From 8e52de52dbf79a40f2b3c53512d0197a8a3e9a1e Mon Sep 17 00:00:00 2001
From: Ian Wienand <iwienand@redhat.com>
Date: Fri, 29 May 2020 10:46:39 +1000
Subject: [PATCH] Restrict wheel publish jobs

Only allow requirements to run the wheel publish jobs.  This used to
be set on the build jobs, but we moved them to openstack-zuul-jobs so
they could be speculatively tested.

It makes sense to run the build jobs in the openstack-zuul-jobs gate
when the wheel build scripts are updated.

Thus move the allowed-projects to the publish jobs, which are actually
the bits that only requirements updates should write out.

See also Ica59634eec533db20fe8b1dd148ee9b4d041fd3c

Change-Id: I0574b69090409a6cd3f09f533a4dd7f710f89d2c
---
 zuul.d/jobs.yaml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 52a9f772a1..4c4840b113 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -855,6 +855,8 @@
     parent: build-wheel-mirror-centos-7
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -880,6 +882,8 @@
     parent: build-wheel-mirror-centos-8
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -905,6 +909,8 @@
     parent: build-wheel-mirror-centos-8-arm64
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -934,6 +940,8 @@
     parent: build-wheel-mirror-debian-buster
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -963,6 +971,8 @@
     parent: build-wheel-mirror-debian-buster-arm64
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -988,6 +998,8 @@
       Publish Ubuntu Focal wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1013,6 +1025,8 @@
       Publish Ubuntu Focal wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1042,6 +1056,8 @@
       Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1071,6 +1087,8 @@
       Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1100,6 +1118,8 @@
       Publish Ubuntu Xenial wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs
@@ -1129,6 +1149,8 @@
       Publish Ubuntu Xenial ARM64 wheels for OpenStack CI mirrors.
     pre-run: playbooks/openafs-client/setup.yaml
     post-run: playbooks/publish/wheel-mirror.yaml
+    allowed-projects:
+      - openstack/requirements
     final: true
     secrets:
       - name: afs