[api] allow to release a flavor only via request action

We don't expand then and just transport the binaries of the
specified flavor.

jsc#OBS-331

src/api/app/models/bs_request_action.rb

@@ -78,7 +78,7 @@ def check_sanity
       errors.add(:target_package, 'No source changes are allowed, if source and target is identical') if source_package == target_package && source_project == target_project && (sourceupdate || updatelink)
     end
     errors.add(:target_package, 'is invalid package name') if target_package && !Package.valid_name?(target_package)
-    errors.add(:source_package, 'is invalid package name') if source_package && !Package.valid_name?(source_package)
+    errors.add(:source_package, 'is invalid package name') if source_package && !Package.valid_name?(Package.striping_multibuild_suffix(source_package))
     errors.add(:target_project, 'is invalid project name') if target_project && !Project.valid_name?(target_project)
     errors.add(:source_project, 'is invalid project name') if source_project && !Project.valid_name?(source_project)
     errors.add(:source_rev, 'should not be upload') if source_rev == 'upload'
@@ -707,6 +707,12 @@ def expand_targets(ignore_build_state, ignore_delegate)
       return
     end
 
+    # allow to release flavors only
+    if action_type.in?(%i[release]) && source_package&.include?(':')
+      Package.get_by_project_and_name(source_project, source_package, { follow_multibuild: true })
+      return
+    end
+
     if action_type.in?(%i[submit release maintenance_release maintenance_incident])
       packages = []
       if source_package
@@ -739,7 +745,7 @@ def expand_target_project
   end
 
   def source_access_check!
-    sp = Package.find_by_project_and_name(source_project, source_package)
+    sp = Package.find_by_project_and_name(source_project, Package.striping_multibuild_suffix(source_package))
     if sp.nil?
       # either not there or read permission problem
       if Package.exists_on_backend?(source_package, source_project)
@@ -749,7 +755,7 @@ def source_access_check!
         tprj = Project.find_by_name(target_project)
         if tprj.nil? || !User.possibly_nobody.can_modify?(tprj)
           # produce an error for the source
-          Package.get_by_project_and_name(source_project, source_package)
+          Package.get_by_project_and_name(source_project, source_package, { follow_multibuild: true })
         end
         return
       end
@@ -759,7 +765,7 @@ def source_access_check!
       end
 
       # produce the same exception for webui
-      Package.get_by_project_and_name(source_project, source_package)
+      Package.get_by_project_and_name(source_project, source_package, { follow_multibuild: true })
     end
     if sp.instance_of?(String)
       # a remote package
@@ -829,7 +835,7 @@ def short_name
   end
 
   def commit_details
-    package = Package.find_by_project_and_name(source_project, source_package)
+    package = Package.find_by_project_and_name(source_project, Package.striping_multibuild_suffix(source_package))
 
     return nil if package.nil? || source_rev.nil?
 
@@ -942,7 +948,7 @@ def check_action_permission_source!
     raise NotSupported, "Source project #{source_project} is not a local project. This is not supported yet." unless sprj.instance_of?(Project) || action_type.in?(%i[submit maintenance_incident])
 
     if source_package
-      spkg = Package.get_by_project_and_name(source_project, source_package)
+      spkg = Package.get_by_project_and_name(source_project, source_package, { follow_multibuild: true })
       spkg.check_weak_dependencies! if spkg && sourceupdate == 'cleanup'
     end
 
@@ -1000,7 +1006,7 @@ def check_permissions!
   def check_permissions_for_sources!
     return unless sourceupdate.in?(%w[update cleanup]) || updatelink
 
-    source_object = Package.find_by_project_and_name(source_project, source_package) ||
+    source_object = Package.find_by_project_and_name(source_project, Package.striping_multibuild_suffix(source_package)) ||
                     Project.get_by_name(source_project)
 
     raise LackingMaintainership if !source_object.is_a?(String) && !User.possibly_nobody.can_modify?(source_object)
@@ -1031,7 +1037,7 @@ def render_xml_source(node)
   end
 
   def source_package_object
-    @source_package_object ||= Package.find_by_project_and_name(source_project, source_package)
+    @source_package_object ||= Package.find_by_project_and_name(source_project, Package.striping_multibuild_suffix(source_package))
   end
 
   def source_project_object

src/api/app/models/bs_request_action_release.rb

@@ -35,12 +35,17 @@ def uniq_key
   end
 
   def execute_accept(opts)
-    pkg = Package.get_by_project_and_name(source_project, source_package)
+    pkg = Package.get_by_project_and_name(source_project, source_package, follow_multibuild: true)
 
     # have a unique time stamp for release
     opts[:acceptTimeStamp] ||= Time.zone.now
 
-    release_package(pkg, Project.get_by_name(target_project), target_package, { action: self, manual: true })
+    flags = { action: self, manual: true }
+    target_package ||= Package.striping_multibuild_suffix(source_package)
+    if source_package.include?(':') && !source_package.starts_with?('_product:')
+      flags[:multibuild_container] = source_package.gsub(/^.*:/, '')
+    end
+    release_package(pkg, Project.get_by_name(target_project), target_package, flags)
   end
 
   def check_permissions!
@@ -50,6 +55,7 @@ def check_permissions!
   # For consistency reasons with the other BsRequestActions
   # rubocop:disable Naming/AccessorMethodName
   def set_acceptinfo(acceptinfo)
+    target_package ||= Package.striping_multibuild_suffix(source_package)
     # released packages are expanded copies, so we can not use
     # the link information. We need to patch the "old" part
     base_package_name = target_package.gsub(/\.[^.]*$/, '')

src/api/app/models/concerns/multibuild_package.rb

@@ -7,6 +7,9 @@ def valid_multibuild_name?(name)
     end
 
     def striping_multibuild_suffix(name)
+      # webui is not checking if object exists
+      return nil if name.nil?
+
       # exception for package names used to have a collon
       return name if name.start_with?('_patchinfo:', '_product:')