chore(deps): update dependency gitlab-org/quality/quality-engineering/modular-feature-testing to v0.1.0

MR B of three (per delivery#22122).

New `sync-release-page` job in the publish-stage child pipeline's
`sync-artifacts` stage. Mirrors the GitLab Release page (description
+ asset links) from the security mirror to canonical so customers
see release notes and asset URLs on the public-facing project.

Flow:

1. GET /projects/${CI_PROJECT_ID}/releases/${CI_COMMIT_TAG} via
   CANONICAL_REPO_TOKEN (api scope; SA has Developer access on
   both projects).
2. Rewrite security URLs to canonical URLs in `description` and
   `assets.links[].url`. Single jq pass with `gsub` on both the
   raw form (`gitlab-org/security/<X>`) and the URL-encoded form
   (`gitlab-org%2Fsecurity%2F<X>`). The `@uri` filter produces the
   encoded variant from the same source string.
3. POST /projects/${CANONICAL_PROJECT_ID}/releases with the
   rewritten body. Treat any non-201 response whose body matches
   `already exists` as idempotent success; otherwise fail loud
   with the URL, status, and response body (matches the api_get
   diagnostic pattern used elsewhere).

Wired into `sync-complete`'s `needs` so the gate accurately
reflects release-page sync status alongside the existing four
sync jobs.

feat(release-platform): add sync-release-page job

See merge request !1573

## [4.10.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-08)

### Features

* **release-platform:** add sync-release-page job ([31f0e48b](31f0e48b)), closes [delivery#22122](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)

Merge branch 'renovate/gitlab-org-quality-quality-engineering-modular-feature-testing-0.x' into 'main'

chore(deps): update dependency gitlab-org/quality/quality-engineering/modular-feature-testing to v0.1.0

See merge request !1570

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.9

See merge request !1571

Recent Renovate releases (e.g. 43.205.2, shipped in the renovate:v4.10.0
image) bundle simple-git >= 3.36.0, whose block-unsafe-operations plugin
refuses to run git when certain env vars are present in the process
environment, failing with e.g.:

    Error: Use of "EDITOR" is not permitted without enabling allowUnsafeEditor

GitLab Runner injects some of these vars (EDITOR observed in the wild) into
the job environment, so renovate_bot jobs in downstream projects break. The
plugin checks key *presence*, not value, so overriding via `variables:
EDITOR: ""` does not help -- the vars must be unset. Verified against the
bundled @simple-git/argv-parser parseEnv: present -> blocked, empty ->
blocked, absent -> OK.

Unset the editor/pager/ssh-command vars in the shared .base_renovate_bot
before_script (inherited by renovate_bot, renovate_bot_immediate and
renovate_validate). Renovate uses HTTPS token auth and no editor/pager here,
so removing these has no effect on its operation.

Refs: https://github.com/renovatebot/renovate/discussions/42740

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-authored-by: John Skarbek <jskarbek@gitlab.com>

MR C of three (per delivery#22122). Documentation
update reflecting the state after MR A (fairway chart sync) and MR B
(release page sync).

- Add Synced artifacts table listing all six artifact types, their
  source/destination, and the job responsible.
- Rewrite Child pipeline structure: now three stages
  (sync-artifacts / sync-commits / sync-done); all sync jobs are
  always emitted and use SYNC_WHEN to select auto vs manual. The
  earlier two-stage / conditional-emit description is obsolete since
  !1550.
- Mark fairway_manifest as required when release_platform_enabled is
  true.
- Add sync-release-page to CANONICAL_REPO_TOKEN's consumer list and
  include the api scope.
- Drop the runway/fairway coexistence note (runway is being phased
  out and runway chart sync was removed in MR A).

docs(release-platform): update sync targets and child pipeline structure

See merge request !1576

generate-publish-pipeline runs under `set -eu` and uses an unquoted
`cat > sync-pipeline.yml <<EOF ... EOF` heredoc, which shell-expands
every `$var` reference inside. The unescaped `$sec` and `$can` in the
jq rewrite function were therefore expanded by the parent shell --
where they're unset -- and `set -u` aborted the job before any
child-pipeline YAML was generated.

Escape to `\$sec` / `\$can` so the heredoc preserves them as literal
`$sec` / `$can` for jq to interpret in the child pipeline's runtime.

Caught by an actual canary run (job 14771139878); jsonnet-tool tests
were validating the generated YAML's text but not the runtime
behavior of the heredoc.

fix(release-platform): escape jq vars in sync-release-page heredoc

See merge request !1577

## [4.10.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-09)

### Fixes

* **release-platform:** escape jq vars in sync-release-page heredoc ([7244d4cb](7244d4cb))

### Docs

* **release-platform:** update sync targets and child pipeline structure ([19c5ba3a](19c5ba3a)), closes [delivery#22122](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)

### Dependencies

* **deps:** update dependency gitlab-org/quality/quality-engineering/modular-feature-testing to v0.1.0 ([878bd2fd](878bd2fd))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.9 ([cfda4401](cfda4401))

go-test v0.1.0 added a test:go:integration:service job that renders an
unconditional `services: [{name: ''}]` when integration_service is unset.
GitLab validates services:name at config parse time regardless of the job's
rules: gate, so the blank name fails pipeline creation for every consumer
of golang-build with release_platform_enabled: true (e.g. release-platform-canary).

Pin goTestVersion back to v0.0.3 (no service-container job) and hold renovate
below v0.1.0 until go-test ships a fix (>= v0.1.1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix: pin go-test to v0.0.3 to unblock release-platform Go pipelines

See merge request !1578

## [4.10.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-09)

### Fixes

* pin go-test to v0.0.3 to unblock release-platform Go pipelines ([afb46eae](afb46eae))

chore(deps): update dependency jdx/mise to v2026.5.18

See merge request !1563

fix(renovate-bot): unset git-unsafe env vars blocked by simple-git

See merge request !1575

## [4.10.3](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-10)

### Fixes

* **renovate-bot:** unset git-unsafe env vars blocked by simple-git ([77905352](77905352))

### Others

* **renovate-bot:** generate templates ([fd75055c](fd75055c))

### Dependencies

* **deps:** update dependency jdx/mise to v2026.5.18 ([1b0c9780](1b0c9780))

The GitLab Runner runs `before_script` and `script` as separate
`docker exec` calls, and `writeExports` re-emits every job variable
at the start of each stage. The `unset` added in !1575 therefore
never reaches the `npx renovate` invocation.

Move the `unset` into the top of each job's `script:` via a shared
jsonnet local so all three Renovate jobs scrub the env in the same
shell that runs `npx`.

Refs !1575 (comment 3439991763)

Duo-Workflow-Definition: ci_expert_agent/v1

fix(renovate-bot): unset unsafe git vars in script, not before_script

See merge request !1579

## [4.10.4](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-10)

### Fixes

* **renovate-bot:** unset unsafe git vars in script, not before_script ([84ab4355](84ab4355))

The previous fix (unset in script:) proved unreliable in practice —
the unset ran but EDITOR was still present when npx renovate started,
likely due to a race between pipeline creation and the fix landing on
main, or Runner stage isolation subtleties we could not fully pin down.

Switch to `env -u` prefixed directly on each npx invocation. This is
atomic with the process launch: the child process simply never sees the
offending vars, regardless of shell state or Runner internals.

The var list is defined once in a jsonnet helper function
`withSafeGitEnv(cmd)` and applied to all three Renovate jobs:
  - renovate_bot
  - renovate_bot_immediate
  - renovate_validate

See: https://github.com/renovatebot/renovate/discussions/42740

Duo-Workflow-Definition: ci_expert_agent/v1

fix(renovate-bot): use env -u to strip unsafe git env vars from npx

See merge request !1580

## [4.10.5](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-10)

### Fixes

* **renovate-bot:** use env -u to strip unsafe git env vars from npx ([53f84131](53f84131))

simple-git >= 3.36.0 (bundled by recent Renovate releases) refuses to
run git when EDITOR (and similar vars) are present in process.env,
failing with:
  Error: "EDITOR" is not permitted without enabling allowUnsafeEditor

Root cause: npx reads npm config and re-injects EDITOR into the child
process environment. Setting `npm config set editor ''` in
before_script writes to the npm config file, which persists into
script: and prevents npx from injecting EDITOR when it runs renovate.

See: https://github.com/renovatebot/renovate/discussions/42740

Duo-Workflow-Definition: ci_expert_agent/v1

fix(renovate-bot): prevent npx from re-injecting EDITOR via npm config

See merge request !1581

## [4.10.6](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-10)

### Fixes

* **renovate-bot:** use npm config to prevent EDITOR injection by npx ([a028b4e2](a028b4e2))

Reverts MRs !1575, !1579, !1580, !1581 (three fix attempts for the
simple-git EDITOR-blocking issue) and the underlying version bump
(!1571 / ad35189d, renovate 43.150.0 → 43.205.2) that caused the
breakage.

All four workarounds (unset in before_script, unset in script,
env -u prefix, npm config set editor) proved insufficient.

See: https://github.com/renovatebot/renovate/discussions/42740

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

revert(renovate-bot): roll back renovate to 43.150.0 and remove env-fix attempts

See merge request !1582

fix: roll back renovate to 43.150.0 and remove env-fix attempts

See merge request !1583

## [4.10.7](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-11)

### Reverts

* **renovate-bot:** roll back renovate to 43.150.0 and remove env-fix attempts ([638ca5ec](638ca5ec))

### Fixes

* roll back renovate to 43.150.0 and remove env-fix attempts ([f921c9ec](f921c9ec))