[FIX] runbot_merge: race condition between closes #x and merging/FF

Turns out skipping locks is not very useful when there are no locks
being held because we only touch the PRs *after* the merge has been
applied.

So finally do that, lock all of a staging's PRs before we try to
fast-forward the relevant repositories, so a close command coming back
from github (from having seen the closes #xxx annotation) doesn't
screw us over.

runbot_merge/controllers/__init__.py

@@ -174,6 +174,7 @@ def handle_pr(env, event):
         FOR UPDATE SKIP LOCKED;
         ''', [pr_obj.id])
         res = env.cr.fetchone()
+        # FIXME: store some sort of "try to close it later" if the merge fails?
         if not res:
             return 'Ignored: could not lock rows (probably being merged)'
 

runbot_merge/models/pull_requests.py

@@ -1231,6 +1231,11 @@ class Stagings(models.Model):
             gh = {repo.name: repo.github() for repo in project.repo_ids}
             repo_name = None
             staging_heads = json.loads(self.heads)
+            self.env.cr.execute('''
+            SELECT 1 FROM runbot_merge_pull_requests
+            WHERE id in %s
+            FOR UPDATE
+            ''', [tuple(self.mapped('batch_ids.prs.id'))])
             try:
                 repo_name = self._safety_dance(gh, staging_heads)
             except exceptions.FastForwardError as e: