Closed Bug 1525906 Opened 1 year ago Closed 1 year ago

Audit the scopes granted to the shipit client

Categories

(Release Engineering :: Applications: Shipit (backend), enhancement)

enhancement
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: jvehent, Assigned: rail)

References

Details

The ShipIt client project/releng/shipit/production has access to the following scopes: https://tools.taskcluster.net/auth/clients/project%2Freleng%2Fshipit%2Fproduction

We should verify these scopes are as minimal as possible.

ATM those scopes are necessary. After we resolve bug 1485680, we definitely can remove a bunch of queue:* related scopes. I'll revisit this bug after the switch (hopefully later this month).

Depends on: 1485680

I'm going to test this using the staging account first. The current list of the scopes is:

assume:repo:hg.mozilla.org/projects/birch:branch:*
assume:repo:hg.mozilla.org/projects/jamun:branch:*
assume:repo:hg.mozilla.org/projects/maple:branch:*
assume:repo:hg.mozilla.org/try-comm-central:branch:*
assume:repo:hg.mozilla.org/try:branch:*
hooks:trigger-hook:project-comm/in-tree-action-1-generic/*
hooks:trigger-hook:project-comm/in-tree-action-1-release-promotion/*
hooks:trigger-hook:project-comm/in-tree-action-3-generic/*
hooks:trigger-hook:project-comm/in-tree-action-3-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-1-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-1-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-3-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-3-release-promotion/*
notify:irc-channel:#releaseduty-staging
project:releng:services/shipit_api/rebuild_product_details
project:releng:services/shipit_api/sync_release_datetimes
project:releng:services/shipit_api/sync_releases
project:releng:services/shipit_api/update_release_status
secrets:get:repo:github.com/mozilla-releng/services:branch:master
secrets:get:repo:github.com/mozilla-releng/services:branch:staging
secrets:get:repo:github.com/mozilla-releng/services:branch:testing
secrets:get:repo:github.com/mozilla-releng/services:pull-request

Staging looks good with the following scopes left:

hooks:trigger-hook:project-comm/in-tree-action-1-generic/*
hooks:trigger-hook:project-comm/in-tree-action-1-release-promotion/*
hooks:trigger-hook:project-comm/in-tree-action-3-generic/*
hooks:trigger-hook:project-comm/in-tree-action-3-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-1-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-1-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-3-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-3-release-promotion/*
notify:irc-channel:#releaseduty-staging
project:releng:services/shipit_api/rebuild_product_details
project:releng:services/shipit_api/sync_release_datetimes
project:releng:services/shipit_api/sync_releases
project:releng:services/shipit_api/update_release_status
secrets:get:repo:github.com/mozilla-releng/services:branch:master
secrets:get:repo:github.com/mozilla-releng/services:branch:staging
secrets:get:repo:github.com/mozilla-releng/services:branch:testing
secrets:get:repo:github.com/mozilla-releng/services:pull-request

Production before:

assume:repo:hg.mozilla.org/releases/comm-beta:branch:*
assume:repo:hg.mozilla.org/releases/comm-esr*
assume:repo:hg.mozilla.org/releases/mozilla-beta:branch:*
assume:repo:hg.mozilla.org/releases/mozilla-esr*
assume:repo:hg.mozilla.org/releases/mozilla-release:branch:*
hooks:trigger-hook:project-comm/in-tree-action-3-generic/*
hooks:trigger-hook:project-comm/in-tree-action-3-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-3-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-3-release-promotion/*
notify:irc-channel:#releaseduty
notify:irc-channel:#tbdrivers
project:releng:services/shipit_api/rebuild_product_details
project:releng:services/shipit_api/sync_release_datetimes
project:releng:services/shipit_api/sync_releases
project:releng:services/shipit_api/update_release_status
secrets:get:repo:github.com/mozilla-releng/services:branch:production

Production after:

hooks:trigger-hook:project-comm/in-tree-action-3-generic/*
hooks:trigger-hook:project-comm/in-tree-action-3-release-promotion/*
hooks:trigger-hook:project-gecko/in-tree-action-3-generic/*
hooks:trigger-hook:project-gecko/in-tree-action-3-release-promotion/*
notify:irc-channel:#releaseduty
notify:irc-channel:#tbdrivers
project:releng:services/shipit_api/rebuild_product_details
project:releng:services/shipit_api/sync_release_datetimes
project:releng:services/shipit_api/sync_releases
project:releng:services/shipit_api/update_release_status
secrets:get:repo:github.com/mozilla-releng/services:branch:production

Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED

I reverted the production client changes. Something didn't work.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---

Looks like something was missing with the uplift of the task-to-hook patches.

I changed the scopes again, 66.0.3 is out, we can try again.

Status: REOPENED → RESOLVED
Closed: 1 year ago1 year ago
Resolution: --- → FIXED

I had to add these scopes, because we had to chemspill and the patches are not on the relbranch.

assume:repo:hg.mozilla.org/releases/comm-esr*
assume:repo:hg.mozilla.org/releases/mozilla-esr*

Status: RESOLVED → REOPENED
Resolution: FIXED → ---

We should be good now. I removed the scopes I added in comment #9.

Status: REOPENED → RESOLVED
Closed: 1 year ago1 year ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.