Cron support about repo-automation-bots

[bcoe]

I believe this would unblock #25?

[JustinBeckwith]

Correct :)

[orthros]

I've done some thinking on this and here is a rough draft; any feedback is appreciated.

Security

As these bots are all Cloud Functions exposed to the internet, we need to be sure that the request invoking the function came from a trusted source. To secure this, each cron for a given function will use a KMS key to sign a blob of data. Then the cron makes an http POST request to the function's endpoint, with the blob of data as the body and the header X-RAB: <SIGNATURE>. The bootstrapper in gcf-utils will register an endpoints (/cron?) which verifies that the signature was signed by the "Cron" key in KMS before forwarding the request to the AppFn.

Limitations

The cron.yaml format does not (as far as I can tell) support custom headers or body payloads. This means each bot will need in it a file (.cron?) which contains the frequency in unix cron format. Then during the cloudbuild process, there is a step which, creates or updates the cron for each bot using gcloud.

[JustinBeckwith]

@orthros this is done, right?

[JustinBeckwith]

This is done!