From: Michał Kępień <michal@isc.org>
Date: Thu, 30 Apr 2026 20:19:59 +0000 (+0200)
Subject: Use "git push --force-with-lease" for autorebases
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=da3c195824e6e7551bc0d98dca2117428dc44e4b;p=thirdparty%2Fbind9.git

Use "git push --force-with-lease" for autorebases

If a merge request is merged to an autorebased branch while it is
getting rebased, the "git push -f" command at the end of the autorebase
job will cause the contents of that merge request to be silently deleted
from Git history even though the merge request will still be (correctly)
shown as "merged" by GitLab.

Use "git push --force-with-lease" instead to prevent force-pushing the
rebased version of the branch if it is pushed to after its pre-rebase
version is fetched by the autorebase job.  Report such an event
accordingly.  For simplicity, no retries are attempted as the problem is
expected to be resolved by the next autorebase and the chances of this
scenario happening in practice are already low to begin with.

(cherry picked from commit f5a7671107e0c51f2a30b0d15aa24298694cb77a)
---

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1f953e51d25..789c82b81a2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2462,7 +2462,7 @@ merged-metadata:
     - *configure
     - make -j${BUILD_PARALLEL_JOBS:-1} V=1
     - git range-diff --color=always "${BASE_COMMIT}" "${CI_COMMIT_SHA}" HEAD
-    - git push -f origin "HEAD:${CI_COMMIT_REF_NAME}"
+    - if ! git push --force-with-lease origin "HEAD:${CI_COMMIT_REF_NAME}"; then touch .git-push-failed; exit 1; fi
   after_script:
     - if [ "${CI_JOB_STATUS}" = "success" ]; then exit 0; fi
     - OLDEST_MERGE_COMMIT="$(git log --reverse --merges --pretty=%H "${CI_COMMIT_SHA}..${BASE_COMMIT}" | head -1)"
@@ -2477,7 +2477,11 @@ merged-metadata:
           # Rebase did not fail; most likely, this is a build failure, or the job was canceled
           CONFLICT_COMMIT="${OLDEST_MERGE_COMMIT}"
           if [ "${CI_JOB_STATUS}" = "failed" ]; then
-              REASON="build failure after a successful rebase"
+              if [ -f ".git-push-failed" ]; then
+                  REASON="branch was updated during rebase"
+              else
+                  REASON="build failure after a successful rebase"
+              fi
           else
               REASON="job was canceled"
           fi