Use PR workflow for updating the lockfile

[jlebon]

Right now, config-bot only supports directly promoting the lockfile using git push. We should enhance it so that it instead opens up a PR to bump the lockfile. This unlocks (pun intended) a few things:

• a better CI workflow: we can actually test the OS against the latest base content before absorbing it
• smarter integration with coreos-koji-tagger: right now, it tags packages once the lockfile is merged, at which point builds won't actually succeed until the packages are signed (if not already), moved to the coreos-pool tag, and the coreos-pool repo is respinned. This means that there's a window of time during which testing-devel would be unbuildable. Switching to a PR workflow would allow e.g. a merge bot to do the tagging and waiting for the repo respin before doing the merge, so that testing-devel can always be built.

[dustymabe]

related: we can open a PR via curl:

https://github.com/coreos/fedora-coreos-pipeline/blob/cf9f40ede1ac700074ade168d383f68529ad4fff/Jenkinsfile.stream.metadata.generator#L59

[jlebon]

Just mentioning this here for lack of a better place. Part of working on this, we should look at how we expect PR testing to work such that we can still get meaningful CI testing of overrides before merging. (See e.g. coreos/fedora-coreos-config#186 (comment)).

[jlebon]

Part of working on this, we should look at how we expect PR testing to work such that we can still get meaningful CI testing before merging.

I think one easy way to do this without having the tagger tag things in before merging is to have CI just go and fetch all the RPMs mentioned in the overrides directly from Koji and drop them in overrides/rpm.

[dustymabe]

I think one easy way to do this without having the tagger tag things in before merging is to have CI just go and fetch all the RPMs mentioned in the overrides directly from Koji and drop them in overrides/rpm.

that's a good idea!

[jlebon]

This is obsolete now that we've moved lockfile bumping to https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile.