Fix missing label evaluation in Gerrit

Fixes the way that missing labels are handled in Gerrit. The intention
is that labels provided by Zuul are removed from the set of missing
labels on the change (and thus ignored). The original code was using the
">" set comparison operator to do this, but this operator is actually
"issuperset()". This means that if there was any disjoint members in the
allow_needs set (that is allow_needs had labels that were not missing),
the comparison would be False, and any actual missing labels would be
ignored.

The fix is to use set difference to calculate the missing labels and
remove the allow_needs set. If any labels are left after this, they are
actually missing and the change cannot be merged

Change-Id: Ibdb5df44e80d75198493f8287443ed19bcf269f1

releasenotes/notes/gerrit-missing-labels-fix-d315cec13a7af6a5.yaml

@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    Fixes a bug where Zuul would incorrectly enqueue a Gerrit change that could
+    not be submitted due to missing labels in a dependent pipeline.
+
+    Specifically, if change had a score for any label that would provided by
+    Zuul, all other missing labels would be incorrectly ignored.

tests/unit/test_gerrit.py

@@ -1059,6 +1059,25 @@ class TestGerritConnection(ZuulTestCase):
         self.assertEqual(A.queried, 3)
         self.assertEqual(A.data['status'], 'MERGED')
 
+    def test_submit_missing_labels(self):
+        # This test checks that missing labels will not allow a change to
+        # enqueued. Specifically in this case the Code-Review and Verified is
+        # missing (but Verified is ignored because Zuul will score it)
+        A = self.fake_gerrit.addFakeChange('org/project', 'master', 'A')
+        self.fake_gerrit.addEvent(A.addApproval('Approved', 1))
+        self.waitUntilSettled()
+        self.assertHistory([])
+
+        # Even adding the Verified score already provided by Zuul will not
+        # cause the change to gate
+        self.fake_gerrit.addEvent(A.addApproval('Verified', 2))
+
+        # Reapply this score to trigger gate, which shouldn't happen because of
+        # the still missing Code-Review label
+        self.fake_gerrit.addEvent(A.addApproval('Approved', 1))
+        self.waitUntilSettled()
+        self.assertHistory([])
+
 
 class TestGerritUnicodeRefs(ZuulTestCase):
     config_file = 'zuul-gerrit-web.conf'

zuul/driver/gerrit/gerritconnection.py

@@ -1067,9 +1067,10 @@ class GerritConnection(ZKChangeCacheMixin, ZKBranchCacheMixin, BaseConnection):
             return True
         if change.wip:
             return False
-        if change.missing_labels > set(allow_needs):
+        missing_labels = change.missing_labels - set(allow_needs)
+        if missing_labels:
             self.log.debug("Unable to merge due to "
-                           "missing labels: %s", change.missing_labels)
+                           "missing labels: %s", missing_labels)
             return False
         for sr in change.submit_requirements:
             if sr.get('status') == 'UNSATISFIED':