[rjd15372]

Problem

A PR that promotes one container image into isv:percona:PR:pr-N:…:containers still runs every lane of that project's qa: block, and each lane's REPOSITORY renders with the PR rootprj. PR projects hold only promoted packages and the registry publishes an image only under the project that built it, so the lanes for images that were not promoted point at registry paths that do not exist.

Change: image references in qa: parameters

A parameter whose value is a mapping names the image by its OBS package instead of spelling the path. The parameter name is irrelevant (REPOSITORY, OLD_DOCKER_REPOSITORY, …):

REPOSITORY:
  image: percona-pgbouncer
  repository: ubi9
  project: ppg:staging:18:containers   # optional, defaults to the lane's project

qa show / qa run render it to <OBS_CONTAINER_REGISTRY>/<rootprj>/<project>/<repository> and choose the root project per image:

image-fallback-rootprj set?	image listed in <rootprj>:<project> on OBS?	root used
no	not queried	current rootprj
yes	yes (promoted into the PR project)	current rootprj
yes	no	fallback rootprj

Each decision is printed on stderr and forwarded into the detect-job log.

• New profile key image-fallback-rootprj / flag --image-fallback-rootprj. CI writes it into the PR profiles only (obs-pr-check.yml, obs-qa-run.yml with a PR number); nightly and production dispatches never query OBS.
• project verify checks that image is a package directory of project and repository one of its repositories (projects not in the tree are skipped).
• list_qa_matrix.py now aborts in PR mode when qa show fails, instead of silently dropping that project's lanes.
• All staging container lanes converted (_shared/containers, common/containers, common/extras/containers, 16-18/extras/containers). On the production root they render byte-for-byte what the string form rendered.
• The string form (${OBS_CONTAINER_REGISTRY}/${OBS_CONTAINER_REGISTRY_ROOTPRJ}/…) keeps working; the tree test now forbids it in non-release project.yaml files.

Out of scope (by design)

A lane whose matrix axis selects the image inside Jenkins (WITH_POSTGIS on docker-server-parallel) names the plain image. When only -with-postgis was promoted, both combos test the fallback images; when only the plain image was promoted, the WITH_POSTGIS=true combo pulls a PR-root -with-postgis image that does not exist and fails. Documented in docs/PERCONA_OBS_TOOL.md → Image references.

Behaviour change to note

OLD_DOCKER_REPOSITORY in the 16/17/18 extras upgrade lanes was hard-coded to isv/percona. It is now an image reference on ppg:staging:<prev>:extras:containers, so a PR that promotes the previous major's custom image runs the upgrade test from the PR-built old image. Production and nightly render identically to before.

Relation to #124

#124 edits the same qa: blocks. Whichever lands second rebases; #124's new pgbackrest/pgbouncer lanes should use image references.

Verification

• pytest tests/ 557 passed; black, pyright clean.
• project verify --offline exits 0 with an unsliced profile and with a b.o.o-shaped profile (exclude-repositories: UBI_*,ubi*,images).
• qa show --json on every converted project, -R isv:percona: identical before/after (37 REPOSITORY values).

Plan: docs/superpowers/plans/2026-10-12-qa-image-refs.md.