1786866 - Support `pull-request-untrusted` roles

Status: RESOLVED FIXED

(Release Engineering :: Firefox-CI Administration, enhancement)

Description

[Andrew Halberstadt [:ahal]]

Taskcluster has a new pullRequests policy called public_restricted.

It is a middle ground between the public policy (non-collaborator pull requests can run everything) and the collaborators policy (non-collaborator pull requests can run nothing). When the public_restricted policy is used, non-collaborator pull requests will assume a separate role from collaborator pull requests. The former will have -untrusted appended to the end of the role name.

In this way, it's possible to assign separate scopes to the two types of pull requests. Thus allowing us to block sensitive scopes for untrusted pull requests without blocking tasks that are otherwise safe to run (e.g, builds and tests).

This bug will implement support for these new pull-request-untrusted roles in ci-admin.

Comment 1

[Andrew Halberstadt [:ahal]]

Attachment: WIP: Bug 1786866 - Support 'pull-request-untrusted' roles (approach #2)

Taskcluster has a new pullRequests policy called public_restricted.

It is a middle ground between the public policy (non-collaborator pull requests
can run everything) and the collaborators policy (non-collaborator pull
requests can run nothing). When the public_restricted policy is used,
non-collaborator pull requests will assume a separate role from collaborator
pull requests. The former will have -untrusted appended to the end of the role
name.

In this way, it's possible to assign separate scopes to the two types of pull
requests. Thus allowing us to block sensitive scopes for untrusted pull
requests without blocking tasks that are otherwise safe to run (e.g, builds and
tests).

Comment 2

[Andrew Halberstadt [:ahal]]

Attachment: Bug 1786866 - Support the 'public_restricted' pullRequest policy, r?#releng-reviewers

Comment 3

[Andrew Halberstadt [:ahal]]

Attachment: Bug 1786866 - Switch taskgraph project to the 'public_restricted' pullRequest policy, r?#releng-reviewers

Depends on D157493

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/ci/ci-configuration/rev/264f0a154aad
Support the 'public_restricted' pullRequest policy, r=releng-reviewers,aki,jcristau

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/ci/ci-configuration/rev/37568e5e5748
Switch taskgraph project to the 'public_restricted' pullRequest policy, r=releng-reviewers,gabriel