Merge "Refactor publish-openstack-releasenotes"

zuul.d/jobs.yaml

@@ -346,11 +346,16 @@
         name: afs
 
 - job:
-    name: publish-openstack-releasenotes
+    name: publish-openstack-releasenotes-base
     description: |
-      Publish the results of build-openstack-releasenotes to
+      Abstract base job to publish the results of build-openstack-releasenotes to
       /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
-    final: true
+    # This job is protected-abstract because it sets the afs_subpath
+    # variable; it is not safe to let that be overridden in an
+    # untrusted job because it would allow writing outside of the
+    # project's directory on the production doc site.
+    protected: true
+    abstract: true
     pre-run: playbooks/releasenotes/pre.yaml
     run: playbooks/releasenotes/run.yaml
     post-run:
@@ -369,31 +374,32 @@
       - secret: afsdocs_secret
         name: afs
 
+- job:
+    name: publish-openstack-releasenotes
+    parent: publish-openstack-releasenotes-base
+    description: |
+      Publish the results of build-openstack-releasenotes to
+      /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
+    # This job is final because its parent sets the afs_subpath
+    # variable; it is not safe to let that be overridden in an
+    # untrusted job because it would allow writing outside of the
+    # project's directory on the production doc site.
+    final: true
+
 - job:
     name: publish-openstack-releasenotes-python3
+    parent: publish-openstack-releasenotes-base
     description: |
       Publish the results of build-openstack-releasenotes to
       /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
       Uses python3.
+    # This job is final because its parent sets the afs_subpath
+    # variable; it is not safe to let that be overridden in an
+    # untrusted job because it would allow writing outside of the
+    # project's directory on the production doc site.
     final: true
-    pre-run: playbooks/releasenotes/pre.yaml
-    run: playbooks/releasenotes/run.yaml
-    post-run:
-      - playbooks/publish/releasenotes.yaml
-      - playbooks/publish/openstack-afs.yaml
-    override-branch: master
-    required-projects:
-      - name: openstack/requirements
-    roles:
-      - zuul: openstack-infra/zuul-jobs
     vars:
-      afs_subpath: "/releasenotes/{{ zuul.project.short_name }}"
-      constraints_file: '{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt'
-      sphinx_build_dir: releasenotes/build
       sphinx_python: python3
-    secrets:
-      - secret: afsdocs_secret
-        name: afs
 
 - job:
     name: publish-openstack-specs