Heterogeneous deployment/Train deploys/GitStructure

   < liw> when we do scap prep on a new train, it seem the extension repos have detached heads, e.g. /srv/mediawiki-staging/php-1.36.0-wmf.35/extensions/RSS right now

   < liw> is that intentional?

   < hashar> liw: yes

   < hashar>  /srv/mediawiki-staging/php-1.36.0-wmf.35  is a working copy of mediawiki/core  on branch wmf/1.36.0-wmf.35

   < hashar> in Gerrit the .gitmodules file registers the extensions / skins / vendor repositories

   < hashar> each with  a gerrit specific parameter of  branch = .

   < hashar> which is to indicate that gerrit should update the submodules when the repos get changes merged

   < liw> but /srv/mediawiki-staging/php-1.36.0-wmf.35 itself does not have a detached head

   < hashar> and thus  extensions/RSS is just a submodule , and they are typically in detached head

   < hashar> cause that is mediawiki/core and we explicitly checkout wmf/1.36.0-wmf.35 branch

   < hashar> you can think about it as a mono repo

   < hashar> of core + vendor + extensions + skins

   < hashar> implemented using git submodules

   < liw> that's just it: I can't think of it as a monorepo, when it's clearly a mess

   < hashar> so essentially one "just" need to:

   < hashar>  git clone --branch wmf/1.36.0-wmf.35 php-1.36.0-wmf.35

   < hashar> cd php-1.36.0-wmf.35

   < hashar> git submodule update --init

   < hashar> apply sec patches

   < hashar> {done}

   < hashar> and if one has to do a backport for an extension:

   < hashar> send patch to master branch, get it reviewed / CR+2

   < hashar> cherry pick to the wmf/1.36.0-wmf.35  branch, get it reviewd / CR+2

   < hashar> once CI submit the change

   < hashar> Gerrit automatically update the submodule registered in mediawiki/core  wmf/1.36.0-wmf.35 branch

   < hashar> so on the deployment server, one  does:  cd /srv/mediawiki-staging/php-1.36.0-wmf.35

   < hashar> git remote update

   < hashar> git log HEAD..HEAD@{u}  # to review the diff

   < hashar> git rebase

   < hashar> git submodule update --init

   < hashar> which is configured to automatically rebase submodules in case there is a security patch applied

   < hashar> scap deploy

   < hashar> done

   < hashar> I guess we could add that tldr in the overhauled train doc brennen plans to work on

   < hashar> !log Purging openjdk-8 packages from Jenkins agents # T269354