feat(ncu-ci): pass COMMIT_SHA_CHECK via --certify-safe (#911)

Changes have been made on Jenkins side, tip of the PR head must be sent
to Jenkins in order to start a PR. This commit adapts ncu-ci CLI to pass
that information – or get the SHA from the latest review if not passed.

Author: aduh95

Diff for: bin/ncu-ci.js

@@ -115,9 +115,9 @@ const args = yargs(hideBin(process.argv))
           type: 'number'
         })
         .positional('certify-safe', {
-          describe: 'If not provided, the command will reject PRs that have ' +
-                    'been pushed since the last review',
-          type: 'boolean'
+          describe: 'SHA of the commit that is expected to be at the tip of the PR head. ' +
+                    'If not provided, the command will use the SHA of the last approved commit.',
+          type: 'string'
         })
         .option('owner', {
           default: '',

Diff for: lib/ci/run_ci.js

@@ -27,7 +27,7 @@ export class RunPRJob {
     this.certifySafe =
       certifySafe ||
       Promise.all([this.prData.getReviews(), this.prData.getPR()]).then(() =>
-        new PRChecker(cli, this.prData, request, {}).checkCommitsAfterReview()
+        (this.certifySafe = new PRChecker(cli, this.prData, request, {}).getApprovedTipOfHead())
       );
   }
 
@@ -45,6 +45,7 @@ export class RunPRJob {
     payload.append('json', JSON.stringify({
       parameter: [
         { name: 'CERTIFY_SAFE', value: 'on' },
+        { name: 'COMMIT_SHA_CHECK', value: this.certifySafe },
         { name: 'TARGET_GITHUB_ORG', value: this.owner },
         { name: 'TARGET_REPO_NAME', value: this.repo },
         { name: 'PR_ID', value: this.prid },

Diff for: lib/pr_checker.js

@@ -524,7 +524,7 @@ export default class PRChecker {
     return true;
   }
 
-  checkCommitsAfterReview() {
+  getApprovedTipOfHead() {
     const {
       commits, reviews, cli, argv
     } = this;
@@ -577,7 +577,11 @@ export default class PRChecker {
       return false;
     }
 
-    return true;
+    return reviews[reviewIndex].commit.oid;
+  }
+
+  checkCommitsAfterReview() {
+    return !!this.getApprovedTipOfHead();
   }
 
   checkMergeableState() {

Diff for: test/unit/ci_start.test.js

@@ -26,6 +26,7 @@ describe('Jenkins', () => {
       const { parameter } = JSON.parse(value);
       const expectedParameters = {
         CERTIFY_SAFE: 'on',
+        COMMIT_SHA_CHECK: 'deadbeef',
         TARGET_GITHUB_ORG: owner,
         TARGET_REPO_NAME: repo,
         PR_ID: prid,
@@ -91,7 +92,7 @@ describe('Jenkins', () => {
       json: sinon.stub().withArgs(CI_CRUMB_URL)
         .returns(Promise.resolve({ crumb }))
     };
-    const jobRunner = new RunPRJob(cli, request, owner, repo, prid, true);
+    const jobRunner = new RunPRJob(cli, request, owner, repo, prid, 'deadbeef');
     assert.ok(await jobRunner.start());
   });
 
@@ -124,8 +125,8 @@ describe('Jenkins', () => {
       }safe`, async() => {
         const cli = new TestCLI();
 
-        sinon.replace(PRChecker.prototype, 'checkCommitsAfterReview',
-          sinon.fake.returns(Promise.resolve(certifySafe)));
+        sinon.replace(PRChecker.prototype, 'getApprovedTipOfHead',
+          sinon.fake.returns(certifySafe && 'deadbeef'));
 
         const request = {
           gql: sinon.stub().returns({