docs/designs/ci-authorization.md

7 Created: 2019-01-30
13 contributions can be made by the general public - anyone with a GitHub account.
26 openbmc/general-developers GitHub team. If the contributor is a member of the
27 team (or a general-developers sub-team), the automated CI processes are
29 the general-developers team, manual intervention (ok-to-test) is required by a
33 https://jenkins.io/ https://help.github.com/articles/about-organizations/
37 The existing method for authorization has a singular problem - the GitHub
39 openbmc/general-developers GitHub team, the contributor must first be a member
42 unrestricted access to all aspects of the project - it would be unwise to bestow
44 openbmc/general-developers group membership administrative capability.
48 - Not require the GitHub organization owner role to administer the list of users
50 - Enable a hierarchical trust model for user authorization (groups nested within
55 The proposal is to simply migrate the current openbmc/general-developers GitHub
58 group: `openbmc/ci-authorized`
60 group: `xyzcorp/ci-authorized`
62 group: `abccorp/ci-authorized`
64 The openbmc/ci-authorized group can contain users that are not associated with
67 group: `openbmc/ci-authorized` contains ->
69 group `xyzcorp/ci-authorized`
71 group `abccorp/ci-authorized`
80 group: `xyzcorp/ci-authorized-owners` administers -> `xyzcorp/ci-authorized`
82 group: `abccorp/ci-authorized-owners` administers -> `abccorp/ci-authorized`
84 group: `openbmc/ci-authorized` administers -> `openbmc/ci-authorized`
87 Gerrit group instead of the GitHub team.
94 Assigning GitHub organization owner roles to organizational group administrators
95 was considered but is a major violation of the least-privilege-required