1315323 - Require membership to scm_versioncontrol to push to version-control-tools

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

Currently, version-control-tools can be pushed to by anyone with SCM level 2. We want to restrict it to trusted people.

Comment 1

[Gregory Szorc [:gps]]

Attachment: ansible/hg-ssh: add scm_versioncontrol (bug 1315323);

We add a stub entry to the test LDAP server, add trust of files owned
by this group to the hgssh server, and create the group on hgssh.
The gid matches production.

I also noticed scm_autoland was missing from Ansible and added it.

Review commit: https://reviewboard.mozilla.org/r/90758/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/90758/

Comment 2

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8807658 [details]
ansible/hg-ssh: add scm_versioncontrol (bug 1315323);

https://reviewboard.mozilla.org/r/90758/#review90480

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/d0b3d956b36d
ansible/hg-ssh: add scm_versioncontrol ; r=fubar

Comment 4

[Gregory Szorc [:gps]]

We never actually changed group ownership of the repo on the ssh server. So I just made that change.