1494832 - I'm (sometimes) unable to perform taskcluster actions on Treeherder due to missing scope trigger-hook:project-gecko/in-tree-action-3-generic/0ea6c1133c

Status: RESOLVED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I returned to Mozilla after roughly a year away, and after getting commit and other access turned back on in various places, have tried to use Treeherder to do some things, like cancel or retrigger jobs. Sometimes that works, other times I get this error (cleaned up a bit for readability):
Taskcluster: 
  You do not have sufficient scopes. You are missing the following scopes:
    hooks:trigger-hook:project-gecko/in-tree-action-3-generic/0ea6c1133c
  You have the scopes: 
    [SCOPES REDACTED]
  This request requires you to satisfy this scope expression: 
    hooks:trigger-hook:project-gecko/in-tree-action-3-generic/0ea6c1133c 
  --- * method: triggerHook * errorCode: InsufficientScopes * statusCode: 403 * time: 2018-09-28T01:40:31.058Z 

I first hit this myself on Tuesday of this week, and since then, I've been able to retrigger jobs just fine. Earlier today, :mixedpuppy hit the same error, but I was able to retrigger the job for them, so we just moved on with our days. Then tonight, I tried to retrigger a job and hit the error again.

I doubt someone is manually flipping this scope on our accounts all the time, is there some network issue messing with this?

Ccing :mixedpuppy since Shane hit the same error, and :camd in case there's something on Treeherder's end that needs attention.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

That is definitely weird.  Your account should have scope hooks:trigger-hook:project-gecko/in-tree-action-3-generic/* so even when that hash changes, you should not get InvalidScopes.  Can you provide the redacted scopes?

Comment 2

[Shane Caraveo (:mixedpuppy)]

The error in treeherder is:

Taskcluster: You do not have sufficient scopes. You are missing the following scopes: ``` hooks:trigger-hook:project-gecko/in-tree-action-1-generic/0ea6c1133c ``` You have the scopes: ``` [ "assume:hook-id:garbage/*", "assume:login-identity:mozilla-auth0/ad|Mozilla-LDAP|scaraveo", "assume:mozilla-group:IntranetWiki", "assume:mozilla-group:StatsDashboard", "assume:mozilla-group:cloudservices_dev_aws", "assume:mozilla-group:corp-vpn", "assume:mozilla-group:egencia_us", "assume:mozilla-group:phonebook_access", "assume:mozilla-group:tableau_users", "assume:mozilla-group:team_moco", "assume:mozilla-group:vpn_corp", "assume:mozilla-group:vpn_default", "assume:project:taskcluster:tutorial", "assume:worker-id:*", "auth:create-client:mozilla-auth0/ad|Mozilla-LDAP|scaraveo/*", "auth:create-role:hook-id:garbage/*", "auth:delete-client:mozilla-auth0/ad|Mozilla-LDAP|scaraveo/*", "auth:delete-role:hook-id:garbage/*", "auth:reset-access-token:mozilla-auth0/ad|Mozilla-LDAP|scaraveo/*", "auth:update-client:mozilla-auth0/ad|Mozilla-LDAP|scaraveo/*", "auth:update-role:hook-id:garbage/*", "hooks:modify-hook:garbage/*", "hooks:trigger-hook:garbage/*", "queue:cancel-task:taskcluster-github/*", "queue:create-task:aws-provisioner-v1/b2gtest", "queue:create-task:aws-provisioner-v1/tutorial", "queue:get-artifact:login-identity/mozilla-auth0/ad|Mozilla-LDAP|scaraveo/*", "queue:get-artifact:private/*", "queue:rerun-task", "queue:resolve-task", "queue:route:index.garbage.*", "queue:route:index.gecko.heavyprofile", "scheduler:create-task-graph", "scheduler:extend-task-graph", "secrets:get:garbage/*", "secrets:set:garbage/*" ] ``` This request requires you to satisfy this scope expression: ``` hooks:trigger-hook:project-gecko/in-tree-action-1-generic/0ea6c1133c ``` --- * method: triggerHook * errorCode: InsufficientScopes * statusCode: 403 * time: 2018-09-27T19:44:20.015Z

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Ah, so it looks like your [e-mail] LDAP account does not have push access.  Actions are associated with permission to push.  So, you'll need to login with the LDAP account that you use to push changes to hg.  Alternately, it's usually pretty easy to get the relevant bits added to your mozilla account, given a connection with your community account.  In that case, you'll still need to occasionally push with the mozilla account to keep it active.  You might also consider just transferring the bits to your mozilla account and using that exclusively to push (you can still set 'author' in your csets).

Comment 4

[Shane Caraveo (:mixedpuppy)]

Yep, that is it.  Using my gmail account lets me retrigger.

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

In my case, I don't think that's the problem. I'm signed in to Treeherder with my MoCo address, which I just used to successfully push to tryserver with `./mach try empty`.

I haven't changed my login, but I am now able to retrigger tasks successfully, so I can't get you my list of scopes. Should this happen again, I'll bring it back up in here.