recipe_roll_tryjob: Add service_account argument.

scripts/slave/recipes/infra/recipe_roll_tryjob.py

 # Copyright (c) 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Rolls recipes.cfg dependencies."""
 
 DEPS = [
   'depot_tools/bot_update',
   'depot_tools/gclient',
   'file',
   'url',
   'recipe_engine/json',
   'recipe_engine/path',
   'recipe_engine/properties',
   'recipe_engine/python',
   'recipe_engine/raw_io',
   'recipe_engine/step',
 ]
 
 from recipe_engine.recipe_api import Property
 
 import collections
 import re
 import base64
 import json
 
 
-def get_auth_token(api):
+def get_auth_token(api, service_account=None):
   """
   Get an auth token; this assumes the user is logged in with the infra
   authutil command line utility.
+
+  If service_account is provided, that service account will be used when calling
+  authutil.
   """
+  cmd = ['/opt/infra-tools/authutil', 'token']
+  if service_account: # pragma: no cover
+      cmd.extend([
+          '-service-account-json='
+          '/creds/service_accounts/service-account-%s.json' % service_account])
 
-  result = api.step('Get auth token',
-      ['/opt/infra-tools/authutil', 'token',],
+  result = api.step(
+      'Get auth token', cmd,
       stdout=api.raw_io.output(),
       step_test_data=lambda: api.raw_io.test_api.stream_output('ya29.foobar'))
   return result.stdout.strip()
 
 def parse_protobuf(lines): # pragma: no cover
   """Parse the protobuf text format just well enough to understand recipes.cfg.
 
   We don't use the protobuf library because we want to be as self-contained
   as possible in this bootstrap, so it can be simply vendored into a client
   repo.
@@ skipping 293 matching lines @@
   "issue": Property(kind=str, default=None,
                     help="The Rietveld issue number to pull data from"),
   "patchset": Property(kind=str, default=None,
                        help="The patchset number for the supplied issue"),
   "patch_project": Property(
       kind=str, default=None,
       help="The luci-config name of the project this patch belongs to"),
 
   # To generate an auth token for running locally, run
   #   infra/go/bin/authutil login
-  'auth_token': Property(default=None),
+  'auth_token': Property(
+      default=None, help="The auth_token to use to talk to luci-config. "
+      "Mutually exclusive with the service_account property"),
+  'service_account': Property(
+      default=None, kind=str,
+      help="The name of the service account to use when running on a bot. For "
+           "example, if you use \"recipe-roller\", this recipe will try to use "
+           "the /creds/service_accounts/service-account-recipe-roller.json "
+           "service account")
 }
 
 def RunSteps(api, patches_raw, rietveld, issue, patchset, patch_project,
-             auth_token):
+             auth_token, service_account):
   # TODO(martiniss): use real types
   issue = int(issue) if issue else None
   patchset = int(patchset) if patchset else None
 
   if not auth_token:
-    auth_token = get_auth_token(api)
+    auth_token = get_auth_token(api, service_account)
+  else: # pragma: no cover
+    assert not service_account, (
+        "Only one of \"service_account\" and \"auth_token\" may be set")
 
   headers = {'Authorization': 'Bearer %s' % auth_token}
 
   patches = parse_patches(
       api, patches_raw, rietveld, issue, patchset, patch_project)
 
   root_dir = api.path['slave_build']
 
   url_mapping = get_url_mapping(api, headers)
 
@@ skipping 80 matching lines @@
       api.properties(
         rietveld="https://fake.code.review",
         issue='12345678',
         patchset='1',
         patch_project="build",
       ) +
       api.step_data("Get build deps", project('build', ['recipe_engine'])) +
       api.step_data("Get recipe_engine deps", project('recipe_engine'))
   )