chore(deps): update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.17.0

See merge request !1521

chore(deps): update dependency terraform-docs/terraform-docs to v0.24.0

See merge request !1517

chore(deps): update dependency bridgecrewio/checkov to v3.2.528

See merge request !1514

chore(deps): update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.18.0

See merge request !1524

chore(deps): update dependency gitlab-com/gl-infra/platform/runway/runwayctl to v4.39.0

See merge request !1522

chore(deps): update dependency gitlab-org/labkit to v2.8.0

See merge request !1516

chore(deps): update dependency gitlab-org/labkit to v2.10.0

See merge request !1526

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.50.0

chore(deps): update ghcr.io/containerbase/base docker tag to v14.10.16

See merge request !1515

chore(deps): update dependency bridgecrewio/checkov to v3.2.529

See merge request !1527

chore(deps): update dependency open-policy-agent/opa to v1.16.2

See merge request !1528

chore(deps): update dependency docker/cli to v29.5.0

See merge request !1529

chore(deps): update dependency helm/helm to v3.21.0

See merge request !1530

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.50.0

See merge request !1531

chore(deps): update node.js to v24.16.0

See merge request !1532

chore(deps): update ghcr.io/containerbase/base docker tag to v14.10.17

See merge request !1533

Adds a `sync-commits` job to the release-platform publish-stage
child pipeline. Pushes the security mirror's release tag + commit
to canonical when a security-only release happens
(`SYNC_TYPE=manual`).

Flow:

1. Push tag to canonical -- always succeeds; the tag is the release
   identifier and must land regardless of branch-sync outcome. Git
   transmits the commit objects needed to make the tag resolvable,
   so this works even when canonical's main doesn't yet reference
   the commit.
2. Try fast-forward push of the commit to canonical:main.
   - Server rejects non-fast-forward pushes without --force, so no
     client-side merge-base check is needed (also sidesteps the
     GIT_DEPTH=50 shallow-clone false-positive trap).
   - Success → done.
3. If fast-forward push is rejected (history diverged, or branch
   protection changed), push the commit to a `sync-${CI_COMMIT_TAG}`
   branch on canonical and open an MR via the `merge_request.create`
   push option. The MR URL is captured from push output and echoed
   prominently at the end of the job so operators can navigate
   directly to review.

Auto path (`SYNC_TYPE=auto`) skips the job entirely -- canonical
already has commit + tag via canonical→security mirror chain.

Other changes:

- Child pipeline stages restructured from `[sync]` to
  `[sync-artifacts, sync-commits]`. `sync-start`,
  `sync-registry-artifacts`, `sync-packages` move to
  `sync-artifacts`.

- Auth via `git -c http.extraHeader="PRIVATE-TOKEN: ${TOKEN}"`. Token
  never in URL → git can't echo it on error.

- Centralised alpine image via a single `local alpineImage` constant
  in the jsonnet, swapped into the child YAML via `std.strReplace`
  on the `__ALPINE_IMAGE__` placeholder. Eliminates drift between
  4 occurrences.

- Pinned `sync-start` image to `alpine:3.21` (matches the other
  sync jobs; was unpinned).

- `set -u` + bare `${VAR}` env-var check would abort before the
  error message. Use `${VAR:-}` defaults.

- Explicit `CI_COMMIT_TAG` empty check up front.

Documentation:

- `release-platform.md` "Child pipeline structure" subsection
  added describing the two stages + the auto-vs-manual emission
  rule.
- Auth requirements table extended with `CANONICAL_REPO_TOKEN_*`
  variables and which job consumes each. Auto-provisioned by
  `release-platform >= v4.1.1`.

Manitest:

- Stages: `testSyncArtifactsStageExists`,
  `testSyncCommitsStageInChild`.
- Conditional emit: `testSyncCommitsConditionalEmit`,
  `testSyncCommitsConditionalEmitClosed`.
- Auth: `testSyncCommitsHttpExtraHeaderAuth`,
  `testSyncCommitsGitDashCAuth` (per-invocation `-c`, not
  persistent config), `testSyncCommitsTokenNotInUrl`.
- Behaviour: `testSyncCommitsTagPushedFirst`,
  `testSyncCommitsMrFallback`.
- Mapping: `testSyncTypeManualMapsToWhenManual`.
- Consistency: `testAlpineImagePlaceholderResolved`.

Related to delivery#22049.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat: add sync-commits job to publish stage child pipeline

See merge request !1498

## [4.3.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-27)

### Features

* add sync-commits job to publish stage child pipeline ([85bc692c](85bc692c))

### Dependencies

* **deps:** update dependency bridgecrewio/checkov to v3.2.528 ([f9fbf292](f9fbf292))
* **deps:** update dependency bridgecrewio/checkov to v3.2.529 ([54e56f0c](54e56f0c))
* **deps:** update dependency docker/cli to v29.5.0 ([8ef58d93](8ef58d93))
* **deps:** update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.17.0 ([5bdef28c](5bdef28c))
* **deps:** update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.18.0 ([d83917fb](d83917fb))
* **deps:** update dependency gitlab-com/gl-infra/platform/runway/runwayctl to v4.39.0 ([80b3f6f1](80b3f6f1))
* **deps:** update dependency gitlab-org/labkit to v2.10.0 ([f8dc729e](f8dc729e))
* **deps:** update dependency gitlab-org/labkit to v2.8.0 ([5cd31cd7](5cd31cd7))
* **deps:** update dependency helm/helm to v3.21.0 ([ad8f04d4](ad8f04d4))
* **deps:** update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.50.0 ([f368905c](f368905c))
* **deps:** update dependency open-policy-agent/opa to v1.16.2 ([0bf374aa](0bf374aa))
* **deps:** update dependency terraform-docs/terraform-docs to v0.24.0 ([b549e15a](b549e15a))
* **deps:** update ghcr.io/containerbase/base docker tag to v14.10.16 ([b6adc073](b6adc073))
* **deps:** update ghcr.io/containerbase/base docker tag to v14.10.17 ([31460331](31460331))
* **deps:** update node.js to v24.16.0 ([ab48ce23](ab48ce23))

The package rule for `golang-version` previously applied `rangeStrategy: bump`
to all managers consuming this datasource. This had the unintended side effect
of bumping the `go` directive in `go.mod` on every Go release, e.g.
gitlab-com/gl-infra/platform/runway/fairway!60 updated `go 1.25.10` to `go
1.26.3`.

The `go` directive in `go.mod` is a minimum-version compatibility statement:
`go 1.25` semantically means "compatible with Go 1.25 or later". The Go
maintainers recommend bumping it only when the code actually requires a newer
language feature, since every consumer of the module is forced to use at least
that Go version. For example, when Fairway upgrades to Go 1.26, LabKit has to
upgrade as well, creating a ripple effect through our codebase.  Renovate's
default `rangeStrategy: replace` for the `gomod` manager respects this:
combined with `go-mod-directive` versioning treating `1.25` as `^1.25`, the
directive is left alone unless a module dependency requires a newer version.
The override to `bump` defeated this default.

The original intent of the rule was to keep fully-qualified versions in
`.tool-versions` (e.g. `golang 1.25.10`) up to date with patch releases, since
`go-mod-directive` versioning would otherwise treat `1.25.10` as already
satisfying `^1.25.10` and skip the update. Limiting the rule to `matchManagers:
["custom.regex"]` preserves that behavior for the `.tool-versions` regex
manager while letting `gomod` fall back to its documented default.

Refs: https://docs.renovatebot.com/modules/manager/gomod/#updating-of-go-mod-and-toolchain-directives
Refs: https://docs.renovatebot.com/modules/versioning/go-mod-directive/

Scope the `golang-version` `rangeStrategy: bump` rule by file name rather
than by manager. Matching `custom.regex` works today only because the
`.tool-versions` regex manager is the sole `custom.regex` manager in this
preset that emits the `golang-version` datasource. If somebody later adds
another regex manager that produces `golang-version` for a different file
(e.g. a `Dockerfile` or a Jsonnet source), it would silently inherit
`rangeStrategy: bump`, which is almost certainly not what they want.

`matchFileNames` makes the rule's intent explicit: the `bump` strategy
applies to `.tool-versions` specifically, regardless of which manager
extracts the dependency. The glob `.tool-versions` covers the repo root
and `**/.tool-versions` covers nested files in monorepos, which matters
for a shared preset consumed across many repositories.

`matchDatasources: ["golang-version"]` is kept so the rule remains scoped
to the Go directive and doesn't accidentally bump other `.tool-versions`
entries like `buf` or `pre-commit`, which use `github-releases` and work
correctly with the default `replace` strategy.

fix(renovate): Scope `golang-version` bump strategy to `.tool-versions` manager.

See merge request !1500

## [4.3.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-28)

### Fixes

* **renovate:** Scope `golang-version` bump strategy to `custom.regex` manager. ([db74ee67](db74ee67))

### Others

* **renovate:** Match `.tool-versions` by file name for Go bump rule. ([dd4f929e](dd4f929e))