Idea: after we find the correct key for the modular tag, add an entry to instance['tags'] with it?
That way, we'd only go through the koji tag traversal once per module tag, and have it cached for next builds in the same tag?
This will not persist between restarts, but that's fine, since this would just be a local cache to speed up the other builds that are bound to come into the same module very soon.

That's done in the latest rebase.

I find the name of this argument very unfortunate :(.
I need to read the documentation to see that this should have been named noauth=True.

This function is not entirely useless :). See the cli.py tagsigner function.

I would prefer len(retval) != 1

What is this witchcraft? This looks like... interesting API design.

Why set up a new client every time we need a tag verified?
You could just set a self.pdc_client in the init.

Maybe be more explicit in return None?

What came first?

Is there any reason you are passing session here if it could get that itself?

After this, you could say target=targets to get rid of all the targets[0]?

I would need to pass koji_instance here to get the session - I think that would not improve anything...

Wasn't this already called just before going into the branch?

Perhaps log another message for unverified to distinguish various possible errors?

If you set the "to" tag to the tag name, you can just send skip_tagging=False, and tagging will be explicitly skipped down the line.

The reason you want to depend on this behavior is that if you get the stream_info cached, this call gets skipped, and it uses whatever is in instance['tags'].
Setting the tag "to" to the same tag name explicitly tells dowork to not move tags.

You probably want to say "if len(targets) != 1", since it might be that the only target is a -repo and you just filtered it out.

Also, maybe add logging statements in all the "return None" cases, so it's easier to debug what happened?

Looks good to me. Can you please add signed-off-by lines (git commit -s)?

Done, I've squashed commits and signed.