2053463 - Move Updatebot to a dedicated pool

Status: ASSIGNED

(Release Engineering :: Firefox-CI Administration, enhancement)

Description

[Tom Ritter [:tjr]]

Updatbot runs in m-c with L3 creds presently, As we add AI into Updatebot, we want to defend against a scenario where we get prompt-injected, and an attacker compromises the underlying instance (breaking out of Docker) and then later uses that access to affect a Firefox release.

After talking with ahal the best solution to this would be to use a dedicated pool. (Other options are possible, but this one seems cleanest/most straightforward.)

Comment 1

[Andrew Halberstadt [:ahal]]

We'll need a patch to the Firefox repo as well to make updatebot use these pools.

Comment 2

[BMO Github Automation]

Attachment: [mozilla-releng/fxci-config] Bug 2053463 - Create dedicate worker pools for update bot (#1084)

Comment 3

[BMO Github Automation]

Authored by https://github.com/ahal
https://github.com/mozilla-releng/fxci-config/commit/ec5d7e2401153ca54abdd9a4146618529661e4cf
[main] Bug 2053463 - Create dedicated worker pools for updatebot

Comment 4

[Andrew Halberstadt [:ahal]]

Attachment: Bug 2053463 - Move updatebot tasks to dedicated worker pools, r?#taskgraph-reviewers!

Comment 5

[BMO Github Automation]

Attachment: [mozilla-releng/fxci-config] Bug 2053463 - Fix typo in new updatebot pools (#1088)