The job pushed the release SHA to canonical. During an embargo the
merge-train advances security past the tag, so that push was always
rejected and the MR fallback could never converge the branches.

Push the current security head instead, after a merge-base check that
it contains the release commit. The MR fallback stays for races.

Found in the delivery#22136 canary E2E (finding F1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Use the REST merge_base check for the release-containment test, the
same pattern as the other ancestry checks in this file. Keep the local
fetch for the push only: a shallow clone cannot build the pack, so
deepen fully when the checkout is shallow.

sync-default-branch pushed an API-resolved SHA that the checkout never
has. Give it the same fetch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Move the CANONICAL_REPO_TOKEN presence check above all API calls and
fetches in sync-commits and sync-default-branch. A misconfigured job
now fails with the clear message, not an HTTP 401 after a full fetch.

URL-encode SOURCE_BRANCH in the new branches API call: a slashed branch
name would 404 and fail the happy path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The fetch already exists for the push pack, so take SYNC_SHA from
FETCH_HEAD and check release containment with a local merge-base.
This drops the branches API call, the URL encoding, and the API
ancestry round-trip; git refspecs handle slashed branch names.

Default the token variables in the presence checks so set -u cannot
abort before the clear error message.

Condense the comment blocks to the essentials.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Auto releases push exactly the release SHA again: they are already
public and no disclosure decision is being made, so a moving security
head must not ride along (a retried auto job during a later embargo
would leak it).

Manual releases are disclosures. Before converging, refuse any commit
on the security head that is neither in the release nor on canonical
(a later embargo's content). When canonical moved since the last
merge-train run, play the merge-train schedule with the bot token and
wait for it, so the convergence merge uses the production bridge and
the bot identity, then fast-forward canonical to the result.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Findings from local harness testing:

- A poll timeout could report success when the previous scheduled run
  had succeeded. The result is now set only when a pipeline at or past
  the expected id reaches a terminal status; timeout is fatal.
- One transient poll failure killed the job; polls now tolerate blips.
- A retry no longer stacks a second bridge run: when a bridge pipeline
  is already running, wait for it instead of playing again. The play
  POST fails with a clear message.
- The disclosure scope guard re-runs on the post-bridge head, closing
  the window between the first check and the bridge finishing.
- A first release from a branch that does not exist on canonical yet
  no longer fails the fetch; the push creates the branch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review findings:

- The http.extraHeader export was global, so the post-bridge origin
  fetch authenticated to the security repo with the canonical token.
  Scope the key to the canonical URL; origin operations keep the
  runner's auth and the fetch-before-export ordering constraint
  disappears.
- Distinguish a missing canonical branch (ls-remote exit 2, the push
  creates it) from a network or auth failure (fatal with a clear
  message) so a blip cannot mislabel canonical commits as undisclosed.
- An awaited pre-existing bridge run can predate canonical's latest
  move; when still unconverged after it, play one fresh run before
  falling back to the sync MR.
- The bridge wait is configurable: new merge_train_bridge_wait_minutes
  input, default 10.
- Guard the poll against a non-numeric pipeline id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Renames the merge_train_bridge_wait_minutes input to merge_train_wait_minutes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Renames check_disclosure_scope to check_sync_scope and UNDISCLOSED to
OUT_OF_SCOPE. Message and comment changes only, no logic change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chore(deps): update node.js to v24.19.0

See merge request !1746

chore(deps): update dependency open-policy-agent/opa to v1.19.0

See merge request !1762

chore(deps): update dependency gitlab-org/labkit to v2.33.1

See merge request !1774

chore(deps): update dependency bridgecrewio/checkov to v3.3.9

See merge request !1765

fix(release-platform): converge the manual release sync via the merge-train schedule

See merge request !1776

## [4.45.0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-17)

### Features

* **release-platform:** scope-guard disclosures, reuse the bridge to converge ([04ede651](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/04ede651418f63f14c842b7d8ae69a132929a9fe))

### Fixes

* **release-platform:** harden the bridge wait in the disclosure sync ([4ac3da5d](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/4ac3da5d4023d38510db01c2e3d55ad39c87311f))
* **release-platform:** scope the canonical auth header, harden the bridge wait ([5926b015](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/5926b0154abc2f401f26e049aac7bf2aab20d441))
* **release-platform:** sync-commits pushes the current security head ([c0617347](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/c061734746b6c3156d2b248960f760bac1807b0c)), closes [delivery#22136](https://gitlab.com/[secure]/delivery/-/issues/)

### Docs

* **release-platform:** replace disclosure wording with release terms ([d840e82a](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/d840e82aa078863a117a1b9965b26679c4657beb))
* **release-platform:** say security-only release instead of embargo ([6c609a20](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/6c609a205b9e9d66b77db9fd74ee9a90550106ab))
* **release-platform:** trim the sync comments to the essentials ([e031953a](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/e031953a704b29d9504f4ed39709b232da83d473))

### Others

* **release-platform:** API ancestry check, fetch push sources ([69690616](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/6969061684a7b0d47f33c8cc59002f46f0005673))
* **release-platform:** derive the sync head from the fetch ([2ecb7b2d](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/2ecb7b2dcdf39cb989863677b1066a9b8ec61cc2))
* **release-platform:** fail fast on missing tokens, encode branch names ([f75f4303](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/f75f430396a3275029b87663beaa2675d08abb7b))
* **release-platform:** replace bridge jargon with merge-train pipeline terms ([8b033ece](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/8b033ece5abb00f47e9d4b93fc09fee5d903e9da))

### Dependencies

* **deps:** update dependency bridgecrewio/checkov to v3.3.9 ([2a0941fe](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/2a0941fe0cb0f65040d84cd7a1a686f44f74d766))
* **deps:** update dependency gitlab-org/labkit to v2.33.1 ([56b442b0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/56b442b0ee34583168fe65f387b5e29f8b582007))
* **deps:** update dependency open-policy-agent/opa to v1.19.0 ([49231d7d](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/49231d7d03ef1e634d545ce2bb5060c76a5dcc01))
* **deps:** update node.js to v24.19.0 ([c014324c](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/c014324c1686a45101f1c2b6a13725b66981f811))