I'm not sure why this works, but it does:

https://gitlab.torproject.org/tpo/tpa/wiki-replica/-/pipelines/54488

Maybe the problem is the newer alpine images don't ship bash. I'm not
sure why we were using bash in the first place; i don't believe we had
any bashism. But according to:

https://docs.gitlab.com/ee/ci/docker/using_docker_images.html#override-the-entrypoint-of-an-image

... just an empty entrypoint is actually the way to go here.

the condition also excludes merge requests, as before

It seems we were actually never running this job, which should have
help with issues like #1. Assuming the mirror
would have been correctly configured, this job would have warned about
the desync commits.

Before the fix, of course, it wouldn't have detected anything, because
the commits were crushed, but now this should correctly fail.

We'd this in MRs CI:

    /bin/bash: line 131: git: command not found

Doh.

The comments were misrefering to things

This is necessarily going to fail.

This will make sure it will run on every pipeline, but also make
failures clearer.

This hides the actual command ran, so it's not so great.

This reverts commit a9d3ae77.

colons are a pain in the back in YAML, but it seems like the "Block
Scaler Style" works around the problem.

The file list just doesn't show up

We still run the entire lint because that is not file-specific, and
will be easier to trigger.

git is not available in that silly image of theirs, so we have to make
a separate build stage to actually list the changed files, store that
in an artifact, and *then* be able to do the run only on those files.

That is quite silly. Surely there must be a better way?

Stack overflow to the rescue once again... https://stackoverflow.com/questions/45588426/how-to-execute-a-script-located-in-the-runner-from-the-ci-pipeline