Promotion 2024-11-19 anvilprod (#6716)

.github/PULL_REQUEST_TEMPLATE/anvilprod-promotion.md

@@ -45,7 +45,7 @@ Connected issue: #0000
 
 - [ ] Pushed PR branch to GitHub
 - [ ] Ran `_select anvilprod.shared && CI_COMMIT_REF_NAME=anvilprod make -C terraform/shared apply_keep_unused` <sub>or this PR is not labeled `deploy:shared`</sub>
-- [ ] Made a backup of the GitLab data volume in `anvilprod` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
+- [ ] Ran `_select anvilprod.gitlab && python scripts/create_gitlab_snapshot.py --no-restart` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
 - [ ] Ran `_select anvilprod.gitlab && CI_COMMIT_REF_NAME=anvilprod make -C terraform/gitlab apply` <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] Checked the items in the next section <sub>or this PR is labeled `deploy:gitlab`</sub>
 - [ ] PR is assigned to only the system administrator <sub>or this PR is not labeled `deploy:gitlab`</sub>

.github/PULL_REQUEST_TEMPLATE/prod-promotion.md

@@ -44,8 +44,8 @@ Connected issue: #0000
 ### Operator (before pushing merge the commit)
 
 - [ ] Pushed PR branch to GitHub
-- [ ] Ran `_select prod.shared && CI_COMMIT_REF_NAME=prod make -C terraform/shared apply` <sub>or this PR is not labeled `deploy:shared`</sub>
-- [ ] Made a backup of the GitLab data volume in `prod` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
+- [ ] Ran `_select prod.shared && CI_COMMIT_REF_NAME=prod make -C terraform/shared apply_keep_unused` <sub>or this PR is not labeled `deploy:shared`</sub>
+- [ ] Ran `_select prod.gitlab && python scripts/create_gitlab_snapshot.py --no-restart` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
 - [ ] Ran `_select prod.gitlab && CI_COMMIT_REF_NAME=prod make -C terraform/gitlab apply` <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] Checked the items in the next section <sub>or this PR is labeled `deploy:gitlab`</sub>
 - [ ] PR is assigned to only the system administrator <sub>or this PR is not labeled `deploy:gitlab`</sub>
@@ -71,6 +71,7 @@ Connected issue: #0000
 - [ ] Pushed merge commit to GitLab `prod`
 - [ ] Build passes on GitLab `prod`
 - [ ] Reviewed build logs for anomalies on GitLab `prod`
+- [ ] Ran `_select prod.shared && make -C terraform/shared apply` <sub>or this PR is not labeled `deploy:shared`</sub>
 - [ ] Deleted PR branch from GitHub
 - [ ] Moved connected issue to *Merged stable* column on ZenHub
 - [ ] Moved promoted issues from *Merged lower* to *Merged stable* column on ZenHub

.github/PULL_REQUEST_TEMPLATE/upgrade.md

@@ -54,10 +54,10 @@ Connected issue: #0000
 - [ ] Sanity-checked history
 - [ ] Pushed PR branch to GitHub
 - [ ] Ran `_select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused` <sub>or this PR is not labeled `deploy:shared`</sub>
-- [ ] Made a backup of the GitLab data volume in `dev` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
+- [ ] Ran `_select dev.gitlab && python scripts/create_gitlab_snapshot.py --no-restart` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
 - [ ] Ran `_select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply` <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] Ran `_select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused` <sub>or this PR is not labeled `deploy:shared`</sub>
-- [ ] Made a backup of the GitLab data volume in `anvildev` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
+- [ ] Ran `_select anvildev.gitlab && python scripts/create_gitlab_snapshot.py --no-restart` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
 - [ ] Ran `_select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply` <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] Checked the items in the next section <sub>or this PR is labeled `deploy:gitlab`</sub>
 - [ ] PR is assigned to only the system administrator <sub>or this PR is not labeled `deploy:gitlab`</sub>
@@ -108,7 +108,7 @@ Connected issue: #0000
 ### Operator
 
 - [ ] At least 24 hours have passed since `anvildev.shared` was last deployed
-- [ ] Ran `script/export_inspector_findings.py` against `anvildev`, imported results to [Google Sheet](https://docs.google.com/spreadsheets/d/1RWF7g5wRKWPGovLw4jpJGX_XMi8aWLXLOvvE5rxqgH8) and posted screenshot of relevant<sup>1</sup> findings as a comment on the connected issue.
+- [ ] Ran `scripts/export_inspector_findings.py` against `anvildev`, imported results to [Google Sheet](https://docs.google.com/spreadsheets/d/1RWF7g5wRKWPGovLw4jpJGX_XMi8aWLXLOvvE5rxqgH8) and posted screenshot of relevant<sup>1</sup> findings as a comment on the connected issue.
 - [ ] Propagated the `deploy:shared`, `deploy:gitlab`, `deploy:runner` and `backup:gitlab` labels to the next promotion PRs <sub>or this PR carries none of these labels</sub>
 - [ ] Propagated any specific instructions related to the `deploy:shared`, `deploy:gitlab`, `deploy:runner` and `backup:gitlab` labels, from the description of this PR to that of the next promotion PRs <sub>or this PR carries none of these labels</sub>
 - [ ] PR is assigned to only the system administrator

.github/pull_request_template.md.template.py

@@ -210,17 +210,15 @@ def needs_shared_deploy(self):
         return self not in (T.backport, T.hotfix)
 
     def shared_deploy_is_two_phase(self, target_branch: str) -> bool:
-        # If there is a sandbox deployment, the `shared` component needs to be
-        # deployed in two-phases. The first phase, prior to the merge and the
-        # sandbox build preceding the merge, mirrors new images to ECR, while
-        # the second phase removes any unused images. This makes it possible to
-        # abandon the merge in case the sandbox build fails. The presence of a
-        # sandbox also (incidentally) suggests the presence of collocated
-        # personal deployments which would break if the old images were to be
-        # deleted immediately. Even with two phases, personal deployments will
+        # All `shared` components are deployed in two-phases. The first phase,
+        # prior to the merge, mirrors new images to ECR, while the second phase
+        # removes any outdated images. This makes it possible to abandon the
+        # merge in case the sandbox build fails. Furthermore, collocated
+        # personal deployments would break if the old images were to be deleted
+        # immediately. Note that even with two phases, personal deployments will
         # break after the second phase but the fix is simply to rebase any
         # feature branches and redeploy.
-        return self.has_sandbox_for(target_branch)
+        return True
 
     def shared_deploy_target(self, target_branch: str) -> str:
         return 'apply' + iif(self.shared_deploy_is_two_phase(target_branch), '_keep_unused')
@@ -681,8 +679,11 @@ def emit(t: T, target_branch: str):
                         },
                         iif(t in (t.upgrade, t.promotion), {
                             'type': 'cli',
-                            'content': f'Made a backup of the GitLab data volume in `{d}` (see [operator manual]'
-                                       f'(../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details)',
+                            'content': 'Ran ' + bq(
+                                f'_select {d}.gitlab && '
+                                f'python scripts/create_gitlab_snapshot.py --no-restart'
+                            ) + ' (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) '
+                                'for details)',
                             'alt': 'or this PR is not labeled `backup:gitlab`'
                         }),
                         {
@@ -962,7 +963,7 @@ def emit(t: T, target_branch: str):
                 },
                 {
                     'type': 'cli',
-                    'content': 'Ran `script/export_inspector_findings.py` against `anvildev`, imported results '
+                    'content': 'Ran `scripts/export_inspector_findings.py` against `anvildev`, imported results '
                                'to [Google Sheet](https://docs.google.com/spreadsheets/d/'
                                '1RWF7g5wRKWPGovLw4jpJGX_XMi8aWLXLOvvE5rxqgH8) and posted screenshot of '
                                'relevant<footnote relevant/> findings as a comment on the connected issue.'