1391560 - snap builds fails release runner automation for missing scopes

Status: RESOLVED FIXED

(Release Engineering :: Release Automation: Other, defect, P2)

Description

[Mihai Tabara [:mtabara]⌚️GMT]

Starting release 56.0b4 was blocked due to missing scopes under newly added snap changes[1]. The scope was missing from the TC client releaserunner is using, but we didn't know where to add it, following this path:

`project:releng:release:mozilla-beta` is expanding `repo:hg.mozilla.org/releases/mozilla-beta:*` which at its turn is expanding `moz-tree:level:3` 

The latter is being used in lot of other roles[2] so we ended up adding the scope in the TC client itself[3]. It still didn't work and we suspect this could be related to the fact that the newly added scope within the graph scopes themselves too maybe[4]. We'll test this later on next week on staging.

Eventually, we did go with backing out the changes from releasetasks[5], pulling to bm85 and re-stating the build which worked smoothly.

First two failed graphs are [6] and [7]. Correct one is in releasewarrior now.

For later: once we fix this bug, we need to make sure we move that scope from [3] and put it in some proper place. Either create a beta-specific role or add it elsewhere. But technically, it's hackish to use the TC client itself for this purpose. But solves the problem for now.


[1]: https://github.com/mozilla-releng/releasetasks/commit/b16f9e02da4d41657d05b061928bb12da0f8d28a
[2]: https://tools.taskcluster.net/auth/scopes/assume%3Amoz-tree%3Alevel%3A3
[3]: project/releng/releasepromotion/production
[4]: https://github.com/mozilla-releng/releasetasks/blob/master/releasetasks/templates/desktop/release_graph.yml.tmpl#L27
[5]: https://github.com/mozilla-releng/releasetasks/commit/0afeb3183dd38c5ce68a9b6d685e05be43a62558
[6]: https://tools.taskcluster.net/groups/GjgfvPMfRcy02KAIUWua7w
[7]: https://tools.taskcluster.net/groups/aWQ10bbMSIOrkZKissLfOA

Comment 2

[Mihai Tabara [:mtabara]⌚️GMT]

Note to self: regardless of how this bug ends, we need to revisit the snap scope[1] from TC relpro role[2].

That means:
a) either we keep it either, assuming it's the best place to live
b) move it to some other dedicated role that is to be assigned to beta only.

[1]:secrets:get:project/releng/snapcraft/firefox/edge
[2]: project/releng/releasepromotion/production

Comment 3

[Johan Lorenzo [:jlorenzo]]

Attachment: releasetasks PR

Was r+'d by both Rail and Mihai. Landed at https://github.com/mozilla-releng/releasetasks/commit/e0821899df4f58435308b800d29d3757ae4f41e5

Please see https://github.com/mozilla-releng/releasetasks/pull/266#issuecomment-323973600 in case of failure. 

I pulled the latest changes on both bm83 and bm85.

Comment 4

[Johan Lorenzo [:jlorenzo]]

(In reply to Mihai Tabara [:mtabara]⌚️GMT from comment #2)
In my opinion, project/releng/releasepromotion/production is good enough. We'll likely want to ship release at some point. Both release and beta will be on the same product on Ubuntu Store (unlike Google Play, for instance). As a consequence, having different credentials seems overkill to me.

Comment 5

[Mihai Tabara [:mtabara]⌚️GMT]

(In reply to Johan Lorenzo [:jlorenzo] from comment #4)
> (In reply to Mihai Tabara [:mtabara]⌚️GMT from comment #2)
> In my opinion, project/releng/releasepromotion/production is good enough.
> We'll likely want to ship release at some point. Both release and beta will
> be on the same product on Ubuntu Store (unlike Google Play, for instance).
> As a consequence, having different credentials seems overkill to me.

Sounds good to me than! :+1