cosalib/gcp: attach to image family in separate API call

Currently we create an image and attach it to an image family in a
single API call. We'd like to attach it to an image family *after*
the image has been deprecated (deprecated images won't be given
to users who are trying to retrieve the latest image for an image
family). However, you can't create an image AND deprecate it in
the same API call so there is a split second of opportunity for
a user to get the newer GCP image before we've officially released
it.

This change breaks it up so that we can:

1. create the image (not part of a image family)
2. deprecate the image
3. attach the image to an image family

The new flow means there is no opportunity for a user to get an
image that has yet to be released.

src/cosalib/gcp.py

@@ -39,38 +39,58 @@ def gcp_run_ore(build, args):
     if args.project is None:
         raise Exception(arg_exp_str.format("project", "GCP_PROJECT"))
 
-    ore_args = ['ore']
-    if args.log_level == "DEBUG":
-        ore_args.extend(['--log-level', "DEBUG"])
-
     gcp_name = re.sub(r'[_\.]', '-', build.image_name_base)
     if not re.fullmatch(GCP_NAMING_RE, gcp_name):
         raise Exception(f"{gcp_name} does match the naming rule: file a bug")
-
     urltmp = os.path.join(build.tmpdir, "gcp-url")
-    ore_args.extend([
+
+    ore_common_args = [
+        'ore',
         'gcloud',
         '--project', args.project,
-        '--basename', build.build_name,
+        '--json-key', args.json_key,
+
+    ]
+    if args.log_level == "DEBUG":
+        ore_common_args.extend(['--log-level', "DEBUG"])
+
+    ore_upload_cmd = ore_common_args + [
         'upload',
+        '--basename', build.build_name,
         '--force',  # We want to support restarting the pipeline
         '--bucket', f'{args.bucket}',
-        '--json-key', args.json_key,
         '--name', gcp_name,
         '--file', f"{build.image_path}",
         '--write-url', urltmp,
-    ])
-
-    if args.family:
-        ore_args.extend(['--family', args.family])
+    ]
     if args.description:
-        ore_args.extend(['--description', args.description])
+        ore_upload_cmd.extend(['--description', args.description])
     if not args.create_image:
-        ore_args.extend(['--create-image=false'])
+        ore_upload_cmd.extend(['--create-image=false'])
     if args.license:
-        ore_args.extend(['--license', args.license])
+        ore_upload_cmd.extend(['--license', args.license])
+    run_verbose(ore_upload_cmd)
+
+    # Run deprecate image to deprecate if requested
+    if args.deprecated:
+        ore_deprecate_cmd = ore_common_args + [
+            'deprecate-image',
+            '--image', gcp_name,
+            '--state', 'DEPRECATED'
+        ]
+        run_verbose(ore_deprecate_cmd)
+
+    # Run update-image to add to an image family if requested.
+    # We run this as a separate API call because we want to run
+    # it AFTER the deprecation if the user passed --deprecated
+    if args.family:
+        ore_update_cmd = ore_common_args + [
+            'update-image',
+            '--image', gcp_name,
+            '--family', args.family
+        ]
+        run_verbose(ore_update_cmd)
 
-    run_verbose(ore_args)
     build.meta['gcp'] = {
         'image': gcp_name,
         'url': open(urltmp).read().strip()
@@ -124,4 +144,8 @@ def gcp_cli(parser):
     parser.add_argument("--license",
                         help="The license that should be attached to the image",
                         default=None)
+    parser.add_argument("--deprecated",
+                        action="store_true",
+                        default=False,
+                        help="If the image should be marked as deprecated")
     return parser