check-release-approval job improvements

Limit check-release-approval to openstack/releases since no
other repository should be using it.

Also fix a corner case where release requests combined with
other changes would crash the check code (only changes in
deliverable files should be taken into account).

Change-Id: I2d744c1d4dfe13a795c0d6754520d1bbf39162b5

roles/check-release-approval/files/check_approval.py

@@ -90,7 +90,10 @@ class GerritChange(object):
                           if i['value'] > 0]
         self.approvers.append(decoded['owner']['email'])
         currev = decoded['current_revision']
-        self.deliv_files = list(decoded['revisions'][currev]['files'].keys())
+        self.deliv_files = [
+            x for x in decoded['revisions'][currev]['files'].keys()
+            if x.startswith('deliverables/')
+        ]
         self.workspace = args.releases
 
     def is_approved(self):

zuul.d/jobs.yaml

@@ -1130,9 +1130,13 @@
 - job:
     name: check-release-approval
     description: |
-      Checks that release was approved by PTL or release liaison.
+      Checks that release requests were approved by PTL or release liaison.
+
+      This job is specific to the openstack/releases repository.
     files:
       - ^deliverables/.*$
+    allowed-projects:
+      - openstack/releases
     required-projects:
       - name: openstack/governance
     run: playbooks/check-release-approval/run.yaml