1354067 - Should implement per-repo scopes for cancelling tasks

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

At the moment, to cancel a github-integration taskcluster task, you need:

queue:cancel-task:taskcluster-github/*

We should be able to control access to task cancellation per repo.

This is non-trivial with existing scopes, but perhaps we could add a github service cancel endpoint, i.e. add a "cancel" endpoint to

https://docs.taskcluster.net/reference/integrations/taskcluster-github/references/api

which in turn calls the queue.cancelTask endpoint.

Just an idea, maybe crazy. Probably is, as we wouldn't want to have github-specific handling in task inspector, no doubt.

Although if we introduce a CI-like repo-specific web interface (like travis) then we could provide access to the endpoint there.

Anyways, probably that isn't the best way to do it, but I'm out of other ideas for the moment, other than introducing some kind of global project property into taskcluster as a primitive (in line with the multi-tenant idea) such that tasks can assigned to projects, and projects could map to repos ... and then scopes could include <projectId> (rather than <taskGroupId>).

Anyways, regardless of how we implement, we should be able to control access to task cancelation more granularly than this.

Oh ..... maybe schedulerId can contain repo name? That might do it!

Comment 1

[Pete Moore [:pmoore][:pete]]

I really probably shouldn't be discussing this in a bug, but too late, it looks like I created it!

Any thoughts on the best way we should implement this?

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Users don't have github-repo-associated scopes, so at the moment there's no way to do this.

This might be better as an RFC, one depending on https://github.com/taskcluster/taskcluster-rfcs/issues/16

Comment 3

[Brian Stack [:bstack]]

Ditto to what dustin said, but in general I agree that making sure users can do this is important for however we build it out.

Comment 4

[Jonas Finnemann Jensen (:jonasfj)]

Agree, let's move this to rfc

Comment 5

[Pete Moore [:pmoore][:pete]]

(In reply to Dustin J. Mitchell [:dustin] from comment #2)
> Users don't have github-repo-associated scopes, so at the moment there's no
> way to do this.
> 
> This might be better as an RFC, one depending on
> https://github.com/taskcluster/taskcluster-rfcs/issues/16

Thanks for the link to that - I think we won't need a separate RFC - I guess rfc #16 would already cover this, but just to be sure, I added a note to the RFC so that it doesn't get forgotten. Therefore I'll close here... Thanks guys!

I'm marking as "RESOLVED" as I can't resolve this bug as a duplicate of a github issue - but let's consider the above github issue as the place for tracking this.