Job for promoting artifacts built during the last `check` pipeline run

Change-Id: I5258040043ee97f3a682a23d94ccc053d477e3c3
Depends-on: https://gerrit.cesnet.cz/c/ci/project-config-public/+/1494
Depends-on: https://cesnet-gerrit-public/c/ci/project-config-public/+/1494
Depends-on: https://gerrit.cesnet.cz/c/ci/project-config-Czechlight-internal/+/1495
Depends-on: https://cesnet-gerrit-CzechLight/c/ci/project-config-Czechlight-internal/+/1495
diff --git a/playbooks/retrieve-artifacts-from-check/run.yaml b/playbooks/retrieve-artifacts-from-check/run.yaml
new file mode 100644
index 0000000..0e44b5b
--- /dev/null
+++ b/playbooks/retrieve-artifacts-from-check/run.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - retrieve-artifacts-from-check
diff --git a/roles/retrieve-artifacts-from-check/tasks/main.yaml b/roles/retrieve-artifacts-from-check/tasks/main.yaml
new file mode 100644
index 0000000..ce10454
--- /dev/null
+++ b/roles/retrieve-artifacts-from-check/tasks/main.yaml
@@ -0,0 +1,19 @@
+- fail: "This job only works in the 'promote' pipeline."
+  when: zuul.pipeline != 'promote'
+
+- name: Retrieve artifacts built within the check pipeline
+  shell: |
+    set -ex
+    curl "https://zuul.gerrit.cesnet.cz/api/tenant/{{ zuul.tenant }}/builds?pipeline=check&change={{ zuul.change }}&patchset={{ zuul.patchset }}" --output ~/zuul-output/logs/check_jobs_for_change.json
+    ALL_JOBS=$(jq -r '.[].job_name' < ~/zuul-output/logs/check_jobs_for_change.json | sort | uniq)
+    for JOB_NAME in ${ALL_JOBS}; do
+      ARTIFACTS_URL=$(jq -r '. | map(select(.job_name == "${JOB_NAME}"))[0].artifacts[].url' < ~/check_jobs_for_change_ps)
+      mkdir ~/zuul-output/artifacts/${JOB_NAME}
+      pushd ~/zuul-output/artifacts/${JOB_NAME}
+      for ONE_URL in ${ARTIFACTS_URL}; do
+        echo "*** Found ${JOB_NAME}: ${ONE_URL}"
+        curl -O "${ONE_URL}"
+      done
+      popd
+    done
+
diff --git a/zuul.yaml b/zuul.yaml
index c3077ab..674d501 100644
--- a/zuul.yaml
+++ b/zuul.yaml
@@ -5,3 +5,12 @@
     run: playbooks/run-test-command/run.yaml
     vars:
       test_command: "ci/build.sh"
+
+- job:
+    name: publish-artifacts-from-check
+    parent: publish-artifacts-tenant
+    description: |
+      Retrieve all artifacts built by the last matching run in the check
+      pipeline, and promote them into a permanent location in the log server.
+      This is intended to be run within a promote pipeline.
+    run: playbooks/retrieve-artifacts-from-check/run.yaml