Update gating for modular, flatpaks, containers, EPEL, ELN

[Adam Williamson]

Hey folks!

The last couple of days I've been poking in Fedora's greenwave config.
I've rewritten it quite a lot to be clearer about what it actually
does. This is how it looks now:

https://pagure.io/fedora-infra/ansible/blob/master/f/roles/openshift-apps...

Functionally, that is (I think, anyway) pretty much equivalent to how
it was a week ago, just clearer:

https://pagure.io/fedora-infra/ansible/blob/b0a3761288eb059acfbe214962e08...

So I wanted to ask about something I figured out while working on it.
If I'm understanding it correctly, one consequence of our policy is
that setting rules in a src.fedoraproject.org repo does not work for
anything outside of the 'mainline' dists - fedora-31, fedora-32,
fedora-33, fedora-34 - because those are the only product_versions
included in the policies that apply the rule `!RemoteRule {}`. That
rule is what actually tells greenwave to look for "remote" policies
(i.e. gating.yaml files in the package repo) and apply them.

The docs don't really cover this in detail at all:

https://docs.fedoraproject.org/en-US/ci/gating/

They just say that the example config (which uses fedora-* as
product_versions) "will enable gating for all Fedora releases based on
the result of the CI Pipeline", without getting into details about what
"all Fedora releases" means exactly.

So, I wondered: assuming I'm interpreting this right, is it
intended/correct that package-level gating policies can't apply to
modular, flatpak, container, EPEL or ELN updates? If so, should we
document this in the above document? If not, should we fix it?

"Fixing" it could be slightly tricky given an unfortunate consequence
of how we name things and the limitations of wildcards. You may well
want to express "this policy applies to all mainline Fedora updates but
not anything else", but you really can't; the wildcard "fedora-*"
matches more than that, but you can't use anything as fancy as a regex
like "fedora-[0-9]*" to match "fedora-32" but not
"fedora-modular-32".
You also can't (AIUI) have Greenwave policies "override" each other,
because they're additive - you can't define a policy for "fedora-
modular-*" that "overrides" the policy for "fedora-*".

So we'd want to consider that if we were to change this in the infra
greenwave policy; the existing docs explicitly recommend the "fedora-*"
wildcard, which means people have probably used it, which means if we
change this in the infra greenwave policy, existing policies people
have written will start, possibly unexpectedly, applying to updates
they wouldn't have applied to before. We'd at least want to communicate
that and explain the options for dealing with it, I guess. I don't know
if we want to get as fancy as allowing regexes for `product_versions`
:)

Thanks folks!
-- 
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net