Adds a manual `sync-default-branch` job to the publish-stage child
pipeline (emitted alongside `sync-commits` on `SYNC_TYPE=manual`).

- Detects canonical's default branch via API; no hard-coded `main`.
- Compares security:default vs canonical:default HEADs; no-op when
  aligned.
- Fast-forward push first; MR fallback on rejection (same shape as
  `sync-commits`).
- Reuses `CANONICAL_REPO_TOKEN` via `GIT_CONFIG_*` env vars.

Manual play because canonical is public: operator confirms no
embargoed commits remain on security:default before exposing them.

Related to delivery#22121

feat(release-platform): add sync-default-branch manual job

See merge request !1537

## [4.4.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-28)

### Features

* **release-platform:** add sync-default-branch manual job ([89fc089b](89fc089b)), closes [delivery#22121](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)

The visibility check previously only verified that the commit existed
on canonical, incorrectly assuming the tag must also exist. This caused
tags to not sync when commits were pushed to canonical separately from
tag creation (e.g., via MRs merged to main before the release).

Now checks both commit AND tag existence via the GitLab API. Only sets
SYNC_TYPE=auto when both exist on canonical. This ensures the sync-commits
job runs when tags need to be synced, even if the commit is already present.

The fix adds a TAG_STATUS check alongside the existing COMMIT_STATUS check:
- If both return HTTP 200: SYNC_TYPE=auto (artifacts-only sync)
- If commit exists but tag doesn't: SYNC_TYPE=manual (full sync including tag push)
- If commit doesn't exist: SYNC_TYPE=manual (full sync)

This resolves tag synchronization failures for projects where commits reach
canonical via non-semantic-release workflows (direct pushes, merged MRs, etc.)
while tags are created only on the security mirror.

Fixes tag sync for release-platform-canary and similar projects.

Test results: All 43 manitests pass.

fix(release-platform): check both commit and tag existence for auto-sync

See merge request !1540

## [4.4.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-28)

### Fixes

* **release-platform:** check both commit and tag existence for auto-sync ([b8f3ccee](b8f3ccee))

Fixes two issues in the generate-publish-pipeline job:

1. Backtick command substitution errors:
   - Comments containing `skipped` were being interpreted as command
     substitution in the heredoc, causing "skipped: not found" errors
   - Changed backticks to single quotes in comments

2. No visibility into generated YAML:
   - Added cat command in after_script to display the generated
     sync-pipeline.yml content
   - Helps with debugging when sync jobs fail
   - Shows SYNC_TYPE value and full pipeline configuration

The generated YAML is now visible in job logs while maintaining the
artifact for the trigger job to consume.

fix(release-platform): remove backtick errors and show generated YAML

See merge request !1542

## [4.4.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-28)

### Fixes

* **release-platform:** remove backtick errors and show generated YAML ([cdcccc1a](cdcccc1a))

CI_JOB_TOKEN was rejected by the GitLab REST endpoints
sync-commits and sync-default-branch query:

- `/projects/:id/repository/commits/:sha/refs` (sync-commits)
- `/projects/:id` and `/repository/branches/:name`
  (sync-default-branch, both same-project and cross-project)

Both jobs failed with curl exit 22 right after `apk add`. Switching
to PRIVATE-TOKEN with CANONICAL_REPO_TOKEN (api scope) resolves both
since the bot SA has Developer access on the security mirror and
canonical via gitlab_project_share_group entries.

fix(release-platform): use CANONICAL_REPO_TOKEN for sync API calls

See merge request !1541

## [4.4.3](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-28)

### Fixes

* **release-platform:** use CANONICAL_REPO_TOKEN for sync API calls ([518f5de9](518f5de9))