fix: ci: Use "git push --force-with-lease" for autorebases

If a merge request is merged to an autorebased branch while it is
getting rebased, the "git push -f" command at the end of the autorebase
job will cause the contents of that merge request to be silently deleted
from Git history even though the merge request will still be (correctly)
shown as "merged" by GitLab.

Use "git push --force-with-lease" instead to prevent force-pushing the
rebased version of the branch if it is pushed to after its pre-rebase
version is fetched by the autorebase job.  Report such an event
accordingly.  For simplicity, no retries are attempted as the problem is
expected to be resolved by the next autorebase and the chances of this
scenario happening in practice are already low to begin with.

Merge branch 'michal/use-git-push-force-with-lease-for-autorebases' into 'main'

See merge request isc-projects/bind9!11939
This commit is contained in:
Michał Kępień 2026-04-30 22:34:55 +02:00
commit 5c66f1a241

View file

@ -2562,7 +2562,7 @@ merged-metadata:
- *configure
- meson compile -C build
- git range-diff --color=always "${BASE_COMMIT}" "${CI_COMMIT_SHA}" HEAD
- git push -f origin "HEAD:${CI_COMMIT_REF_NAME}"
- if ! git push --force-with-lease origin "HEAD:${CI_COMMIT_REF_NAME}"; then touch .git-push-failed; exit 1; fi
after_script:
- if [ "${CI_JOB_STATUS}" = "success" ]; then exit 0; fi
- OLDEST_MERGE_COMMIT="$(git log --reverse --merges --pretty=%H "${CI_COMMIT_SHA}..${BASE_COMMIT}" | head -1)"
@ -2577,7 +2577,11 @@ merged-metadata:
# Rebase did not fail; most likely, this is a build failure, or the job was canceled
CONFLICT_COMMIT="${OLDEST_MERGE_COMMIT}"
if [ "${CI_JOB_STATUS}" = "failed" ]; then
REASON="build failure after a successful rebase"
if [ -f ".git-push-failed" ]; then
REASON="branch was updated during rebase"
else
REASON="build failure after a successful rebase"
fi
else
REASON="job was canceled"
fi