Automatically verify all the security merge requests have been deployed to prod in a security release.
Issue spawned from gitlab-org/release-tools!1574 (comment 692691327)
Before tagging the security release, all security merge requests need to be deployed to GitLab.com. On the last security release https://gitlab.com/gitlab-org/gitlab/-/issues/339783, we had 32 security issues associated, which made this task cumbersome and time-consuming.
We should find a way to do this verification automatically. Some ideas so far:
- Modify the
auto_deploy statuscommand to take multiple arguments, and check the status of all of them. The bot could then post a comment with the commit SHAs of all the merged master MRs, and we could run theauto_deploy statuscommand. - Fetch the security merge requests targeting the default branch using the API and use the
chatops checkcommand to verify if they're in production. - Fetch the security merge requests targeting the default branch using the API and check the
environmentattribute