBuildsSpy: jasmine.Spy;
-    let existingBuildsDeferred: {resolve: Function, reject: Function};
-    let openPrsDeferred: {resolve: Function, reject: Function};
-    let promise: Promise<void>;
+    let cleanerRemoveUnnecessaryDownloadsSpy: jasmine.Spy;
 
     beforeEach(() => {
-      cleanerGetExistingBuildNumbersSpy = spyOn(cleaner as any, 'getExistingBuildNumbers').and.callFake(() => {
-        return new Promise((resolve, reject) => existingBuildsDeferred = {resolve, reject});
-      });
-      cleanerGetOpenPrNumbersSpy = spyOn(cleaner as any, 'getOpenPrNumbers').and.callFake(() => {
-        return new Promise((resolve, reject) => openPrsDeferred = {resolve, reject});
-      });
-      cleanerRemoveUnnecessaryBuildsSpy = spyOn(cleaner as any, 'removeUnnecessaryBuilds');
+      cleanerGetExistingBuildNumbersSpy = spyOn(cleaner, 'getExistingBuildNumbers')
+        .and.callFake(() => Promise.resolve(EXISTING_BUILDS));
+      cleanerGetOpenPrNumbersSpy = spyOn(cleaner, 'getOpenPrNumbers')
+        .and.callFake(() => Promise.resolve(OPEN_PRS));
+      cleanerGetExistingDownloadsSpy = spyOn(cleaner, 'getExistingDownloads')
+        .and.callFake(() => Promise.resolve(EXISTING_DOWNLOADS));
+
+      cleanerRemoveUnnecessaryBuildsSpy = spyOn(cleaner, 'removeUnnecessaryBuilds');
+      cleanerRemoveUnnecessaryDownloadsSpy = spyOn(cleaner, 'removeUnnecessaryDownloads');
 
-      promise = cleaner.cleanUp();
     });
 
 
-    it('should return a promise', () => {
+    it('should return a promise', async () => {
+      const promise = cleaner.cleanUp();
       expect(promise).toEqual(jasmine.any(Promise));
+
+      // Do not complete the test and release the spies synchronously, to avoid running the actual implementations.
+      await promise;
     });
 
 
-    it('should get the existing builds', () => {
-      expect(cleanerGetExistingBuildNumbersSpy).toHaveBeenCalled();
-    });
-
-
-    it('should get the open PRs', () => {
+    it('should get the open PRs', async () => {
+      await cleaner.cleanUp();
       expect(cleanerGetOpenPrNumbersSpy).toHaveBeenCalled();
     });
 
 
-    it('should reject if \'getExistingBuildNumbers()\' rejects', done => {
-      promise.catch(err => {
+    it('should get the existing builds', async () => {
+      await cleaner.cleanUp();
+      expect(cleanerGetExistingBuildNumbersSpy).toHaveBeenCalled();
+    });
+
+
+    it('should get the existing downloads', async () => {
+      await cleaner.cleanUp();
+      expect(cleanerGetExistingDownloadsSpy).toHaveBeenCalled();
+    });
+
+
+    it('should pass existing builds and open PRs to \'removeUnnecessaryBuilds()\'', async () => {
+      await cleaner.cleanUp();
+      expect(cleanerRemoveUnnecessaryBuildsSpy).toHaveBeenCalledWith(EXISTING_BUILDS, OPEN_PRS);
+    });
+
+
+    it('should pass existing downloads and open PRs to \'removeUnnecessaryDownloads()\'', async () => {
+      await cleaner.cleanUp();
+      expect(cleanerRemoveUnnecessaryDownloadsSpy).toHaveBeenCalledWith(EXISTING_DOWNLOADS, OPEN_PRS);
+    });
+
+
+    it('should reject if \'getOpenPrNumbers()\' rejects', async () => {
+      try {
+        cleanerGetOpenPrNumbersSpy.and.callFake(() => Promise.reject('Test'));
+        await cleaner.cleanUp();
+      } catch (err) {
         expect(err).toBe('Test');
-        done();
-      });
-
-      existingBuildsDeferred.reject('Test');
+      }
     });
 
 
-    it('should reject if \'getOpenPrNumbers()\' rejects', done => {
-      promise.catch(err => {
+    it('should reject if \'getExistingBuildNumbers()\' rejects', async () => {
+      try {
+        cleanerGetExistingBuildNumbersSpy.and.callFake(() => Promise.reject('Test'));
+        await cleaner.cleanUp();
+      } catch (err) {
         expect(err).toBe('Test');
-        done();
-      });
-
-      openPrsDeferred.reject('Test');
+      }
     });
 
 
-    it('should reject if \'removeUnnecessaryBuilds()\' rejects', done => {
-      promise.catch(err => {
+    it('should reject if \'getExistingDownloads()\' rejects', async () => {
+      try {
+        cleanerGetExistingDownloadsSpy.and.callFake(() => Promise.reject('Test'));
+        await cleaner.cleanUp();
+      } catch (err) {
         expect(err).toBe('Test');
-        done();
-      });
-
-      cleanerRemoveUnnecessaryBuildsSpy.and.returnValue(Promise.reject('Test'));
-      existingBuildsDeferred.resolve();
-      openPrsDeferred.resolve();
+      }
     });
 
 
-    it('should pass existing builds and open PRs to \'removeUnnecessaryBuilds()\'', done => {
-      promise.then(() => {
-        expect(cleanerRemoveUnnecessaryBuildsSpy).toHaveBeenCalledWith('foo', 'bar');
-        done();
-      });
-
-      existingBuildsDeferred.resolve('foo');
-      openPrsDeferred.resolve('bar');
+    it('should reject if \'removeUnnecessaryBuilds()\' rejects', async () => {
+      try {
+        cleanerRemoveUnnecessaryBuildsSpy.and.callFake(() => Promise.reject('Test'));
+        await cleaner.cleanUp();
+      } catch (err) {
+        expect(err).toBe('Test');
+      }
     });
 
 
-    it('should resolve with the value returned by \'removeUnnecessaryBuilds()\'', done => {
-      promise.then(result => {
-        expect(result).toBe('Test');
-        done();
-      });
-
-      cleanerRemoveUnnecessaryBuildsSpy.and.returnValue(Promise.resolve('Test'));
-      existingBuildsDeferred.resolve();
-      openPrsDeferred.resolve();
+    it('should reject if \'removeUnnecessaryDownloads()\' rejects', async () => {
+      try {
+        cleanerRemoveUnnecessaryDownloadsSpy.and.callFake(() => Promise.reject('Test'));
+        await cleaner.cleanUp();
+      } catch (err) {
+        expect(err).toBe('Test');
+      }
     });
 
   });
 
 
-  // Protected methods
-
   describe('getExistingBuildNumbers()', () => {
     let fsReaddirSpy: jasmine.Spy;
     let readdirCb: (err: any, files?: string[]) => void;
@@ -135,7 +188,7 @@ describe('BuildCleaner', () => {
 
     beforeEach(() => {
       fsReaddirSpy = spyOn(fs, 'readdir').and.callFake((_: string, cb: typeof readdirCb) => readdirCb = cb);
-      promise = (cleaner as any).getExistingBuildNumbers();
+      promise = cleaner.getExistingBuildNumbers();
     });
 
 
@@ -170,6 +223,16 @@ describe('BuildCleaner', () => {
     });
 
 
+    it('should remove `HIDDEN_DIR_PREFIX` from the filenames', done => {
+      promise.then(result => {
+        expect(result).toEqual([12, 34, 56]);
+        done();
+      });
+
+      readdirCb(null, [`${HIDDEN_DIR_PREFIX}12`, '34', `${HIDDEN_DIR_PREFIX}56`]);
+    });
+
+
     it('should ignore files with non-numeric (or zero) names', done => {
       promise.then(result => {
         expect(result).toEqual([12, 34, 56]);
@@ -183,7 +246,7 @@ describe('BuildCleaner', () => {
 
 
   describe('getOpenPrNumbers()', () => {
-    let prDeferred: {resolve: Function, reject: Function};
+    let prDeferred: {resolve: (v: any) => void, reject: (v: any) => void};
     let promise: Promise<number[]>;
 
     beforeEach(() => {
@@ -191,7 +254,7 @@ describe('BuildCleaner', () => {
         return new Promise((resolve, reject) => prDeferred = {resolve, reject});
       });
 
-      promise = (cleaner as any).getOpenPrNumbers();
+      promise = cleaner.getOpenPrNumbers();
     });
 
 
@@ -224,95 +287,215 @@ describe('BuildCleaner', () => {
       prDeferred.resolve([{id: 0, number: 1}, {id: 1, number: 2}, {id: 2, number: 3}]);
     });
 
+
+    it('should log the number of open PRs', () => {
+      promise.then(prNumbers => {
+        expect(loggerLogSpy).toHaveBeenCalledWith(
+          ANY_DATE, 'BuildCleaner:        ', `Open pull requests: ${prNumbers}`);
+      });
+    });
+
+  });
+
+
+  describe('getExistingDownloads()', () => {
+    let fsReaddirSpy: jasmine.Spy;
+    let readdirCb: (err: any, files?: string[]) => void;
+    let promise: Promise<string[]>;
+
+    beforeEach(() => {
+      fsReaddirSpy = spyOn(fs, 'readdir').and.callFake((_: string, cb: typeof readdirCb) => readdirCb = cb);
+      promise = cleaner.getExistingDownloads();
+    });
+
+
+    it('should return a promise', () => {
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should get the contents of the downloads directory', () => {
+      expect(fsReaddirSpy).toHaveBeenCalled();
+      expect(fsReaddirSpy.calls.argsFor(0)[0]).toBe('/downloads');
+    });
+
+
+    it('should reject if an error occurs while getting the files', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      readdirCb('Test');
+    });
+
+
+    it('should resolve with the returned file names', done => {
+      promise.then(result => {
+        expect(result).toEqual(EXISTING_DOWNLOADS);
+        done();
+      });
+
+      readdirCb(null, EXISTING_DOWNLOADS);
+    });
+
+
+    it('should ignore files that do not match the artifactPath', done => {
+      promise.then(result => {
+        expect(result).toEqual(['10-ABCDEF-build.zip', '30-FFFFFFF-build.zip']);
+        done();
+      });
+
+      readdirCb(null, ['10-ABCDEF-build.zip', '20-AAAAAAA-otherfile.zip', '30-FFFFFFF-build.zip']);
+    });
+
   });
 
 
   describe('removeDir()', () => {
     let shellChmodSpy: jasmine.Spy;
     let shellRmSpy: jasmine.Spy;
+    let shellTestSpy: jasmine.Spy;
 
     beforeEach(() => {
       shellChmodSpy = spyOn(shell, 'chmod');
       shellRmSpy = spyOn(shell, 'rm');
+      shellTestSpy = spyOn(shell, 'test').and.returnValue(true);
+    });
+
+
+    it('should test if the directory exists (and return if is does not)', () => {
+      shellTestSpy.and.returnValue(false);
+      cleaner.removeDir('/foo/bar');
+
+      expect(shellTestSpy).toHaveBeenCalledWith('-d', '/foo/bar');
+      expect(shellChmodSpy).not.toHaveBeenCalled();
+      expect(shellRmSpy).not.toHaveBeenCalled();
     });
 
 
     it('should remove the specified directory and its content', () => {
-      (cleaner as any).removeDir('/foo/bar');
+      cleaner.removeDir('/foo/bar');
       expect(shellRmSpy).toHaveBeenCalledWith('-rf', '/foo/bar');
     });
 
 
     it('should make the directory and its content writable before removing', () => {
       shellRmSpy.and.callFake(() => expect(shellChmodSpy).toHaveBeenCalledWith('-R', 'a+w', '/foo/bar'));
-      (cleaner as any).removeDir('/foo/bar');
+      cleaner.removeDir('/foo/bar');
 
       expect(shellRmSpy).toHaveBeenCalled();
     });
 
 
     it('should catch errors and log them', () => {
-      const consoleErrorSpy = spyOn(console, 'error');
-      shellRmSpy.and.callFake(() => { throw 'Test'; });
+      shellRmSpy.and.callFake(() => {
+        // tslint:disable-next-line: no-string-throw
+        throw 'Test';
+      });
 
-      (cleaner as any).removeDir('/foo/bar');
+      cleaner.removeDir('/foo/bar');
 
-      expect(consoleErrorSpy).toHaveBeenCalled();
-      expect(consoleErrorSpy.calls.argsFor(0)[0]).toContain('Unable to remove \'/foo/bar\'');
-      expect(consoleErrorSpy.calls.argsFor(0)[1]).toBe('Test');
+      expect(loggerErrorSpy).toHaveBeenCalledWith('ERROR: Unable to remove \'/foo/bar\' due to:', 'Test');
     });
 
   });
 
 
   describe('removeUnnecessaryBuilds()', () => {
-    let consoleLogSpy: jasmine.Spy;
     let cleanerRemoveDirSpy: jasmine.Spy;
 
     beforeEach(() => {
-      consoleLogSpy = spyOn(console, 'log');
-      cleanerRemoveDirSpy = spyOn(cleaner as any, 'removeDir');
+      cleanerRemoveDirSpy = spyOn(cleaner, 'removeDir');
     });
 
 
-    it('should log the number of existing builds, open PRs and builds to be removed', () => {
-      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3], [3, 4, 5, 6]);
+    it('should log the number of existing builds and builds to be removed', () => {
+      cleaner.removeUnnecessaryBuilds([1, 2, 3], [3, 4, 5, 6]);
 
-      expect(console.log).toHaveBeenCalledWith('Existing builds: 3');
-      expect(console.log).toHaveBeenCalledWith('Open pull requests: 4');
-      expect(console.log).toHaveBeenCalledWith('Removing 2 build(s): 1, 2');
+      expect(loggerLogSpy).toHaveBeenCalledWith('Existing builds: 3');
+      expect(loggerLogSpy).toHaveBeenCalledWith('Removing 2 build(s): 1, 2');
     });
 
 
     it('should construct full paths to directories (by prepending \'buildsDir\')', () => {
-      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3], []);
+      cleaner.removeUnnecessaryBuilds([1, 2, 3], []);
 
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/2');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/1'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/2'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/3'));
+    });
+
+
+    it('should try removing hidden directories as well', () => {
+      cleaner.removeUnnecessaryBuilds([1, 2, 3], []);
+
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}1`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}2`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}3`));
     });
 
 
     it('should remove the builds that do not correspond to open PRs', () => {
-      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], [2, 4]);
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(2);
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
+      cleaner.removeUnnecessaryBuilds([1, 2, 3, 4], [2, 4]);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(4);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/1'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/3'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}1`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}3`));
       cleanerRemoveDirSpy.calls.reset();
 
-      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], [1, 2, 3, 4]);
+      cleaner.removeUnnecessaryBuilds([1, 2, 3, 4], [1, 2, 3, 4]);
       expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(0);
       cleanerRemoveDirSpy.calls.reset();
 
       (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], []);
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(4);
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/2');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
-      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/4');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(8);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/1'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/2'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/3'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize('/foo/bar/4'));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}1`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}2`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}3`));
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith(normalize(`/foo/bar/${HIDDEN_DIR_PREFIX}4`));
       cleanerRemoveDirSpy.calls.reset();
     });
 
   });
 
+
+  describe('removeUnnecessaryDownloads()', () => {
+    let shellRmSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      shellRmSpy = spyOn(shell, 'rm');
+    });
+
+
+    it('should log the number of existing downloads and downloads to be removed', () => {
+      cleaner.removeUnnecessaryDownloads(EXISTING_DOWNLOADS, OPEN_PRS);
+
+      expect(loggerLogSpy).toHaveBeenCalledWith('Existing downloads: 4');
+      expect(loggerLogSpy).toHaveBeenCalledWith('Removing 2 download(s): 20-ABCDEF0-build.zip, 20-1234567-build.zip');
+    });
+
+
+    it('should construct full paths to directories (by prepending \'downloadsDir\')', () => {
+      cleaner.removeUnnecessaryDownloads(['dl-1', 'dl-2', 'dl-3'], []);
+
+      expect(shellRmSpy).toHaveBeenCalledWith(normalize('/downloads/dl-1'));
+      expect(shellRmSpy).toHaveBeenCalledWith(normalize('/downloads/dl-2'));
+      expect(shellRmSpy).toHaveBeenCalledWith(normalize('/downloads/dl-3'));
+    });
+
+
+    it('should remove the downloads that do not correspond to open PRs', () => {
+      cleaner.removeUnnecessaryDownloads(EXISTING_DOWNLOADS, OPEN_PRS);
+      expect(shellRmSpy).toHaveBeenCalledTimes(2);
+      expect(shellRmSpy).toHaveBeenCalledWith(normalize('/downloads/20-ABCDEF0-build.zip'));
+      expect(shellRmSpy).toHaveBeenCalledWith(normalize('/downloads/20-1234567-build.zip'));
+    });
+
+  });
 });

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/circleci-api.spec.ts

@@ -0,0 +1,134 @@
+import * as nock from 'nock';
+import {CircleCiApi} from '../../lib/common/circle-ci-api';
+
+const ORG = 'testorg';
+const REPO = 'testrepo';
+const TOKEN = 'xxxx';
+const BASE_URL = `https://circleci.com/api/v1.1/project/github/${ORG}/${REPO}`;
+
+describe('CircleCIApi', () => {
+  describe('constructor()', () => {
+    it('should throw if \'githubOrg\' is missing or empty', () => {
+      expect(() => new CircleCiApi('', REPO, TOKEN)).
+        toThrowError('Missing or empty required parameter \'githubOrg\'!');
+    });
+
+    it('should throw if \'githubRepo\' is missing or empty', () => {
+      expect(() => new CircleCiApi(ORG, '', TOKEN)).
+        toThrowError('Missing or empty required parameter \'githubRepo\'!');
+    });
+
+    it('should throw if \'circleCiToken\' is missing or empty', () => {
+      expect(() => new CircleCiApi(ORG, REPO, '')).
+        toThrowError('Missing or empty required parameter \'circleCiToken\'!');
+    });
+  });
+
+  describe('getBuildInfo', () => {
+    it('should make a request to the CircleCI API for the given build number', async () => {
+      const api = new CircleCiApi(ORG, REPO, TOKEN);
+      const buildNum = 12345;
+      const expectedBuildInfo: any = { org: ORG, repo: REPO, build_num: buildNum };
+
+      const request = nock(BASE_URL)
+        .get(`/${buildNum}?circle-token=${TOKEN}`)
+        .reply(200, expectedBuildInfo);
+
+      const buildInfo = await api.getBuildInfo(buildNum);
+      expect(buildInfo).toEqual(expectedBuildInfo);
+      request.done();
+    });
+
+    it('should throw an error if the request fails', async () => {
+      const api = new CircleCiApi(ORG, REPO, TOKEN);
+      const buildNum = 12345;
+      const errorMessage = 'Invalid request';
+      const request = nock(BASE_URL).get(`/${buildNum}?circle-token=${TOKEN}`);
+
+      try {
+        request.replyWithError(errorMessage);
+        await api.getBuildInfo(buildNum);
+        throw new Error('Exception Expected');
+      } catch (err) {
+        expect(err.message).toEqual(
+          `CircleCI build info request failed ` +
+          `(request to ${BASE_URL}/${buildNum}?circle-token=${TOKEN} failed, reason: ${errorMessage})`);
+      }
+
+      try {
+        request.reply(404, errorMessage);
+        await api.getBuildInfo(buildNum);
+        throw new Error('Exception Expected');
+      } catch (err) {
+        expect(err.message).toEqual(
+          `CircleCI build info request failed ` +
+          `(request to ${BASE_URL}/${buildNum}?circle-token=${TOKEN} failed, reason: ${errorMessage})`);
+      }
+    });
+  });
+
+  describe('getBuildArtifactUrl', () => {
+    it('should make a request to the CircleCI API for the given build number', async () => {
+      const api = new CircleCiApi(ORG, REPO, TOKEN);
+      const buildNum = 12345;
+      const artifact0: any = { path: 'some/path/0', url: 'https://url/0' };
+      const artifact1: any = { path: 'some/path/1', url: 'https://url/1' };
+      const artifact2: any = { path: 'some/path/2', url: 'https://url/2' };
+      const request = nock(BASE_URL)
+        .get(`/${buildNum}/artifacts?circle-token=${TOKEN}`)
+        .reply(200, [artifact0, artifact1, artifact2]);
+
+      const artifactUrl = await api.getBuildArtifactUrl(buildNum, 'some/path/1');
+      expect(artifactUrl).toEqual('https://url/1');
+      request.done();
+    });
+
+
+    it('should throw an error if the request fails', async () => {
+      const api = new CircleCiApi(ORG, REPO, TOKEN);
+      const buildNum = 12345;
+      const errorMessage = 'Invalid request';
+      const request = nock(BASE_URL).get(`/${buildNum}/artifacts?circle-token=${TOKEN}`);
+
+      try {
+        request.replyWithError(errorMessage);
+        await api.getBuildArtifactUrl(buildNum, 'some/path/1');
+        throw new Error('Exception Expected');
+      } catch (err) {
+        expect(err.message).toEqual(
+          `CircleCI artifact URL request failed ` +
+          `(request to ${BASE_URL}/${buildNum}/artifacts?circle-token=${TOKEN} failed, reason: ${errorMessage})`);
+      }
+
+      try {
+        request.reply(404, errorMessage);
+        await api.getBuildArtifactUrl(buildNum, 'some/path/1');
+        throw new Error('Exception Expected');
+      } catch (err) {
+        expect(err.message).toEqual(
+          `CircleCI artifact URL request failed ` +
+          `(request to ${BASE_URL}/${buildNum}/artifacts?circle-token=${TOKEN} failed, reason: ${errorMessage})`);
+      }
+    });
+
+    it('should throw an error if the response does not contain the specified artifact', async () => {
+      const api = new CircleCiApi(ORG, REPO, TOKEN);
+      const buildNum = 12345;
+      const artifact0: any = { path: 'some/path/0', url: 'https://url/0' };
+      const artifact1: any = { path: 'some/path/1', url: 'https://url/1' };
+      const artifact2: any = { path: 'some/path/2', url: 'https://url/2' };
+      nock(BASE_URL)
+        .get(`/${buildNum}/artifacts?circle-token=${TOKEN}`)
+        .reply(200, [artifact0, artifact1, artifact2]);
+
+      try {
+        await api.getBuildArtifactUrl(buildNum, 'some/path/3');
+        throw new Error('Exception Expected');
+      } catch (err) {
+        expect(err.message).toEqual(
+          `CircleCI artifact URL request failed ` +
+          `(Missing artifact (some/path/3) for CircleCI build: ${buildNum})`);
+      }
+    });
+  });
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-api.spec.ts

@@ -1,7 +1,5 @@
 // Imports
-import {EventEmitter} from 'events';
-import {ClientRequest, IncomingMessage} from 'http';
-import * as https from 'https';
+import * as nock from 'nock';
 import {GithubApi} from '../../lib/common/github-api';
 
 // Tests
@@ -56,7 +54,7 @@ describe('GithubApi', () => {
 
 
     it('should not pass data to \'request()\'', () => {
-      (api.get as Function)('foo', {}, {});
+      (api.get as any)('foo', {}, {});
 
       expect(apiRequestSpy).toHaveBeenCalled();
       expect(apiRequestSpy.calls.argsFor(0)[2]).toBeUndefined();
@@ -110,41 +108,8 @@ describe('GithubApi', () => {
   });
 
 
-  // Protected methods
-
-  describe('buildPath()', () => {
-
-    it('should return the pathname if no params', () => {
-      expect((api as any).buildPath('/foo')).toBe('/foo');
-      expect((api as any).buildPath('/foo', undefined)).toBe('/foo');
-      expect((api as any).buildPath('/foo', null)).toBe('/foo');
-    });
-
-
-    it('should append the params to the pathname', () => {
-      expect((api as any).buildPath('/foo', {bar: 'baz'})).toBe('/foo?bar=baz');
-    });
-
-
-    it('should join the params with \'&\'', () => {
-      expect((api as any).buildPath('/foo', {bar: 1, baz: 2})).toBe('/foo?bar=1&baz=2');
-    });
-
-
-    it('should ignore undefined/null params', () => {
-      expect((api as any).buildPath('/foo', {bar: undefined, baz: null})).toBe('/foo');
-    });
-
-
-    it('should encode param values as URI components', () => {
-      expect((api as any).buildPath('/foo', {bar: 'b a&z'})).toBe('/foo?bar=b%20a%26z');
-    });
-
-  });
-
-
   describe('getPaginated()', () => {
-    let deferreds: {resolve: Function, reject: Function}[];
+    let deferreds: {resolve: (v: any) => void, reject: (v: any) => void}[];
 
     beforeEach(() => {
       deferreds = [];
@@ -161,8 +126,8 @@ describe('GithubApi', () => {
       (api as any).getPaginated('/foo/bar');
       (api as any).getPaginated('/foo/bar', {baz: 'qux'});
 
-      expect(api.get).toHaveBeenCalledWith('/foo/bar', {page: 0, per_page: 100});
-      expect(api.get).toHaveBeenCalledWith('/foo/bar', {baz: 'qux', page: 0, per_page: 100});
+      expect(api.get).toHaveBeenCalledWith('/foo/bar', {page: 1, per_page: 100});
+      expect(api.get).toHaveBeenCalledWith('/foo/bar', {baz: 'qux', page: 1, per_page: 100});
     });
 
 
@@ -197,9 +162,9 @@ describe('GithubApi', () => {
         const paramsForPage = (page: number) => ({baz: 'qux', page, per_page: 100});
 
         expect(apiGetSpy).toHaveBeenCalledTimes(3);
-        expect(apiGetSpy.calls.argsFor(0)).toEqual(['/foo/bar', paramsForPage(0)]);
-        expect(apiGetSpy.calls.argsFor(1)).toEqual(['/foo/bar', paramsForPage(1)]);
-        expect(apiGetSpy.calls.argsFor(2)).toEqual(['/foo/bar', paramsForPage(2)]);
+        expect(apiGetSpy.calls.argsFor(0)).toEqual(['/foo/bar', paramsForPage(1)]);
+        expect(apiGetSpy.calls.argsFor(1)).toEqual(['/foo/bar', paramsForPage(2)]);
+        expect(apiGetSpy.calls.argsFor(2)).toEqual(['/foo/bar', paramsForPage(3)]);
 
         expect(data).toEqual(allItems);
 
@@ -218,191 +183,162 @@ describe('GithubApi', () => {
   });
 
 
-  describe('request()', () => {
-    let httpsRequestSpy: jasmine.Spy;
-    let latestRequest: ClientRequest;
+  // Protected methods
 
-    beforeEach(() => {
-      const originalRequest = https.request;
+  describe('buildPath()', () => {
 
-      httpsRequestSpy = spyOn(https, 'request').and.callFake((...args: any[]) => {
-        latestRequest = originalRequest.apply(https, args);
-
-        spyOn(latestRequest, 'on').and.callThrough();
-        spyOn(latestRequest, 'end');
-
-        return latestRequest;
-      });
+    it('should return the pathname if no params', () => {
+      expect((api as any).buildPath('/foo')).toBe('/foo');
+      expect((api as any).buildPath('/foo', undefined)).toBe('/foo');
+      expect((api as any).buildPath('/foo', null)).toBe('/foo');
     });
 
 
+    it('should append the params to the pathname', () => {
+      expect((api as any).buildPath('/foo', {bar: 'baz'})).toBe('/foo?bar=baz');
+    });
+
+
+    it('should join the params with \'&\'', () => {
+      expect((api as any).buildPath('/foo', {bar: 1, baz: 2})).toBe('/foo?bar=1&baz=2');
+    });
+
+
+    it('should ignore undefined/null params', () => {
+      expect((api as any).buildPath('/foo', {bar: undefined, baz: null})).toBe('/foo');
+    });
+
+
+    it('should encode param values as URI components', () => {
+      expect((api as any).buildPath('/foo', {bar: 'b a&z'})).toBe('/foo?bar=b%20a%26z');
+    });
+
+  });
+
+  describe('request()', () => {
     it('should return a promise', () => {
+      nock('https://api.github.com').get('').reply(200);
       expect((api as any).request()).toEqual(jasmine.any(Promise));
     });
 
 
     it('should call \'https.request()\' with the correct options', () => {
-      (api as any).request('method', 'path');
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(200);
 
-      expect(httpsRequestSpy).toHaveBeenCalled();
-      expect(httpsRequestSpy.calls.argsFor(0)[0]).toEqual(jasmine.objectContaining({
-        headers: jasmine.objectContaining({
-          'User-Agent': `Node/${process.versions.node}`,
-        }),
-        host: 'api.github.com',
-        method: 'method',
-        path: 'path',
-      }));
+      (api as any).request('method', '/path');
+      requestHandler.done();
     });
 
 
-    it('should call specify an \'Authorization\' header if \'githubToken\' is present', () => {
-      (api as any).request('method', 'path');
-
-      expect(httpsRequestSpy).toHaveBeenCalled();
-      expect(httpsRequestSpy.calls.argsFor(0)[0].headers).toEqual(jasmine.objectContaining({
-        Authorization: 'token 12345',
-      }));
+    it('should add the \'Authorization\' header containing the \'githubToken\'', () => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method', undefined, {
+          reqheaders: {Authorization: 'token 12345'},
+        })
+        .reply(200);
+      (api as any).request('method', '/path');
+      requestHandler.done();
     });
 
 
-    it('should reject on request error', done => {
-      (api as any).request('method', 'path').catch((err: any) => {
-        expect(err).toBe('Test');
-        done();
-      });
-
-      latestRequest.emit('error', 'Test');
-    });
-
-
-    it('should send the request (i.e. call \'end()\')', () => {
-      (api as any).request('method', 'path');
-      expect(latestRequest.end).toHaveBeenCalled();
+    it('should reject on request error', async () => {
+      nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .replyWithError('Test');
+      let message = 'Failed to reject error';
+      await (api as any).request('method', '/path').catch((err: any) => message = err.message);
+      expect(message).toEqual('Test');
     });
 
 
     it('should \'JSON.stringify\' and send the data along with the request', () => {
-      (api as any).request('method', 'path');
-      expect(latestRequest.end).toHaveBeenCalledWith(null);
-
-      (api as any).request('method', 'path', {key: 'value'});
-      expect(latestRequest.end).toHaveBeenCalledWith('{"key":"value"}');
+      const data = {key: 'value'};
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method', JSON.stringify(data))
+        .reply(200);
+      (api as any).request('method', '/path', data);
+      requestHandler.done();
     });
 
 
-    describe('onResponse', () => {
-      let promise: Promise<void>;
-      let respond: (statusCode: number) => IncomingMessage;
+    it('should reject if response statusCode is <200', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(199);
 
-      beforeEach(() => {
-        promise = (api as any).request('method', 'path');
-
-        respond = (statusCode: number) => {
-          const mockResponse = new EventEmitter() as IncomingMessage;
-          mockResponse.statusCode = statusCode;
-
-          const onResponse = httpsRequestSpy.calls.argsFor(0)[1];
-          onResponse(mockResponse);
-
-          return mockResponse;
-        };
-      });
-
-
-      it('should reject on response error', done => {
-        promise.catch(err => {
-          expect(err).toBe('Test');
-          done();
-        });
-
-        const res = respond(200);
-        res.emit('error', 'Test');
-      });
-
-
-      it('should reject if returned statusCode is <200', done => {
-        promise.catch(err => {
+      (api as any).request('method', '/path')
+        .catch((err: string) => {
           expect(err).toContain('failed');
           expect(err).toContain('status: 199');
           done();
         });
-
-        const res = respond(199);
-        res.emit('end');
-      });
+      requestHandler.done();
+    });
 
 
-      it('should reject if returned statusCode is >=400', done => {
-        promise.catch(err => {
+    it('should reject if response statusCode is >=400', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(400);
+
+      (api as any).request('method', '/path')
+        .catch((err: string) => {
           expect(err).toContain('failed');
           expect(err).toContain('status: 400');
           done();
         });
-
-        const res = respond(400);
-        res.emit('end');
-      });
+      requestHandler.done();
+    });
 
 
-      it('should include the response text in the rejection message', done => {
-        promise.catch(err => {
+    it('should include the response text in the rejection message', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(500, 'Test');
+
+      (api as any).request('method', '/path')
+        .catch((err: string) => {
           expect(err).toContain('Test');
           done();
         });
+      requestHandler.done();
+     });
 
-        const res = respond(500);
-        res.emit('data', 'Test');
-        res.emit('end');
+
+    it('should resolve if returned statusCode is >=200 and <400', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(200);
+
+      (api as any).request('method', '/path').then(done);
+      requestHandler.done();
+    });
+
+
+    it('should parse the response body into an object using \'JSON.parse\'', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(300, '{"foo": "bar"}');
+
+      (api as any).request('method', '/path').then((data: any) => {
+        expect(data).toEqual({foo: 'bar'});
+        done();
       });
+      requestHandler.done();
+    });
 
+    it('should reject if the response text is malformed JSON', done => {
+      const requestHandler = nock('https://api.github.com')
+        .intercept('/path', 'method')
+        .reply(300, '}');
 
-      it('should resolve if returned statusCode is <=200 <400', done => {
-        promise.then(done);
-
-        const res = respond(200);
-        res.emit('data', '{}');
-        res.emit('end');
+      (api as any).request('method', '/path').catch((err: any) => {
+        expect(err).toEqual(jasmine.any(SyntaxError));
+        done();
       });
-
-
-      it('should resolve with the response text \'JSON.parsed\'', done => {
-        promise.then(data => {
-          expect(data).toEqual({foo: 'bar'});
-          done();
-        });
-
-        const res = respond(300);
-        res.emit('data', '{"foo":"bar"}');
-        res.emit('end');
-      });
-
-
-      it('should collect and concatenate the whole response text', done => {
-        promise.then(data => {
-          expect(data).toEqual({foo: 'bar', baz: 'qux'});
-          done();
-        });
-
-        const res = respond(300);
-        res.emit('data', '{"foo":');
-        res.emit('data', '"bar","baz"');
-        res.emit('data', ':"qux"}');
-        res.emit('end');
-      });
-
-
-      it('should reject if the response text is malformed JSON', done => {
-        promise.catch(err => {
-          expect(err).toEqual(jasmine.any(SyntaxError));
-          done();
-        });
-
-        const res = respond(300);
-        res.emit('data', '}');
-        res.emit('end');
-      });
-
+      requestHandler.done();
     });
 
   });

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-pull-requests.spec.ts

@@ -1,20 +1,27 @@
 // Imports
+import {GithubApi} from '../../lib/common/github-api';
 import {GithubPullRequests} from '../../lib/common/github-pull-requests';
 
 // Tests
 describe('GithubPullRequests', () => {
+  let githubApi: jasmine.SpyObj<GithubApi>;
+
+  beforeEach(() => {
+    githubApi = jasmine.createSpyObj('githubApi', ['post', 'get', 'getPaginated']);
+  });
+
 
   describe('constructor()', () => {
 
-    it('should throw if \'githubToken\' is missing or empty', () => {
-      expect(() => new GithubPullRequests('', 'foo/bar')).
-        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    it('should throw if \'githubOrg\' is missing or empty', () => {
+      expect(() => new GithubPullRequests(githubApi, '', 'bar')).
+        toThrowError('Missing or empty required parameter \'githubOrg\'!');
     });
 
 
-    it('should throw if \'repoSlug\' is missing or empty', () => {
-      expect(() => new GithubPullRequests('12345', '')).
-        toThrowError('Missing or empty required parameter \'repoSlug\'!');
+    it('should throw if \'githubRepo\' is missing or empty', () => {
+      expect(() => new GithubPullRequests(githubApi, 'foo', '')).
+        toThrowError('Missing or empty required parameter \'githubRepo\'!');
     });
 
   });
@@ -22,17 +29,9 @@ describe('GithubPullRequests', () => {
 
   describe('addComment()', () => {
     let prs: GithubPullRequests;
-    let deferred: {resolve: Function, reject: Function};
 
     beforeEach(() => {
-      prs = new GithubPullRequests('12345', 'foo/bar');
-
-      spyOn(prs, 'post').and.callFake(() => new Promise((resolve, reject) => deferred = {resolve, reject}));
-    });
-
-
-    it('should return a promise', () => {
-      expect(prs.addComment(42, 'body')).toEqual(jasmine.any(Promise));
+      prs = new GithubPullRequests(githubApi, 'foo', 'bar');
     });
 
 
@@ -47,30 +46,54 @@ describe('GithubPullRequests', () => {
     });
 
 
-    it('should call \'post()\' with the correct pathname, params and data', () => {
+    it('should make a POST request to Github with the correct pathname, params and data', () => {
+      githubApi.post.and.callFake(() => Promise.resolve());
       prs.addComment(42, 'body');
-
-      expect(prs.post).toHaveBeenCalledWith('/repos/foo/bar/issues/42/comments', null, {body: 'body'});
+      expect(githubApi.post).toHaveBeenCalledWith('/repos/foo/bar/issues/42/comments', null, {body: 'body'});
     });
 
 
     it('should reject if the request fails', done => {
+      githubApi.post.and.callFake(() => Promise.reject('Test'));
       prs.addComment(42, 'body').catch(err => {
         expect(err).toBe('Test');
         done();
       });
-
-      deferred.reject('Test');
     });
 
 
-    it('should resolve with the returned response', done => {
+    it('should resolve with the data from the Github POST', done => {
+      githubApi.post.and.callFake(() => Promise.resolve('Test'));
       prs.addComment(42, 'body').then(data => {
-        expect(data).toEqual('Test');
+        expect(data).toBe('Test');
         done();
       });
+    });
 
-      deferred.resolve('Test');
+  });
+
+
+  describe('fetch()', () => {
+    let prs: GithubPullRequests;
+
+    beforeEach(() => {
+      prs = new GithubPullRequests(githubApi, 'foo', 'bar');
+    });
+
+
+    it('should make a GET request to GitHub with the correct pathname', () => {
+      prs.fetch(42);
+      expect(githubApi.get).toHaveBeenCalledWith('/repos/foo/bar/issues/42');
+    });
+
+
+    it('should resolve with the data returned from GitHub', done => {
+      const expected: any = {number: 42};
+      githubApi.get.and.callFake(() => Promise.resolve(expected));
+      prs.fetch(42).then(data => {
+        expect(data).toEqual(expected);
+        done();
+      });
     });
 
   });
@@ -78,13 +101,8 @@ describe('GithubPullRequests', () => {
 
   describe('fetchAll()', () => {
     let prs: GithubPullRequests;
-    let prsGetPaginatedSpy: jasmine.Spy;
 
-    beforeEach(() => {
-      prs = new GithubPullRequests('12345', 'foo/bar');
-      prsGetPaginatedSpy = spyOn(prs as any, 'getPaginated');
-      spyOn(console, 'log');
-    });
+    beforeEach(() => prs = new GithubPullRequests(githubApi, 'foo', 'bar'));
 
 
     it('should call \'getPaginated()\' with the correct pathname and params', () => {
@@ -94,22 +112,48 @@ describe('GithubPullRequests', () => {
       prs.fetchAll('closed');
       prs.fetchAll('open');
 
-      expect(prsGetPaginatedSpy).toHaveBeenCalledTimes(3);
-      expect(prsGetPaginatedSpy.calls.argsFor(0)).toEqual([expectedPathname, {state: 'all'}]);
-      expect(prsGetPaginatedSpy.calls.argsFor(1)).toEqual([expectedPathname, {state: 'closed'}]);
-      expect(prsGetPaginatedSpy.calls.argsFor(2)).toEqual([expectedPathname, {state: 'open'}]);
+      expect(githubApi.getPaginated).toHaveBeenCalledTimes(3);
+      expect(githubApi.getPaginated.calls.argsFor(0)).toEqual([expectedPathname, {state: 'all'}]);
+      expect(githubApi.getPaginated.calls.argsFor(1)).toEqual([expectedPathname, {state: 'closed'}]);
+      expect(githubApi.getPaginated.calls.argsFor(2)).toEqual([expectedPathname, {state: 'open'}]);
     });
 
 
     it('should default to \'all\' if no state is specified', () => {
       prs.fetchAll();
-      expect(prsGetPaginatedSpy).toHaveBeenCalledWith('/repos/foo/bar/pulls', {state: 'all'});
+      expect(githubApi.getPaginated).toHaveBeenCalledWith('/repos/foo/bar/pulls', {state: 'all'});
     });
 
 
     it('should forward the value returned by \'getPaginated()\'', () => {
-      prsGetPaginatedSpy.and.returnValue('Test');
-      expect(prs.fetchAll()).toBe('Test');
+      githubApi.getPaginated.and.returnValue('Test');
+      expect(prs.fetchAll() as any).toBe('Test');
+    });
+
+  });
+
+
+  describe('fetchFiles()', () => {
+    let prs: GithubPullRequests;
+
+    beforeEach(() => {
+      prs = new GithubPullRequests(githubApi, 'foo', 'bar');
+    });
+
+
+    it('should make a paginated GET request to GitHub with the correct pathname', () => {
+      prs.fetchFiles(42);
+      expect(githubApi.getPaginated).toHaveBeenCalledWith('/repos/foo/bar/pulls/42/files');
+    });
+
+
+    it('should resolve with the data returned from GitHub', done => {
+      const expected: any = [{sha: 'ABCDE', filename: 'a/b/c'}, {sha: '12345', filename: 'x/y/z'}];
+      githubApi.getPaginated.and.callFake(() => Promise.resolve(expected));
+      prs.fetchFiles(42).then(data => {
+        expect(data).toEqual(expected);
+        done();
+      });
     });
 
   });

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-teams.spec.ts

@@ -1,44 +1,41 @@
-// Imports
+import {GithubApi} from '../../lib/common/github-api';
 import {GithubTeams} from '../../lib/common/github-teams';
 
 // Tests
 describe('GithubTeams', () => {
 
+  let githubApi: jasmine.SpyObj<GithubApi>;
+
+  beforeEach(() => {
+    githubApi = jasmine.createSpyObj('githubApi', ['post', 'get', 'getPaginated']);
+  });
+
   describe('constructor()', () => {
 
-    it('should throw if \'githubToken\' is missing or empty', () => {
-      expect(() => new GithubTeams('', 'org')).
-        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    it('should throw if \'githubOrg\' is missing or empty', () => {
+      expect(() => new GithubTeams(githubApi, '')).
+        toThrowError('Missing or empty required parameter \'githubOrg\'!');
     });
-
-
-    it('should throw if \'organization\' is missing or empty', () => {
-      expect(() => new GithubTeams('12345', '')).
-        toThrowError('Missing or empty required parameter \'organization\'!');
-    });
-
   });
 
 
   describe('fetchAll()', () => {
     let teams: GithubTeams;
-    let teamsGetPaginatedSpy: jasmine.Spy;
 
     beforeEach(() => {
-      teams = new GithubTeams('12345', 'foo');
-      teamsGetPaginatedSpy = spyOn(teams as any, 'getPaginated');
+      teams = new GithubTeams(githubApi, 'foo');
     });
 
 
     it('should call \'getPaginated()\' with the correct pathname and params', () => {
       teams.fetchAll();
-      expect(teamsGetPaginatedSpy).toHaveBeenCalledWith('/orgs/foo/teams');
+      expect(githubApi.getPaginated).toHaveBeenCalledWith('/orgs/foo/teams');
     });
 
 
     it('should forward the value returned by \'getPaginated()\'', () => {
-      teamsGetPaginatedSpy.and.returnValue('Test');
-      expect(teams.fetchAll()).toBe('Test');
+      githubApi.getPaginated.and.returnValue('Test');
+      expect(teams.fetchAll() as any).toBe('Test');
     });
 
   });
@@ -46,59 +43,59 @@ describe('GithubTeams', () => {
 
   describe('isMemberById()', () => {
     let teams: GithubTeams;
-    let teamsGetSpy: jasmine.Spy;
 
     beforeEach(() => {
-      teams = new GithubTeams('12345', 'foo');
-      teamsGetSpy = spyOn(teams, 'get');
+      teams = new GithubTeams(githubApi, 'foo');
     });
 
 
     it('should return a promise', () => {
-      expect(teams.isMemberById('user', [1])).toEqual(jasmine.any(Promise));
+      githubApi.get.and.callFake(() => Promise.resolve());
+      const promise = teams.isMemberById('user', [1]);
+      expect(promise).toEqual(jasmine.any(Promise));
     });
 
 
     it('should resolve with false if called with an empty array', done => {
       teams.isMemberById('user', []).then(isMember => {
         expect(isMember).toBe(false);
-        expect(teamsGetSpy).not.toHaveBeenCalled();
+        expect(githubApi.get).not.toHaveBeenCalled();
         done();
       });
     });
 
 
     it('should call \'get()\' with the correct pathname', done => {
-      teamsGetSpy.and.returnValue(Promise.resolve(null));
+      githubApi.get.and.callFake(() => Promise.resolve());
       teams.isMemberById('user', [1]).then(() => {
-        expect(teamsGetSpy).toHaveBeenCalledWith('/teams/1/memberships/user');
+        expect(githubApi.get).toHaveBeenCalledWith('/teams/1/memberships/user');
         done();
       });
     });
 
 
     it('should resolve with false if \'get()\' rejects', done => {
-      teamsGetSpy.and.returnValue(Promise.reject(null));
+      githubApi.get.and.callFake(() => Promise.reject(null));
       teams.isMemberById('user', [1]).then(isMember => {
         expect(isMember).toBe(false);
-        expect(teamsGetSpy).toHaveBeenCalled();
+        expect(githubApi.get).toHaveBeenCalled();
         done();
       });
     });
 
 
     it('should resolve with false if the membership is not active', done => {
-      teamsGetSpy.and.returnValue(Promise.resolve({state: 'pending'}));
+      githubApi.get.and.callFake(() => Promise.resolve({state: 'pending'}));
       teams.isMemberById('user', [1]).then(isMember => {
         expect(isMember).toBe(false);
-        expect(teamsGetSpy).toHaveBeenCalled();
+        expect(githubApi.get).toHaveBeenCalled();
         done();
       });
     });
 
 
     it('should resolve with true if the membership is active', done => {
-      teamsGetSpy.and.returnValue(Promise.resolve({state: 'active'}));
+      githubApi.get.and.callFake(() => Promise.resolve({state: 'active'}));
       teams.isMemberById('user', [1]).then(isMember => {
         expect(isMember).toBe(true);
         done();
@@ -112,15 +109,15 @@ describe('GithubTeams', () => {
         '/teams/2/memberships/user': Promise.reject(null),
         '/teams/3/memberships/user': Promise.resolve({state: 'active'}),
       };
-      teamsGetSpy.and.callFake((pathname: string) => trainedResponses[pathname]);
+      githubApi.get.and.callFake((pathname: string) => trainedResponses[pathname]);
 
       teams.isMemberById('user', [1, 2, 3, 4]).then(isMember => {
         expect(isMember).toBe(true);
 
-        expect(teamsGetSpy).toHaveBeenCalledTimes(3);
-        expect(teamsGetSpy.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
-        expect(teamsGetSpy.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
-        expect(teamsGetSpy.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
+        expect(githubApi.get).toHaveBeenCalledTimes(3);
+        expect(githubApi.get.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
+        expect(githubApi.get.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
+        expect(githubApi.get.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
 
         done();
       });
@@ -134,16 +131,16 @@ describe('GithubTeams', () => {
         '/teams/3/memberships/user': Promise.resolve({state: 'not active'}),
         '/teams/4/memberships/user':  Promise.reject(null),
       };
-      teamsGetSpy.and.callFake((pathname: string) => trainedResponses[pathname]);
+      githubApi.get.and.callFake((pathname: string) => trainedResponses[pathname]);
 
       teams.isMemberById('user', [1, 2, 3, 4]).then(isMember => {
         expect(isMember).toBe(false);
 
-        expect(teamsGetSpy).toHaveBeenCalledTimes(4);
-        expect(teamsGetSpy.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
-        expect(teamsGetSpy.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
-        expect(teamsGetSpy.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
-        expect(teamsGetSpy.calls.argsFor(3)[0]).toBe('/teams/4/memberships/user');
+        expect(githubApi.get).toHaveBeenCalledTimes(4);
+        expect(githubApi.get.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
+        expect(githubApi.get.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
+        expect(githubApi.get.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
+        expect(githubApi.get.calls.argsFor(3)[0]).toBe('/teams/4/memberships/user');
 
         done();
       });
@@ -158,7 +155,7 @@ describe('GithubTeams', () => {
     let teamsIsMemberByIdSpy: jasmine.Spy;
 
     beforeEach(() => {
-      teams = new GithubTeams('12345', 'foo');
+      teams = new GithubTeams(githubApi, 'foo');
 
       const mockResponse = Promise.resolve([{id: 1, slug: 'team1'}, {id: 2, slug: 'team2'}]);
       teamsFetchAllSpy = spyOn(teams, 'fetchAll').and.returnValue(mockResponse);
@@ -178,7 +175,7 @@ describe('GithubTeams', () => {
 
 
     it('should resolve with false if \'fetchAll()\' rejects', done => {
-      teamsFetchAllSpy.and.returnValue(Promise.reject(null));
+      teamsFetchAllSpy.and.callFake(() => Promise.reject(null));
       teams.isMemberBySlug('user', ['team-slug']).then(isMember => {
         expect(isMember).toBe(false);
         done();
@@ -206,7 +203,7 @@ describe('GithubTeams', () => {
 
 
     it('should resolve with false if \'isMemberById()\' rejects', done => {
-      teamsIsMemberByIdSpy.and.returnValue(Promise.reject(null));
+      teamsIsMemberByIdSpy.and.callFake(() => Promise.reject(null));
       teams.isMemberBySlug('user', ['team1']).then(isMember => {
         expect(isMember).toBe(false);
         expect(teamsIsMemberByIdSpy).toHaveBeenCalled();
@@ -215,16 +212,17 @@ describe('GithubTeams', () => {
     });
 
 
-    it('should resolve with the value \'isMemberById()\' resolves with', done => {
-      teamsIsMemberByIdSpy.and.returnValues(Promise.resolve(false), Promise.resolve(true));
+    it('should resolve with the value \'isMemberById()\' resolves with', async () => {
 
-      Promise.all([
-        teams.isMemberBySlug('user', ['team1']).then(isMember => expect(isMember).toBe(false)),
-        teams.isMemberBySlug('user', ['team1']).then(isMember => expect(isMember).toBe(true)),
-      ]).then(() => {
-        expect(teamsIsMemberByIdSpy).toHaveBeenCalledTimes(2);
-        done();
-      });
+      teamsIsMemberByIdSpy.and.callFake(() => Promise.resolve(true));
+      const isMember1 = await teams.isMemberBySlug('user', ['team1']);
+      expect(isMember1).toBe(true);
+      expect(teamsIsMemberByIdSpy).toHaveBeenCalledWith('user', [1]);
+
+      teamsIsMemberByIdSpy.and.callFake(() => Promise.resolve(false));
+      const isMember2 = await teams.isMemberBySlug('user', ['team1']);
+      expect(isMember2).toBe(false);
+      expect(teamsIsMemberByIdSpy).toHaveBeenCalledWith('user', [1]);
     });
 
   });

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/utils.spec.ts

@@ -1,9 +1,59 @@
 // Imports
-import {assertNotMissingOrEmpty, getEnvVar} from '../../lib/common/utils';
+import {resolve as resolvePath} from 'path';
+import {
+  assert,
+  assertNotMissingOrEmpty,
+  computeArtifactDownloadPath,
+  computeShortSha,
+  getEnvVar,
+  getPrInfoFromDownloadPath,
+  Logger,
+} from '../../lib/common/utils';
 
 // Tests
 describe('utils', () => {
 
+  describe('computeShortSha', () => {
+    it('should return only the first SHORT_SHA_LEN characters of the SHA', () => {
+      expect(computeShortSha('0123456789')).toEqual('0123456');
+      expect(computeShortSha('ABC')).toEqual('ABC');
+      expect(computeShortSha('')).toEqual('');
+    });
+  });
+
+
+  describe('assert', () => {
+    it('should throw if passed a false value', () => {
+      expect(() => assert(false, 'error message')).toThrowError('error message');
+    });
+
+    it('should not throw if passed a true value', () => {
+      expect(() => assert(true, 'error message')).not.toThrow();
+    });
+  });
+
+
+  describe('computeArtifactDownloadPath', () => {
+    it('should compute an absolute path based on the artifact info provided', () => {
+      const downloadDir = '/a/b/c';
+      const pr = 123;
+      const sha = 'ABCDEF1234567';
+      const artifactPath = 'a/path/to/file.zip';
+      const path = computeArtifactDownloadPath(downloadDir, pr, sha, artifactPath);
+      expect(path).toBe(resolvePath('/a/b/c/123-ABCDEF1-file.zip'));
+    });
+  });
+
+
+  describe('getPrInfoFromDownloadPath', () => {
+    it('should extract the PR and SHA from the file path', () => {
+      const {pr, sha} = getPrInfoFromDownloadPath('a/b/c/12345-ABCDE-artifact.zip');
+      expect(pr).toEqual(12345);
+      expect(sha).toEqual('ABCDE');
+    });
+  });
+
+
   describe('assertNotMissingOrEmpty()', () => {
 
     it('should throw if passed an empty value', () => {
@@ -78,4 +128,79 @@ describe('utils', () => {
 
   });
 
+
+  describe('Logger', () => {
+    let consoleErrorSpy: jasmine.Spy;
+    let consoleInfoSpy: jasmine.Spy;
+    let consoleLogSpy: jasmine.Spy;
+    let consoleWarnSpy: jasmine.Spy;
+    let logger: Logger;
+
+    beforeEach(() => {
+      consoleErrorSpy = spyOn(console, 'error');
+      consoleInfoSpy = spyOn(console, 'info');
+      consoleLogSpy = spyOn(console, 'log');
+      consoleWarnSpy = spyOn(console, 'warn');
+
+      logger = new Logger('TestScope');
+    });
+
+
+    it('should delegate to `console`', () => {
+      logger.error('foo');
+      expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+      expect(consoleErrorSpy.calls.argsFor(0)).toContain('foo');
+
+      logger.info('bar');
+      expect(consoleInfoSpy).toHaveBeenCalledTimes(1);
+      expect(consoleInfoSpy.calls.argsFor(0)).toContain('bar');
+
+      logger.log('baz');
+      expect(consoleLogSpy).toHaveBeenCalledTimes(1);
+      expect(consoleLogSpy.calls.argsFor(0)).toContain('baz');
+
+      logger.warn('qux');
+      expect(consoleWarnSpy).toHaveBeenCalledTimes(1);
+      expect(consoleWarnSpy.calls.argsFor(0)).toContain('qux');
+    });
+
+
+    it('should prepend messages with the current date and logger\'s scope', () => {
+      const mockDate = new Date(1337);
+      const expectedDateStr = `[${mockDate}]`;
+      const expectedScopeStr = 'TestScope:           ';
+
+      jasmine.clock().mockDate(mockDate);
+      jasmine.clock().withMock(() => {
+        logger.error();
+        logger.info();
+        logger.log();
+        logger.warn();
+      });
+
+      expect(consoleErrorSpy).toHaveBeenCalledWith(expectedDateStr, expectedScopeStr);
+      expect(consoleInfoSpy).toHaveBeenCalledWith(expectedDateStr, expectedScopeStr);
+      expect(consoleLogSpy).toHaveBeenCalledWith(expectedDateStr, expectedScopeStr);
+      expect(consoleWarnSpy).toHaveBeenCalledWith(expectedDateStr, expectedScopeStr);
+    });
+
+
+    it('should pass all arguments to `console`', () => {
+      const someString = jasmine.any(String);
+
+      logger.error('foo1', 'foo2');
+      expect(consoleErrorSpy).toHaveBeenCalledWith(someString, someString, 'foo1', 'foo2');
+
+      logger.info('bar1', 'bar2');
+      expect(consoleInfoSpy).toHaveBeenCalledWith(someString, someString, 'bar1', 'bar2');
+
+      logger.log('baz1', 'baz2');
+      expect(consoleLogSpy).toHaveBeenCalledWith(someString, someString, 'baz1', 'baz2');
+
+      logger.warn('qux1', 'qux2');
+      expect(consoleWarnSpy).toHaveBeenCalledWith(someString, someString, 'qux1', 'qux2');
+    });
+
+  });
+
 });

aio/aio-builds-setup/dockerbuild/scripts-js/test/helpers.ts

@@ -1,6 +0,0 @@
-declare namespace jasmine {
-  export interface DoneFn extends Function {
-    (): void;
-    fail: (message: Error | string) => void;
-  }
-}