TOOL-30021 Enable sdb upstream tracking + bootstrap upstreams branch on first sync

[prakashsurya]

Background

Spec 0003 Phase 2 onboards sdb as an upstream-tracked package against sdimitro/sdb. Phase 1 (delphix/sdb#360) merged 2026-05-06 and landed the bootstrap merge from sdimitro/develop plus the dh-virtualenv overlay. The linux-pkg side is wiring update_upstream() up against sdimitro/sdb's develop, and having build() derive PACKAGE_VERSION from setuptools_scm so the .deb's metadata version follows upstream sdb tags automatically.

Problem

The first check-updates run against the new sdb recipe fails before reaching update_upstream at all, e.g.

Running: [token passed] git fetch https://github.com/delphix/sdb.git --no-tags +upstreams/develop:upstream-HEAD
fatal: couldn't find remote ref upstreams/develop
Error: git fetch failed

fetch_repo_from_git requires upstreams/$DEFAULT_GIT_BRANCH to already exist on the package repo's origin before the update_upstream stage even runs; update_upstream_from_git only fast-forwards an existing local upstream-HEAD, it doesn't create it. The linux-pkg README's onboarding section (around line 740) says you're supposed to push that branch by hand at repo-creation time, but the branch protection on delphix/sdb restricts pushes to upstreams/* to delphix-devops-bot only, so a human spec author can't do it themselves; the bot only pushes during the normal sync flow, which can't run because the branch doesn't exist. Chicken-and-egg.

The same gap applies to every future upstream-tracked package that gets onboarded.

Solution

The solution is to bootstrap upstream-HEAD from UPSTREAM_GIT_URL / UPSTREAM_GIT_BRANCH directly when the package repo's upstreams/<branch> is missing, and touch $WORKDIR/upstream-updated so sync-with-upstream.sh pushes the bootstrapped ref back via the bot creds it already uses at the push step. git push of a non-existent remote branch creates it, so the first sync run becomes the moment upstreams/<branch> is born on origin; subsequent runs are no different from the existing fast-forward path.

To make the conditional fetch possible, git_fetch_helper's internal || die is dropped. The four existing callers all use logmust, which handles failure identically, so the new fallback caller can branch on the exit code without losing the fail-hard behavior elsewhere.

Two files change: the bootstrap fallback in lib/common.sh, and the sdb recipe at packages/sdb/config.sh, which surfaces the gap and is needed to verify the fallback end-to-end against a real upstream-tracked recipe.

Testing Done

Jenkins check-updates #1148 on this branch with PACKAGES=sdb, UPDATE_PACKAGES=false. The bootstrap path hits, upstream-HEAD populates from sdimitro/sdb develop, and "Package sdb has updates available" reports cleanly, e.g.

fatal: couldn't find remote ref upstreams/develop
NOTE: upstreams/develop does not exist on https://github.com/delphix/sdb.git; bootstrapping upstream-HEAD from https://github.com/sdimitro/sdb.git (develop).
Running: [token passed] git fetch https://github.com/sdimitro/sdb.git --no-tags +develop:upstream-HEAD
 * [new branch]      develop    -> upstream-HEAD
Running: touch .../upstream-updated
Success: Package sdb has updates available.

For contrast, #1147 at the prior branch tip confirms the original failure mode.

Post-merge verification (out of scope here):

• Seed job picks up sdb's update_upstream() definition and auto-generates update-package/sdb.
• First nightly cron run, after delphix/devops-gate#4438 also lands, exercises the real push of upstreams/develop to delphix/sdb and merges upstream into develop. That also satisfies the long-deferred Phase 1 AC Add unit tests #2 as a side-effect.
• build-package/sdb/pre-push to verify the .deb's Version: field derives from setuptools_scm (Phase 2 AC Add package definition for make-jpkg #11).

Spec context: delphix/cd-aidlc#62. JIRA: TOOL-30021.