Fix setting the tempest virtual env constraints env var

Heat upgrade script set the env var TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE
which are used to use the constraints during Tempest virtual env
installation. Those env var are set to non-master constraint when
we need to use non-master constraints but when we need to use the
master constraints we do not set/reset them point to master constraints.

This create the issue when this grenade script install the tempest with
stable constraints but with master Tempest and as there is mismatch of
constraints now with fasteners of stable branches. Below is failure
of heat greande job on stable/yoga

- https://zuul.opendev.org/t/openstack/build/3aaec4d59bb84068bb4d4428ea747cbd/log/controller/logs/grenade.sh_log.txt#3245

Similar way, role should set stable constraints only for the stable EM branch
not for all otherwise it fail when constraints/requirements are bumped.

- https://zuul.opendev.org/t/openstack/build/74f86b8097f44c35acaffdcfe41d9693

We should set/reset those constraint env var to master constraints if configuration
tell to use the master constraints.

Note:
This backport includes change Ie552e6398c10797e4df4afe757760c48ca7f80af
to unblock gate by a single commit.

Closes-Bug: #2003993
Change-Id: I024cd134577338fc1075e7742df7f006dc914646
(cherry picked from commit dbbba907d396158ce3bf3a207a8875b9fbb5a5b1)
(cherry picked from commit b29266398fbb4e623faaa6a894de2a33bb2846a7)
(cherry picked from commit 391684581b60bf1ca7a88f2c52898cd22cfd48f1)
(cherry picked from commit 1360cfdfa3026ce09e86c9f67e38c390229477fd)

4 files changed, 39 insertions, 4 deletions

diff --git a/devstack/upgrade/resources.sh b/devstack/upgrade/resources.sh
index 3f00dce9d..277e37dcf 100755
--- a/devstack/upgrade/resources.sh
+++ b/devstack/upgrade/resources.sh
@@ -64,14 +64,40 @@ function _run_heat_integrationtests {
     # Run set of specified functional tests
     UPGRADE_TESTS=upgrade_tests.list
     _write_heat_integrationtests $UPGRADE_TESTS
-    export UPPER_CONSTRAINTS_FILE=$DEST/requirements/upper-constraints.txt
-    export TOX_CONSTRAINTS_FILE=$UPPER_CONSTRAINTS_FILE
+    # NOTE(gmann): heat script does not know about
+    # TEMPEST_VENV_UPPER_CONSTRAINTS, only DevStack does.
+    # This sources that one variable from it.
+    TEMPEST_VENV_UPPER_CONSTRAINTS=$(set +o xtrace &&
+        source $devstack_dir/stackrc &&
+        echo $TEMPEST_VENV_UPPER_CONSTRAINTS)
+    # NOTE(gmann): If gate explicitly set the non master
+    # constraints to use for Tempest venv then use the same
+    # while running the tests too otherwise, it will recreate
+    # the Tempest venv due to constraints mismatch.
+    # recreation of Tempest venv can flush the initially installed
+    # tempest plugins and their deps.
+    if [[ "$TEMPEST_VENV_UPPER_CONSTRAINTS" != "master" ]]; then
+        echo "Using $TEMPEST_VENV_UPPER_CONSTRAINTS constraints in Tempest virtual env."
+        # NOTE: setting both tox env var and once Tempest start using new var
+        # TOX_CONSTRAINTS_FILE then we can remove the old one.
+        export UPPER_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+        export TOX_CONSTRAINTS_FILE=$TEMPEST_VENV_UPPER_CONSTRAINTS
+    else
+        # NOTE(gmann): we need to set the below env var pointing to master
+        # constraints even that is what default in tox.ini. Otherwise it
+        # can create the issue for grenade run where old and new devstack
+        # can have different tempest (old and master) to install. For
+        # detail problem, refer to the
+        # https://bugs.launchpad.net/devstack/+bug/2003993
+        export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
+        export TOX_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/master
+    fi
     export HEAT_TEMPEST_PLUGIN=$DEST/heat-tempest-plugin
     sudo git config --system --add safe.directory $HEAT_TEMPEST_PLUGIN
     tox -evenv-tempest -- pip install -c$UPPER_CONSTRAINTS_FILE $HEAT_TEMPEST_PLUGIN
     tox -evenv-tempest -- stestr --test-path=$DEST/heat/heat_integrationtests --top-dir=$DEST/heat \
         --group_regex='heat_tempest_plugin\.tests\.api\.test_heat_api[._]([^_]+)' \
-        run --whitelist-file $UPGRADE_TESTS
+        run --include-list $UPGRADE_TESTS
     _heat_set_user
     popd
 }
diff --git a/roles/run-heat-tests/defaults/main.yaml b/roles/run-heat-tests/defaults/main.yaml
index 22ce4a490..1ae87b9ed 100644
--- a/roles/run-heat-tests/defaults/main.yaml
+++ b/roles/run-heat-tests/defaults/main.yaml
@@ -3,3 +3,4 @@ tempest_test_timeout: ''
 tempest_tox_environment: {}
 heat_tempest_plugin: /opt/stack/heat-tempest-plugin
 constraints_file: /opt/stack/requirements/upper-constraints.txt
+target_branch: "{{ zuul.branch }}"
diff --git a/roles/run-heat-tests/tasks/main.yaml b/roles/run-heat-tests/tasks/main.yaml
index 4af1d0e03..03661d774 100644
--- a/roles/run-heat-tests/tasks/main.yaml
+++ b/roles/run-heat-tests/tasks/main.yaml
@@ -3,9 +3,17 @@
     tempest_tox_environment: "{{ tempest_tox_environment | combine({'OS_TEST_TIMEOUT': tempest_test_timeout}) }}"
   when: tempest_test_timeout != ''
 
+- name: Override target branch
+  set_fact:
+    target_branch: "{{ zuul.override_checkout }}"
+  when: zuul.override_checkout is defined
+
 - name: Set TOX_CONSTRAINTS_FILE
   set_fact:
+    # Set TOX_CONSTRAINTS_FILE/UPPER_CONSTRAINTS_FILE to stable constraints only
+    # for the EM stable branch where old tempest (not master) is used.
     tempest_tox_environment: "{{ tempest_tox_environment | combine({'UPPER_CONSTRAINTS_FILE': constraints_file}) | combine({'TOX_CONSTRAINTS_FILE': constraints_file}) }}"
+  when: target_branch in ["stable/ocata", "stable/pike", "stable/queens", "stable/rocky", "stable/stein", "stable/train", "stable/ussuri", "stable/victoria", "stable/wallaby"]
 
 - name: Allow git to read plugin directories
   become: true
diff --git a/test-requirements.txt b/test-requirements.txt
index bd3032139..62872ccaa 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -9,7 +9,7 @@ hacking>=3.0.1,<3.1.0 # Apache-2.0
 # care of pyflakes version compatibilty.
 pyflakes>=2.1.1
 
-bandit!=1.6.0,>=1.1.0 # Apache-2.0
+bandit!=1.6.0,>=1.1.0,<1.7.5 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
 kombu!=4.0.2,>=5.0.1 # BSD