1563627 - Please RESTORE jorgk's access rerun tasks on C-C treeherder

Status: RESOLVED WORKSFORME

(Release Engineering :: Firefox-CI Administration, defect)

Description

[Jorg K (CEST = GMT+2)]

+++ This bug was initially created as a clone of Bug #1538462 +++
+++ This bug was initially created as a clone of Bug #1459478 +++

This stopped working just now:

$ ../taskcluster.exe task rerun  f3hAEOQ-TB29m19iAbVmrg
Error: could not rerun the task f3hAEOQ-TB29m19iAbVmrg: (Permanent) HTTP response code 403
HTTP/1.1 403 Forbidden
Content-Length: 1094
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,Accept,Origin,Cache-Control
Access-Control-Allow-Methods: OPTIONS,GET,HEAD,POST,PUT,DELETE,TRACE,CONNECT
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 900
Access-Control-Request-Method: *
Cache-Control: no-store no-cache must-revalidate
Connection: keep-alive
Content-Security-Policy: report-uri /__cspreport__;default-src 'none';frame-ancestors 'none';
Content-Type: application/json; charset=utf-8
Date: Thu, 04 Jul 2019 22:42:41 GMT
Etag: W/"446-3/PgXuYQLw/55SwU4cEi35uZIHk"
Server: Cowboy
Strict-Transport-Security: max-age=7776000000; includeSubDomains
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-For-Request-Id: 5c25293f-9b1a-4551-b06b-2dfcf443d9db

{
  "code": "InsufficientScopes",
  "message": "Client ID mozilla-auth0/ad|Mozilla-LDAP|mozilla23456789/cli does not have sufficient scopes and is missing the following scopes:\n\n```\n{\n  \"AnyOf\": [\n    \"queue:rerun-task:comm-level-3/f3hAEOQ-TB29m19iAbVmrg/f3hAEOQ-TB29m19iAbVmrg\",\n    {\n      \"AllOf\": [\n        \"queue:rerun-task\",\n        \"assume:scheduler-id:comm-level-3/f3hAEOQ-TB29m19iAbVmrg\"\n      ]\n    }\n  ]\n}\n```\n\nThis request requires the client to satisfy the following scope expression:\n\n```\n{\n  \"AnyOf\": [\n    \"queue:rerun-task:comm-level-3/f3hAEOQ-TB29m19iAbVmrg/f3hAEOQ-TB29m19iAbVmrg\",\n    {\n      \"AllOf\": [\n        \"queue:rerun-task\",\n        \"assume:scheduler-id:comm-level-3/f3hAEOQ-TB29m19iAbVmrg\"\n      ]\n    }\n  ]\n}\n```\n\n---\n\n* method:     rerunTask\n* errorCode:  InsufficientScopes\n* statusCode: 403\n* time:       2019-07-04T22:42:41.550Z",
  "requestInfo": {
    "method": "rerunTask",
    "params": {
      "taskId": "f3hAEOQ-TB29m19iAbVmrg"
    },
    "payload": {},
    "time": "2019-07-04T22:42:41.550Z"
  }
}
Usage:
  taskcluster task rerun <taskId> [flags]

Comment 1

[Tom Prince [:tomprince]]

You should be able to do it from treeherder.

Comment 2

[Jorg K (CEST = GMT+2)]

Well, retriggering from treeherder mostly doesn't work. Besides, you (Tom) told me personally that the right way to retrigger especially the decision task was to used the taskcluster tool. Has that changed?

Comment 3

[Jorg K (CEST = GMT+2)]

OK, I tried to retrigger a task from the treeherder and got:
Error getting Gecko Decision Task Ids: 404: No decision tasks found for pushes: ['507615']
Attempting to retrigger/add job via actions.json

Right now I'm trying to help this push along a bit:
https://treeherder.mozilla.org/#/jobs?repo=comm-central&revision=8da790400467339fff4f0954284c9ac69b98c7e8

Right now, I tried to retrigger the failed deb9-base task with ID KM1WaKs7QSSup9R5n9g-_Q and got the same error.

This is extremely annoying since sometimes some tasks need to be retriggered to get the build going and now the tools that always worked don't work any more :-(

Comment 4

[Jorg K (CEST = GMT+2)]

I got the sheriffs to rerun it. They told me to use the three dots and "Custom Action..." instead of "Repeat the selected job", the icon with the circular arrow. I'm confused now. Anyway, I'll try this next time and go back the the sheriffs if it doesn't work for me.

I don't insist on using the clumsy executable if the UI works.

Comment 5

[Jorg K (CEST = GMT+2)]

Any update here? Together with bug 1564856 I can actually not work any more.

Comment 6

[Rob Lemley [:rjl]]

This looks like the result of bug 1470625. Part of that was to restore the sheriffs' ability to rerun and cancel tasks using the commandline tool. Would Jörg, Geoff, and myself be able to get similar access on the comm repositories? As Jörg points out, using the UI doesn't work presently. I get the same "No decision task for push [XXX]" error.

I'm thinking something like:

- grant:
  # Allow Thunderbird sherrifs & releng to rerun and cancel tasks level 3 tasks
  - queue:cancel-task:comm-level-3/*
  - queue:rerun-task:comm-level-3/*
  to:
  - groups:
    - thunderbird-sheriff
    - thunderbird-releng

I don't know that there is a "thunderbird-sheriff" group, but "thunderbird-releng" does exist.

The other commands I run from the client are "group cancel" and "task log". I'm guessing those would be "cancel-group" and "log-task"?

Personally, I prefer the commandline for these things.

Comment 7

[Jorg K (CEST = GMT+2)]

Just make sure I'm in the right group. I don't enjoy the command line tool, far easier to do a few clicks, but I'll do whatever works.

Comment 8

[Rob Lemley [:rjl]]

Attachment: Bug 1563627 - Restore Taskcluster access for Thunderbird releng. r?tomprince

Restores rerun and cancel commandline access and allows cancel-all
via actions on comm level-3 (comm-central, comm-beta, etc)

Comment 9

[Mihai Tabara [:mtabara]⌚️GMT]

Found in triaging. Do we still need to action anything here or can we close this?

Comment 10

[Jorg K (CEST = GMT+2)]

I haven't had any trouble lately. I don't know whether the patch from comment #8 was landed, or however this got fixed. Thanks for catching up.