1538239 - Move sec-approval into Phabricator

Status: NEW

(Conduit :: Phabricator, enhancement, P2)

Description

[Steven MacLeod [:smacleod]]

The “sec-approval” flag needs some analog in Phabricator for the new process and for use in Lando. This can be used to create a better warning based on sec-approval.

• Create a “sec-approval” project in Phabricator, with members being those who can set “sec-approval+” in bugzilla.
• Document a process for the management of those with the permission to provide sec-approval.
• Document a process around requesting sec-approval by asking for review from the sec-approval project and receiving approval or changes being requested.
  • Plan is to have Lando take care of this automatically when prompting you for a sanitized commit message.
• Ensure there is a good notification / dashboarding story for sec-approval requests
  • Documentation around managing the notification emails and dashboarding would be useful.

We should also ensure we:

• Update Lando API to special case and never include “sec-approval” as a reviewer in the commit message.
  • A patch having sec-approval is sensitive and we should not leak this.
• Update Lando API to have a landing warning when sec-approval has not been given for a security revision.
  • We’re starting with a warning and can aim to have a hard blocker in later milestones.