1458613 - Enable travis for the security repository

Status: RESOLVED WONTFIX

(addons.mozilla.org :: Security, enhancement)

Description

[Andreas Wagner [:TheOne] [use NI]]

It would be great if we could 

1) run travis against the security repository to catch test failures for security patches

2) add a job to jenkins to be able to push directly to stage/prod from that repository, in order to avoid having to commit the patch to the public repo before deploying.

Comment 1

[Andrew Williamson [:eviljeff]]

1) is just hooking up a private travis-ci.com account

2) is a lot more non-trivial, and will rely on addons-server-security being up to date with addons-server before merging. 

I think you should split deployment into another bug.

Comment 2

[Philip Cristiano]

If we have a Travis CI private account this would need an admin for the security repo to enable it. At this time I'm not an admin for the repo.

Comment 3

[Andrew Williamson [:eviljeff]]

Stuart is this something you can enable?

Comment 4

[Stuart Colville [:muffinresearch]]

(In reply to Andrew Williamson [:eviljeff] from comment #3)
> Stuart is this something you can enable?

I'll need to see whether the mozilla github ops can setup the travis integration. It doesn't appear to be enabled yet.

Comment 5

[Stuart Colville [:muffinresearch]]

Since this was filed, there's a new feature on github that we now use for managing security patches. However it's not posssible to enable CI for this either. On that basis this is a wontfix.

From https://docs.github.com/en/github/managing-security-vulnerabilities/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability

"To keep information about vulnerabilities secure, integrations, including CI, cannot access temporary private forks."