Fix danger-review include rule and update component to 2.2.0

What does this MR do?

Since c1420bdb ("Skip danger-review on forks"), the danger-review job no longer runs on MRs targeting master, so no reviewer roulette is posted.

The include rule compares $CI_PROJECT_PATH with $CNG_CANONICAL_PROJECT_PATH, $CNG_SECURITY_PROJECT_PATH and $CNG_QA_PROJECT_PATH. Those are defined in the global variables: section, which isn't available when include:rules are evaluated. They are empty there, so the rule never matches.

Evidence from MR pipelines in this project:

MRs	Target	danger-review
Before the change: !3185 (merged), !3189 (merged), !3197 (merged), !3200 (merged), !3201 (merged), !3202 (merged)	master	ran
After the change: !3203 (merged), !3204 (merged), !3222 (closed), !3224 (merged), !3231 (merged), !3236 (merged)	master	missing
After the change: !3210 (merged), !3214 (merged), !3228 (closed)	*-stable (still on the old rule)	ran

This MR compares against literal project paths instead, so forks are still skipped.

It also updates the danger-review component from 2.1.0 to 2.2.0. Once the job ran again it crashed with uninitialized constant Git::Base (NameError): git gem 6.0.0 (released 2026-10-28) removed Git::Base, which danger 9.6.1 still uses. 2.2.0 includes gitlab-org/components/danger-review!24 (merged), which pins git < 6. This also affects the *-stable branches, which still use 2.1.0.

How to validate

• The danger-review job is present in this MR's pipeline and posts the reviewer roulette (job, installs git 5.7.1).

Follow-up

The vault secrets includes (.gitlab-ci.yml) select a file with the same $CI_PROJECT_PATH == $CNG_SECURITY_PROJECT_PATH comparison, so they may have the same problem on the security mirror. If this MR confirms the cause, we'll look at those separately.

🤖 Generated with Claude Code