pkg-merge-upstream-to-downstreams: Ensure the target branch exist

When pulling an update for a stable branch it should target a `-updates`
or `-security` branch. However there's no guarantee that they exist, so
the creaton of the merge may fail:

    remote:              WARNINGS: Error encountered with push options
    remote:       'merge_request.create' 'merge_request.remove_source_branch'
    remote:              'merge_request.target=apertis/v2021-security'
    remote:       'merge_request.title=Update from debian/buster-security for
    remote:     apertis/v2021-security': Branch apertis/v2021-security does not
    remote:                                  exist

To avoid that, ensure to push the target branch before creating the MR.

Unfortunately we can't simply use `git push` as the creation of
protected branches is restricted to the Web UI and the API, so let's use
the latter, even if it requires a bit of juggling.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

package-source-builder/overlay/usr/bin/apertis-pkg-merge-upstream-to-downstreams

@@ -13,6 +13,8 @@ from sh import apertis_pkg_merge_updates, echo, ErrorReturnCode
 import re
 from pathlib import Path
 from functools import partial
+import urllib.request
+import urllib.parse
 
 def parse_ref(ref: str) -> str:
     return git('rev-parse', '-q', '--verify', ref + '^{commit}', _ok_code=[0, 1]).strip('\n')
@@ -54,6 +56,37 @@ def is_minor_change(upstream, downstream):
   o = git('diff', '--exit-code', upstream, downstream, ':!debian/changelog', ':!debian/apertis/*', _ok_code=[0,1])
   return o.exit_code == 0
 
+def ensure_downstream_branch(project_url, downstream):
+  if parse_ref(f"origin/{downstream}"):
+      return
+  downstream_commit = parse_ref(downstream)
+  print(f"Ensure the target branch '{downstream}' ({downstream_commit}) is available", flush=True)
+  url = urllib.parse.urlsplit(project_url)
+  project_id = urllib.parse.quote(url.path.strip("/").removesuffix(".git"), safe="")
+  # drop the inline auth data as urllib does not like it
+  auth, netloc_no_auth = url.netloc.split("@", 1)
+  token = auth.split(":", 1)[-1]
+  url = url._replace(
+      path=f"/api/v4/projects/{project_id}/repository/branches",
+      netloc=netloc_no_auth,
+  )
+  project_branches_url = url.geturl()
+  # TODO: add `ci.skip` once it is avaliable from the API
+  data = {"branch": urllib.parse.quote(downstream), "ref": downstream_commit}
+  print(f"POST'ing to {project_branches_url}: {data}")
+  req = urllib.request.Request(
+      url=project_branches_url,
+      method="POST",
+      headers={"PRIVATE-TOKEN": token},
+      data=urllib.parse.urlencode(data).encode('ascii'),
+  )
+  try:
+      res = urllib.request.urlopen(req).read().decode('utf-8')
+  except urllib.error.HTTPError as e:
+      print("ERROR:", e.read().decode())
+      raise
+  print(res)
+
 def push_merge_request(project_url, proposed_branch, upstream, downstream, auto_merge = '', dry_run=False):
   title = f"Update from {upstream} for {downstream}"
   print(f"Pushing {proposed_branch}: {title}")
@@ -67,6 +100,8 @@ def push_merge_request(project_url, proposed_branch, upstream, downstream, auto_
   else:
     print('Merge should be reviewed')
 
+  ensure_downstream_branch(project_url, downstream)
+
   print(f"Create merge request from '{proposed_branch}' to '{downstream}'", flush=True)
   git_push_custom(
     "-o", "merge_request.create",