auto-bump canton (#13596)

Or, maybe, break CI trying to.

CHANGELOG_BEGIN
CHANGELOG_END

canton_dep.bzl

@@ -0,0 +1,8 @@
+# Copyright (c) 2022 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+canton = {
+    "sha": "733e948bfa9641d66d1e635cd99ec185841933c15b963cc18109f4ebc4c642d6",
+    "prefix": "canton-open-source-2.2.0-SNAPSHOT",
+    "url": "https://www.canton.io/releases/canton-open-source-20220411.tar.gz",
+}

ci/cron/daily-compat.yml

@@ -512,10 +512,90 @@ jobs:
                                        --project daml
           fi
 
+  - job: bump_canton
+    timeoutInMinutes: 60
+    pool:
+      name: ubuntu_20_04
+      demands: assignment -equals default
+    steps:
+    - checkout: self
+      persistCredentials: true
+    - template: ../bash-lib.yml
+      parameters:
+        var_name: bash_lib
+    - bash: |
+        set -euo pipefail
+
+        eval "$(./dev-env/bin/dade-assist)"
+        source $(bash_lib)
+
+        canton_version=$(curl -u $AUTH \
+                              --fail \
+                              --location \
+                              --silent \
+                              https://digitalasset.jfrog.io/artifactory/api/storage/assembly/canton \
+                         | jq -r '.children[].uri' \
+                         | sed -e 's/^\///' \
+                         | grep '^[0-9]\{8\}$' \
+                         | sort \
+                         | tail -1)
+        dir=$(pwd)
+        cd $(mktemp -d)
+        curl -u $AUTH \
+             --fail \
+             --location \
+             --silent \
+             https://digitalasset.jfrog.io/artifactory/assembly/canton/$canton_version/canton-open-source-$canton_version.tar.gz \
+             > tarball.tar.gz
+        canton_sha=$(sha256sum tarball.tar.gz | awk '{print $1}')
+        tar xzf tarball.tar.gz
+        rm tarball.tar.gz
+        canton_prefix=$(ls)
+        mv $canton_prefix canton
+        canton_local_path=external/$(ls canton/lib/*.jar)
+        cd $dir
+
+        bad_file=daml-script/test/src/test-utils/com/daml/lf/engine/script/test/MultiParticipantFixture.scala
+
+        sed -i 's|"external/canton/lib/.*|"'$canton_local_path'"|' $bad_file
+        cat <<EOF > canton_dep.bzl
+        # Copyright (c) 2022 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+        # SPDX-License-Identifier: Apache-2.0
+
+        canton = {
+            "sha": "$canton_sha",
+            "prefix": "$canton_prefix",
+            "url": "https://www.canton.io/releases/canton-open-source-$canton_version.tar.gz",
+        }
+        EOF
+
+        branch="canton-update-$canton_version"
+
+        if git diff --exit-code -- canton_dep.bzl $bad_file; then
+            echo "Already up-to-date with latest Canton snapshot."
+            setvar need_to_build false
+        else
+            if [ "main" = "$(Build.SourceBranchName)" ]; then
+                git add canton_dep.bzl $bad_file
+                open_pr "$branch" "bump canton to $canton_version"
+                az extension add --name azure-devops
+                trap "az devops logout" EXIT
+                echo "$(System.AccessToken)" | az devops login --org "https://dev.azure.com/digitalasset"
+                az pipelines build queue --branch "$branch" \
+                                         --definition-name "PRs" \
+                                         --org "https://dev.azure.com/digitalasset" \
+                                         --project daml
+            else
+                echo "Would open PR if this were running on main."
+            fi
+        fi
+      env:
+        AUTH: $(ARTIFACTORY_USERNAME):$(ARTIFACTORY_PASSWORD)
+
   - job: report
     dependsOn: [compatibility_ts_libs, compatibility, compatibility_windows,
                 perf_speedy, perf_http_json, perf_http_json_querystore, check_releases,
-                blackduck_scan, run_notices_pr_build]
+                blackduck_scan, run_notices_pr_build, bump_canton]
     condition: and(succeededOrFailed(),
                    eq(variables['Build.SourceBranchName'], 'main'))
     pool:
@@ -534,6 +614,7 @@ jobs:
       check_releases: $[ dependencies.check_releases.result ]
       blackduck_scan: $[ dependencies.blackduck_scan.result ]
       run_notices_pr_build: $[ dependencies.run_notices_pr_build.result ]
+      bump_canton: $[ dependencies.bump_canton.result ]
     steps:
     - template: ../bash-lib.yml
       parameters:
@@ -554,6 +635,7 @@ jobs:
            && "$(perf_http_json)" == "Succeeded"
            && "$(perf_http_json_querystore)" == "Succeeded"
            && "$(check_releases)" == "Succeeded"
+           && "$(bump_canton)" == "Succeeded"
            && ("$(blackduck_scan)" == "Succeeded" || "$(blackduck_scan)" == "Skipped")
            && ("$(run_notices_pr_build)" == "Succeeded" || "$(run_notices_pr_build)" == "Skipped") ]]; then
             MSG="Daily tests passed: $COMMIT_LINK"

deps.bzl

@@ -29,6 +29,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+load("//:canton_dep.bzl", "canton")
 
 rules_scala_version = "17791a18aa966cdf2babb004822e6c70a7decc76"
 rules_scala_sha256 = "6899cddf7407d09266dddcf6faf9f2a8b414de5e2b35ef8b294418f559172f28"
@@ -370,9 +371,9 @@ java_import(
     jars = glob(["lib/**/*.jar"]),
 )
         """,
-            sha256 = "733e948bfa9641d66d1e635cd99ec185841933c15b963cc18109f4ebc4c642d6",
-            strip_prefix = "canton-open-source-2.2.0-SNAPSHOT",
-            urls = ["https://www.canton.io/releases/canton-open-source-20220411.tar.gz"],
+            sha256 = canton["sha"],
+            strip_prefix = canton["prefix"],
+            urls = [canton["url"]],
         )
 
     if "freefont" not in native.existing_rules():