Run staging upload for all internal release builds
What does this MR do and why?
Two staging upload jobs never ran during internal releases even though their build jobs did, so those packages were built and then discarded at the end of the pipeline.
| Staging job | Its build job runs on internal release since | Rules it inherited | Matched? |
|---|---|---|---|
Ubuntu-22.04-fips-staging |
ea9ef78b (2024-12-12) | .fips_staging_upload_template, ^EE_(RC|TAG|NIGHTLY)_BUILD_PIPELINE$ |
no |
Ubuntu-24.04-arm64-staging |
fc820825 (2025-05-23) | .staging_upload_template, _(RC|TAG)_BUILD_PIPELINE$ |
no |
f39dd23d added the equivalent per-job override to Ubuntu-22.04-staging and Ubuntu-24.04-staging, and in the same change created .fips_staging_upload_template without it. The arm64 and FIPS siblings were missed.
The practical effect is that gitlab-fips_<version>+internal<n>-0_amd64.deb and the Ubuntu 24.04 arm64 package are produced by an internal release and never reach the staging repository, so consumers have to have them uploaded by hand.
The invariant, and a full audit against it
A staging upload job should run exactly when its build job runs. Every staging job in this file, checked by resolving each job's effective rules through its extends chain and evaluating them against PIPELINE_TYPE=INTERNAL_RELEASE_BUILD_PIPELINE:
| Platform | Builds | Uploads before | Uploads after |
|---|---|---|---|
| Ubuntu 22.04 | yes | yes | yes |
| Ubuntu 22.04 FIPS | yes | no | yes |
| Ubuntu 24.04 | yes | yes | yes |
| Ubuntu 24.04 arm64 | yes | no | yes |
| Ubuntu 22.04 arm64, Ubuntu 26.04 and arm64, Debian 11/12/13 and arm64, AlmaLinux 8/9/10 and arm64, AlmaLinux 8/9 FIPS, AmazonLinux 2023 and arm64 and FIPS, OpenSUSE 15.6 and arm64 | no | no | no |
Exactly two platforms disagreed, and they are the two this MR changes. Everything else is consistently disabled at both stages, so this is not a partial fix.
Why per-job overrides rather than widening the shared templates
Both overrides are additive: each keeps the rules the job already had and appends only the internal release case, so behaviour for every other pipeline type is unchanged.
Widening .staging_upload_template or .fips_staging_upload_template would enable staging uploads for platforms whose build jobs are not enabled for internal releases. Those staging jobs declare their needs as optional: true, so an absent build job does not block them; they would start, find no artifacts, and fail on No packages found for upload. Are artifacts available?.
.fips_release_template and .production_release_template are deliberately untouched. Those publish to public, user-facing repositories, and internal releases must not be published there.
Testing
CI Lint against this branch returns valid: true with no errors.