Fix Homebrew PR creation

* switch to the macos executor, because the non-ES linuxbrew image is
  not a permitted to access expeditor secrets.
* Updates buildkite emoji alias to be :mac:
* mac-compatibility fixes for sed usage.
* Fix PR request to set maintainer_can_modify to false. This otherwise
  fails the PR with a message about the non-existent field
  `fork_collab`, possibly because the account creating the branch
  (chef-ci) doesn't have proper push access to the branch, triggering
  an odd validation failure from GH API.  Ref: octokit/rest.js#490
* fix indentation issue in third party package pipeline yml (tball,
squashed)

Signed-off-by: Marc A. Paradise <marc.paradise@gmail.com>

.expeditor/create_pr_for_homebrew.sh

@@ -1,31 +1,33 @@
 #!/bin/bash
 
-# This bumps the version in the ENV var 'EXPEDITOR_VERSION' on the project specified
-# It fetches the sha256 via omnitruck api
-
 set -ex
-echo "--- Getting chef/homebrew-cask repository and updating latest from upstream Homebrew/homebrew-casks"
-git clone git@github.com:/chef/homebrew-cask
-cd homebrew-cask
+FORK_OWNER="chef"
+UPSTREAM_OWNER="Homebrew"
+REPO_NAME="homebrew-cask"
+BRANCH="${EXPEDITOR_PRODUCT_KEY}-${EXPEDITOR_VERSION}"
+URL="https://omnitruck.chef.io/stable/$EXPEDITOR_PRODUCT_KEY/metadata?p=mac_os_x&pv=10.14&m=x86_64&v=$EXPEDITOR_VERSION"
+SHA=""
+
+echo "--- Getting $FORK_OWNER/$REPO_NAME repository and updating latest from upstream $UPSTREAM_OWNER/$REPO_NAME"
+git clone git@github.com:/$FORK_OWNER/$REPO_NAME
+cd $REPO_NAME
+
 git config user.email "expeditor@chef.io"
 git config user.name "Chef Expeditor"
 
-git remote add upstream git@github.com:/Homebrew/homebrew-cask
+git remote add upstream "git@github.com:/$UPSTREAM_OWNER/$REPO_NAME"
 git fetch --all
+
 # Reset the chef/homebrew-cask fork to the upstream so we are always
 # making a PR off their master
 git reset --hard upstream/master
 git push origin master
 
-branch="chef-software/${EXPEDITOR_PRODUCT_KEY}-${EXPEDITOR_VERSION}"
 git checkout master
-git checkout -b "$branch"
-
-URL="https://omnitruck.chef.io/stable/$EXPEDITOR_PRODUCT_KEY/metadata?p=mac_os_x&pv=10.14&m=x86_64&v=$EXPEDITOR_VERSION"
-SHA=""
+git checkout -b "$BRANCH"
 
 function get_sha() {
-  curl -Ssv "$URL" | sed -n 's/sha256\s*\(\S*\)/\1/p'
+  curl -Ss "$URL" | sed -n 's/sha256\s*\(\S*\)/\1/p' | awk '{$1=$1;print}'
 }
 
 delay=20 # seconds
@@ -48,39 +50,55 @@ for (( i=1; i<=tries; i+=1 )); do
   fi
 done
 
-echo "Updating Cask $EXPEDITOR_PRODUCT_KEY"
-echo "Updating version to $EXPEDITOR_VERSION"
-sed -i -r "s/(version\s*'.+')/version '$EXPEDITOR_VERSION'/g" Casks/chef-workstation.rb
-echo "Updating sha to $SHA"
+echo "Updating Casks/chef-workstation.rb version: $EXPEDITOR_VERSION sha: $SHA"
+
+sed -i '' "s/version '.*'/version '$EXPEDITOR_VERSION'/g" Casks/chef-workstation.rb
+sed -i '' "s/sha256 '.*'/sha256 '$SHA'/g" Casks/chef-workstation.rb
 
-sed -i -r "s/(sha256\s*'.+')/sha256 '$SHA'/g" Casks/chef-workstation.rb
+echo "--- Debug: git diff of patched files follows"
 
-echo "--- Debug: Delta follows"
 git diff
 
-echo "-- Verifying Cask"
-echo Running style fixes "brew cask style --fix"
+echo "--- Verifying Cask"
+
 brew cask style --fix ./Casks/chef-workstation.rb
-echo Verifying with "brew cask audit --download"
 brew cask audit --download ./Casks/chef-workstation.rb
 
+echo "-- Committing change"
+
 # This conforms with the PR template used by homebrew-cask
 # https://github.com/Homebrew/homebrew-cask/.github/PULL_REQUEST_TEMPLATE.md
+TITLE="Bump $EXPEDITOR_PRODUCT_KEY to $EXPEDITOR_VERSION"
 BODY=$(cat <<EOB
-Bump $EXPEDITOR_PRODUCT_KEY to $EXPEDITOR_VERSION
-
 After making all changes to the cask:
-
-- [x] \`brew cask audit --download {{cask_file}}\` is error-free.
-- [x] \`brew cask style --fix {{cask_file}}\` reports no offenses.
+- [x] \`brew cask audit --download Casks/chef-workstation.rb\` is error-free.
+- [x] \`brew cask style --fix Casks/chef-workstation.rb\` reports no offenses.
 - [x] The commit message includes the cask’s name and version.
 - [x] The submission is for stable version.
+EOB
+)
+# the json form of this needs to not have newlines.
+PR_BODY="After making all changes to the cask:\\n - [x] \`brew cask audit --download Casks/chef-workstation.rb\` is error-free.\\n - [x] \`brew cask style --fix Casks/chef-workstation.rb\` reports no offenses.\\n - [x] The commit message includes the cask’s name and version.\\n - [x] The submission is for stable version.\\n"
+
+COMMIT_BODY=$(cat <<EOB
+$TITLE
 
+$BODY
 EOB
 )
 
-echo "-- Committing change and opening PR"
 git add ./Casks/chef-workstation.rb
-git commit --message "$BODY"
+git status
+git commit --message "$COMMIT_BODY"
+
+echo "--- Opening PR"
+
+git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${FORK_OWNER}/${REPO_NAME}.git" "$BRANCH" --force;
+result=$(curl --silent --header "Authorization: token $CHEF_CI_GITHUB_AUTH_TOKEN" \
+  --data-binary "{\"title\":\"$TITLE\",\"head\":\"chef:$BRANCH\",\"base\":\"master\",\"maintainer_can_modify\":false,\"body\":\"$PR_BODY\"}" \
+  -XPOST "https://api.github.com/repos/${UPSTREAM_OWNER}/${REPO_NAME}/pulls" \
+  --write-out "Response:%{http_code}")
+
+# Fail the run if 201 (created) response not received.
+echo "$result" | grep "Response:201"
 
-open_pull_request

.expeditor/third-party-packages.pipeline.yml

@@ -12,16 +12,18 @@ steps:
           host_os: windows
           environment:
 
-  # - label: ":mac_os_x: :github: Create PR to update Homebrew/homebrew-cask"
-  #   command:
-  #     - bash .expeditor/create_pr_for_homebrew.sh
-  #   expeditor:
-  #     accounts:
-  #       - github/chef
-  #     secrets:
-  #       GITHUB_TOKEN:
-  #         account: github/chef
-  #         field: token
-  #   executor:
-  #     docker:
-  #        image: homebrew/brew
+  - label: ":mac: :github: Create PR to update Homebrew/homebrew-cask"
+    command:
+      - bash .expeditor/create_pr_for_homebrew.sh
+    expeditor:
+      accounts:
+        - github/chef
+      secrets:
+        CHEF_CI_GITHUB_AUTH_TOKEN:
+          path: account/static/github/chef-ci
+          field: token
+        GITHUB_TOKEN:
+          account: github/chef
+          field: token
+      executor:
+        macos: