## TL;DR Follow-up to gitlab-com/gl-infra/delivery#22049. The `sync-commits` job (in [common-ci-tasks!1498](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1498)) syncs commits + tags from security mirror to canonical, but only fires on tag pipelines. Security fixes on `main` are often NOT tagged (only the stable-branch backports get tagged for patch releases), so `canonical/main` permanently diverges from `security/main` until someone syncs manually. This issue tracks automating that source-side reconciliation. ## Problem / Goal Today's security release flow: 1. Security fix commit `X` lands on `security/main` (private; pre-disclosure) 2. Cherry-pick `X` → `Y` on `security/16-7-stable`, `X` → `Z` on `security/16-6-stable` 3. semantic-release tags `v16.7.5` at `Y` and `v16.6.7` at `Z` -- but **main is not tagged** 4. Tag pipelines for `Y` and `Z` fire `sync-commits`, which routes them to canonical's matching stable branches 5. `canonical/main` is left with no sync trigger -- `X` stays unsynced indefinitely Result: `canonical/main` permanently diverges from `security/main` over time. Push mirror canonical→security keeps skipping `main` (divergent ref with `keep_divergent_refs = true`). Future canonical changes to main don't reach security mirror's main either. ## Background / Context `sync-commits` (common-ci-tasks!1498, in review) handles the tag-triggered case correctly. The gap is the untagged case, which is the dominant flow for security patch releases at GitLab. ## Proposed Solution Add a separate job (let's call it `sync-default-branch`) on the security mirror's main pipeline (not tag pipeline) that: 1. Reuses the same auth + push patterns as `sync-commits` (release-bot SA, `GIT_CONFIG_*` env vars, fast-forward push with MR fallback) 2. Detects whether `security/main` is ahead of `canonical/main` (API check) 3. Pushes the delta to `canonical/main`; falls back to MR if FF rejected 4. Gated `when: manual` so an operator triggers it after CVE disclosure / embargo lifts (avoids leaking pre-disclosure commits) ### Implementation sketch - New job in the release-platform component's publish stage (or a new stage), or possibly in `standard-build`. - Mirror-aware guard: only run on the security mirror (`noCanonical.noBuild`). - Rule: `if: $CI_COMMIT_BRANCH == "main"` (or the default-branch equivalent). - `when: manual` so it doesn't fire on every merge to main. - Reuse the existing `CANONICAL_REPO_TOKEN` CI/CD variable (already provisioned by release-platform terraform module >= v4.1.1). ## Out of Scope - Auto-firing on every merge to main (avoid premature disclosure during the embargo window) - Cross-branch backport detection (handled by the existing stable-branch tag flow) - UI for triggering / status (operator uses standard CI play button) ## Affected Systems - [`gitlab-com/gl-infra/common-ci-tasks`](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks) -- `src/ci/components/release-platform.jsonnet` (new job, possibly new stage) - [`gitlab-org/software-delivery/release-platform-canary`](https://gitlab.com/gitlab-org/software-delivery/release-platform-canary) -- validation target ## Dependencies - common-ci-tasks!1498 merged (sync-commits job + supporting infra) ## Resources - Parent issue: gitlab-com/gl-infra/delivery#22049 - Predecessor: gitlab-com/gl-infra/delivery#22003 (publish-stage smart sync) - common-ci-tasks!1498 (sync-commits, in review) ## Tasks - [x] Decide trigger: manual play (via `when: ${SYNC_WHEN}` in the publish-stage child pipeline, which resolves to `manual` when `SYNC_TYPE=manual`). No separate scheduled pipeline. - [x] Implement `sync-default-branch` job (reuses sync-commits auth + push logic) -- [common-ci-tasks!1537](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1537), iterated through [!1545](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1545) (SAAT Basic auth), [!1550](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1550) (auto-emit regardless of SYNC_TYPE) - [x] Add manitest assertions -- locked in the source MRs above - [x] Update `release-platform.md` describing the job's role -- [common-ci-tasks!1576](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1576) - [x] Validate end-to-end on `release-platform-canary` -- via [delivery#22122](https://gitlab.com/gitlab-com/gl-infra/delivery/-/work_items/22122) validation on security tag v1.5.15 -> [child sync pipeline 2592377845](https://gitlab.com/gitlab-org/security/release-platform-canary/-/pipelines/2592377845); divergence-resolution exercised via the sync-MR fallback ([release-platform-canary!140](https://gitlab.com/gitlab-org/software-delivery/release-platform-canary/-/merge_requests/140)). In this run `sync-default-branch` correctly no-op'd (release was from main, so sync-commits covers it -- behaviour from [common-ci-tasks!1565](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/merge_requests/1565)); the FF-push + MR-fallback paths were exercised by `sync-commits` on the same divergence. ## Acceptance Criteria - [x] When `security/main` is ahead of `canonical/main`, the operator-played job syncs the delta - [x] When histories have diverged, the job opens an MR on canonical (same fallback as sync-commits) -- validated on canary v1.5.15 (sync-commits opened [!140](https://gitlab.com/gitlab-org/software-delivery/release-platform-canary/-/merge_requests/140); sync-default-branch shares the same MR-fallback code path) - [x] Job is gated to the security mirror only (same mirror guards as sync-commits) - [x] Default trigger is `when: manual` (via `${SYNC_WHEN}`) so embargo windows are respected - [x] Validated end-to-end on release-platform-canary ## Follow-up Continuous auto-bridging during the embargo window (so canonical commits keep flowing into security/main while waiting for the operator to play sync-default-branch) is tracked separately in [delivery#22136](https://gitlab.com/gitlab-com/gl-infra/delivery/-/work_items/22136) -- the merge-train auto-reconciliation pattern from gitlab.com's release-tools.