Remove Release Managers from post-release groups

After discussion in a recent release managers meeting, we decided
that Release Managers should be removed from the -release-branch
groups post-release, rather than always be present.

This change adjusts the code to match that policy:
- removes release managers in post-release action
- ensures presence of release managers as part of the pre-release
  action instead of withing a specific ensure_rm action
- add comments to match the policy in the code

Change-Id: I4f900ba66a906031f0a3143aaf25c18700d8012d

README.rst

@@ -854,10 +854,10 @@ The 'acls' action helps to produce a patch over openstack-infra/project-config
 that inserts a specific ACL for stable/$SERIES.
 
 The 'groups' action helps to adjust the membership of $PROJ-release-branch
-Gerrit groups, to ensure presence of Release Managers (ensure_rm subaction),
-remove $PROJ-stable-maint and add the $PROJ-release group (pre_release
-subaction) or remove $PROJ-release and add $PROJ-stable-maint (post_release
-subaction).
+Gerrit group, based on which stage the release branch is at. At pre-release
+we remove $PROJ-stable-maint, and add the $PROJ-release and Release Managers
+group (pre_release subaction). At post-release, we remove $PROJ-release and
+Release Managers, and add $PROJ-stable-maint (post_release subaction).
 
 Examples:
 

aclmanager.py

@@ -122,13 +122,21 @@ def modify_gerrit_groups(args):
     """Handles the 'groups' action"""
 
     if args.stage == 'pre_release':
-        actions = [('DELETE', lambda x: '%s-stable-maint' % x),
-                   ('PUT', lambda x: '%s-release' % x)]
+        # At pre-release stage we want to have $PROJECT-release and
+        # Release Managers (and remove $PROJECT-stable-maint if present)
+        actions = [
+            ('PUT', lambda x: '%s-release' % x),
+            ('PUT', lambda x: 'Release Managers'),
+            ('DELETE', lambda x: '%s-stable-maint' % x),
+        ]
     elif args.stage == 'post_release':
-        actions = [('DELETE', lambda x: '%s-release' % x),
-                   ('PUT', lambda x: '%s-stable-maint' % x)]
-    elif args.stage == 'ensure_rm':
-        actions = [('PUT', lambda x: 'Release Managers')]
+        # At post-release stage we want to have $PROJECT-stable-maint
+        # (and remove Release Managers and $PROJECT-release if present)
+        actions = [
+            ('PUT', lambda x: '%s-stable-maint' % x),
+            ('DELETE', lambda x: 'Release Managers'),
+            ('DELETE', lambda x: '%s-release' % x),
+        ]
 
     # Build the list of calls to make
     print('Computing the list of modifications')
@@ -177,7 +185,7 @@ def main(args=sys.argv[1:]):
         help='modify Gerrit groups membership')
     do_groups.add_argument(
         'stage',
-        choices=['ensure_rm', 'pre_release', 'post_release'],
+        choices=['pre_release', 'post_release'],
         help='type of modification to push')
     do_groups.add_argument(
         'username',