feat(gitlab): default pipeline schedule on the least used slot

[beliven-alex-zongaro]

Summary

New projects had no pipeline schedule, so whoever wanted a periodic run (e.g. to rebuild the Docker images with the latest patches) created it by hand, usually at the same time as everyone else. This adds an opt-in default schedule whose time is chosen by the tool, so the pipelines are spread.

The schedule (defaults in code, no configuration)

• weekly, on a working day, between 09:00 and 18:00 (Europe/Rome), 15 minutes slots
• runs on main when the project has it, otherwise on the default branch
• description opsi default schedule
• the slot is the least used one, counting the active schedules of every project (also the ones in another time zone, and the ones created in the same run). Among equal slots the choice depends on the project, so it is stable

Commands

• opsi gitlab project create <name> ... -c (--schedule): creates the schedule at the end of the creation. Without the flag nothing changes.
• opsi gitlab schedule create {project_id}...: creates the schedule on existing projects. A project that already has an active schedule is skipped; a failing project does not stop the others.
• opsi gitlab schedule update [project_id]...: fixes the active schedules that lost their owner (the owner does not exist anymore, is blocked or is deactivated). A schedule runs as its owner, so it stops silently when the owner goes away. Those schedules are given to the user of the token with take_ownership. The schedules of an active user are left alone, and cron, branch and description are not touched. It never creates or activates anything. Without projects it checks all of them (5 at a time, progress on one line); projects whose schedules cannot be read (pipelines disabled) are skipped. --dry-run only shows the schedules with their description and owner, and asks no confirmation.

The projects are referred to by numeric ID, like the other commands.

Also fixes the hint of mirror create, which still suggested the removed update mirroring command.

Notes

• A schedule is owned by the user of the token that creates it. Today the existing schedules belong to cicd; the ones created with a personal token will belong to that user. Giving them to cicd would need a token with the sudo scope (Sudo header) or the cicd token: not part of this PR.

Test plan

• go vet ./... and go test ./... (slot choice and spreading, existing cron parsing and time zone conversion, create with an existing schedule / without main / failing project, update dry run, orphan owner, inactive schedules, projects without pipelines)
• opsi gitlab schedule update --dry-run on git.beliven.dev (241 projects): the 3 active schedules, all owned by cicd, are left alone
• opsi gitlab schedule create <id> on a test repo, twice (second run skips), and check it in Build > Pipeline schedules
• opsi gitlab project create ... -c on a test group

🤖 Generated with Claude Code