The vendir_validate job ran plain `vendir sync`, which re-resolves the
moving refs in vendir.yml (branches, tags, version constraints), pulls the
latest upstream content and rewrites vendir.lock.yml. The subsequent
`git diff --exit-code` then failed whenever upstream changed, even on the
default branch, defeating the purpose of the committed lock file.

Now the job syncs with `--locked` when a vendir.lock.yml is committed, so
the check resolves the pinned SHAs and is immune to upstream drift. Without
a committed lock file it falls back to a plain sync and logs a warning.

Also harden the change detection with `git add -A` + `git diff --cached
--exit-code` so newly-added (untracked) files are detected, which the
previous `git diff --exit-code` silently missed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(release-platform): update fairway to v2

See merge request !1782

## [5.1.0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-19)

### Features

* **release-platform:** update fairway to v2 ([94156572](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/941565722e60c81777ae31f821a4978cf1fbd929))

fix(vendir): sync from lock file to avoid drift on upstream updates

See merge request !1787

## [5.1.1](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-19)

### Fixes

* **vendir:** sync from lock file to avoid drift on upstream updates ([c383eaa9](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/c383eaa9ae3e889a9e1a972edc4d485f60d5ff25))

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.74.0

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.74.0

See merge request !1761

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v5

See merge request !1786

Add a project-specific GitLab Duo review rule and a matching AGENTS.md
convention: any change that forces a consumer of common-ci-tasks to edit
their own repository is consumer-facing, and must either ship with a
paired common-template-copier migration so `copier update` applies it
automatically, or be released as a BREAKING CHANGE.

- .gitlab/duo/mr-review-instructions.yaml: new copier-managed base file
  (rendered for this repo's answers) plus a
  `consumer-facing-changes-are-breaking` rule below the project-specific
  delimiter.
- AGENTS.md: new "Consumer-Facing Changes Are Breaking Changes" section.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GitLab Duo flagged that the non-recursive `*.yml`/`*.md` filters only
matched repo-root files, missing nested consumer-facing changes (e.g.
`docs/*.md`, `test/downstream-pipeline-tests/tests.*.yml`). Broaden the
rule to `**/*` so every changed file is evaluated against it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Consumer impact is often described in the MR description or commit
messages rather than being obvious from the diff. Instruct the reviewer
to read those for signals ("you must", "add ... to your", new
prerequisites, renamed/removed jobs) and to flag when a consumer-facing
change lacks a breaking marker or a paired copier migration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs(review): require copier migrations for consumer-facing changes

See merge request !1796

fix(semantic-release): push releases with the configured token, never the job token

See merge request !1789

## [5.1.2](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-21)

### Fixes

* **semantic-release:** push releases with the configured token, never the job token ([50d5784e](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/50d5784e5af9c3b1cc68c3efe88a1c8432069c80))

### Docs

* **review:** apply consumer-facing rule to all changed files ([52765691](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/52765691e00bd17f2933c9b3108e3b5768c0c58b))
* **review:** require copier migrations for consumer-facing changes ([0e2312ab](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/0e2312ab308a29095d81176a4ebf5d3640525abd))
* **review:** scan MR description and commit messages for breaking-change signals ([4031aa4e](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/4031aa4edc6654688e1178e6d3142ff2ac8a2051))

### Dependencies

* **deps:** update dependency https://gitlab.com/[secure]/gl-infra/common-template-copier.git to v1.74.0 ([7253aab2](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/7253aab2c51b292ab67cde5af54356c35b9a9f3b))
* **deps:** update pre-commit hook [secure]/gl-infra/common-ci-tasks to v5 ([3d961c32](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/3d961c32980fef8fa3df98de2a8842b23f9b8b9b))