[NavidSassan]

Summary

A workflow for keeping versioned templates in line with upstream releases, piloted with Graylog.

• tools/follow-upstream <app> <version> extracts /etc from the RPM and the DEB of a release (streamed in a Rocky 9 container, nothing is installed) and three-way merges the packaged file changes since each template's base release into the template: git merge-file <template> <packaged file, base release> <packaged file, new release>. LFOps changes are kept, overlapping upstream changes become conflict markers. For a new release series it creates the template from the previous one, adds the series to the supported versions and lists lines that still mention the old series.
• On every run it also checks the packaging: files below /etc that are neither templated nor ignored, templated files a release no longer ships, and files that differ between RPM and DEB.
• The base comes from the package, not from the upstream source tree: Graylog's packaging rewrites server.conf (absolute bin_dir, data_dir, node_id_file, message_journal_dir, added integrations_scripts_dir).
• Each template records its base as {# Based on graylog-server 7.2.1 #}. As a Jinja comment it is not rendered, so adding it changes no deployed file and restarts nothing. CONTRIBUTING.md documents the convention.
• tools/follow-upstream.yml lists the applications (Graylog for now). The lfops-follow-upstream Claude Code skill drives the tool from a release notice (pasted mail, <app> <version>, or a local notmuch tag) and covers what the tool cannot decide: conflicts, new or removed options, packaging changes, tests, CHANGELOG. .claude is excluded from the collection build.
• First use: the 7.1 server.conf template is synced with Graylog 7.1.11 (adds the commented events_index_refresh_interval setting). 7.0.15 and 7.2.1 need no change.

No CHANGELOG entry: the tooling is contributor-only, and the template sync only adds upstream comments, as with the earlier 7.1.10 sync.

Test

No Molecule scenario exists for the Graylog roles.

• The Based on release of every 7.x template was determined by diffing it against the files from the graylog-server / graylog-datanode RPMs of all patch releases of its series.
• New-series path: with the 7.2 templates deleted in a scratch copy, tools/follow-upstream graylog 7.2.1 rebuilt them from 7.1 identical to the existing ones, except the timestamp and a go2docs.graylog.org/7-1/ link, which the tool reports.
• tools/follow-upstream graylog for 7.0.15, 7.1.11 and 7.2.1: exit 0, RPM and DEB byte-identical for all mapped files.
• Packaging check, provoked in a scratch copy: an unignored packaged file, a changed DEB server.conf, a moved jvm.options and a non-existent release are all reported (exit 1 / exit 2).
• The Based on Jinja comment renders to nothing (ansible.builtin.template lookup).
• pre-commit (ruff, bandit, vulture, yamllint) passes.