How we prevented security fixes leaking into our public repositories

What this post added

This post details a critical fix to GitLab's security mirroring process. A design flaw in the mirroring feature caused commits from the private Security repository to be exposed in the public Canonical repository before intended release. The initial workaround involved pausing mirroring during security releases, which caused delays and merge conflicts. The core fix involved switching from Git's `fetch` command to `ls-remote` for branches, preventing Git objects from being persisted on-disk in the public repository. An experiment was conducted to validate this change, followed by a phased rollout using feature flags. A subsequent bug emerged where transient push mirror divergence errors occurred due to `ls-remote` taking too long, causing the local repository to update before remote refs were gathered. This was resolved by swapping the order of reference gathering.