[FF] security_policy_target_branch_desync_detection -- Fail-closed desync detection for approval policy rules

Summary

Roll out the feature currently behind the security_policy_target_branch_desync_detection feature flag.

• DRI: @sashi_kumar
• Team Slack channel: #g_srm_security_policies

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

Rollout

Run all production /chatops in #production and cross-post the results to #g_srm_security_policies. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set security_policy_target_branch_desync_detection 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set security_policy_target_branch_desync_detection true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set security_policy_target_branch_desync_detection <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss security_policy_target_branch_desync_detection true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com security_policy_target_branch_desync_detection true
/chatops gitlab run feature set --user=<gitlab-username-of-dri> security_policy_target_branch_desync_detection true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

• Docs + version history updated
• Breaking changes announced, if any
• Change management issue opened, if required
• External API consumers handled with a fail-open mechanism, if applicable

Cleanup

Remove the flag once deemed stable — see cleaning up. Track it here, or open a follow-up Feature Flag Cleanup issue. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check <merge-request-url> <milestone>
/chatops gitlab run feature delete security_policy_target_branch_desync_detection --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set security_policy_target_branch_desync_detection false                                         # production
/chatops gitlab run feature set security_policy_target_branch_desync_detection false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete security_policy_target_branch_desync_detection --dev --pre --staging --staging-ref --production  # remove entirely