Automatically verify all the security merge requests have been deployed to prod in a security release.

Issue spawned from gitlab-org/release-tools!1574 (comment 692691327)

Before tagging the security release, all security merge requests need to be deployed to GitLab.com. On the last security release https://gitlab.com/gitlab-org/gitlab/-/issues/339783, we had 32 security issues associated, which made this task cumbersome and time-consuming.

We should find a way to do this verification automatically. Some ideas so far:

  • Modify the auto_deploy status command to take multiple arguments, and check the status of all of them. The bot could then post a comment with the commit SHAs of all the merged master MRs, and we could run the auto_deploy status command.
  • Fetch the security merge requests targeting the default branch using the API and use the chatops check command to verify if they're in production.
  • Fetch the security merge requests targeting the default branch using the API and check the environment attribute