Screwdriver: Metadata is unintentionally overwritten

[yoshwata]

What happened:

After apply https://github.com/screwdriver-cd/launcher/pull/410 accidents can occur in our user's application.

Our template sets the host name of the application to meta at build time. The meta is used to test in the child job. If metadata of the same key is set in parallel, it will refer to the unintended value in child build. Testing with an unintended host name results in an unintended production deployment.

What you expected to happen:

(Just example)
If meta is set in the parent build, skip meta overwriting of parallel build.

How to reproduce it:

[jithine]

Is that in same event ? This could be a bug in how merge happens. Immediate parent build's meta should always overwrite event meta, if same key exists in both. cc @tkyi

[kumada626]

Yes, this is in the same event.

[jithine]

We have to look at how mergemap.merge is working, I think it's skipping same key from source if it already exist in destination object

I saw similar behavior from other merging libraries while refactoring triggerNextJob and had to use a custom merge logic to always prefer value fro source https://github.com/screwdriver-cd/screwdriver/blob/master/plugins/builds/index.js#L405-L408

[jithine]

ok I see the bug, it's the wrong order of arguments, First argument is destination https://github.com/peterbourgon/mergemap/blob/master/mergemap.go#L17

We've been using it in reverse all over the place.

[tkyi]

Should be fixed with above