fix(ci): refresh accumulated stack pins from main

[sbaum1994]

TL;DR

Refresh the shared stack-pin branch from current main before applying each chart release so accumulated pin commits do not hide newly merged release metadata.

Additional Details

The invocation chart v1.6.0 release exposed a split-brain workflow state. The stack audit passed on current main, but the workflow then switched to the older chore/stack-pin-bumps branch. The resolver failed there because that branch predated the invocation chart release metadata from #1386.

This change extracts the branch preparation into a small helper. An existing pin branch is fetched and rebased onto the current default branch before the resolver runs. A missing branch starts directly from the current default branch. Rebase conflicts and remote lookup failures remain loud, and the existing force-with-lease protects against concurrent updates.

A git-backed regression test verifies that previously accumulated pins survive the refresh, new metadata is present, history remains linear, and a missing branch starts at the current base.

Customer release notes: Not customer visible.

Plan summary: Not applicable.

Usage: Not applicable.

Notes: After merge, rerun the invocation v1.6.0 stack-pin workflow and confirm #1381 gains the invocation pin alongside its existing NATS and request-router pins.

Related pull requests: #1381, #1386.

Dependencies: None. No license review or NOTICE update is required.

For the Reviewer

Please focus on the fetch/rebase behavior in tools/ci/prepare-stack-pin-branch and the force-with-lease assumptions in .github/workflows/stack-pin-bump.yml.

For QA

QA is not needed beyond CI and the post-merge rerun of the failed invocation pin workflow.

Tests run:

• bash tools/ci/test-prepare-stack-pin-branch
• bash -n tools/ci/prepare-stack-pin-branch tools/ci/test-prepare-stack-pin-branch
• shellcheck tools/ci/prepare-stack-pin-branch tools/ci/test-prepare-stack-pin-branch
• python3 tools/ci/test-github-release.py (47 tests passed)
• go test -C tools/stack-pin-resolver ./...
• Ruby YAML parsing for both changed workflows
• git diff --check

The standalone local license-header checker was also attempted. In this OSS snapshot it exits before checking files because its empty arrays trigger an existing unbound variable error. Every changed file carries the required SPDX header, and repository CI remains the authoritative check.

Issues

Closes #1387

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Bug Fixes

  • Improved automated branch refreshes so existing branches are rebased onto the latest default branch while preserving changes.
  • Ensured new branches start cleanly from the latest default branch.
  • Added clearer failure handling when branch preparation encounters Git errors.

• Tests

  • Added integration coverage for branch creation, rebasing, history preservation, and linear ancestry.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7494ae87-2f95-4bd6-9234-bceb9ebb44a2

📥 Commits

Reviewing files that changed from the base of the PR and between b632456 and 7e2f336.

📒 Files selected for processing (4)

• .github/workflows/build-test.yml
• .github/workflows/stack-pin-bump.yml
• tools/ci/prepare-stack-pin-branch
• tools/ci/test-prepare-stack-pin-branch

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds prepare-stack-pin-branch, integrates it into the stack-pin bump workflow, and adds integration coverage for existing and missing target branches. The build-test workflow runs the new integration test.

Changes

Stack-pin branch refresh

Layer / File(s)	Summary
Branch preparation logic tools/ci/prepare-stack-pin-branch	The script validates branch names, fetches the base branch, rebases existing target branches, and creates missing target branches.
Workflow branch refresh integration .github/workflows/stack-pin-bump.yml	The workflow uses complete history, determines the default branch, refreshes release metadata, and invokes the preparation script.
Branch refresh integration validation tools/ci/test-prepare-stack-pin-branch, .github/workflows/build-test.yml	The integration test checks rebasing, commit preservation, linear history, and new-branch creation. The build-test workflow runs the test.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 7e2f3

This change refreshes the shared pin branch from the current base before resolving releases, preserving accumulated pins while including new release metadata. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: apartha-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits format and accurately identifies a CI bug fix that refreshes accumulated stack pins from main.
Linked Issues check	✅ Passed	The changes satisfy the coding objectives in issue #1387: they refresh existing stack-pin branches, create missing branches from the base branch, preserve accumulated commits, maintain linear history,…
Out of Scope Changes check	✅ Passed	All changes are within scope for issue #1387. The workflow updates, preparation helper, and integration test directly support stack-pin branch refresh behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The changes satisfy the coding objectives in issue #1387: they refresh existing stack-pin branches, create missing branches from the base branch, preserve accumulated commits, maintain linear history, fail on Git errors, and add regression coverage for both branch scenarios.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stack-pin-branch-refresh

---

_{Comment @coderabbitai help to get the list of available commands.}