957606 - See also: <github issue url> should subscribe to receive event notifications for the issue

Status: RESOLVED WONTFIX

(bugzilla.mozilla.org :: General, enhancement)

Description

[Luke Crouch [:groovecoder]]

If a bugzilla bug depends on a GitHub issue, it should receive updates as comments when the GitHub issue is closed/opened via the GitHub Hooks API.

Note: We may have to change GitHub's bugzilla hook for this? https://github.com/github/github-services/blob/master/lib/services/bugzilla.rb

Comment 1

[Adam Muntner [:adamm] (use NEEDINFO)]

Both directions are needed. 

For projects where devs use Github issues except for security bugs which will reside in Bugzilla, there should be a way to make Github and/or Bugzilla bug dependencies/blockers of each other, in both directions.

This is a more and more common circumstance. For example, AMO recently moved to this bug handling method. 

I understand the workflow advantages for devs because of Github's issue integration with their repo. However,the change in process introduced a risk, easily blocking feature tracker bugs with security bugs, and making security bug closure dependent on some other child bug representing a stream of work required to close it. It's an unintended consequence of the process change that we (security) team need to find a manual workaround for. 

I don't know enough about Bugzilla internals to know whether this means Git would need to have access to security-sensitive bugs in Bugzilla. We'd need to be sure that sensitive bug info wouldn't accidentally published into a public github issue.

Comment 2

[Adam Muntner [:adamm] (use NEEDINFO)]

I could have stated the issue more clearly:

As more dev teams move to a model where infosec bugs reside in Bugzilla but all other issues are tracked Github Issues, we lose the ability to make a feature dependent on a bug closing and to make a record on either system dependent on a counterpart in the other system due to the lack of communication about bug/issue dependency/block relationships and status.

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

For historical purposes: https://groups.google.com/forum/#!topic/mozilla.dev.webdev/BujqZWGtZlQ

Comment 4

[David Lawrence [:dkl]]

There is no plan currently for implementing bidirectional syncing with Github and BMO.