static_checks: Don't fail on WIP check unless CQ+2

Bug: b/374993770
Change-Id: I2f1bd73448485aa5c07664b57f837c25bca09c97
Reviewed-on: https://pigweed-review.googlesource.com/c/infra/recipes/+/243878
Pigweed-Auto-Submit: Rob Mohr <mohrr@google.com>
Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
Reviewed-by: Taylor Cramer <cramertj@google.com>
Commit-Queue: Auto-Submit <auto-submit@pigweed-service-accounts.iam.gserviceaccount.com>
Presubmit-Verified: CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/recipes/static_checks.expected/do-not-submit.dry.json b/recipes/static_checks.expected/do-not-submit.dry.json
new file mode 100644
index 0000000..a612234
--- /dev/null
+++ b/recipes/static_checks.expected/do-not-submit.dry.json
@@ -0,0 +1,273 @@
+[
+  {
+    "cmd": [],
+    "name": "ensure infra/tools/luci/gerrit/${platform}"
+  },
+  {
+    "cmd": [],
+    "name": "ensure infra/tools/luci/gerrit/${platform}.get packages",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "vpython3",
+      "-u",
+      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
+      "--json-output",
+      "/path/to/tmp/json",
+      "copy",
+      "RECIPE_MODULE[fuchsia::gerrit]/resources/cipd.ensure",
+      "/path/to/tmp/"
+    ],
+    "infra_step": true,
+    "luci_context": {
+      "realm": {
+        "name": "project:try"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "ensure infra/tools/luci/gerrit/${platform}.get packages.read ensure file",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@2@@@",
+      "@@@STEP_LOG_LINE@cipd.ensure@infra/tools/luci/gerrit/${platform} version:pinned-version@@@",
+      "@@@STEP_LOG_END@cipd.ensure@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "ensure infra/tools/luci/gerrit/${platform}.install infra/tools/luci/gerrit",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@1@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "vpython3",
+      "-u",
+      "RECIPE_MODULE[recipe_engine::file]/resources/fileutil.py",
+      "--json-output",
+      "/path/to/tmp/json",
+      "ensure-directory",
+      "--mode",
+      "0o777",
+      "[START_DIR]/cipd_tool/infra/tools/luci/gerrit/0e548aa33f8113a45a5b3b62201e114e98e63d00f97296912380138f44597b07"
+    ],
+    "infra_step": true,
+    "luci_context": {
+      "realm": {
+        "name": "project:try"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "ensure infra/tools/luci/gerrit/${platform}.install infra/tools/luci/gerrit.ensure package directory",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@2@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "cipd",
+      "ensure",
+      "-root",
+      "[START_DIR]/cipd_tool/infra/tools/luci/gerrit/0e548aa33f8113a45a5b3b62201e114e98e63d00f97296912380138f44597b07",
+      "-ensure-file",
+      "infra/tools/luci/gerrit/${platform} version:pinned-version",
+      "-max-threads",
+      "0",
+      "-json-output",
+      "/path/to/tmp/json"
+    ],
+    "infra_step": true,
+    "luci_context": {
+      "realm": {
+        "name": "project:try"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "ensure infra/tools/luci/gerrit/${platform}.install infra/tools/luci/gerrit.ensure_installed",
+    "~followup_annotations": [
+      "@@@STEP_NEST_LEVEL@2@@@",
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"result\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@      {@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"instance_id\": \"resolved-instance_id-of-version:pinned-v\",@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"package\": \"infra/tools/luci/gerrit/resolved-platform\"@@@",
+      "@@@STEP_LOG_LINE@json.output@      }@@@",
+      "@@@STEP_LOG_LINE@json.output@    ]@@@",
+      "@@@STEP_LOG_LINE@json.output@  }@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[START_DIR]/cipd_tool/infra/tools/luci/gerrit/0e548aa33f8113a45a5b3b62201e114e98e63d00f97296912380138f44597b07/gerrit",
+      "change-detail",
+      "-host",
+      "https://chromium-review.googlesource.com",
+      "-input",
+      "{\"change_id\": \"123456\", \"params\": {\"o\": [\"ALL_COMMITS\", \"ALL_REVISIONS\", \"ALL_FILES\"]}}",
+      "-output",
+      "/path/to/tmp/json"
+    ],
+    "infra_step": true,
+    "luci_context": {
+      "realm": {
+        "name": "project:try"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "change details",
+    "timeout": 600,
+    "~followup_annotations": [
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"_number\": 1234,@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"current_revision\": \"HASH\",@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"labels\": {},@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"owner\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"email\": \"nobody@example.com\"@@@",
+      "@@@STEP_LOG_LINE@json.output@  },@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"revert_of\": 0,@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"revisions\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@    \"HASH\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@      \"_number\": 1,@@@",
+      "@@@STEP_LOG_LINE@json.output@      \"commit\": {@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"message\": \"Do_NoT-sUbMiT\",@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"parents\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@          {@@@",
+      "@@@STEP_LOG_LINE@json.output@            \"commit\": \"PARENT0\"@@@",
+      "@@@STEP_LOG_LINE@json.output@          }@@@",
+      "@@@STEP_LOG_LINE@json.output@        ],@@@",
+      "@@@STEP_LOG_LINE@json.output@        \"subject\": \"Do_NoT-sUbMiT\"@@@",
+      "@@@STEP_LOG_LINE@json.output@      },@@@",
+      "@@@STEP_LOG_LINE@json.output@      \"description\": \"\",@@@",
+      "@@@STEP_LOG_LINE@json.output@      \"files\": {}@@@",
+      "@@@STEP_LOG_LINE@json.output@    }@@@",
+      "@@@STEP_LOG_LINE@json.output@  }@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@",
+      "@@@STEP_LOG_LINE@json.input@{@@@",
+      "@@@STEP_LOG_LINE@json.input@  \"change_id\": \"123456\",@@@",
+      "@@@STEP_LOG_LINE@json.input@  \"params\": {@@@",
+      "@@@STEP_LOG_LINE@json.input@    \"o\": [@@@",
+      "@@@STEP_LOG_LINE@json.input@      \"ALL_COMMITS\",@@@",
+      "@@@STEP_LOG_LINE@json.input@      \"ALL_REVISIONS\",@@@",
+      "@@@STEP_LOG_LINE@json.input@      \"ALL_FILES\"@@@",
+      "@@@STEP_LOG_LINE@json.input@    ]@@@",
+      "@@@STEP_LOG_LINE@json.input@  }@@@",
+      "@@@STEP_LOG_LINE@json.input@}@@@",
+      "@@@STEP_LOG_END@json.input@@@",
+      "@@@STEP_LINK@gerrit link@https://chromium-review.googlesource.com/q/123456@@@"
+    ]
+  },
+  {
+    "cmd": [
+      "[START_DIR]/cipd_tool/infra/tools/luci/gerrit/0e548aa33f8113a45a5b3b62201e114e98e63d00f97296912380138f44597b07/gerrit",
+      "list-change-comments",
+      "-host",
+      "https://chromium-review.googlesource.com",
+      "-input",
+      "{\"change_id\": \"123456\"}",
+      "-output",
+      "/path/to/tmp/json"
+    ],
+    "infra_step": true,
+    "luci_context": {
+      "realm": {
+        "name": "project:try"
+      },
+      "resultdb": {
+        "current_invocation": {
+          "name": "invocations/build:8945511751514863184",
+          "update_token": "token"
+        },
+        "hostname": "rdbhost"
+      }
+    },
+    "name": "list change comments",
+    "timeout": 600,
+    "~followup_annotations": [
+      "@@@STEP_LOG_LINE@json.output@{@@@",
+      "@@@STEP_LOG_LINE@json.output@  \"/PATCHSET_LEVEL\": [@@@",
+      "@@@STEP_LOG_LINE@json.output@    {@@@",
+      "@@@STEP_LOG_LINE@json.output@      \"message\": \"\"@@@",
+      "@@@STEP_LOG_LINE@json.output@    }@@@",
+      "@@@STEP_LOG_LINE@json.output@  ]@@@",
+      "@@@STEP_LOG_LINE@json.output@}@@@",
+      "@@@STEP_LOG_END@json.output@@@",
+      "@@@STEP_LOG_LINE@json.input@{@@@",
+      "@@@STEP_LOG_LINE@json.input@  \"change_id\": \"123456\"@@@",
+      "@@@STEP_LOG_LINE@json.input@}@@@",
+      "@@@STEP_LOG_END@json.input@@@",
+      "@@@STEP_LINK@gerrit link@https://chromium-review.googlesource.com/q/123456@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "TRYJOB DO NOT RETRY",
+    "~followup_annotations": [
+      "@@@SET_BUILD_PROPERTY@$recipe_engine/cq/output@{\"retry\": \"OUTPUT_RETRY_DENIED\"}@@@",
+      "@@@SET_BUILD_PROPERTY@$recipe_engine/cv/output@{\"retry\": \"OUTPUT_RETRY_DENIED\"}@@@",
+      "@@@SET_BUILD_PROPERTY@do_not_retry@true@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "checking if revert",
+    "~followup_annotations": [
+      "@@@STEP_SUMMARY_TEXT@0@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "checking if merge",
+    "~followup_annotations": [
+      "@@@STEP_SUMMARY_TEXT@['PARENT0']@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "checking owner account",
+    "~followup_annotations": [
+      "@@@STEP_SUMMARY_TEXT@nobody@example.com@@@"
+    ]
+  },
+  {
+    "cmd": [],
+    "name": "check requires"
+  },
+  {
+    "cmd": [],
+    "name": "check dns"
+  },
+  {
+    "name": "$result"
+  }
+]
\ No newline at end of file
diff --git a/recipes/static_checks.expected/do-not-submit.json b/recipes/static_checks.expected/do-not-submit.full.json
similarity index 100%
rename from recipes/static_checks.expected/do-not-submit.json
rename to recipes/static_checks.expected/do-not-submit.full.json
diff --git a/recipes/static_checks.py b/recipes/static_checks.py
index 1710753..ee820ed 100644
--- a/recipes/static_checks.py
+++ b/recipes/static_checks.py
@@ -130,12 +130,17 @@
         re.compile(r'\bWIP\b', re.IGNORECASE),
     ]
 
+    match: re.Pattern | None = None
     for regex in regexes:
-        match = regex.search(details['message'])
-        if match:
-            raise api.step.StepFailure(
-                f'found "{match.group(0)}" in commit message'
-            )
+        if match := regex.search(details['message']):
+            break
+    else:
+        return
+
+    if api.cv.run_mode == api.cv.FULL_RUN:
+        raise api.step.StepFailure(
+            f'found "{match.group(0)}" in commit message'
+        )
 
 
 @nest_step
@@ -586,22 +591,26 @@
     )
 
 
+def do_not_submit_tests(api):
+    def test(name, cv_mode, commit_message, status, *args, **kwargs):
+        return api.test(
+            f'do-not-submit.{name}',
+            api.buildbucket.try_build(),
+            api.cv(cv_mode),
+            change_details(api, commit_message),
+            status=status,
+            *args,
+            **kwargs,
+        )
+
+    yield test('full', api.cv.FULL_RUN, 'Do_NoT-sUbMiT', 'FAILURE')
+
+    yield test('dry', api.cv.DRY_RUN, 'Do_NoT-sUbMiT', 'SUCCESS')
+
+
 def GenTests(api) -> Generator[recipe_test_api.TestData, None, None]:
-    for test in requires_tests(api):
-        yield test
-
-    for test in tested_tests(api):
-        yield test
-
-    for test in readability_tests(api):
-        yield test
-
-    for test in regexp_tests(api):
-        yield test
-
-    yield api.test(
-        'do-not-submit',
-        api.buildbucket.try_build(),
-        change_details(api, 'Do_NoT-sUbMiT'),
-        status='FAILURE',
-    )
+    yield from requires_tests(api)
+    yield from tested_tests(api)
+    yield from readability_tests(api)
+    yield from regexp_tests(api)
+    yield from do_not_submit_tests(api)