Currently we have sync jobs that pulls into our branches the upstream branches. For instance, we have a job that syncs the Istio upstream branch 1.16 with our maistra-2.4 branch, bringing in all changes from upstream.

Quoting Daniel:

The only issue I have with this approach - and I discussed this with Jonh on one of the PRs before - is that we're pulling in all changes from the release branches, no matter if they have been released or not. This is great to keep us up to date, but we're also not based on a clear-cut upstream version anymore, because we're including yet-unreleased commits. If everybody's aware of that and thinks it's a negligible risk, then that's fine but it needs to be on top of everybody's mind in case it causes problems in the future (e.g. we included a faulty commit that upstream reverted before release)

We should enhance the automator script to have an option of only fetch commits up to the latest tag on the specified branch. This way we can rest assured that we're only bringing in changes that were released in upstream.