koji: Add supported git branches (eg: {8.3, master} for v8.3-* tags)

make `koji_build` accept builds for v8.3 and from both `master` and `8.3`

Preparation for switch `master` to be "next" aka v9

The motivation of change is part of a bigger
plan, to prepare a smooth transition to enable bleeding edge
development on master branch. Of course maintenance will remain in
v8.x branches.

Once the master branch needs to be stabilized then a new 9.0 branch
can be open (this mean declared in PROTECTED_TARGETS, and also move
the `master` branch from `8.3` target to `9.0` for a future cycle)

Note that `8.3` git branches are not created yet in repos, it would
make sense to open them soon or later, ideally when master branches
need to receive feature from next release. Coincidentaly thoses 8.3
branches will be used for maintenance of the LTS release and then
developers/RE might consider back-porting fixes from master to 8.3.

Extra remarks, from squashed changes

About "Handle undeclared branches differently than empty set..."

This was not obvious to me that non protected targets are granted.  If
target is not declared, and then branches name not checked, just
presence of commits, more logs provided to users.

About "Pylint source, fix redefined-builtin W0622"

Fix redefined-builtin mistake on hash (BTW I noticed similar mistakes
elsewhere to be fixed in later PR that pylint the script)

About "Log exception on missing remote branches",

I removed the expression "()" containing the results because it is
useless and not working when there is no result. now it raises an
exception (which will be ignored and attempt to look for commit in
other branches, a log may be printed to help trouble shoot.)

Relate-to: #774 (comment)
Co-authored-by: Yann Dirson <yann.dirson@vates.tech>
Signed-off-by: Philippe Coval <philippe.coval@vates.tech>

Author: rzr

scripts/koji/koji_build.py

@@ -16,14 +16,14 @@
 
 TIME_FORMAT = '%Y-%m-%d-%H-%M-%S'
 
-# target -> required branch
+# target -> allowed branch(es), For unsupported targets just assign an empty set :"{}"
 PROTECTED_TARGETS = {
-    "v8.2-ci": "8.2",
-    "v8.2-fasttrack": "8.2",
-    "v8.2-incoming": "8.2",
-    "v8.3-ci": "master",
-    "v8.3-fasttrack": "master",
-    "v8.3-incoming": "master",
+    "v8.2-ci": {"8.2"},
+    "v8.2-fasttrack": {"8.2"},
+    "v8.2-incoming": {"8.2"},
+    "v8.3-ci": {"master", "8.3"},
+    "v8.3-fasttrack": {"master", "8.3"},
+    "v8.3-incoming": {"master", "8.3"},
 }
 
 @contextmanager
@@ -46,20 +46,30 @@ def check_git_repo(dirpath):
     with cd(dirpath):
         return subprocess.run(['git', 'diff-index', '--quiet', 'HEAD', '--']).returncode == 0
 
-def check_commit_is_available_remotely(dirpath, hash, target, warn):
+def check_commit_is_available_remotely(dirpath, sha, target, warn):
     with cd(dirpath):
-        if not subprocess.check_output(['git', 'branch', '-r', '--contains', hash]):
+        output = subprocess.check_output(['git', 'branch', '-r', '--contains', sha])
+        if not line:
             raise Exception("The current commit is not available in the remote repository")
+        logging.debug('Commit %s is contained in remote branch: %s', sha, output.decode().strip())
+        
         if target is not None and re.match(r'v\d+\.\d+-u-.+', target):
             raise Exception("Building with a user target requires using --pre-build or --test-build.\n")
         try:
-            expected_branch = PROTECTED_TARGETS.get(target)
-            if (
-                expected_branch is not None
-                and not is_remote_branch_commit(dirpath, hash, expected_branch)
-            ):
-                raise Exception(f"The current commit is not the last commit in the remote branch {expected_branch}.\n"
-                                f"This is required when using the protected target {target}.\n")
+            allowed_branches = PROTECTED_TARGETS.get(target)
+            if allowed_branches is None:
+                logging.debug('Target %s is not protected, any branch is allowed', target)
+            else:
+                for branch in allowed_branches:
+                    try:
+                        if is_remote_branch_commit(dirpath, sha, branch):
+                            logging.debug('Commit %s is on top of branch %s (target: %s)', sha, branch, target)
+                            break
+                    except Exception as e:
+                        logging.debug('Ignoring %s', e)
+                else:
+                    raise Exception(f"The current commit is not the last commit of any remote allowed branches: {allowed_branches}.\n"
+                                    f"This is required when using the protected target {target}.")
         except Exception as e:
             if warn:
                 print(f"warning: {e}", flush=True)
@@ -152,10 +162,12 @@ def push_bumped_release(git_repo, target, test_build_id, pre_build_id):
         return commit
 
 def is_remote_branch_commit(git_repo, sha, branch):
+    """ Return True if commit is on top of an assumed remote branch"""
     with cd(git_repo):
-        remote_sha = (
-            subprocess.check_output(['git', 'ls-remote', 'origin', f'refs/heads/{branch}']).decode().strip().split()[0]
-        )
+        references = subprocess.check_output(['git', 'ls-remote', 'origin', f'refs/heads/{branch}']).decode().strip().split()
+        if not references:
+            raise Exception(f'Missing remote branch "{branch}"')
+        remote_sha = references[0]
     return sha == remote_sha
 
 def build_id_of(name, candidate):