[api] support staging without write access in GA projects

[adrianschroeter]

SLSA requires seperation of release managers and code stream managers. Therefore release managers just approve reviews and the code stream managers using the request approve mechanism.

As consequence the release managers have no write access anymore in the GA projects:

• request gets not accepted directly via staging api, just indirect via approve mechanism
• modifications outside of the requests (like fiddeling with local links) are not allowed anymore

jsc#OBS-200

[adrianschroeter]

this is just currently an untested draft, needs further investigation and testing. And esp. review of permission handling.

[eduardoj]

@adrianschroeter, only a small note about labelling pull requests: we usually create issues and label them with a priority label (P2 for example). And after that we create pull requests which could solve the issue. This helps us to separate the problem (and assign to it a prioriy) from the solution.

[hennevogel]

Depends on #12789 and #12787

[dmarcoux]

Depends on #12789 and #12787

Both are now merged. Rebasing...

[hennevogel]

Now depends on #12816

[hennevogel]

And now depends on #12845

[codecov[bot]]

Codecov Report

Merging #12771 (0abb3bf) into master (8350159) will increase coverage by 0.00%. The diff coverage is 96.55%.

@@           Coverage Diff           @@
##           master   #12771   +/-   ##
=======================================
  Coverage   88.49%   88.49%           
=======================================
  Files         698      698           
  Lines       23847    23851    +4     
=======================================
+ Hits        21103    21107    +4     
  Misses       2744     2744           

[hennevogel]

@coolo can you have another look please?

[hennevogel]

Let's go then @adrianschroeter @coolo right?

[adrianschroeter]

sure, it works in production since quite some time.

[coolo]

This broke staging accept as the release tools always accept with force after checking on client side that everything is in acceptable. As acceptable is not in FORCEABLE_STATES this fails now.

The reason we have to accept with force is that if you accept two stagings at the same time, the 2nd one will flip to 'building' due to the scheduler thinking "oh, something in Factory changed, let me check if all the projects linking to it need to change".

[DimStar77]

That's already monkey patched on OBS (https://github.com/openSUSE/open-build-service/pull/13004)