How we prevented security fixes leaking into our public repositories

This post details a critical fix to GitLab's push mirroring functionality. Previously, the use of `git fetch` for mirroring branches to a private security repository inadvertently exposed Git objects (and thus security fixes) in the public repository. The solution involved switching to `git ls-remote` for branches, similar to how tags were handled, which only retrieves remote references without persisting local objects. This change was implemented and validated through a feature flag experiment, followed by a phased rollout and the eventual removal of the old behavior. A subsequent bug related to `ls-remote` taking too long and causing transient divergence errors was resolved by swapping the order of reference gathering.