Bump gitlab-shell to 14.57.6

Vladimir Glafirovrequested to merge
bump-gitlab-shell-14-57-6 into master

What does this MR do and why?

Bumps GITLAB_SHELL_VERSION from 14.57.4 to 14.57.6, shipping the Cells SSH routing fix from gitlab-shell!1570 (merged).

Note

Draft until the v14.57.6 tag exists. The release MR gitlab-shell!1572 (merged) still needs merging and tagging. CI that fetches gitlab-shell at this version will fail until then.

What the fix does

Cells SSH routing signed the Shell JWT (1-minute TTL) once, when the Cells git client was built, and reused it for every request to the target cell.

Since gitlab-shell!1561 (merged) (v14.57.4), a Cells push makes two requests:

  1. A short request that fetches the ref advertisement.
  2. The actual ssh-receive-pack, opened only once the client starts sending, which is after its pre-push hook finishes.

With Git LFS the pre-push hook uploads objects and can take many minutes. The second request then carried an expired JWT, Rails rejected it with 404 by design, and the push failed with remote: ERROR: cells routing: receive-pack response: Not found. The JWT is now signed for each request, for both push and pull.

Why this is needed

This blocks the production rollout of Topology Service SSH routing (gitlab-shell#874, production#22944). GitLab.com builds gitlab-shell from the pinned GITLAB_SHELL_VERSION rather than main, so this bump is required for the fix to reach staging and production.

It was validated on staging with a custom image built from the fix, deployed to all gstg clusters. A single-command git push of a new 2 GiB LFS object succeeded:

Image Advertisement request Second ssh-receive-pack Result
current (v14.57.4) 200 404 at +10m44s ❌ Not found
with gitlab-shell!1570 (merged) 200 200 at +9m07s ✅ ok refs/heads/vg/test-lfs-rule

Evidence: gitlab-shell#874 (comment 3894763329)

Release contents

v14.57.6:

v14.57.5 (released in gitlab-shell!1567 (merged), included by this bump):

The golangci-lint and nilaway changes are CI-only.

Verification

To do once the tag is published:

git merge-base --is-ancestor 572faf78 v14.57.6   ->  expect true   (Sign Cells Shell JWT per request)
v14.57.6:VERSION                                 ->  expect 14.57.6

References

MR acceptance checklist

  • Version bump only; no application code changes.
  • Target version is a published, verified gitlab-shell tag (pending gitlab-shell!1572 (merged) and the v14.57.6 tag).

🤖 Created with the help of OpenCode Duo

Merge request reports