2055604 - Add blocker that ensures status flags are set on sec-high and sec-critical bugs

Status: NEW

(Conduit :: Lando, enhancement, P3)

Description

[Tom Ritter [:tjr]]

As mentioned on Matrix and in Bug 2055287, relman is dealing with a lot of missing status flags on bugs about whether or not things affect ESR. Ideally these flags would be set long before a patch is ready to land, but as a minimum bar, I think we ought to be able to block a patch from landing if the bug does not have the status flags for release, beta, and all ESR branches set. (This is the status flag, so a developer would either set it to 'affected', 'unaffected', 'disabled' etc.) If we don't already have documentation about how to set these flags in the Source Docs, we can add that.

Comment 1

[Tom Ritter [:tjr]]

To flesh this out a bit more, this would apply to any bug with a sec-critical or sec-high keyword. It would apply to landing any patch associated with that bug.

It would require a value to be set for Firefox Release, Beta, and ESR. This is actually a little tricky. In bugzilla we have aliases status-firefox-release that map to the right number. But those aren't exposed through the API. So either we would have Lando know what the current version of Firefox is (as well as what ESRs are active) or we simply say "Nightly + Beta + Release + ESR + 115" is 5 status flags, make sure there are at least 5 status flags set on the bug. (I'd say the first is preferable.)

This should be a hard block in Lando. A developer is not prevented from landing their patch: they just need to go to Bugzilla, set the flags, come back and reload Lando. One of the values is even "?" for unknown so if there's some question about it, that's still an option for them.

One wrinkle is that Lando would need access to read security bugs.

I think it could also apply to requesting an uplift for any bug, whether or not its a security bug: if you're requesting an uplift, you ought to be setting the status flags. But I don't think that is the biggest pain point at the moment.

Comment 2

[Tom Ritter [:tjr]]

One wrinkle is that Lando would need access to read security bugs.

Lando has release-group membership already, however bugs are set to this security group once the fix hits central, which is after we want to check whether or not the patch is allowed to land.

Comment 3

[Zeid [:zeid]]

I think it could also apply to requesting an uplift for any bug, whether or not its a security bug: if you're requesting an uplift, you ought to be setting the status flags. But I don't think that is the biggest pain point at the moment.

Maybe this can be a follow-up or tracked separately. Seems like the most needed use case is for sec-high and sec-critical bugs, and normal landings, if I understand correctly.

Comment 4

[BMO Github Automation]

Attachment: [mozilla-conduit/lando] Bug 2055604: Add blocker that ensures status flags are set on sec-high and sec-critical bugs (#1352)