[hdamker]

What type of PR is this?

• cleanup

What this PR does / why we need it:

Adds the two modules the finalize job will call, with tests. They are not wired into the post-release or common-sync steps yet; the next PR does that when it replaces update-issue, post-result and create-sync-pr.

release_automation/scripts/sync_pr.py replaces the two github-script blocks and the shell step of create-sync-pr: copy the README release-information block and the release-cycle CHANGELOG from the tag, push pr-to-main/<tag>, open the PR with the same title, body and labels. The result is a SyncPrOutcome whose status is created, failed or no_changes. Two differences:

• a re-run converges: the branch is rebuilt from main and force-pushed, and an open PR for it is reused (a re-run used to fail on git push)
• a failed clone or push is failed; before, it failed the job and left the status empty ("unknown")

release_automation/scripts/common_sync.py gains the common sync itself, next to the detection it already had (sync_common(), replacing the inline Python and shell of the common-sync steps in update-issue): clone the Commonalities release, copy artifacts/common/*.yaml, write .sync-manifest.yaml, rebuild sync-common/<release> from main, close superseded sync PRs, open or reuse the PR. Its interface takes a git client and a GitHub client and no release-automation types. Fixes from the earlier review of this feature, each with a test:

• the sync branch is reset to main before the files are copied
• every failed step returns failed, not only a failed Commonalities checkout, so the caller can post common_sync_failed for all of them
• files under code/common/ that the release does not provide are named in a warning and in the PR body (not deleted)
• detection checks the ICM release too, but only once the manifest records ICM files (ICM publishes no common artifacts today; checking it unconditionally would leave every cache stale with no common sync able to fix it)
• the existing sync PR is looked up by the exact sync-common/<release> head; plan used startswith("sync-common/"). This lookup moves from a shell step in plan into common_sync.py
• PR bodies and contexts are built in Python, not by expression interpolation

Supporting changes: GitOperations takes a remote_url, shallow clones, create_branch(reset=True), has_changes() and push(force=True); GitHubClient gets find_open_pr, list_open_prs, create_pr, add_pr_labels and close_pr. The git-level tests run real git against local bare repositories (release_automation/tests/local_git.py); conftest.py keeps the developer's git config out of them.

Which issue(s) this PR fixes:

Part of #476

Special notes for reviewers:

Targets release-automation-refactor. The only change on a running path is the sync-PR lookup in plan, which the canary reaches only when the cache is stale. The new modules run for the first time in the manual end-to-end test after the next PR.

Changelog input

 release-note

Additional documentation

docs