git-export does not remove commits or tags for rolled-back changes in preview

[alexcottner]

It's possible for remote-settings users to rollback their proposed changes that are in the preview collection.

The git-export process does not handle this situation cleanly.
Ex: https://github.com/mozilla/remote-settings-data-stage/tree/v1/timestamps/main-preview/product-integrity/1781106009105

These changes were requested for review and then rolled back. So that commit and tag would need to be removed.

Steps to reproduce:

1. In admin, make a change and request review
2. Wait for git-export job to pick up the changes and export them to git
3. Verify the data git repo now has the commit and tag for the preview bucket
4. Rollback the changes in admin
5. Wait for git-export job to run again
6. Changes are still in the data git repo

┆Issue is synchronized with this Jira Task

[leplatrem]

The commit and associated tag after the rollback are here: mozilla/remote-settings-data-stage@6060dd4

So the issue is that there is "a trace" of some changes that were rolledback. Like a patch in phabricator keeps all intermediary versions before it's merged.

git-export is "append only" in that sense too.
Also I don't know how we would detect a rollback to hard-delete these intermediary commits.
Comparing collection wouldn't work since we wouldn't be able to differenciate it with: create record. approve. delete record. approve.

What are the consequences of this bug?

[alexcottner]

The main consequence is this means preview collections can't be "rolled back". They can be overwritten with the next set of staged changes, but they can never be rolled back.