Add Geo replication for Packages::Debian::ProjectComponentFile

What does this MR do and why?

Implements Geo replication and verification for Packages::Debian::ProjectComponentFile behind the geo_packages_debian_project_component_file_replication feature flag, following the established Geo SSF blob replicator pattern.

This is Task 2 (Implementation) for the Add Geo Support issue. It is stacked on top of the Task 1 (DB schema) MR Add Geo replication DB schema for Packages::Deb... (!228787 - merged) • Chad Woolley • 19.0.

Change follows the documented template: .gitlab/issue_templates/Geo Replicate a new blob type.md

What's included

• EE model concern with ReplicableModel, VerifiableModel, and 2-hop project_id_in scope via joins(component: :distribution)
• Replicator, registry model, and verification state model
• GraphQL type, resolver, and finder (with experiment: { milestone: '18.10' } metadata)
• Feature flags: geo_packages_debian_project_component_file_replication and geo_packages_debian_project_component_file_force_primary_checksumming
• create_verification_details_for override for sharding key population via indirect join
• copy_project_id callback on state model for single-record creates
• Factories, specs (replicator, registry, finder, GraphQL resolver/type)
• Cross-cutting patches: Geo class lists, inflections, shared contexts, integration specs
• Documentation: datatypes, API docs, Prometheus metrics, GraphQL reference, OpenAPI specs

Selective sync query

The selective_sync_scope delegates to Project.selective_sync_scope(node) via a 2-hop join:

scope :project_id_in, ->(ids) {
  joins(component: :distribution).where(packages_debian_project_distributions: { project_id: ids })
}

References

• Parent issue: Add Geo support for Packages::Debian::ProjectCo... (#333611) • Chad Woolley • 19.1 • At risk
• Task work item: Implement Geo replication behind feature flag f... (#594714) • Chad Woolley
• Epic: Protocells Code Yellow Interlock - Migrate Firs... (&18384) • Nick Nguyen, Mark Wood
• Task 1 (DB schema) MR: Add Geo replication DB schema for Packages::Deb... (!228787 - merged) • Chad Woolley • 19.0
• Feature flag: geo_packages_debian_project_component_file_replication

End-to-end acceptance verification

Verified end-to-end against the pkg-geo-get Geo test environment (a GitLab Environment Toolkit deployment with a Geo primary + secondary pair on AWS). See the verification process docs.

Latest verification — 2026-04-23, PASS (this MR @ 3b7d2ac + Task 1 MR Add Geo replication DB schema for Packages::Deb... (!228787 - merged) • Chad Woolley • 19.0):

• Omnibus build: job 14047100437 from pipeline 2472582935
• Deployed to GET via terraform taint + apply on both rails nodes
• Automated acceptance test: scripts/verify-metadata-replication --type debian-project-component-file → synced 0 → 1 in ~30s
• Manual verification: secondary S3 bucket pkg-geo-secondary-packages content match; REST counters count = synced = verified = 1, failed = 0
• Loose-FK cleanup: destroying parent on primary → LooseForeignKeys::DeletedRecord created → CleanupWorker runs → state row removed on both sites; registry row cleaned from secondary tracking DB
• Full result artifact: results/228959/2026-04-23-035104-manual-verification-and-loose-fk.md in the pkg-geo-get repo

Verification history:

• 2026-03-30 — Discovered upstream llhttp-ffi bug blocking all Geo blob sync (Geo blob replication fails with HPE_USER llhttp... (#595139 - closed) • Scott Murray, Chloe Fons • 19.0); root cause: rugged 1.9.0 corrupts Omnibus libffi 3.2.1 FFI callbacks on kernel ≥ 6.8. Runtime workaround (gem upgrade + monkey-patch) required during initial verification; upstream fix landed in Geo: Switch blob download to use GitLab::HTTP t... (!230361 - merged) • Scott Murray • 18.11
• 2026-04-07 — Automated PASS with workaround applied: REST counter incremented 4 → 5 in ~50s after enabling geo_packages_debian_project_component_file_replication
• 2026-04-13 — Manual GUI verification PASS
• 2026-04-22 — Backfilled with loose-FK support after informal pre-review (comment); generator updated to emit config/gitlab_loose_foreign_keys.yml entry + track_record_deletions post-migration + removal of hard FK from state→parent
• 2026-04-23 — Re-verification PASS (latest, see above)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.