Uploading artifacts to Swift

There's a new role, the `upload-artifacts-swift`. It is a pretty
bare-bones role which should serve as a (mostly) drop-in replacement of
the add-fileserver + publish-artifacts-to-fileserver combo. It still
requires "something" to ensure that the artifacts are available at the
executor, and it will not register these artifacts, nor return them to
Zuul. That all should be done separately (check the rest of our CI setup
for details, especially publish-artifacts-base and
publish-artifacts-tenant in ci/project-config.git), this one is only a
building block.

The rest happens in the updated role `download-artifacts-from-check`. It
is no longer intended to run within the post playbook; it should now be
defined in a parent job's `run`.

Also, I'm moving everything to the executor so that we don't require a
dummy build node. This necessitated a fix to the executor's bubblewrap
configuration for accessing the TLS certificates and preferences and
what not.

Change-Id: I4e4bb26e5976127ca8c504ed3e6d1f8b9ede9393
diff --git a/roles/download-artifacts-from-check/tasks/main.yaml b/roles/download-artifacts-from-check/tasks/main.yaml
index 75d490c..48ef576 100644
--- a/roles/download-artifacts-from-check/tasks/main.yaml
+++ b/roles/download-artifacts-from-check/tasks/main.yaml
@@ -2,17 +2,25 @@
     msg: "This job only works in the 'promote' pipeline."
   when: zuul.pipeline != 'promote'
 
+- name: Ensure artifacts directory exists
+  delegate_to: localhost
+  file:
+    path: "{{ zuul.executor.work_root }}/artifacts"
+    state: directory
+
 - name: Retrieve artifacts built within the check pipeline
   shell: |
     set -ex
-    curl "https://zuul.gerrit.cesnet.cz/api/tenant/{{ zuul.tenant }}/builds?pipeline=check&change={{ zuul.change }}&patchset={{ zuul.patchset }}" --output {{ zuul_output_dir }}/logs/check_jobs_for_change.json
-    ALL_JOBS=$(jq -r '.[].job_name' < {{ zuul_output_dir }}/logs/check_jobs_for_change.json | sort | uniq)
+    CHECKS_JSON={{ zuul.executor.work_root }}/check_jobs_for_change.json
+    curl "{{ zuul_root_url }}/api/tenant/{{ zuul.tenant }}/builds?pipeline=check&change={{ zuul.change }}&patchset={{ zuul.patchset }}" --output ${CHECKS_JSON}
+    ALL_JOBS=$(jq -r '.[].job_name' < ${CHECKS_JSON} | sort | uniq)
     for JOB_NAME in ${ALL_JOBS}; do
-      ARTIFACTS_URL=$(jq -r ". | map(select(.job_name == \"${JOB_NAME}\"))[0].artifacts[].url" < {{ zuul_output_dir }}/logs/check_jobs_for_change.json)
-      mkdir {{ zuul_output_dir }}/artifacts/${JOB_NAME}
-      pushd {{ zuul_output_dir }}/artifacts/${JOB_NAME}
+      ARTIFACTS_URL=$(jq -r ". | map(select(.job_name == \"${JOB_NAME}\"))[0].artifacts[].url" < ${CHECKS_JSON})
+      mkdir {{ zuul.executor.work_root }}/artifacts/${JOB_NAME}
+      pushd {{ zuul.executor.work_root }}/artifacts/${JOB_NAME}
       for ONE_URL in ${ARTIFACTS_URL}; do
         curl -O "${ONE_URL}"
       done
       popd
     done
+    rm -f ${CHECKS_JSON}