Apply hotfix patches to pagure.io too (staging for now)

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

inventory/group_vars/pagure

@@ -72,6 +72,8 @@ vpn: true
 zabbix_host: zabbix01.vpn.fedoraproject.org
 zabbix_macros:
   'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight
+# Hotfixes
+pagure_patches: []
 
 notes: |
   Run the pagure instances for fedora

inventory/group_vars/pagure_stg

@@ -41,6 +41,13 @@ zabbix_host: zabbix01.vpn.fedoraproject.org
 zabbix_server: "{{ zabbix_hostname }}"
 zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo
 zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird...
+# Hotfixes
+pagure_patches:
+  - b50d32b7c92f131ebcc3b633de6c6e91e28297ec
+  - 5529
+  - readme-include
+  - 26bc9746
+  - 5553
 
 notes: |
   Run the pagure instances for fedora

roles/pagure/tasks/main.yml

@@ -429,6 +429,12 @@
   - fedora-messaging
 
 
+- name: Apply patches
+  ansible.builtin.import_tasks: patches.yml
+  tags:
+  - pagure
+  - patches
+
 # Set-up Pagure
 
 - name: Create the folders used for releases and archives

roles/pagure/tasks/patches.yml

@@ -0,0 +1,35 @@
+---
+- name: Install patch and filterdiff
+  ansible.builtin.dnf:
+    name:
+      - patch
+      - patchutils
+
+- name: Prepare the patches directory
+  ansible.builtin.file:
+    path: /opt/patches
+    state: directory
+    mode: "0755"
+
+- name: Download patches
+  ansible.builtin.copy:
+    src: /srv/web/infra/bigfiles/hotfixes/pagure/{{ item }}.patch
+    dest: /opt/patches/{{ item }}.patch
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ pagure_patches }}"
+
+- name: Apply patches
+  ansible.builtin.shell:
+    chdir: "{{ ansible_facts['python3']['sitelib'] }}"
+    cmd: filterdiff --include '?/pagure/*' /opt/patches/{{ item }}.patch | patch -p1 --forward --fuzz=0 --reject-file=- --batch
+  loop: "{{ pagure_patches }}"
+  register: result
+  ignore_errors: true
+  changed_when:
+    - "'Reversed (or previously applied) patch detected!' not in result.stdout"
+    - result.rc == 0
+  failed_when: "'FAILED' in result.stdout"
+  notify:
+  - Restart apache