Add LUCI config for project.

This adds the baseline LUCI configuration for the project,
including a dummy recipe (that does nothing), one presubmit (try)
builder and one postsubmit (CI) builder.

(Manually merged/submitted).

Bug: 1260171
Change-Id: Id339b440ec8e6a24298abbfb5bdea638667aa3ec
Reviewed-On: https://crrev.com/c/3223361
diff --git a/.gitignore b/.gitignore
index 0b70598..7c3716d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@
 *.swp
 
 build
+infra/.recipe_deps
 node_modules
 node_modules.tar.gz
 third_party/depot_tools
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
new file mode 100644
index 0000000..03ca50d
--- /dev/null
+++ b/PRESUBMIT.py
@@ -0,0 +1,23 @@
+# Copyright (c) 2012 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Top-level presubmit script for Chromium.
+
+See http://dev.chromium.org/developers/how-tos/depottools/presubmit-scripts
+for more details about the presubmit API built into depot_tools.
+"""
+PRESUBMIT_VERSION = '2.0.0'
+
+# This line is 'magic' in that git-cl looks for it to decide whether to
+# use Python3 instead of Python2 when running the code in this file.
+USE_PYTHON3 = True
+
+
+def CheckPatchFormatted(input_api, output_api):
+  return input_api.canned_checks.CheckPatchFormatted(input_api, output_api)
+
+
+def CheckChangeHasDescription(input_api, output_api):
+  return input_api.canned_checks.CheckChangeHasDescription(
+      input_api, output_api)
diff --git a/infra/README.recipes.md b/infra/README.recipes.md
new file mode 100644
index 0000000..1c64483
--- /dev/null
+++ b/infra/README.recipes.md
@@ -0,0 +1,20 @@
+<!--- AUTOGENERATED BY `./recipes.py test train` -->
+# Repo documentation for [chromium\_website]()
+## Table of Contents
+
+**[Recipes](#Recipes)**
+  * [website](#recipes-website) &mdash; Recipe for building and deploying the www.
+## Recipes
+
+### *recipes* / [website](/infra/recipes/website.py)
+
+[DEPS](/infra/recipes/website.py#10): [recipe\_engine/buildbucket][recipe_engine/recipe_modules/buildbucket], [recipe\_engine/properties][recipe_engine/recipe_modules/properties], [recipe\_engine/runtime][recipe_engine/recipe_modules/runtime], [recipe\_engine/step][recipe_engine/recipe_modules/step]
+
+Recipe for building and deploying the www.chromium.org static website.
+
+&mdash; **def [RunSteps](/infra/recipes/website.py#22)(api, repository):**
+
+[recipe_engine/recipe_modules/buildbucket]: https://chromium.googlesource.com/infra/luci/recipes-py.git/+/d31ba13ede8c21e60116ae61e4490d53ba77fcbd/README.recipes.md#recipe_modules-buildbucket
+[recipe_engine/recipe_modules/properties]: https://chromium.googlesource.com/infra/luci/recipes-py.git/+/d31ba13ede8c21e60116ae61e4490d53ba77fcbd/README.recipes.md#recipe_modules-properties
+[recipe_engine/recipe_modules/runtime]: https://chromium.googlesource.com/infra/luci/recipes-py.git/+/d31ba13ede8c21e60116ae61e4490d53ba77fcbd/README.recipes.md#recipe_modules-runtime
+[recipe_engine/recipe_modules/step]: https://chromium.googlesource.com/infra/luci/recipes-py.git/+/d31ba13ede8c21e60116ae61e4490d53ba77fcbd/README.recipes.md#recipe_modules-step
diff --git a/infra/config/generated/commit-queue.cfg b/infra/config/generated/commit-queue.cfg
new file mode 100644
index 0000000..72bb4f5
--- /dev/null
+++ b/infra/config/generated/commit-queue.cfg
@@ -0,0 +1,40 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see Config message:
+#   https://luci-config.appspot.com/schemas/projects:commit-queue.cfg
+
+submit_options {
+  max_burst: 4
+  burst_delay {
+    seconds: 480
+  }
+}
+config_groups {
+  name: "chromium-website"
+  gerrit {
+    url: "https://chromium-review.googlesource.com"
+    projects {
+      name: "experimental/chromium_website"
+      ref_regexp: "refs/heads/main"
+    }
+  }
+  verifiers {
+    gerrit_cq_ability {
+      committer_list: "project-chromium-website-committers"
+      dry_run_access_list: "project-chromium-website-tryjob-access"
+    }
+    tryjob {
+      builders {
+        name: "chromium-website/try/chromium-website-try-builder"
+      }
+      retry_config {
+        single_quota: 1
+        global_quota: 2
+        failure_weight: 1
+        transient_failure_weight: 1
+        timeout_weight: 2
+      }
+    }
+  }
+}
diff --git a/infra/config/generated/cr-buildbucket.cfg b/infra/config/generated/cr-buildbucket.cfg
new file mode 100644
index 0000000..315ebfe
--- /dev/null
+++ b/infra/config/generated/cr-buildbucket.cfg
@@ -0,0 +1,66 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see BuildbucketCfg message:
+#   https://luci-config.appspot.com/schemas/projects:buildbucket.cfg
+
+buckets {
+  name: "ci"
+  acls {
+    group: "all"
+  }
+  swarming {
+    builders {
+      name: "chromium-website-ci-builder"
+      swarming_host: "chromium-swarm.appspot.com"
+      dimensions: "cpu:x86-64"
+      dimensions: "os:Ubuntu-18.04"
+      dimensions: "pool:luci.flex.ci"
+      recipe {
+        name: "chromium-website"
+        cipd_package: "https://chromium.googlesource.com/experimental/chromium_website"
+        cipd_version: "refs/heads/main"
+      }
+      execution_timeout_secs: 3600
+      service_account: "chromium-website-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      experiments {
+        key: "luci.use_realms"
+        value: 100
+      }
+    }
+  }
+}
+buckets {
+  name: "try"
+  acls {
+    group: "all"
+  }
+  acls {
+    role: SCHEDULER
+    group: "project-chromium-website-tryjob-access"
+  }
+  acls {
+    role: SCHEDULER
+    group: "service-account-cq"
+  }
+  swarming {
+    builders {
+      name: "chromium-website-try-builder"
+      swarming_host: "chromium-swarm.appspot.com"
+      dimensions: "cpu:x86-64"
+      dimensions: "os:Ubuntu-18.04"
+      dimensions: "pool:luci.flex.try"
+      recipe {
+        name: "chromium-website"
+        cipd_package: "https://chromium.googlesource.com/experimental/chromium_website"
+        cipd_version: "refs/heads/main"
+      }
+      execution_timeout_secs: 3600
+      service_account: "chromium-website-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+      experiments {
+        key: "luci.use_realms"
+        value: 100
+      }
+    }
+  }
+}
diff --git a/infra/config/generated/luci-logdog.cfg b/infra/config/generated/luci-logdog.cfg
new file mode 100644
index 0000000..6264153
--- /dev/null
+++ b/infra/config/generated/luci-logdog.cfg
@@ -0,0 +1,9 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see ProjectConfig message:
+#   https://luci-config.appspot.com/schemas/projects:luci-logdog.cfg
+
+reader_auth_groups: "all"
+writer_auth_groups: "luci-logdog-chromium-website-writers"
+archive_gs_bucket: "chromium-luci-logdog"
diff --git a/infra/config/generated/luci-milo.cfg b/infra/config/generated/luci-milo.cfg
new file mode 100644
index 0000000..f3cfcd0
--- /dev/null
+++ b/infra/config/generated/luci-milo.cfg
@@ -0,0 +1,19 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see Project message:
+#   https://luci-config.appspot.com/schemas/projects:luci-milo.cfg
+
+consoles {
+  id: "chromium-website"
+  name: "chromium-website"
+  repo_url: "https://chromium.googlesource.com/experimental/chromium_website"
+  refs: "regexp:refs/heads/main"
+  manifest_name: "REVISION"
+  builders {
+    name: "buildbucket/luci.chromium-website.ci/chromium-website-ci-builder"
+    short_name: "ci"
+  }
+  favicon_url: "https://storage.googleapis.com/chrome-infra-public/logo/favicon.ico"
+}
+logo_url: "https://storage.googleapis.com/chrome-infra-public/logo/chromium.svg"
diff --git a/infra/config/generated/luci-scheduler.cfg b/infra/config/generated/luci-scheduler.cfg
new file mode 100644
index 0000000..5c24fa5
--- /dev/null
+++ b/infra/config/generated/luci-scheduler.cfg
@@ -0,0 +1,36 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see ProjectConfig message:
+#   https://luci-config.appspot.com/schemas/projects:luci-scheduler.cfg
+
+job {
+  id: "chromium-website-ci-builder"
+  realm: "ci"
+  acl_sets: "ci"
+  buildbucket {
+    server: "cr-buildbucket.appspot.com"
+    bucket: "luci.chromium-website.ci"
+    builder: "chromium-website-ci-builder"
+  }
+}
+trigger {
+  id: "chromium-website-trigger"
+  realm: "ci"
+  acl_sets: "ci"
+  triggers: "chromium-website-ci-builder"
+  gitiles {
+    repo: "https://chromium.googlesource.com/experimental/chromium_website"
+    refs: "regexp:refs/heads/main"
+  }
+}
+acl_sets {
+  name: "ci"
+  acls {
+    role: OWNER
+    granted_to: "group:project-chromium-website-committers"
+  }
+  acls {
+    granted_to: "group:all"
+  }
+}
diff --git a/infra/config/generated/project.cfg b/infra/config/generated/project.cfg
new file mode 100644
index 0000000..4fb318e
--- /dev/null
+++ b/infra/config/generated/project.cfg
@@ -0,0 +1,8 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see ProjectCfg message:
+#   https://luci-config.appspot.com/schemas/projects:project.cfg
+
+name: "chromium-website"
+access: "group:all"
diff --git a/infra/config/generated/realms.cfg b/infra/config/generated/realms.cfg
new file mode 100644
index 0000000..967d5ac
--- /dev/null
+++ b/infra/config/generated/realms.cfg
@@ -0,0 +1,52 @@
+# Auto-generated by lucicfg.
+# Do not modify manually.
+#
+# For the schema of this file, see RealmsCfg message:
+#   https://luci-config.appspot.com/schemas/projects:realms.cfg
+
+realms {
+  name: "@root"
+  bindings {
+    role: "role/buildbucket.reader"
+    principals: "group:all"
+  }
+  bindings {
+    role: "role/configs.reader"
+    principals: "group:all"
+  }
+  bindings {
+    role: "role/logdog.reader"
+    principals: "group:all"
+  }
+  bindings {
+    role: "role/logdog.writer"
+    principals: "group:luci-logdog-chromium-website-writers"
+  }
+  bindings {
+    role: "role/scheduler.owner"
+    principals: "group:project-chromium-website-committers"
+  }
+  bindings {
+    role: "role/scheduler.reader"
+    principals: "group:all"
+  }
+}
+realms {
+  name: "ci"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:chromium-website-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+}
+realms {
+  name: "try"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:chromium-website-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  bindings {
+    role: "role/buildbucket.triggerer"
+    principals: "group:project-chromium-website-tryjob-access"
+    principals: "group:service-account-cq"
+  }
+}
diff --git a/infra/config/main.star b/infra/config/main.star
new file mode 100755
index 0000000..35e182f
--- /dev/null
+++ b/infra/config/main.star
@@ -0,0 +1,193 @@
+#!/usr/bin/env lucicfg
+#
+# This is the LUCI configuration for the 'chromium_website' project,
+# the set of machines that build and test changes for the static website
+# deployed to serve www.chromium.org.
+#
+# The chromium website needs basically the simplest possible LUCI project:
+# one presubmit (aka "try") builder and one postsubmit (aka "CI" or
+# continuous integration) builder, with the following conventions:
+#
+# - The project is called PROJECT_NAME.
+# - The repo containing the LUCI configuration is found in PROJECT_REPO.
+# - The recipes are found in the same repo as the rest of the LUCI config
+#   (which is likely also the main repo for the project source code).
+# - The builders will run in LUCI's public flex pools.
+# - The builders will be configured into two different buckets, called "try"
+# - and "ci"
+# - The builders will be named $PROJECT_NAME-$BUCKET-builder
+# - The builders will use the same recipe, found in
+#   //infra/config/recipes/$PROJECT_NAME.py
+
+# This should match the LUCI project name.
+#
+# In order to aid with grepping for occurrences of the project name
+# in various other names, we repeat the string, below in some places,
+# rather than using string interpolation. This means that if you change
+# the project name, you should also do a search-and-replace for other
+# occurrences of the string in this file.
+PROJECT_NAME = "chromium-website"
+
+# TODO(dpranke): Update this once the production repo is populated.
+PROJECT_REPO = "https://chromium.googlesource.com/experimental/chromium_website"
+
+# TODO(dpranke): Update this when/if you get a custom logo.
+PROJECT_LOGO = "https://storage.googleapis.com/chrome-infra-public/logo/chromium.svg"
+
+#
+# Everything below this comment should be almost completely generic; however,
+# in some places we explicitly expand $PROJECT_NAME rather than using
+# string interpolation to aid in grepping for strings / code search.
+# See the note above for more.
+#
+
+lucicfg.check_version("1.23.3", "Please update depot_tools")
+
+_LINUX_OS = "Ubuntu-18.04"
+
+# Enable LUCI Realms support and launch all builds in realms-aware mode.
+lucicfg.enable_experiment("crbug.com/1085650")
+luci.builder.defaults.experiments.set({"luci.use_realms": 100})
+
+lucicfg.config(
+    config_dir = "generated",
+    tracked_files = [
+        "commit-queue.cfg",
+        "cr-buildbucket.cfg",
+        "project.cfg",
+        "luci-logdog.cfg",
+        "luci-milo.cfg",
+        "luci-scheduler.cfg",
+        "realms.cfg",
+    ],
+    fail_on_warnings = True,
+)
+
+luci.project(
+    name = PROJECT_NAME,
+    buildbucket = "cr-buildbucket.appspot.com",
+    logdog = "luci-logdog",
+    milo = "luci-milo",
+    scheduler = "luci-scheduler",
+    swarming = "chromium-swarm.appspot.com",
+    acls = [
+        acl.entry(
+            [
+                acl.BUILDBUCKET_READER,
+                acl.LOGDOG_READER,
+                acl.PROJECT_CONFIGS_READER,
+                acl.SCHEDULER_READER,
+            ],
+            groups = ["all"],
+        ),
+        acl.entry([acl.SCHEDULER_OWNER], groups = ["project-chromium-website-committers"]),
+        acl.entry([acl.LOGDOG_WRITER], groups = ["luci-logdog-chromium-website-writers"]),
+    ],
+)
+
+
+luci.logdog(
+    gs_bucket = "chromium-luci-logdog",
+)
+
+luci.milo(
+    logo = PROJECT_LOGO,
+)
+
+luci.console_view(
+    name = PROJECT_NAME,
+    title = PROJECT_NAME,
+    repo = PROJECT_REPO,
+    refs = ["refs/heads/main"],
+    favicon = "https://storage.googleapis.com/chrome-infra-public/logo/favicon.ico",
+)
+
+luci.gitiles_poller(
+    name = "chromium-website-trigger",
+    bucket = "ci",
+    repo = PROJECT_REPO,
+    refs = ["refs/heads/main"],
+)
+
+luci.bucket(name = "ci", acls = [
+    acl.entry(
+        [acl.BUILDBUCKET_TRIGGERER],
+    ),
+])
+
+
+luci.builder(
+    name = "chromium-website-ci-builder",
+    bucket = "ci",
+    executable = luci.recipe(
+        name = PROJECT_NAME,
+        cipd_package = PROJECT_REPO,
+        cipd_version = "refs/heads/main",
+    ),
+    service_account = "chromium-website-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+    execution_timeout = 1 * time.hour,
+    dimensions = {"cpu": "x86-64", "os": _LINUX_OS, "pool": "luci.flex.ci"},
+    triggered_by = ["chromium-website-trigger"],
+)
+
+luci.console_view_entry(
+    console_view = PROJECT_NAME,
+    builder = "chromium-website-ci-builder",
+    short_name = "ci",
+)
+
+luci.cq(
+    submit_max_burst = 4,
+    submit_burst_delay = 8 * time.minute,
+)
+
+luci.cq_group(
+    name = PROJECT_NAME,
+    watch = cq.refset(
+        repo = PROJECT_REPO,
+        refs = ["refs/heads/main"],
+    ),
+    acls = [
+        acl.entry(
+            [acl.CQ_COMMITTER],
+            groups = ["project-chromium-website-committers"],
+        ),
+        acl.entry(
+            [acl.CQ_DRY_RUNNER],
+            groups = ["project-chromium-website-tryjob-access"],
+        ),
+    ],
+    retry_config = cq.retry_config(
+        single_quota = 1,
+        global_quota = 2,
+        failure_weight = 1,
+        transient_failure_weight = 1,
+        timeout_weight = 2,
+    ),
+)
+
+luci.bucket(name = "try", acls = [
+    acl.entry(
+        [acl.BUILDBUCKET_TRIGGERER],
+        groups = ["project-chromium-website-tryjob-access", "service-account-cq"],
+    ),
+])
+
+
+luci.builder(
+    name = "chromium-website-try-builder",
+    bucket = "try",
+    executable = luci.recipe(
+        name = PROJECT_NAME,
+        cipd_package = PROJECT_REPO,
+        cipd_version = "refs/heads/main",
+    ),
+    service_account = "chromium-website-try-builder@chops-service-accounts.iam.gserviceaccount.com",
+    execution_timeout = 1 * time.hour,
+    dimensions = {"cpu": "x86-64", "os": _LINUX_OS, "pool": "luci.flex.try"},
+)
+
+luci.cq_tryjob_verifier(
+    builder = "chromium-website-try-builder",
+    cq_group = PROJECT_NAME,
+)
diff --git a/infra/config/recipes.cfg b/infra/config/recipes.cfg
new file mode 100644
index 0000000..3b290e7
--- /dev/null
+++ b/infra/config/recipes.cfg
@@ -0,0 +1,12 @@
+{
+  "api_version": 2,
+  "deps": {
+    "recipe_engine": {
+      "branch": "main",
+      "revision": "d31ba13ede8c21e60116ae61e4490d53ba77fcbd",
+      "url": "https://chromium.googlesource.com/infra/luci/recipes-py"
+    }
+  },
+  "project_id": "chromium_website",
+  "recipes_path": "infra"
+}
diff --git a/infra/recipes.py b/infra/recipes.py
new file mode 100755
index 0000000..2fe0086
--- /dev/null
+++ b/infra/recipes.py
@@ -0,0 +1,228 @@
+#!/usr/bin/env python
+
+# Copyright 2017 The LUCI Authors. All rights reserved.
+# Use of this source code is governed under the Apache License, Version 2.0
+# that can be found in the LICENSE file.
+
+"""Bootstrap script to clone and forward to the recipe engine tool.
+
+*******************
+** DO NOT MODIFY **
+*******************
+
+This is a copy of https://chromium.googlesource.com/infra/luci/recipes-py/+/master/recipes.py.
+To fix bugs, fix in the googlesource repo then run the autoroller.
+"""
+
+import argparse
+import json
+import logging
+import os
+import random
+import subprocess
+import sys
+import time
+import urlparse
+
+from collections import namedtuple
+
+from cStringIO import StringIO
+
+# The dependency entry for the recipe_engine in the client repo's recipes.cfg
+#
+# url (str) - the url to the engine repo we want to use.
+# revision (str) - the git revision for the engine to get.
+# branch (str) - the branch to fetch for the engine as an absolute ref (e.g.
+#   refs/heads/master)
+EngineDep = namedtuple('EngineDep',
+                       'url revision branch')
+
+
+class MalformedRecipesCfg(Exception):
+  def __init__(self, msg, path):
+    super(MalformedRecipesCfg, self).__init__('malformed recipes.cfg: %s: %r'
+                                              % (msg, path))
+
+
+def parse(repo_root, recipes_cfg_path):
+  """Parse is a lightweight a recipes.cfg file parser.
+
+  Args:
+    repo_root (str) - native path to the root of the repo we're trying to run
+      recipes for.
+    recipes_cfg_path (str) - native path to the recipes.cfg file to process.
+
+  Returns (as tuple):
+    engine_dep (EngineDep|None): The recipe_engine dependency, or None, if the
+      current repo IS the recipe_engine.
+    recipes_path (str) - native path to where the recipes live inside of the
+      current repo (i.e. the folder containing `recipes/` and/or
+      `recipe_modules`)
+  """
+  with open(recipes_cfg_path, 'rU') as fh:
+    pb = json.load(fh)
+
+  try:
+    if pb['api_version'] != 2:
+      raise MalformedRecipesCfg('unknown version %d' % pb['api_version'],
+                                recipes_cfg_path)
+
+    # If we're running ./recipes.py from the recipe_engine repo itself, then
+    # return None to signal that there's no EngineDep.
+    repo_name = pb.get('repo_name')
+    if not repo_name:
+      repo_name = pb['project_id']
+    if repo_name == 'recipe_engine':
+      return None, pb.get('recipes_path', '')
+
+    engine = pb['deps']['recipe_engine']
+
+    if 'url' not in engine:
+      raise MalformedRecipesCfg(
+        'Required field "url" in dependency "recipe_engine" not found',
+        recipes_cfg_path)
+
+    engine.setdefault('revision', '')
+    engine.setdefault('branch', 'refs/heads/master')
+    recipes_path = pb.get('recipes_path', '')
+
+    # TODO(iannucci): only support absolute refs
+    if not engine['branch'].startswith('refs/'):
+      engine['branch'] = 'refs/heads/' + engine['branch']
+
+    recipes_path = os.path.join(
+      repo_root, recipes_path.replace('/', os.path.sep))
+    return EngineDep(**engine), recipes_path
+  except KeyError as ex:
+    raise MalformedRecipesCfg(ex.message, recipes_cfg_path)
+
+
+_BAT = '.bat' if sys.platform.startswith(('win', 'cygwin')) else ''
+GIT = 'git' + _BAT
+VPYTHON = 'vpython' + _BAT
+CIPD = 'cipd' + _BAT
+REQUIRED_BINARIES = {GIT, VPYTHON, CIPD}
+
+
+def _is_executable(path):
+  return os.path.isfile(path) and os.access(path, os.X_OK)
+
+# TODO: Use shutil.which once we switch to Python3.
+def _is_on_path(basename):
+  for path in os.environ['PATH'].split(os.pathsep):
+    full_path = os.path.join(path, basename)
+    if _is_executable(full_path):
+      return True
+  return False
+
+
+def _subprocess_call(argv, **kwargs):
+  logging.info('Running %r', argv)
+  return subprocess.call(argv, **kwargs)
+
+
+def _git_check_call(argv, **kwargs):
+  argv = [GIT]+argv
+  logging.info('Running %r', argv)
+  subprocess.check_call(argv, **kwargs)
+
+
+def _git_output(argv, **kwargs):
+  argv = [GIT]+argv
+  logging.info('Running %r', argv)
+  return subprocess.check_output(argv, **kwargs)
+
+
+def parse_args(argv):
+  """This extracts a subset of the arguments that this bootstrap script cares
+  about. Currently this consists of:
+    * an override for the recipe engine in the form of `-O recipe_engine=/path`
+    * the --package option.
+  """
+  PREFIX = 'recipe_engine='
+
+  p = argparse.ArgumentParser(add_help=False)
+  p.add_argument('-O', '--project-override', action='append')
+  p.add_argument('--package', type=os.path.abspath)
+  args, _ = p.parse_known_args(argv)
+  for override in args.project_override or ():
+    if override.startswith(PREFIX):
+      return override[len(PREFIX):], args.package
+  return None, args.package
+
+
+def checkout_engine(engine_path, repo_root, recipes_cfg_path):
+  dep, recipes_path = parse(repo_root, recipes_cfg_path)
+  if dep is None:
+    # we're running from the engine repo already!
+    return os.path.join(repo_root, recipes_path)
+
+  url = dep.url
+
+  if not engine_path and url.startswith('file://'):
+    engine_path = urlparse.urlparse(url).path
+
+  if not engine_path:
+    revision = dep.revision
+    branch = dep.branch
+
+    # Ensure that we have the recipe engine cloned.
+    engine_path = os.path.join(recipes_path, '.recipe_deps', 'recipe_engine')
+
+    with open(os.devnull, 'w') as NUL:
+      # Note: this logic mirrors the logic in recipe_engine/fetch.py
+      _git_check_call(['init', engine_path], stdout=NUL)
+
+      try:
+        _git_check_call(['rev-parse', '--verify', '%s^{commit}' % revision],
+                        cwd=engine_path, stdout=NUL, stderr=NUL)
+      except subprocess.CalledProcessError:
+        _git_check_call(['fetch', url, branch], cwd=engine_path, stdout=NUL,
+                        stderr=NUL)
+
+    try:
+      _git_check_call(['diff', '--quiet', revision], cwd=engine_path)
+    except subprocess.CalledProcessError:
+      _git_check_call(['reset', '-q', '--hard', revision], cwd=engine_path)
+
+    # If the engine has refactored/moved modules we need to clean all .pyc files
+    # or things will get squirrely.
+    _git_check_call(['clean', '-qxf'], cwd=engine_path)
+
+  return engine_path
+
+
+def main():
+  for required_binary in REQUIRED_BINARIES:
+    if not _is_on_path(required_binary):
+      return 'Required binary is not found on PATH: %s' % required_binary
+
+  if '--verbose' in sys.argv:
+    logging.getLogger().setLevel(logging.INFO)
+
+  args = sys.argv[1:]
+  engine_override, recipes_cfg_path = parse_args(args)
+
+  if recipes_cfg_path:
+    # calculate repo_root from recipes_cfg_path
+    repo_root = os.path.dirname(
+      os.path.dirname(
+        os.path.dirname(recipes_cfg_path)))
+  else:
+    # find repo_root with git and calculate recipes_cfg_path
+    repo_root = (_git_output(
+      ['rev-parse', '--show-toplevel'],
+      cwd=os.path.abspath(os.path.dirname(__file__))).strip())
+    repo_root = os.path.abspath(repo_root)
+    recipes_cfg_path = os.path.join(repo_root, 'infra', 'config', 'recipes.cfg')
+    args = ['--package', recipes_cfg_path] + args
+
+  engine_path = checkout_engine(engine_override, repo_root, recipes_cfg_path)
+
+  return _subprocess_call([
+      VPYTHON, '-u',
+      os.path.join(engine_path, 'recipe_engine', 'main.py')] + args)
+
+
+if __name__ == '__main__':
+  sys.exit(main())
diff --git a/infra/recipes/chromium_website.py b/infra/recipes/chromium_website.py
new file mode 100644
index 0000000..e02b2b0
--- /dev/null
+++ b/infra/recipes/chromium_website.py
@@ -0,0 +1,33 @@
+# Copyright 2021 The Chromium Authors. All rights reserved.
+# Use of this source code is governed under the Apache License, Version 2.0
+# that can be found in the LICENSE file.
+"""Recipe for building and deploying the www.chromium.org static website."""
+
+from recipe_engine.post_process import DropExpectation
+from recipe_engine.recipe_api import Property
+
+
+DEPS = [
+    'recipe_engine/buildbucket',
+    'recipe_engine/properties',
+    'recipe_engine/runtime',
+    'recipe_engine/step',
+]
+
+PROPERTIES = {
+    'repository': Property(kind=str, default='https://chromium.googlesource.com/experimental/chromium_website'),
+}
+
+
+def RunSteps(api, repository):
+  # TODO(dpranke): Fill this in once the builders are alive.
+  pass
+
+
+
+def GenTests(api):
+  yield api.test(
+      'ci',
+      api.buildbucket.ci_build(),
+      api.post_process(DropExpectation),
+      )