Add gergich error on absent patchsets deps

Fixes: CCI-354

Test plan
- builds pass

Test plan after merge:
- After merged, create two patchsets build on the prior
- the latter patchset should have a gergich -2 message on COMMIT_MSG

Change-Id: Iba6e9bb7a82d11841214f10842d50e129079fa5c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/235775
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Derek Bender <djbender@instructure.com>
Product-Review: Derek Bender <djbender@instructure.com>
Reviewed-by: Rex Fleischer <rfleischer@instructure.com>
Reviewed-by: Jacob Powell <spowell@instructure.com>

Jenkinsfile

@@ -299,9 +299,11 @@ pipeline {
             echo 'adding Linters'
             stages['Linters'] = {
               skipIfPreviouslySuccessful("linters") {
-                sh 'build/new-jenkins/linters/run-gergich.sh'
+                def credentials = load 'build/new-jenkins/groovy/credentials.groovy'
+                credentials.withGerritCredentials {
+                  sh 'build/new-jenkins/linters/run-gergich.sh'
+                }
                 if (env.MASTER_BOUNCER_RUN == '1' && env.GERRIT_EVENT_TYPE == 'patchset-created') {
-                  def credentials = load 'build/new-jenkins/groovy/credentials.groovy'
                   credentials.withMasterBouncerCredentials {
                     sh 'build/new-jenkins/linters/run-master-bouncer.sh'
                   }

build/new-jenkins/linters/run-gergich.sh

@@ -2,6 +2,9 @@
 
 set -x -o errexit -o errtrace -o nounset -o pipefail
 
+GIT_SSH_COMMAND='ssh -i "$SSH_KEY_PATH" -l "$SSH_USERNAME"' \
+    git fetch --no-tags origin "$GERRIT_BRANCH":"$GERRIT_BRANCH"
+
 inputs=()
 inputs+=("--volume $WORKSPACE/.git:/usr/src/app/.git")
 inputs+=("--env GERGICH_PUBLISH=$GERGICH_PUBLISH")
@@ -19,15 +22,21 @@ inputs+=("--env GERRIT_CHANGE_NUMBER=$GERRIT_CHANGE_NUMBER")
 # send things to gergich
 inputs+=("--env GERRIT_REFSPEC=$GERRIT_REFSPEC")
 
-cat <<EOF | docker run --interactive ${inputs[@]} $PATCHSET_TAG /bin/bash -
+cat <<EOF | docker run --interactive ${inputs[@]} "$PATCHSET_TAG" /bin/bash -
 set -ex
 
 # ensure we run the gergich comments with the Lint-Review label
 export GERGICH_REVIEW_LABEL="Lint-Review"
 
+# when parent is not in \$GERRIT_BRANCH (i.e. master)
+if ! git merge-base --is-ancestor HEAD~1 \$GERRIT_BRANCH; then
+  message="This commit is built upon commits not currently merged in \$GERRIT_BRANCH. Ensure that your dependent patchsets are merged first!\\n"
+  gergich comment "{\"path\":\"/COMMIT_MSG\",\"position\":1,\"severity\":\"error\",\"message\":\"\$message\"}"
+fi
+
 # we need to remove the hooks because compile_assets calls yarn install which will
 # try to create the .git commit hooks
-echo "" > ./script/install_hooks
+> ./script/install_hooks
 gergich capture custom:./build/gergich/compile_assets:Gergich::CompileAssets "rake canvas:compile_assets"
 
 gergich capture custom:./build/gergich/xsslint:Gergich::XSSLint "node script/xsslint.js"

build/new-jenkins/splunk_event.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
-set -o errexit -o nounset -o xtrace
+
+set -o errexit -o nounset -o xtrace -o errtrace -o pipefail
+
 SPLUNK_URL=${SPLUNK_URL:-"https://http-inputs-inst.splunkcloud.com/services/collector"}
-curl -v -k "$SPLUNK_URL" -H "Authorization: Splunk $SPLUNK_HEC_KEY" -d "$1"
+curl -k "$SPLUNK_URL" -H "Authorization: Splunk $SPLUNK_HEC_KEY" -d "$1"