1597329 - application-services: Cannot kick release off because of missing scope

Status: RESOLVED FIXED

(Release Engineering :: Firefox-CI Administration, defect)

Description

[Johan Lorenzo [:jlorenzo]]

Submitting the task to Taskcluster failed. Details

Taskcluster-GitHub attempted to create a task for this event with the following scopes:

[
  "assume:repo:github.com/mozilla/application-services:release",
  "queue:route:statuses",
  "queue:scheduler-id:taskcluster-github"
]

The expansion of these scopes is not sufficient to create the task, leading to the following:

Client ID static/taskcluster/github does not have sufficient scopes and is missing the following scopes:

{
  "AllOf": [
    "queue:create-task:scriptworker-k8s/appservices-3-signing",
    "queue:create-task:highest:scriptworker-k8s/appservices-3-beetmover"
  ]
}

This request requires the client to satisfy the following scope expression:

{
  "AllOf": [
    "queue:create-task:highest:app-services-3/b-linux",
    "queue:create-task:highest:app-services-3/images",
    "queue:route:statuses",
    "queue:route:notify.email.*",
    "queue:scheduler-id:taskcluster-github",
    "queue:route:index.project.application-services.*",
    "docker-worker:cache:application-services-*",
    "project:releng:services/tooltool/api/download/internal",
    "project:mozilla:application-services:releng:beetmover:action:push-to-maven",
    "project:mozilla:application-services:releng:signing:cert:release-signing",
    "queue:create-task:scriptworker-k8s/appservices-3-signing",
    "secrets:get:project/application-services/symbols-token",
    "project:mozilla:application-services:releng:beetmover:bucket:maven-production",
    "queue:create-task:highest:scriptworker-k8s/appservices-3-beetmover",
    "queue:route:statuses",
    {
      "AnyOf": [
        {
          "AllOf": [
            "queue:scheduler-id:taskcluster-github",
            {
              "AnyOf": [
                "queue:create-task:highest:app-services-3/decision"
              ]
            }
          ]
        }
      ]
    }
  ]
}

* method:     createTask

* errorCode:  InsufficientScopes

* statusCode: 403

* time:       2019-11-18T16:22:27.967Z

https://github.com/mozilla/application-services/commit/b88630040b32c99b183bf00e738c2f6ca30818a5#commitcomment-36010306

Comment 1

[Johan Lorenzo [:jlorenzo]]

The error is because GCP[1] and ci-admin[2][3] have different assumptions regarding the name scheme.

Mihai agreed we should eventually follow ci-admin's. In the meantime, I'm going to add more scopes so it unblocks the release. I'll clean this up later.

[1] https://github.com/mozilla/application-services/pull/2147/files#diff-ac0229d1171c0983b27003af4c7441a5R190
[2] https://hg.mozilla.org/ci/ci-configuration/file/f11b90a46659e947183411a0c7f7fd133db1990c/grants.yml#l1197
[3] https://hg.mozilla.org/ci/ci-configuration/file/f11b90a46659e947183411a0c7f7fd133db1990c/projects.yml#l496

Comment 2

[Johan Lorenzo [:jlorenzo]]

Attachment: Bug 1597329 - part 1: Rename `mobile-taskgraph` into `github-taskgraph` r=mtabara

Because it doesn't carry any mobile-specific roles but it does add some github scopes

Comment 3

[Johan Lorenzo [:jlorenzo]]

Attachment: Bug 1597329 - part 2: Add temporary scopes to application-services r=mtabara

Depends on D53664

Comment 4

[Johan Lorenzo [:jlorenzo]]

Marking this bug as fixed (which is the case). Let's do the followups in another bug.