Bugzilla

Thanks Julien.

So, grating `project:releng:ship-it:server:production` to `mozilla-central` would enable it to call all the actions on all the products?

That kinda sucks :C

Is it because we grant [the actions](https://hg.mozilla.org/ci/ci-configuration/file/b596f4e363c456c0701bf16fbdeb544d27e46eaa/grants.yml#l319) to `gecko-roles`?

I see some references to "products" in the worker's client scopes, but they apply to all the `gecko-3` workers.

```
...
project/releng/scriptworker/v2/shipit/prod/firefoxci-gecko-3:
  description: ''
  scopes:
    - project:releng:services/shipit_api/update_product_channel_version/firefox
    - project:releng:services/shipit_api/add_release/devedition
    - project:releng:services/shipit_api/add_release/fennec
    - project:releng:services/shipit_api/add_release/firefox
...
```

Thanks Julien.

So, grating `project:releng:ship-it:server:production` to `mozilla-central` would enable it to call all the actions on all the products?

That kinda sucks :C

Is it because we grant [the actions](https://hg.mozilla.org/ci/ci-configuration/file/b596f4e363c456c0701bf16fbdeb544d27e46eaa/grants.yml#l319) to the `gecko` trust domain?

I see some references to "products" in the worker's client scopes, but they apply to all the `gecko-3` workers.

```
...
project/releng/scriptworker/v2/shipit/prod/firefoxci-gecko-3:
  description: ''
  scopes:
    - project:releng:services/shipit_api/update_product_channel_version/firefox
    - project:releng:services/shipit_api/add_release/devedition
    - project:releng:services/shipit_api/add_release/fennec
    - project:releng:services/shipit_api/add_release/firefox
...
```