The pipeline, end to end

1. Pinnewest_tag_overall() lists remote stable tags from the Chromium mirror, sorts them by version and resolves the newest. The whole cycle hangs off this single number.
2. Syncgclient sync at the pinned tag pulls the main src.git pack (~6 GB shallow) plus hundreds of dependency repos across parallel streams. depot_tools is cloned automatically if missing.
3. PatchThe Fluorite layer applies onto the pristine tree. Queued changes from pending/ join here after review. Anything that fails against the new base stops the line for triage.
4. BuildAn official-config release compile into out/LTS: component build off, symbols trimmed. This is the long stage — hours of cores doing honest work.
5. TestIf a suite is configured it runs now. An empty TEST_CMD skips the gate; a failing test aborts promotion.
6. PromoteBlessed files are copied into dist/<tag>/: the browser binary plus its runtime data files. The cycle stamps itself as done and won't fire again until the next window.

Command	When to use it
./fetch-chromium.sh	First ever run: clones depot_tools, verifies ~120 GB free disk, syncs the newest stable tag, seeds the patch directories and writes BASE_VERSION.
./fluorite-release.sh	The cycle runner. Self-gates on the LAST_CYCLE stamp — silently skips unless 42 days have passed.
FORCE_CYCLE=1 ./fluorite-release.sh	Overrides the calendar: discard tree, fresh pull, build, test, promote right now.
./apply-security-update.sh	Mid-cycle path: fast-forwards the pinned tree to include a milestone security fix, then rebuilds.
./secwatch-weekly.sh	The weekly orchestrator run by systemd: watch container first, then conditional update, then the self-gated cycle script.

• Disk: ~120 GB free minimum — shallow checkout plus build output. The fetch script checks this and refuses otherwise.
• Tooling: git, Python 3, Docker (for the containerized watcher; an inline fallback exists).
• Bandwidth: the main pack is a single ~6 GB stream; dependency repos fan out over JOBS parallel connections (16–24 saturates most lines).
• Patience: a full official Chromium build takes hours even on strong hardware. Nice 10 on the weekly timer keeps it polite.

All shared settings live in env.sh; everything can be overridden per-invocation without editing files.

JOBS=24 TEST_CMD="./fluorite/tests/run.sh $PWD/out/LTS" ./fluorite-release.sh FORCE_CYCLE=1

Full variable reference on the developers page. Weekly automation details live on the security page.