apertis-pkg-merge-updates: fast-forward the main debian branch after a Debian release point

Updates available in -security and -proposed-updates fall into the main Debian repository after a Debian release point. In case an update has been imported from -security or -proposed-updates, our main Debian branch stays out of date. Consequently, the Dashboard wrongly complains about an available update from Debian.

In this scenario, the main Debian branch needs to be synchronized with the -security or -proposed-updates branch used previously.

https://phabricator.apertis.org/T8870

Signed-off-by: Dylan Aïssi dylan.aissi@collabora.com

tools/apertis-pkg-pull-updates

@@ -21,6 +21,7 @@ import yaml
 
 from sh.contrib import git
 from itertools import chain
+from functools import cache
 
 from debian.debian_support import Version
 from debian.changelog import Changelog
@@ -82,6 +83,7 @@ def prepare_git_repo(upstream_suite):
   ensure_suite_branches(f'{upstream_suite}-proposed-updates', allow_missing=True)
   configure_git_user('Apertis CI', 'devel@lists.apertis.org')
 
+@cache
 def get_remote_version(suite, package):
     """Request the package version for the Debian suite from Madison
 
@@ -259,7 +261,7 @@ def main():
   print('source package', package_name)
   prepare_git_repo(upstream_suite)
   for suite in [f'{upstream_suite}-security', f'{upstream_suite}-proposed-updates', upstream_suite]:
-      _, local_version = get_newest_branch_version(upstream_suite)
+      local_version_branch, local_version = get_newest_branch_version(upstream_suite)
       print('local version:', local_version)
       remote_version = should_update(suite, package_name, local_version, upstream_suite==suite)
       if remote_version:
@@ -273,5 +275,21 @@ def main():
             if (local_version.upstream_version != remote_version.upstream_version) and (remote_version.debian_revision is not None):
                 run(['pristine-lfs', 'import-dsc', local_dsc])
 
+      # Keep the debian/{suite} (e.g. debian/bullseye) branches up-to-date after a point release.
+      # i.e. Updates from {upstream_suite}-security and {upstream_suite}-proposed-updates fall into
+      # the main repo {upstream_suite}. We need to sync the corresponding branch with the one used previously.
+      if suite == upstream_suite:
+          local_suite_version = Version(get_git_branch_version(debian_branch(upstream_suite)))
+          remote_suite_version = should_update(upstream_suite, package_name, local_suite_version)
+          if remote_suite_version and remote_suite_version == local_version:
+            upstream_suite_branch = debian_branch(upstream_suite)
+            print(upstream_suite_branch, 'needs a fast-forward from', local_version_branch, 'for', remote_suite_version)
+            git('checkout', upstream_suite_branch)
+            o = git('merge', '--ff-only', local_version_branch, _out='/dev/stdout', _err='/dev/stderr')
+            if o.exit_code == 0:
+              print(f"⏩ Successfully fast-forwarded {local_version_branch} to {upstream_suite_branch}")
+            else:
+              print('🛑 Fast-forward failed')
+
 if __name__ == '__main__':
   main()