tf-a-lts-create-release: For sandbox run, push commit to a branch

If it's sandbox run, we still need to push commit to some branch,
because otherwise the tag won't be visible in Gerrit (due to ACL
model Gerrit uses: it resolve tag to a branch it belongs to, then
checks ACLs on branch to see if a user has access to it; no branch
== problems).

Signed-off-by: Paul Sokolovsky <paul.sokolovsky@linaro.org>
Change-Id: Ifa467c9b07951e3e9997fa0d687ea08f9e459144
diff --git a/tf-a-lts-create-release.yaml b/tf-a-lts-create-release.yaml
index 30feb3d..5ba35c4 100644
--- a/tf-a-lts-create-release.yaml
+++ b/tf-a-lts-create-release.yaml
@@ -92,9 +92,16 @@
 
             #git push ssh://$CI_BOT_USERNAME@$GERRIT_HOST:29418/$GERRIT_PROJECT HEAD:refs/for/$GERRIT_BRANCH
 
-            # Push to the LTS branch
             if [ "$SANDBOX_RUN" == "false" ]; then
+                # Push to the LTS branch
                 git push ssh://$CI_BOT_USERNAME@$GERRIT_HOST:29418/$GERRIT_PROJECT
+            else
+                # If it's sandbox run, we still need to push commit to some branch,
+                # because otherwise the tag won't be visible in Gerrit (due to ACL
+                # model Gerrit uses: it resolve tag to a branch it belongs to, then
+                # checks ACLs on branch to see if a user has access to it; no branch
+                # == problems).
+                git push ssh://${CI_BOT_USERNAME}@${GERRIT_HOST}:29418/${GERRIT_PROJECT} HEAD:refs/heads/${TAG}-br
             fi
             # Push tag
             git push ssh://$CI_BOT_USERNAME@$GERRIT_HOST:29418/$GERRIT_PROJECT $TAG