apertis-pkg-merge-updates: fast-forward the main debian branch after a Debian release point

Updates available in -security and -proposed-updates fall into the main Debian repository
after a Debian release point. In case an update has been imported from -security or -proposed-updates,
our main Debian branch stays out of date. Consequently, the Dashboard wrongly complains about an
available update from Debian.

In this scenario, the main Debian branch needs to be synchronized with the
-security or -proposed-updates branch used previously.

Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>

debian/changelog

+apertis-dev-tools (0.2021.9) apertis; urgency=medium
+
+  * apertis-pkg-merge-updates: fast-forward the main debian branch
+      after a Debian release point
+
+ -- Dylan Aïssi <dylan.aissi@collabora.com>  Fri, 13 May 2022 14:33:34 +0200
+
 apertis-dev-tools (0.2021.8) apertis; urgency=medium
 
   * Add a script to switch between coreutils and rust-coreutils

tools/apertis-pkg-pull-updates

@@ -21,6 +21,7 @@ import yaml
 
 from sh.contrib import git
 from itertools import chain
+from functools import cache
 
 from debian.debian_support import Version
 from debian.changelog import Changelog
@@ -82,6 +83,7 @@ def prepare_git_repo(upstream_suite):
   ensure_suite_branches(f'{upstream_suite}-proposed-updates', allow_missing=True)
   configure_git_user('Apertis CI', 'devel@lists.apertis.org')
 
+@cache
 def get_remote_version(suite, package):
     """Request the package version for the Debian suite from Madison
 
@@ -259,7 +261,7 @@ def main():
   print('source package', package_name)
   prepare_git_repo(upstream_suite)
   for suite in [f'{upstream_suite}-security', f'{upstream_suite}-proposed-updates', upstream_suite]:
-      _, local_version = get_newest_branch_version(upstream_suite)
+      local_version_branch, local_version = get_newest_branch_version(upstream_suite)
       print('local version:', local_version)
       remote_version = should_update(suite, package_name, local_version, upstream_suite==suite)
       if remote_version:
@@ -273,5 +275,21 @@ def main():
             if (local_version.upstream_version != remote_version.upstream_version) and (remote_version.debian_revision is not None):
                 run(['pristine-lfs', 'import-dsc', local_dsc])
 
+      # Keep the debian/{suite} (e.g. debian/bullseye) branches up-to-date after a point release.
+      # i.e. Updates from {upstream_suite}-security and {upstream_suite}-proposed-updates fall into
+      # the main repo {upstream_suite}. We need to sync the corresponding branch with the one used previously.
+      if suite == upstream_suite:
+          local_suite_version = Version(get_git_branch_version(debian_branch(upstream_suite)))
+          remote_suite_version = should_update(upstream_suite, package_name, local_suite_version)
+          if remote_suite_version and remote_suite_version == local_version:
+            upstream_suite_branch = debian_branch(upstream_suite)
+            print(upstream_suite_branch, 'needs a fast-forward from', local_version_branch, 'for', remote_suite_version)
+            git('checkout', upstream_suite_branch)
+            o = git('merge', '--ff-only', local_version_branch, _out='/dev/stdout', _err='/dev/stderr')
+            if o.exit_code == 0:
+              print(f"⏩ Successfully fast-forwarded {local_version_branch} to {upstream_suite_branch}")
+            else:
+              print('🛑 Fast-forward failed')
+
 if __name__ == '__main__':
   main()