Disable pull mirror if repository is in read-only state

During a project migration to another shard in
https://gitlab.com/gitlab-com/gl-infra/production/issues/1250, we
noticed the GetAllLFSPointers RPC was timing out for a repository
that was marked as read-only.

To avoid updates while the migration is happening, we need to check
the `repository_read_only` flag and skip the update.

changelogs/unreleased/sh-guard-repository-mirrors-read-only.yml

+---
+title: Disable pull mirror if repository is in read-only state
+merge_request: 19182
+author:
+type: fixed

ee/app/services/projects/update_mirror_service.rb

@@ -10,6 +10,12 @@ module Projects
         return success
       end
 
+      # This should be an error, but to prevent the mirroring
+      # from being disabled when moving between shards
+      # we make it "success" for time being
+      # Ref: https://gitlab.com/gitlab-org/gitlab/merge_requests/19182
+      return success if project.repository_read_only?
+
       unless can?(current_user, :push_code_to_protected_branches, project)
         return error("The mirror user is not allowed to push code to all branches on this project.")
       end

ee/spec/services/projects/update_mirror_service_spec.rb

@@ -72,6 +72,19 @@ describe Projects::UpdateMirrorService do
       end
     end
 
+    context 'when repository is in read-only mode' do
+      before do
+        project.update_attribute(:repository_read_only, true)
+      end
+
+      it 'does not run if repository is set to read-only' do
+        expect(service).not_to receive(:update_tags)
+        expect(service).not_to receive(:update_branches)
+
+        expect(service.execute).to be_truthy
+      end
+    end
+
     context 'when tags on mirror are modified' do
       let(:mirror_project) { create(:project, :repository)}
       let(:mirror_path) { File.join(TestEnv.repos_path, mirror_project.repository.relative_path) }