chore(ci): fix scheduled Renovate pipeline when the last commit is from semantic-release

See merge request !1454

chore(deps): update dependency pre-commit/pre-commit to v4.6.0

See merge request !1465

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.46.0

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.46.0

See merge request !1463

chore(deps): update dependency terraform-docs/terraform-docs to v0.22.0

See merge request !1467

chore(deps): update dependency bridgecrewio/checkov to v3.2.525

See merge request !1455

chore(deps): update dependency docker/cli to v29.4.1

See merge request !1456

chore(deps): update dependency open-policy-agent/conftest to v0.68.2

See merge request !1459

chore(deps): update ghcr.io/containerbase/base docker tag to v14.9.5

See merge request !1468

chore(deps): update dependency python/cpython to v3.14.4

See merge request !1461

chore(deps): update dependency renovate to v43.141.6

See merge request !1466

chore(deps): update node.js to v24.15.0

See merge request !1469

chore(deps): update dependency helm/helm to v3.20.2

See merge request !1457

chore(deps): update dependency open-policy-agent/opa to v1.15.2

See merge request !1460

chore(deps): update dependency git/git to v2.54.0

See merge request !1462

chore(deps): update dependency mikefarah/yq to v4.53.2

See merge request !1464

chore(deps): update dependency jdx/mise to v2026.4.23

See merge request !1458

Adds an optional include of fairway/helm-chart@v1.10.0 to the
release-platform component, gated by a new fairway_manifest input.
When set, the component pulls in Fairway's Helm-chart pipeline
(generates and pushes a Helm chart from the manifest) using the
CI-component form, exactly mirroring the pattern adopted in
gitlab-org/ops/artifact-registry!59.

Reference consumer: gitlab-org/ops/artifact-registry!59

AI-assisted: OpenCode (claude-opus-4-7)

feat(release-platform): include Fairway helm-chart template

See merge request !1450

## [3.24.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-04)

### Features

* **release-platform:** include Fairway helm-chart template ([a4e614fa](a4e614fa))

### Others

* **ci:** fix scheduled Renovate pipeline when the last commit is from semantic-release ([a62f2671](a62f2671))

### Dependencies

* **deps:** update dependency bridgecrewio/checkov to v3.2.525 ([09482f96](09482f96))
* **deps:** update dependency docker/cli to v29.4.1 ([05672899](05672899))
* **deps:** update dependency git/git to v2.54.0 ([52d8c6a5](52d8c6a5))
* **deps:** update dependency helm/helm to v3.20.2 ([62957417](62957417))
* **deps:** update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.46.0 ([0162b02b](0162b02b))
* **deps:** update dependency jdx/mise to v2026.4.23 ([29aa3d0e](29aa3d0e))
* **deps:** update dependency mikefarah/yq to v4.53.2 ([ec1aab05](ec1aab05))
* **deps:** update dependency open-policy-agent/conftest to v0.68.2 ([2825463b](2825463b))
* **deps:** update dependency open-policy-agent/opa to v1.15.2 ([c14f924f](c14f924f))
* **deps:** update dependency pre-commit/pre-commit to v4.6.0 ([7c6646cf](7c6646cf))
* **deps:** update dependency python/cpython to v3.14.4 ([639656cd](639656cd))
* **deps:** update dependency renovate to v43.141.6 ([dd673ea1](dd673ea1))
* **deps:** update dependency terraform-docs/terraform-docs to v0.22.0 ([83990536](83990536))
* **deps:** update ghcr.io/containerbase/base docker tag to v14.9.5 ([95ac0d66](95ac0d66))
* **deps:** update node.js to v24.15.0 ([67520bc8](67520bc8))

fix(shellcheck,shfmt): handle paths containing whitespace

See merge request !1472

## [3.24.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-05)

### Fixes

* **shellcheck,shfmt:** handle paths containing whitespace ([1977d9f5](1977d9f5))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.24

See merge request !1470

Previously the parent pipeline reported failed when SYNC_TYPE=manual
because:
- generate-publish-pipeline emitted sync-pipeline.yml with all-manual jobs
- trigger-publish-pipeline used strategy: depend
- GitLab marks an all-manual downstream as "skipped" until something is played
- strategy: depend propagates "skipped" as a failed bridge -> failed parent

`allow_failure: true` would mask the issue but also hide played-and-failed
manual jobs, which is worse.

Fix: emit two trigger jobs gated by $SYNC_TYPE rules.

- trigger-publish-pipeline-auto: SYNC_TYPE == "on_success", keeps
  strategy: depend so the parent waits and surfaces sync failures.
- trigger-publish-pipeline-manual: SYNC_TYPE == "manual" (or anything
  non-on_success), no strategy: depend so the bridge succeeds as soon
  as the downstream is created. Maintainers play manual jobs on the
  downstream pipeline; their success/failure shows there.

generate-publish-pipeline now also writes SYNC_TYPE to sync-pipeline.env
and exposes it as a `reports: dotenv` artifact, which downstream `needs:`
jobs (the trigger jobs) inherit as a CI variable for their rules.

Manitest assertions updated to lock both new job names and the dotenv
artifact path.

Surfaced on the canary v1.6.0 manual-sync test pipeline:
https://gitlab.com/gitlab-org/security/release-platform-canary/-/pipelines/2499080658



Related to delivery#22003

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fix: split trigger-publish-pipeline by SYNC_TYPE so manual case doesn't fail parent

See merge request !1471

## [3.24.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-05)

### Fixes

* split trigger-publish-pipeline by SYNC_TYPE so manual case doesn't fail parent ([1227a746](1227a746)), closes [delivery#22003](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)

### Dependencies

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.24 ([3175772f](3175772f))

Add a regression guard to validate-renovate-container-image.sh that
exercises a mise shim and detects the argv[0]-drop wrapper bug
introduced by containerbase's install-tool mise.

This commit is intentionally added BEFORE the fix so the pipeline
demonstrates the bug visibly. The next commit (the revert of 1a395c49)
makes the test pass.

AI-assisted: OpenCode (claude-opus-4-7)

This reverts commit 1a395c49.

Revert "chore: install mise via install-tool in Renovate image"

See merge request !1475

## [3.24.3](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-05)

### Reverts

* Revert "chore: install mise via install-tool in Renovate image" ([ee68ce85](ee68ce85))

### Tests

* **renovate:** assert mise shims dispatch correctly ([b20e7793](b20e7793))