[rjd15372]

Why

EXPECTED_VERSIONS (sent to the Jenkins QA jobs so they check the versions we actually ship) was derived by parsing each package's obs/_service locally, with one heuristic per service type. When a package's version could not be derived it was silently dropped, and the test suites fell back to their own tables. Release PR #148 hit this with pgBackRest 2.60.0 (download_url): every container, server and tarball lane failed against correct binaries. 8f803fe patched that service type; this PR removes the class of bug.

OBS already knows the answer: every built binary carries its version in its file name.

Spec: docs/superpowers/specs/2026-10-20-obs-built-versions-design.md · Plan: docs/superpowers/plans/2026-10-20-obs-built-versions.md

What

• percona_obs/obs_versions.py (new): one GET /build/<prj>/_result?view=binarylist per OBS project (cached per run) gives every package's versrel per repository; source artifacts (.src.rpm, .dsc) are preferred; _version_from_binary now reads them. Aggregates are covered: OBS lists aggregated binaries under the aggregating package. A 404 means "project absent"; any other error stops the command naming the project.
• qa run computes EXPECTED_VERSIONS from the OBS project under test for every lane (PR, staging, nightly, pre-release):
  • value = upstream version (versrel without release); the repositories of the instance's slice must agree;
  • a conflict aborts the run before any trigger only if a selected lane sends that package; other conflicts are warnings;
  • packages without binaries are left out and named in one warning (no silent drop);
  • the local tree still decides which packages (artifact-recipe packages excluded; first provider wins and a name taken by a higher-priority project stays taken);
  • PR lanes read packages absent from the PR project from the fallback root (image-fallback-rootprj); a present package whose build failed never falls back;
  • release mirrors take their structure from the staging project named by release.yaml and read versions from the pre-release (production ppg:releases:* is never read);
  • a missing project under test is an error.
• qa show computes EXPECTED_VERSIONS only with --expected-versions, so CI matrix detection (list_qa_matrix.py) makes no OBS request.
• project release stops baking EXPECTED_VERSIONS into release mirrors; copied package lanes carry package: <pkg>, a new validated qa-entry key that restricts the entry to that package's line.
• project versions --online: package rows use the same batch request (one per project instead of per package × repository), keep printing the full versrel (now from the first repository in sorted order) and warn when repositories disagree. Image rows unchanged.
• Docs: docs/PERCONA_OBS_TOOL.md, .github/copilot-instructions.md, the two-hop release spec.

Verification

• pytest: 737 passed; pyright: 0 errors; black --check percona_obs/ tests/: clean.
• Live, read-only qa show --expected-versions --json on build.opensuse.org (-P isv) and labs (-P labsmain) for ppg:staging:{17,18,19} and their :containers: all exit 0, no conflicts, percona-pgbackrest=2.60.0 everywhere, percona-postgresql=19.0.1~rc1 on staging:19. Compared with the old local parser the lane sets are identical and the values only gain packages the parser could not see (GIS libraries, llvm-21, ppg-server, build dependencies; labs container lanes grow from 50 to 89 lines).

Follow-up after merge

Refresh release PR #148 (project release for 17 and 18): its mirrors lose the baked values and the release lanes compute from the pre-release projects.