infra-prod: clone source once

The current opendev-infra-prod-base job sets up the executor to log
into bridge AND copies in Zuul's checkout of system-config to
/home/zuul/src.

This presents an issue for parallel operation, as every production job
is cloning system-config ontop of each other.

Since they all operate in the same buildset, we only need to clone
system-config from Zuul once, and then all jobs can share that repo.

This adds a new job "infra-prod-setup-src" which does this.  It is a
dependency of the base job so should run first.

All other jobs now inhert from opendev-infra-prod-setup-keys, which
only sets up the executor for logging into bridge.

Change-Id: I19db98fcec5715c33b62c9c9ba5234fd55700fd8
Depends-On: https://review.opendev.org/c/opendev/base-jobs/+/807807

playbooks/zuul/setup-production-workspace.yaml

@@ -0,0 +1,6 @@
+- hosts: bridge.openstack.org
+  become: true
+  tasks:
+    - name: Placeholder
+      debug:
+        msg: 'Setup production workspace tasks running'

zuul.d/infra-prod.yaml

@@ -7,9 +7,27 @@
     name: infra-prod-playbook
     max: 1
 
+# This job is intended to run first and setup the bridge source repo
+# to the state of the current buildset.  After this, deployment jobs
+# can run in parallel using this source checkout.
+- job:
+    name: infra-prod-setup-src
+    parent: opendev-infra-prod-setup-src
+    description: |
+      Replicate Zuul source repos to bridge
+
+      This replicates the Zuul source state to the bridge node.  This
+      should be run once per buildset.
+    semaphores: infra-prod-playbook
+    # The action actually happens in opendev-infra-prod-setup-src
+    # because it's a trusted playbook.  But this might be a handy
+    # place to hook in things such as writing out secrets from Zuul in
+    # the future?
+    run: playbooks/zuul/setup-production-workspace.yaml
+
 - job:
     name: infra-prod-playbook
-    parent: opendev-infra-prod-base
+    parent: opendev-infra-prod-setup-keys
     description: |
       Run specified playbook against productions hosts.
 

zuul.d/project.yaml

@@ -353,10 +353,15 @@
         # dependencies here rather than job definitions to help keep
         # these relationships clear.
 
+        # This job replicates the system-config from this buildset
+        # onto bridge
+        - opendev-infra-prod-setup-src
+
         # This installs the ansible on bridge that all the infra-prod
         # jobs will run with.  Note the jobs use this ansible to then
         # run against zuul's checkout of system-config.
-        - infra-prod-install-ansible
+        - infra-prod-install-ansible:
+            dependencies: opendev-infra-prod-setup-src
 
         # From now on, all jobs should depend on base
         - infra-prod-base: &infra-prod-base