Get Ready for the New RBCommons

February 11, 2025February 19, 2025 Christian Hammond

Update: We’re postponing just a bit longer while we work through a last-minute bug. We’ll announce the new date soon!

We’re excited to announce that RBCommons will be getting a major update with tons of new features and more flexible pricing for teams of all sizes.

We want to show off what’s coming soon. There’s a lot!

Commit Histories

Previously, any code changes posted to RBCommons would show up as a squashed diff, merely showing the difference between the upstream code and the tip of your local branch. If your change was built with multiple commits, there was really no way to really dive into them individually. Until now.

When using Git, or Mercurial, or other DVCS solutions, RBTools will upload the complete commit history of your branch. You can look at the diff of the entire branch as a whole just as before, but also dig down into each individual commit, or even ranges of commits.

The New Unified Draft Banner

Until now, your draft review requests, reviews, and replies were all managed separately, each with their own green draft banner. While it was obvious when there was a draft review request update or a draft review, sometimes draft replies could get lost in long threads.

We’ve rebuilt this with a new unified banner that always sits at the top of the page, collecting all your work together in one place. You’ll never lose a draft again.

The new Unified Review Banner, showing that there are changes, a review, and a reply ready to publish. Alongside that is a Publish button and a Review menu. Under that is a textbox saying "Describe your changes."

With the new banner, you can now publish all your drafts at once, generating a single e-mail. This means you can publish all of your replies to people’s reviews along with the updated version of your change with a single click. Fun fact, this was one of our most-requested features ever.

You can also add comments to your own diff before you publish it, which is handy for calling out parts of the diff to jump-start the conversation.

Dark Mode

There’s nothing worse than staying up late to review code and feeling blinded by your screen. With dark mode, you can reduce eye strain and work comfortably no matter the time of day.

Markdown Formatting Toolbar

Rich text editors throughout the product now include a new toolbar for common Markdown formatting options. Don’t remember how to make something italic or include a link? Just click a button!

An Improved Dashboard

The “Overview” section

The new Overview section of the Dashboard is a combined view that shows both your incoming and outgoing review requests. This is your new default view whenever you open the Dashboard.

Stale Ship Its!

The Ship It! indicator in the dashboard will now show as greyed out if there has been an update to the review request since the Ship It! was given.

If you don’t have this column added, click the pencil to the right of the columns and add it (or any other column you like!). Click and drag columns to place them in any order you prefer.

The Dashboard, with stale Ship It indicators shown in grey instead of green.

All Sorts of Diff Viewer Features

Trojan Character Detection

Trojan Source attacks employ special Unicode characters, such as bi-directional control characters, zero-width spaces, or confusable/homoglyph characters (which have the appearance of other common characters) to trick reviewers into approving possibly malicious code.

These are CVE-2021-42574 and CVE-2021-42694, and affect many tools on the market (code review tools, IDEs, repository browsers, and more).

Review Board now detects characters that can be used in these attacks, and flags them in the diff viewer. When found, a helpful notice with examples and informative links will be shown at the top of the file, and the lines themselves will be flagged.

The Unicode characters will be highlighted and replaced with the Unicode codepoint, rendering the attack harmless. Reviewers can click a button to see how the code would have looked.

A warning block shown on a diff containing malicious trojan code. The warning explains the kind of attack, warns the user to review carefully, and provides a button for toggling the hidden malicious characters.

Current File Display and Quick Switch

When browsing through the diff, the list of files will now dock into the banner at the top of the screen. This will always show you the names of the files that are visible on the screen, so you always know what you’re looking at.

Clicking the menu at the side of this file list will pop open the full list, so you can quickly navigate to other files without having to scroll all the way back up to the top of the page.

The diff viewer showing the current file docked to the top of the page, with a menu for navigating to other files.

Binary Files in Diffs

Review Board now supports displaying, reviewing, and diffing certain types of binary files included as part of your code diffs.

At the moment this is limited to image files, but support for additional file types (including PDFs) are in the works.

This requires posting your changes with RBTools 5.0+, and is supported for a limited set of version control systems:

Git
Mercurial
Perforce
Subversion

An image diff in the diff viewer, showing a split view between two versions of a game character.##

Mobile Diff Viewer

The diff viewer has been updated with a new responsive mode when viewing on mobile devices. This will change the display from the two-column view into a single column for content. This makes it much easier to read and interact with diffs on phones and other mobile devices.

The diff viewer in mobile mode, showing inserted code, deleted code, and moved code, with comments filed.

New Integrations

RBCommons is adding new chat integrations with Discord, Matrix, and Microsoft Teams, as well as a new CI integration with Jenkins.

New Flexible Pricing

Finally, we’d like to announce that we’re going to be changing the pricing for RBCommons.

Our new pricing model has two tiers, Basic and Business. Both of these are priced per-user, so you don’t have to worry about a big price jump just because you need to add a 26th user.

All existing team accounts will continue to be grandfathered in on their current plan, so you don’t have to switch to the new plans unless you want to. If and when you’re ready, simply change your plan to take advantage of the new flexible pricing.

Plus…

There are many additional tweaks and polish that you’ll see, including:

Draft indicators for file attachments that tell you whether an attachment is new, pending deletion, or has a new update within your current draft.
Quick options to archive after publishing, and click the archive icon itself to toggle the archive state instead of having to wait for a drop-down menu to appear.
We’ve been tweaking colors and spacing, and polishing down some rough edges to improve the look and feel, especially for reading diffs.
Better support for mobile devices.
Better accessibility support for screen readers, keyboard navigation, low contrast, and other accessibility tools.
Renamed “submitted” to “completed” for review request states. The word “submitted” throughout the Review Board UI was a holdover from the very earliest days of the tool, when we adopted the Perforce naming convention for when changes were pushed to a central repository. This has long been a source of confusion, so we’ve renamed this state to “completed”.
Clicking a text field on a review request now positions the cursor where you click.
Too many bug fixes to count.

Coming Soon

We’re in the final stages of testing and building out new servers. We expect to announce a release date soon, and will include it in the announcement banner at the top of RBCommons.

For further updates on RBCommons and all things Review Board, you can follow us on:

Or join us on the new Review Board Discord.

A Sneak Peak Into the New RBCommons

December 9, 2024 Christian Hammond

Our team’s been hard at work bringing RBCommons to the cutting-edge Review Board 7 platform. This is a massive update with tons of new features, and we think it’s time to give you a glimpse of what’s coming:

Multi-commit review requests for Git and Mercurial

In the past decade, DVCS has become the norm, and many people work in local branches with lots of individual commits. Previously, any code changes posted to RBCommons would show up as a squashed diff, merely showing the difference between the upstream code and the tip of the local branch.

When using DVCS systems like Git or Mercurial, RBTools will now upload the commit history of your branch. You can look at the diff of the branch as a whole, but also dig down into each individual commit.

A list of commits for a review request, with summaries for each and selectors for choosing a range to view.

An improved review experience

The new unified banner always sits at the top of the page, and collects all your work together in one place. You can also use this to publish all your drafts at once with a single click and a single-email notification.

The new review banner, showing pending changes, one review, and one reply. A button saying "Publish All" to the right of that summary publishes all pending drafts. A "Review" drop-down to the right of the button controls the review. A "Describe your changes" field sits below it.

Dark mode

There’s nothing worse than staying up late to review code and feeling blinded by your screen. With dark mode, you can reduce eye strain and work comfortably no matter the time of day.

And just so much more

There’s a lot more coming, but we wanted to keep this first message short. We’re working hard to make this transition as seamless as possible for you. Keep an eye out for more details about all the new features and a timeline for the rollout.

If you have any questions, please feel free to reply to this e-mail.

Thanks for using RBCommons! We’re excited to bring Review Board 7 to you.

ChangeLog: Office Document Review, New Draft Banner, Actions Rewrite

December 6, 2022December 6, 2022 Christian Hammond

Welcome back to ChangeLog, where we dive into the latest developments around Review Board, Power Pack, and other Beanbag products.

Today we’re going to cover a major feature coming to Power Pack, plus some work that’s in progress for Review Board 6.

Office Document Review in Power Pack

Power Pack has long offered support for reviewing and diffing PDF documents. This has been used by companies to review documentation, contracts, schematics, industrial designs, and more.

Soon, you’ll be able to review a few more file types:

Microsoft Office documents (Word, Excel, PowerPoint)
OpenOffice/LibreOffice documents (Writer, Calc, Impress)

A sample review session for a LibreOffice Impress document, covering a presentation titled "Writing Enterprise WebApps in Bourne Shell." There's a comment saying "This seems like a really bad idea." The second page says "Bourne Shell: Why Not?" and states "It's on every system; It's memory-safe; You might not completely nuke your system unexpectedly, maybe."

It also supports diffing! You’ll be able to view the differences in new revisions of Word documents, spreadsheets, and presentations.

A screenshot showing a side-by-side diff of two PowerPoint presentations. The old text, "You definitely won't completely nuke your system unexpectedly" is shown on the left in red. On the right, the replacement text is shown in green: "You might not completely nuke your system unexpectedly." The red and green show only the changed words.

This will require setting up a small microservice, which we’ll provide via Docker.

When uploading a supported document to Review Board, Power Pack will send it along to the microservice to convert to PDF for render. This supports not just showing the document, but diffing multiple revisions of the document as well.

Both the original document and the PDF can also be downloaded to the local machine.

We’re expecting this will be released in Power Pack 6 by early/mid-2023.

The Unified Draft Banner

Over the years, we’ve come up with all sorts of ideas for improving the review experience in Review Board, and in Review Board 6, we’re kicking some of our plans into action, starting with the Unified Draft Banner.

This replaces the current, basic draft banners shown on review requests and reviews with a new one that:

Helps you see what all you have pending to publish (review requests, reviews, replies).
Let’s you publish them either all at once (with one combined e-mail) or individually, as before.
Shows additional information on what you’re reviewing, like the list of files in the diff viewer.
Can be further augmented by extensions.

When creating a new review request, the banner will look pretty similar to today:

When you have multiple things in flight (such as review request updates and replies to reviews), you can publish them in one go:

A draft banner showing that there are both changes to the review request pending, and one reply to a review. This lists "Changes an 1 reply" as a drop-down menu for selecting just a subset; a "Publish All"/Options combo button, and a "Review" drop-down menu. On the next line is a "Describe your changes" field for describing the new review request draft.

Or you can switch to a specific draft to publish:

The drop-down for the "Changes and 1 reply" menu, showing each draft. These can be clicked. The items are: 1) "Review request changes", and 2) "Replying to David Trowbridge's review"

The gear menu controls options for your publishes (depending on what’s being published):

The drop-down options on the "Publish All" combo button. This shows a single "Archive after publishing" checkbox.

The “Review” menu will always be present, and can be used to guide users to creating a new review, adding general comments, and quickly posting a Ship It! review.

This is still in the early stages. We’ll provide some more screenshots as development progresses.

Actions Rewrite

Behind-the-scenes, we have the “actions” system, which lets Review Board and extensions register buttons in some parts of the review request UI. It’s where the “Ship It!”, “Close”, “Upload Diff”, etc. buttons all come from.

The existing system is, let’s be honest, a bit of a mess. It grew organically, and we kept bolting things onto the design. There are class-based review request actions, dictionary-based review request actions, two forms of header actions, and several other purpose-built types. Keeping this maintainable has been a problem.

So this is finally getting a major overhaul. The new design is a lot more reasonable for both us and extension authors to work with. With this, we’re aiming for:

Better keyboard shortcuts throughout the product.
Improved accessibility.
Newer UI features like a possible Command-K bar (a sort of command-line-in-browser interface, similar to macOS Spotlight, Alfred, and other tools).

Once this is further along, we’ll have more to show off.

Looking Toward Review Board 6

With Review Board 6, we’re heavily focusing on improvements to the review process. There’s more to talk about, but we’ll save those for a future ChangeLog (available on this blog, Reddit, Mastodon, Twitter, or Facebook).

We’re aiming to for a mid-2023 release date for Review Board 6. This is a shorter release cycle than most of our large releases, and that’s the plan going forward. We want to get new features our faster, with smaller, focused releases.

RBTools 3.1.2, Power Pack 5.1.1

October 3, 2022October 3, 2022 Christian Hammond

Today, we’re bringing two new releases of RBTools and Power Pack, focusing on stability and feature improvements.

RBTools 3.1.2 Highlights

Now supports the upcoming Python 3.11.
Added back directory change information to diffs for ClearCase and VersionVault, and fixed problems posting symlinks.
Fixed several issues generating Perforce diffs, especially on Python 3.
Fixed applied patches on Subversion.

To learn more about this release, see the RBTools 3.1.2 release notes.

Power Pack 5.1.1 Highlights

Added support for showing changes to directories when using ClearCase or VersionVault
Fixed broken repository configuration forms when selecting Cliosoft SOS on Review Board 4.0.3 or older.

This upgrade is available for all existing Power Pack users.

To learn more about this release, see the Power Pack 5.1.1 release notes.

RBTools 2.0: Ready for Review Board 4.0

November 30, 2020November 30, 2020 Christian Hammond

RBTools 2.0 is out, bringing compatibility improvements and new features for all users. The biggest improvement is the support for Review Board 4.0’s upcoming multi-commit review requests.

Multi-Commit Review Requests

Review Board 4.0 beta 1 is coming in the next few weeks, and with RBTools 2.0, developers will be able to post a series of commits to a review request so that they can be reviewed individually or as one squashed change, depending on what the reviewer chooses to do.

Those changes can also be landed, preserving their history or squashing them back into a single commit.

To stay with the old behavior and squash the commits before posting to a review request, you can pass –squash to rbt post or rbt land (or set SQUASH_HISTORY = True or LAND_SQUASH = True, respectively, in .reviewboardrc).

This is available for both Git and Mercurial, and will require Review Board 4.0.

RBCommons users will receive multi-commit review request support in 2021.

Custom Certificate Authorities

If your Review Board server uses a self-signed certificate backed by an in-house Certificate Authority, you can now configure RBTools to recognize it through the --ca-certs, --client-key, and --client-cert options (or CA_CERTS, CLIENT_KEY, and CLIENT_CERT in .reviewboardrc).

Easier Repository Setup

rbt setup-repo has been redesigned to better help people configure their local repositories to connect to Review Board. It offers a more helpful guided setup, making it easier to find the right repository and generate your .reviewboardrc file.

Default Branches in Git

RBTools now understands the init.defaultBranch configuration for Git, helping you transition your primary branch from master to something like main.

Better Mercurial Integration

Compatibility issues are fixed, repository detection is faster, and custom scripts can benefit from performance improvements by connecting RBTools to the Mercurial command server.

And Better Perforce Integration

RBTools can work with a wider mix of configurations utilizing SSL and brokers.

There’s also a new reviewboard.repository_name Perforce counter that can tie a depot to a Review Board repository, which can be used if .reviewboardrc isn’t an option.

Plus…

Variety of improvements for Python 3 compatibility (including support for Python 3.9).
Additional Git arguments for fine-tuning rename detection.
Custom formatting for rbt status, which is useful for scripting.
rbt land and rbt patch now accept a review request URL, instead of just an ID.
rbt patch can print a patch from a review request without needing a local copy of the repository.

See the release notes for more information, or download RBTools 2.0 today.

ChangeLog: May 21, 2020 — Trial Limit Increases, New Releases, Student Wrap-Up

May 21, 2020May 21, 2020 Christian Hammond

If you’re a regular follower of ChangeLog, you’ll notice we’ve gone from weekly to semi-monthly, and may be wondering what’s going on. Don’t worry, we’ll return to our regularly-scheduled ChangeLog in time.

We’ve been focusing heavily on wrapping up Review Board 4.0 development, testing things internally, and helping many of our support customers get out from under a backlog of internal support requests within their companies.

And just taking care of ourselves during a global pandemic.

So here’s some of what we’ve been busy with lately:

Increasing Power Pack and RBCommons trials
Several new releases (RBTools, kgb, and introducing babel-plugin-django-gettext)
Review Board 3.0.18 release preparation
Review Board 4.0 beta and RBTools 2.0 beta preparation
Wrapping up our semester with CANOSP students

Higher Power Pack/RBCommons Trial Lengths

We’ve increased the amount of time you have to give Power Pack or RBCommons a try. Now, when you download a Power Pack license, or sign up for a team on RBCommons, you have two full months to fully explore and use the products.

We’ve applied the new trial period to all existing RBCommons customers who are still in their trial.

If you’re a Power Pack user, and have a trial license, come talk to us for an extension.

New Releases

RBTools 1.0.3

Last month, we released RBTools 1.0.3, which was long overdue. We’re going to try to release RBTools releases more frequently going forward, and we have some good stuff prepared for 1.0.4 for Perforce users coming up soon.

We also have two new releases for some tools we use to help build Review Board: kgb, and introducing babel-plugin-django-gettext.

kgb 5.0

kgb is a Python module that helps with writing unit tests, adding support for function spies. This lets you spy on any function or method, whether in your own code or elsewhere, and track all calls made to the function and inspect the results of those calls.

It’s also used to override what happens when a function is called, mocking results or behavior. This goes far beyond the capabilities of Python’s own mock patching, and instead alters things at a bytecode level. Super useful when you want to fake results from urlopen, for example.

kgb 5.0 introduces support for:

Python 3.8
New spy assertion methods, providing detailed output when they fail
Support for spying on “slippery” functions (functions generated dynamically when referencing the function itself — common in some API-wrapping Python libraries, like Stripe)

babel-plugin-django-gettext 1.0

We use Babel to let us build modern JavaScript and export it to older browsers. Something Babel allows for is custom plugins to transform JavaScript, and we’ve introduced a new plugin to help us write better localized text.

babel-plugin-django-gettext lets us mark up strings using modern JavaScript tagged template literals (backtick strings) and convert them to use Django’s gettext localization methods.

When using the standard gettext support, lines are not allowed to wrap, meaning you end up with some very long lines of text to maintain, and if you want to include the contents of variables in the text, you have to wrap in this interpolate() call, which is a pain.

This plugin takes all the annoyance out of this. Instead of writing:

var s = interpolate(
    gettext('This is localizated text, and we can freely wrap lines how we want, or include variables like %(foo)s.'),
    {'foo': foo},
    true);

We get to write:

const s = _`
    This is localizated text, and we can freely wrap
    lines how we want, or include variables like ${foo}.
`;

Better, right?

If you use Babel and Django, give this plugin a try.

We’ll be releasing a new version soon with even better support for ngettext (used for strings that are based on singular/plural values) and combining with other tagged templates (like dedent).

Review Board 3.0.18 Release Prep

We’re getting close to a new Review Board 3.0.18 release. There’s a lot going into this one, but some highlights will include:

Preparation for GitHub and Bitbucket API/feature deprecations
Compatibility fixes for GitLab, Subversion, and Perforce
Improved API support for working with repositories
Faster SSH communication
Faster condensediffs for large MySQL databases
Lots of bug fixes

Expect 3.0.18 within the next two weeks.

Review Board 4.0 Release Prep

Work continues. We’ve had some people test 4.0 early, and found some regressions that pertain to extensions. We don’t want to release with those regressions in place, so we’re still iterating, but the good news is that the core product is looking pretty good now.

Remember, this release is a major architectural rewrite of the product, with equally major dependency updates, so there’s a lot to get right.

Meanwhile, we’re getting RBTools 2.0 ready for beta. This is meant to be used with Review Board 4.0, and features all the multi-commit review support, from posting changes to landing them. We’ll be shipping both at the same time.

CANOSP Student Wrap-Ups

We’ve talked before about the CANOSP student program we work with in Canada. Well, we’ve wrapped up our semester, and I can speak for the team when I say we’re going to miss working with this group.

By the way, if you’re looking to hire some strong developers coming out of college, we have plenty we can refer.

To wrap up their semester, they’ve put together some final demos of the work they’ve done, and we’d like to show them off.

Hannah Lin

Hannah worked this semester on a prototype for a new first-time setup guide for administrators, and some keyboard accessibility improvements in the diff viewer and modal dialogs, amongst other improvements. She’s also continuing on after the semester, working on a formatting toolbar for input fields.

Katherine Patenio

Katherine worked away on RBTools for most of the semester, fixing some bugs that shipped in RBTools 1.0.3, and completely reworking the rbt setup-repo experience (which we hope to ship in RBTools 2.0).

She also did a lot of work on investigating improvements to supporting users with different kinds of color-blindness, which she covers in this demo.

Monica Bui

Monica focused primarily this semester on keyboard navigation improvements in the New Review Request page (part of a big effort toward improved accessibility), and prototyping new guidance for filling in fields on a blank review request. We think that will pair nicely with work planned for Review Board 5.0.

Xiaohui Liu

Xiaohui worked on standardizing how we handle keyboard shortcuts, introducing a new registry on the page that anything can plug into to register shortcuts. This even offers a handy help screen, giving users an overview of all the keys can happily press to get their work done faster.

Xiaole Zeng

Xiaole’s projects covered help and accessibility improvements, such as adding a new Help menu to the top-right of every page (which could provide access to useful, relevant documentation), and making the review request infoboxes on the Dashboard less annoying and more keyboard-friendly. We’re looking to ship some of this in 4.0.

And that’s it for the moment

We’ll be back to a weekly format once we’ve gotten some of these releases wrapped up, and of course any time we have something pretty exciting to talk about.

In the meantime, if we can help with anything, reach out. You can also follow us on the community forum, Reddit, Twitter, Facebook, and YouTube if you want other ways to keep up with Review Board and Beanbag.

ChangeLog: April 2, 2020 — Catching Up

April 2, 2020 Christian Hammond 1 Comment

This is our first ChangeLog in several weeks. As you all know, the current pandemic has resulted in a lot of changes and hardships in the world. We’re doing fine here, and our team has stayed healthy and safe, if a little less productive than we’d like as we adjust and take care of our families.

David building a playground for the kids

Still, work never ceases, and it’s time to start keeping you all up-to-date again. Here’s a breakdown of what we’ll be covering today.

Support options for Review Board
Upcoming increases to RBCommons and Power Pack trial lengths
Upcoming releases of RBTools 1.0.3 and KGB 5.0.
Review Board 4.0 progress
New student demo videos

Getting Support for Review Board

More companies than ever are in full-on work-from-home mode, and this brings with it a lot of new work challenges that are, right now, often mixed with personal-life stresses.

We can help with at least some of that.

Our company offers support contracts for Review Board, which can be tailored to meet your company’s needs. We help with anything from basic Q&A and troubleshooting to custom builds and assistance with developing in-house integrations.

If you’re managing Review Board at your company, and are feeling a bit overwhelmed right now, please reach out. We can help. And we take support seriously.

Basic Support

Basic Support is pretty well-suited for smaller companies that need general troubleshooting, installation/upgrade assistance, or may have other questions.

We guarantee a response by the following day, but always aim for same-day (just depends on the support load).

Unlike our community support forum, all your support requests are handled privately on a dedicated support tracker, where you can manage tickets, provide confidential attachments, and more.

We don’t farm out our support to some outside party. We, the developers of Review Board, will handle your support. You’ll probably hear from me personally quite a bit.

Premium Support

This is a better option for the larger companies.

Or if you’re working on any in-house integrations or need priority bug fixes or need to use an older version of Review Board but may need some custom builds with fixes on occasion.

Or have some terrible emergency that needs to be resolved quick.

With Premium, there’s a same-day guarantee, 24/7/365. We’ll usually respond within an hour, especially if it’s an emergency. I will personally wake up and take care of your issue at 4AM if you need something.

So again, if things are crazy right now and you need a hand, contact us and we’ll talk options with you.

Increases to Trial Lengths

Since things are slower-moving right now (again, with the work-from-home status of so many companies), we want to make sure that you’re not in as much of a rush to evaluate either RBCommons and Power Pack.

So we’re going to be increasing the trial lengths of both from 30 days to 60.

This isn’t done yet, as we’re still preparing the codebases to change this over. In the meantime, if you’re a trial user of either, we’ll try to make sure to be proactive and increase your trial period manually.

If you’re already trialing either of this, contact us for a trial extension.

Upcoming Releases

RBTools 1.0.3

We’re finishing up this release now. It’s a big feature and bug fix release that we’ve been ironing out for a while.

The highlights are:

rbt land support for Mercurial
A much better commit editing experience (for rbt land and rbt patch)
Several bug fixes for various source code management systems and for Python 3 environments

We should have this release out next week.

KGB 5.0

KGB is our Python module for using function spies in unit tests. This lets you track when a function is called, with what arguments and results, and to even override what happens when that function is called.

It’s extremely powerful, and is a big part of how we maintain our large test suites.

We’re preparing a 5.0 release, which adds:

Python 3.8 support, with positional-only arguments
Workarounds for very corner-casey situations with method decorator that generate a new function every time it’s accessed (what we’re calling “slippery functions,” because they’re hard to hold on to)
Probably some new helpers for asserting the results of calls (TBD)

This should be released in the coming weeks. If you’re a Python user, I highly suggest giving KGB a try.

Review Board 4.0 Progress

Almost there.

We were going to get 4.0 in beta form by end of March. That was the goal. We hinted at this last time, and we were feeling good about it, but the impact from the pandemic changed some priorities.

So it’s delayed… I’m not going to give a new date at this point, but nearly everything is ready for beta. We just want to hammer on it some more first, make sure we’re pushing out a solid beta. Pretty much everything, including our extension ecosystem, is ready to go.

Student Demos

As you may know by now, we work with CS students every semester, mentoring them and helping them learn to contribute to real-world code bases through Review Board development.

They recently completed their second demo videos for the semester, showing off what they’ve built. Please take a look. I’m sure they’d love to hear some positive feedback on their videos:

Stay Safe, and Wash Your Hands

(Definitely the catch phrase of 2020, but it’s important!)

Again, if we can help with anything, reach out, or follow us on the community forum, Reddit, Twitter, Facebook, and YouTube if you want other ways to keep up with Review Board and Beanbag.

ChangeLog: March 6, 2020 — Nearing Beta

March 6, 2020March 6, 2020 Christian Hammond

These are exciting times, right? While everyone is preparing for the coronavirus, we’ve been preparing for Review Board 4.0 beta 1.

Review Board 4.0 Beta 1

And the coronavirus.

The shelves are getting pretty empty in my local grocery store, but I’ve kept my sanity.

Preparing for Review Board 4.0 Beta 1

We have an internal target date for 4.0 beta 1, which is coming up very soon, but we’re not prepared to release that just yet. Still a couple factors that might need to delay a week.

This beta will feature:

Posting and reviewing multi-commit review requests
A brand new, streamlined, mobile-friendly administration UI
A full move to Django 1.11, with preliminary Python 3 support (which will affect extensions, so get ready)
Read-only mode, letting you prepare for an upgrade without shutting the whole server down
A new “Overview” mode in the Dashboard showing all incoming and outgoing review requests
A new integration for Jenkins CI
Live thumbnails for video file attachments
Beginnings of accessibility improvements, improving keyboard input, color contrast, and screen reader integration
New JavaScript and CSS components usable by third-party extensions
An overhaul of the diff parsers, setting things up for some major future improvements to diffing capabilities (including our in-development new DiffX proposal)
Removal of a lot of deprecated internal APIs (again, this may affect extensions)

We’re working on the final bits of the administration UI, and expect to be done by end of next week. Everything is in place, with the exception of the Integrations, Extensions, and Security Center pages. But that’s it!

We’ve also been finishing up the work to make our third-party integrations (Travis-CI, Asana, Jenkins, etc.), Review Bot, and Power Pack all compatible with Review Board 4.0, Django 1.11, and Python 3. These are the last big blockers before release.

After all that is done, beta 1 will be a go!

(Assuming none of us get the coronavirus.)

If you are building custom extensions, please get ready to test this beta. Let us know if you plan to test so we can coordinate with you and give you a heads up on what may change.

RBTools 2.0 Beta

RBTools 2.0 features full support for multi-commit review requests. We’ve had the bulk of this work done for a while, but have been really thoroughly testing it in preparation for a beta, which will go out alongside Review Board 4.0 beta 1.

This week, we’ve finished up the work to apply patches from a multi-commit review request (giving the ability to apply all commits sequentially or squash into a single commit), and to fully land changes.

We’re wrapping this up soon. If you test Review Board 4.0 beta 1, you’ll need RBTools 2.0 beta 1.

What else, what else..

Accessibility Improvements

We’re continuing to work toward improving our accessibility story in Review Board. While we’re nowhere close to where we want to be yet, we’ve amended our policies around new UI components to ensure that keyboard usage and ARIA roles are a first-class citizen in any designs.

If you make use of any assistive technologies, such as screen readers, we’d love to talk to you and get your feedback on a few things!

Video Thumbnails

Review Board 4.0 will be making it easier to glance over file attachments for video files. Just like file attachment thumbnails for images and text files give you a preview of the contents, they’ll soon give you a preview of the video as well.

Hovering the mouse over these thumbnails will cause the video to play (muted) until you move the mouse away. Hovering over them again causes the video to resume from where it left off.

This is great if someone’s using video files to demonstrate their feature. We’re hoping to make this the start of some useful UI around videos.

New UI Components

This past week saw the development of several new accessible CSS/JavaScript components, which can be used by extensions:

New Button Classes

We’ve historically had a few different ways to show buttons. Any <input type="button" />, <input type="submit" />, or anything with the .btn CSS class would have a consistent appearance, and could be modified by a set of additional CSS classes.

This has been revised to include <button> (which we oddly did not have before) and anything using the .rb-c-button CSS class (the successor to .btn, which is now deprecated).

Button Groups

A button group (.rb-c-button-group in LessCSS) is a collection of buttons, packed together either horizontally or vertically, providing an almost toolbar appearance.

Pop-up Menus

Pop-up menus

The new RB.MenuView (JavaScript) and .rb-c-menu (LessCSS) component manages a pop-up menu that can be shown or hidden as needed. It supports full keyboard navigation and ARIA attributes for accessibility.

We’re working on moving to this in every place that involves a pop-up menu, including review request actions (like “Update” and “Close”) and the Account, Support, and Follow menus in the upper-right of pages.

Menu Buttons

Menu buttons

RB.MenuButtonView (JavaScript) and .rb-c-menu-button (LessCSS) implements a type of button that displays a pop-up menu when clicked.

There are two main ways this can be used:

As a single button that will show some text and a drop-down indicator, used just to display the menu.
As a group of action buttons, all packed together (but visually separated), containing a final button that displays the drop-down menu.

The later is great when you want to offer a common action, but make alternative actions easily available.

Like the new pop-up menus, these provide full keyboard navigation and ARIA attributes for accessibility, and are a great building block for extensions to use.

We hope to provide full documentation at a later time on the standard library of UI components we’re building.

New KGB Release Coming

KGB is our Python module for unit tests, which provides the ability to spy on any function and track the calls and results, or override the behavior. It’s incredibly powerful, and we make heavy of use of it in Review Board and all our other projects.

We’ve just fixed up KGB to work with Python 3.8, so we’re preparing for a release pretty soon.

If you’re a Python developer, check out KGB. Tell your friends. Give us some feature requests. Honestly, it’s pretty complete these days, but we need more reasons to bump the version number.

Alright, that’s enough for this ChangeLog.

Coming Up

We may skip next week’s ChangeLog to focus on finishing beta 1, unless we have anything really interesting to report.

If you want to know more, have any questions, or are curious about anything else, please reach out on our community forum.

We’re also on Reddit (/r/reviewboard), Twitter, Facebook, and YouTube if you want other ways to keep up with Review Board and Beanbag.

ChangeLog: February 20, 2020 — Accessibility, Student Demos

February 20, 2020 Christian Hammond

Hi everyone, and welcome to this week’s ChangeLog. This week, we want to talk about accessibility improvements for Review Board 4.0, and show you what this semester’s students are working on.

If you want to watch some videos instead of reading a bunch of stuff, jump down to Student Demo Videos!

Accessibility in Review Board

As we revise parts of our UI, introducing new features and designing new CSS Components, we have a goal of improving accessibility. We’re aiming to better support screen readers, improve keyboard navigation, and help people with visual impairments.

This will not be 100% implemented by 4.0, since we do plan to release sometime soon, but we will have laid the groundwork, working toward eventually being fully compliant with the Web Content Accessibility Guidelines (WCAG) 2.1.

There’s a lot that goes into accessibility on the web, but there’s two key areas that are important to get right, and are becoming a core part of our design and CSS component specifications: ARIA attributes and keyboard navigation.

ARIA attributes help screen readers and other assistive technologies understand, navigate, and communicate parts of the UI. They can communicate the intent of a UI component, provide more suitable labels or hints to screen readers, notify as important content updates, and more. They’re important, and we haven’t been good at using them, but they’re now being baked in to the design of any new UI we write.

Keyboard navigation is also very important. Not everyone can or wants to use a pointing device to navigate the UI, and we’ve identified several places where keyboard navigation (and focus presentation) is subpar or flat-out broken. So we’re making this a first-class citizen in new UIs, adding new keyboard shortcuts for important content areas or operations, and fixing cases where navigation is just busted.

To be clear, these aren’t the only focuses — there’s a lot more to the accessibility work than this. Improving accessibility is a long-term goal, and Review Board is a big product. We aren’t holding up 4.0 for this, but rather expect to spend time throughout the 4.0.x release cycle to gradually work on this.

And it’s a current focus of some of our student projects.

Student Demo Videos

In an earlier ChangeLog, we announced our new team of students working on Review Board. The big focuses this semester are on keyboard accessibility and first-time setup improvements.

They’ve been working hard for a month now, and have just completed their first (of three) demo videos. We’d like to show them off.

All videos are uploaded to our YouTube channel. Subscribe to keep up with content as we upload it.

Hannah Lin

Hannah’s been working on implementing keyboard navigation for file attachments, letting users focus on the attachments and control the pop-up menu (for reviewing, updating attachments, deleting, and downloading). That was her first warm-up project.

Her main project for the semester is working on a first-time setup guide, for new Review Board administrators. The goal is to help them get a new server up-and-running fast by walking them through the main setup steps as they progress through the administration UI.

Katherine Patenio

Katherine’s first demo covers some initial bug fixing work for RBTools on Python 3, addressing a problem where --help didn’t always work. She’s fixed this up and added a new layer of unit tests we can build upon.

Her main project for the semester isn’t covered here, but she’s going to be working on the rbt setup-repo command, helping streamline getting a new repository set up with Review Board.

Monica Bui

Monica’s also working on keyboard accessibility. Her focus in this demo is improving the New Review Request page, making sure that all elements can be tabbed to and navigated entirely by keyboard.

Xiaohui Liu

Xiaohui’s first project fixes up tab key navigation in the review request page. Previously, tabbing to fields would prioritize the fields on the right-hand side of review requests (Branch, Bugs, etc.) before the main fields (Description, Testing Done), which wasn’t really intuitive. His fix brings some sanity back to tab orders.

His second project is to implement common support in the UI for keyboard shortcuts, making it much easier for us to bake in better keyboard support on every page with less code to worry about.

Xiaole Zeng

Xiaole’s working on improving help within the product, giving users both a single place to go to when needing to find documentation or other useful information, and finding places within the UI where we can offer better inline guidance. For the latter, she’s working on adding helpful descriptions and documentation links when configuring repositories, based on the selected hosting service or repository type.

Next Week

We’re getting a new RBTools release ready to ship, so you’ll see that soon. We’re also testing 4.0 beta 1, and are getting that beta release on the calendar.

If you want to know more, have any questions, or are curious about anything else, please reach out on our community forum.

We’re also on Reddit (/r/reviewboard), Twitter, Facebook, and YouTube if you want other ways to keep up with Review Board and Beanbag.

ChangeLog: February 6, 2020 — GitHub API Changes, OAuth

February 6, 2020 Christian Hammond

Busy couple of weeks here. I’ve personally been sick, hence the lack of a ChangeLog last week. Sorry about that!

We’ve made a lot of great progress on getting Review Board 4.0 ready for beta, and updating the ecosystem of packages (such as Power Pack and Review Bot), but there is one urgent thing that came up that’s taking a bit of our time.

GitHub’s Authorization Changes

For many, many years, GitHub’s API has offered several options for authenticating with the API. Our initial integration with GitHub was written 10 years ago, and while it’s evolved over time, it’s continued to use the same original authentication methods to communicate with the API and link accounts.

In November, GitHub announced their were deprecating those methods. Frankly, due to its proximity to the holidays and some time-consuming work on our plate, this announcement slipped by us.

There are really two main ways in which this affects us:

HTTP requests to the API need to change how they pass API access tokens
We can no longer automatically exchange user credentials for an API access token when linking an account for a repository

GitHub API Authentication

GitHub’s APIs have historically taken an ?access_token=... parameter in API requests, and the original code we wrote to talk to the API continues to use this method. (If it ain’t broke…)

The modern approach is to make use of the HTTP Authorization header to pass in the access token. This is more standards-compliant and probably simplifies a lot of URL building and logging on their end.

This week, they began e-mailing users whose accounts were accessing the API using ?access_token=. You may have seen these, if you linked your GitHub account to Review Board. It’s annoying, but it’s designed to be, so that people update their software in time.

We’ve fixed this internally, and are testing to make sure it works everywhere. We’ll have a build out soon (see our timeline toward the bottom of this ChangeLog).

Linking GitHub Accounts

In order to talk to a source code repository, we typically need credentials of some kind. This may be a username and password, an API key/authentication token, or an SSH key.

Traditionally, we’ve been able to get by with taking the credentials right on the repository configuration page, combining the steps of linking an account and creating a repository. This is just easier for many reasons, and worked great with GitHub.

The GitHub process went like this:

We’d provide fields for a username and password to a GitHub account to use for repository access (though we’d never store the password).
When saving the repository, we’d use those credentials server-side to immediately make a request to GitHub’s Authorizations API to request a new access token.
We’d store that token and use it for all future API access.

This token was associated with the user’s account, and could be revoked at any point. We never had to store the password, like we unfortunately must do with some services that lack any form of authentication token capability.

This had always worked before, but it will be changing going forward, as the Authorizations APIs we used is now deprecated.

Short-term, we’ll be changing the dialog to provide instructions on how to generate a personal access token, and a field for providing it (instead of a password). This is an annoying extra step for users, but it’s a working solution we can employ short-term (and we already use this approach for some other services).

Long-term, we need to modernize the configuration experience, taking full advantage of OAuth web flows for linking accounts.

Challenges of OAuth in Review Board

First, let’s quickly go over OAuth (or, more specifically, OAuth2, the modern version of the standard).

OAuth is a standard way for a service (Service A) to request access to another service (Service B), on behalf of a user. You’ve probably seen basically this before when you’ve initiated a “Log In With Facebook” or when you’ve connected some service to Slack. You click a button, a browser window pops up and presents a page on Service B telling you that Service A wants access via your account, telling you what permissions it requests.

While complicated, it’s a pretty great thing to have in the modern world, but it’s not automatic.

Before Service A can even begin this process, someone must register it on Service B (through whatever mechanism is required by that service — this usually requires filling out a form). The result is a Client ID and a Client Secret, which must be stored somewhere and then used when initiating the OAuth process.

The Burden on Administrators

It’s very important that the Client ID and Secret are kept secure and not shared, and this is where things get more difficult for tools like Review Board.

Review Board is open source and self-installed, so we can’t supply a Client ID or Secret as part of the installation. That means an administrator must perform this task, and this can be a real annoyance when just getting started. It’s worse for some services than others.

Fortunately, it only has to be done once per required service, but we try to avoid this extra step when there are alternatives. We do take care of it on RBCommons so users don’t have to, at least.

In the case of GitHub, they’ve thought through this and have some mechanisms (such as App Manifests) we’re looking into that should aid in OAuth registration, but we haven’t yet figured out how this is going to work in the end.

Timeline: When Is This All Happening?

There’s no public information yet on when GitHub will be removing the old APIs, though we’ve been in communication with them and have a timeline we’re comfortable with. They’re still fairly early in the deprecation process, and have a history of handling deprecations very well.

We have three phases:

Update the API authentication method
Our plan is to release Review Board 3.0.17 early next week (targeting February 11th, 2020) with this fix.

We are not planning (at this time) to backport this to older generations of Review Board.
Request Personal Access Tokens when linking accounts

This is the manual version of what we’ve been doing behind the scenes. Users will need to generate their own token and supply it when linking an account.

We are planning to provide this a couple months before the API removal date. This is to keep the process nice and simple as long as possible, but to allow time for people to upgrade.
Implement an OAuth web-based account linking workflow

This will likely come sometime after the API removal, and will be in Review Board 4.0. We’ve been planning this anyway, and it’s not (at this time) needed to remain compatible with GitHub. Though it is the better method.

These plans may change as we go. We might decide to fast-track the OAuth web-based flow, for instance, based on other factors.

We still really want to get Review Board 4.0 wrapped up soon, and a lot of “urgent” things like this have come up, causing further delays, so we’re punting what we can for now.

Whew.

That was a lot to talk about.

If you want to know more, have any questions, or are curious about anything else, please reach out on our community forum.

We’re also on Reddit (/r/reviewboard), Twitter, Facebook, and YouTube if you want other ways to keep up with Review Board and Beanbag.