Cirrus: Support using updated/latest NV/AV in PRs

On occasion, developers need to run the latest or bleeding-edge
netavark/aardvark-dns in the podman CI environment.  Enable this through
use of magic strings in the PR title, but only if the PR is marked as a
draft.  The intent being, when the PR is ready for review, the current
CI VM package versions will be used.  Hopefully also reminding the PR
author to remove the magic strings from the title, remove draft status,
and push the final set of changes to be merged.

Also, add documentation about this new magic PR title string and CI's
behaviors.

Signed-off-by: Chris Evich <cevich@redhat.com>

contrib/cirrus/CIModes.md

@@ -86,7 +86,7 @@ of this document, it's not possible to override the behavior of `$CIRRUS_PR`.
 + meta
 + success
 
-### Intend `[CI:BUILD]` PR Tasks:
+### Intended `[CI:BUILD]` PR Tasks:
 + *build*
 + validate
 + *alt_build*
@@ -96,6 +96,23 @@ of this document, it's not possible to override the behavior of `$CIRRUS_PR`.
 + success
 + artifacts
 
+### Intended `[CI:NVAV=update]` or `[CI:NVAV=main]` behavior:
+
+If and only if the PR is in **draft-mode**, either update Fedora CI VMs to the
+latest Netavark/Aardvark-dns RPMs ("update" keyword), or install the most
+recent package builds from their `main` branch ("main" keyword).  These are
+**runtime changes** only, and will not persist or impact other PRs
+in any way.
+
+The intent is to temporarily support testing of updates with the latest podman
+code & tests.  To help prevent accidents, when the PR is not in draft-mode, the
+presence of the magic string will cause VM-setup script to fail, until the magic
+is removed.
+
+**Note:** When changing the draft-status of PR, you will need to re-push a
+commit-change before Cirrus-CI will notice the draft-status update (i.e.
+pressing the re-run button **is not** good enough).
+
 ### Intended Branch tasks (and Cirrus-cron jobs, except "multiarch"):
 + *build*
 + swagger

contrib/cirrus/lib.sh

@@ -236,6 +236,7 @@ use_cni() {
 }
 
 use_netavark() {
+    local magickind repokind
     msg "Forcing NETWORK_BACKEND=netavark for all subsequent environments."
     echo "NETWORK_BACKEND=netavark" >> /etc/ci_environment
     export NETWORK_BACKEND=netavark  # needed for install_test_configs()
@@ -244,6 +245,37 @@ use_netavark() {
     # N/B: The CNI packages are still installed and available. This is
     # on purpose, since CI needs to verify the selection mechanisms are
     # functional when both are available.
+
+    # See ./contrib/cirrus/CIModes.md.
+    # Vars defined by cirrus-ci
+    # shellcheck disable=SC2154
+    if [[ "$CIRRUS_CHANGE_TITLE" =~ CI:[AN]V[AN]V= ]]; then
+        # shellcheck disable=SC2154
+        if [[ "$CIRRUS_PR_DRAFT" != "true" ]]; then
+            die "Magic 'CI:NVAV=*' string can only be used on DRAFT PRs"
+        fi
+
+        magickind=$(sed -r -e 's~(.*CI:[AN]V[AN]V=)(\w+)(.*)~\2~' <<<"$CIRRUS_CHANGE_TITLE")
+
+        # The update source scheme is defined during VM image build.
+        # See c/automation_images repo. cache_images/fedora_packaging.sh
+        repokind="updates-testing"  # $DISTRO_NV==$FEDORA_NAME
+        # shellcheck disable=SC2154
+        if [[ "$DISTRO_NV" =~ $PRIOR_FEDORA_NAME ]]; then
+            repokind="updates"
+        # else we're not running fedora, or .cirrus.yml env. vars are setup wrong.
+        fi
+
+        if [[ "$magickind" == "update" ]]; then
+            warn "Updating netavark/aardvark RPM packages from ***the fedora $repokind repo.***"
+        elif [[ "$magickind" == "main" ]]; then
+            warn "Installing latest netavark/aardvark packages from their main branches using ***the podman-next COPR repo***"
+            showrun dnf copr enable rhcontainerbot/podman-next -y
+        else
+            die "Unknown CI:NVAV= '$magickind' keyword.  Only 'update' and 'main' are supported."
+        fi
+        showrun dnf upgrade -y netavark aardvark-dns
+    fi
 }
 
 # Remove all files provided by the distro version of podman.