Remove skip_protected_branch_push_cache feature flag

Stan Hurequested to merge
sh-remove-skip-protected-branch-push-cache-ff into master

What does this MR do and why?

Removes the skip_protected_branch_push_cache feature flag, making the Ruby-side protected-branch match in the push access check permanent. Gitlab::Checks::BranchCheck now always calls ProtectedBranch.protected?(..., skip_cache: true), matching against the preloaded all_protected_branches association instead of the per-ref Redis cache.

Behavior is unchanged; only the caching path is fixed. See the original change in !267313 (merged) and the issue https://gitlab.com/gitlab-org/gitlab/-/issues/637905.

Rollout

The flag reached 100% on GitLab.com and was validated stable over ~11h of monitoring (rollout issue #638081 (closed)):

  • No change in push outcomes. The result of protected? is identical on both paths (same matches_protection_rule? call; only the Redis caching differs), and behaviorally the 401 denial rate on git-receive-pack pushes showed no step at the 10:42 UTC-7 rollout. It tracks the normal daily curve (confirmed against the prior day); the one evening spike was a single CI actor's retry loop, unrelated to the flag.
  • No error-rate regression (exceptions flat; unrelated Gitaly diff errors only).
  • /internal/allowed latency unchanged.
  • Per-request cache-call tail stays low on ordinary pushes; large pushes to code-owner-approval branches keep a per-ref cost from the separate can_push_to_branch? path (https://gitlab.com/gitlab-org/gitlab/-/issues/637931), which this MR does not change.

After merge

Delete the flag via ChatOps:

/chatops run feature delete skip_protected_branch_push_cache

Related

Edited by Stan Hu

Merge request reports