Request team for packager sponsors in Forgejo

gotmax23 commented

2026-04-20 14:48:54 +00:00

Description of request

Background

Hi 👋, I am working on getting https://forge.fedoraproject.org/packaging set up for the Packaging Committee and to host packaging tooling. This is tracked in forge/forge#456.

Request

This ticket is specifically about migrating https://pagure.io/packager-sponsors/ to https://forge.fedoraproject.org/packager/sponsors. I would like to see if we can configure this so that the new repo is owned by a Forge team that inherits its members from the sponsors (AKA member managers) of the packager group in the accounts system. Permissions in the Pagure repo are currently handled manually which doesn't really scale, hence this request.

Per @ryanlerch in forge/forge#456 (comment):

This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be.

Also, CCing @frostyx since I think https://github.com/FrostyX/fedora-review-service will need to be updated before we transfer the sponsors tracker to Forge.

### Description of request ### Background Hi 👋, I am working on getting https://forge.fedoraproject.org/packaging set up for the Packaging Committee and to host packaging tooling. This is tracked in https://forge.fedoraproject.org/forge/forge/issues/456. ### Request This ticket is specifically about migrating <https://pagure.io/packager-sponsors/> to <https://forge.fedoraproject.org/packager/sponsors>. I would like to see if we can configure this so that the new repo is owned by a Forge team that inherits its members from the sponsors (AKA member managers) of the `packager` group in the accounts system. Permissions in the Pagure repo are currently handled manually which doesn't really scale, hence this request. Per @ryanlerch in https://forge.fedoraproject.org/forge/forge/issues/456#issuecomment-616783: > This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be. Also, CCing @frostyx since I think <https://github.com/FrostyX/fedora-review-service> will need to be updated before we transfer the sponsors tracker to Forge.

james added the

labels

2026-04-20 19:03:50 +00:00

frostyx commented

2026-04-20 20:18:33 +00:00

Thank you for working on this @gotmax23 and for CCing me here.
Do you have an ETA of this switch so I can prioritize the Fedora Review Service change accordingly?

Thank you for working on this @gotmax23 and for CCing me here. Do you have an ETA of this switch so I can prioritize the Fedora Review Service change accordingly?

zlopez commented

2026-04-21 11:25:13 +00:00

Owner

What is the name of the group that will own the new repo? Does it exist already?

kevin commented

2026-05-07 20:47:51 +00:00

Owner

So I think all the group stuff was sorted out in that forge issue?

and whats left is to actually migrate the sponsors repo/project over?

If so I can do that. Does it need any coordination? We will also need to change some docs that point to the old place.

So I think all the group stuff was sorted out in that forge issue? and whats left is to actually migrate the sponsors repo/project over? If so I can do that. Does it need any coordination? We will also need to change some docs that point to the old place.

gotmax23 commented

2026-05-07 23:53:44 +00:00

Author

So I think all the group stuff was sorted out in that forge issue?

Not entirely. This ticket was about seeing if we could get a forge team created in the packaging org that contains all the sponsors of the packager group so that team can own the packager-sponsors repository once we are ready to migrate it.

A team for all members of the packager group was already created in forge/forge#456, but @ryanlerch asked me to file an infra ticket for another team that maps to the sponsors.

Per @ryanlerch in forge/forge#456 (comment):

This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be.

Permissions in the Pagure repo are currently handled manually which doesn't really scale, so I'm trying to find a better way here.

and whats left is to actually migrate the sponsors repo/project over? Does it need any coordination?

Once the team is created, we can move the tracker over once @frostyx is ready. That part shouldn't require Infra coordination.

We will also need to change some docs that point to the old place.

Do you know which ones? It would be good to have draft PRs open for the docs before we do the migration.

> So I think all the group stuff was sorted out in that forge issue? Not entirely. This ticket was about seeing if we could get a forge team created in the `packaging` org that contains all the **sponsors** of the `packager` group so that team can own the packager-sponsors repository once we are ready to migrate it. A team for all **members** of the `packager` group was already created in https://forge.fedoraproject.org/forge/forge/issues/456, but @ryanlerch asked me to file an infra ticket for another team that maps to the **sponsors**. Per @ryanlerch in https://forge.fedoraproject.org/forge/forge/issues/456#issuecomment-616783: > This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be. Permissions in the Pagure repo are currently handled manually which doesn't really scale, so I'm trying to find a better way here. > and whats left is to actually migrate the sponsors repo/project over? Does it need any coordination? Once the team is created, we can move the tracker over once @frostyx is ready. That part shouldn't require Infra coordination. > We will also need to change some docs that point to the old place. Do you know which ones? It would be good to have draft PRs open for the docs before we do the migration.

gotmax23 commented

2026-05-07 23:54:30 +00:00

Author

Do you have an ETA of this switch so I can prioritize the Fedora Review Service change accordingly?

Pagure is supposed to be shut down next month, so probably soon.

> Do you have an ETA of this switch so I can prioritize the Fedora Review Service change accordingly? Pagure is supposed to be shut down next month, so probably soon.

kevin commented

2026-05-08 18:32:35 +00:00

Owner

Ah, I see... ok, will see if @ryanlerch can explain his solution then. I mean, we could make a 'packager-sponsors' group and try and keep it in sync with the managers for the packager group, that might be ok... since we don't often add sponsors. But anyhow, will see what ryan came up with. ;)

frostyx commented

2026-05-09 11:29:15 +00:00

Pagure is supposed to be shut down next month, so probably soon.

Right. The Fedora Review Service is ready now:
https://github.com/FrostyX/fedora-review-service/pull/74
I will deploy once this issue gets resolved.

> Pagure is supposed to be shut down next month, so probably soon. Right. The Fedora Review Service is ready now: https://github.com/FrostyX/fedora-review-service/pull/74 I will deploy once this issue gets resolved.

👍 1

humaton commented

2026-05-14 13:56:53 +00:00

Member

What if we created one more group in IPA and used IPA group memberships to handle this?

Package member managers - 1st group
Packager - 2nd group
Make package member mangers group manage the packager group by group membership in IPA.(we can put groups in groups in IPA)
Map the 1st group to the team in forge.

This way we have just one group that needs management.

What if we created one more group in IPA and used IPA group memberships to handle this? Package member managers - 1st group Packager - 2nd group Make package member mangers group manage the packager group by group membership in IPA.(we can put groups in groups in IPA) Map the 1st group to the team in forge. This way we have just one group that needs management.

👍 1

kevin commented

2026-05-14 17:09:18 +00:00

Owner

Yeah, that might work. We could test it in staging?

gotmax23 commented

2026-06-03 17:16:18 +00:00

Author

Any updates here? See https://pagure.io/packager-sponsors/issue/773.

kevin commented

2026-06-23 19:07:43 +00:00

Owner

who is going to test it? can one of you do so?

kevin commented

2026-07-30 22:33:07 +00:00

Owner

ok. I created a group in staging called 'packager-sponsors' and added @gotmax23 to it.
Then I added that group as a manager of the 'packagers' group.

@gotmax23 can you login to accounts.stg.fedoraproject.org and confirm you can sponsor someone into packager group?

If that works I think it should all work fine and I can adjust production.

ok. I created a group in staging called 'packager-sponsors' and added @gotmax23 to it. Then I added that group as a manager of the 'packagers' group. @gotmax23 can you login to accounts.stg.fedoraproject.org and confirm you can sponsor someone into packager group? If that works I think it should all work fine and I can adjust production.

gotmax23 commented

2026-07-31 00:51:04 +00:00

Author

No, I am neither shown as a sponsor nor a member of the packager group on accounts.stg.

![accounts.stg screenshot](/attachments/1a729558-a2b0-414e-8ce1-fde13284e3cd) No, I am neither shown as a sponsor nor a member of the packager group on accounts.stg.

image.png

92 KiB

gotmax23 commented

2026-07-31 00:56:36 +00:00

Author

I was able to sponsor myself into the packager group through https://id.stg.fedoraproject.org/ipa/ui/#/e/group/member_user/packager but Noggin doesn't let me add ~~sponsors~~ packager group members.

I was able to sponsor myself into the packager group through <https://id.stg.fedoraproject.org/ipa/ui/#/e/group/member_user/packager> but Noggin doesn't let me add ~~sponsors~~ packager group members.

kevin commented

2026-07-31 01:08:28 +00:00

Owner

Ah, so noggin needs to learn about groups as member managers I guess.

@abompard any ideas how hard that might be to implement?

Ah, so noggin needs to learn about groups as member managers I guess. @abompard any ideas how hard that might be to implement?

kevin commented

2026-07-31 01:10:20 +00:00

Owner

I guess short term we could just make the group and populate it and add it as a manager group, but leave also users in member managers for packager.

It means adding/removing people will require you to do so in both places, but it would work for the current needs as a stopgap.

I guess short term we could just make the group and populate it and add it as a manager group, but leave also users in member managers for packager. It means adding/removing people will require you to do so in both places, but it would work for the current needs as a stopgap.

gotmax23 commented

2026-07-31 01:22:38 +00:00

Author

I was just going to query FASJSON for the packager group sponsors and manually add them as collaborators in the packaging/sponsors repo using the Forgejo API. But if you don't mind tracking packager sponsors in two places in FAS (until we can fix Noggin), that works for me.

I was just going to query FASJSON for the `packager` group sponsors and manually add them as collaborators in the `packaging/sponsors` repo using the Forgejo API. But if you don't mind tracking packager sponsors in two places in FAS (until we can fix Noggin), that works for me.

kevin commented

2026-07-31 18:09:14 +00:00

Owner

Well, yeah... but the forge docs say: "Team membership on Fedora Forge is managed exclusively through Fedora Accounts groups." so I am not sure if some process will just remove them after you add them when it syncs groups...

gotmax23 commented

2026-07-31 18:26:26 +00:00

Author

I think if you add individual users to a specific repository, it's okay? I added Aoife as an individual collaborator (https://forge.fedoraproject.org/fesco/tickets/settings/collaboration) to fesco/tickets for Change wrangling, and that has seemed to stick.

If we can get the IPA + Noggin + Forgejo integration working properly, that's of course preferable, but otherwise, since we only need to sync these users to a single repository, that seems easier.

I think if you add individual users to a specific repository, it's okay? I added Aoife as an individual collaborator (https://forge.fedoraproject.org/fesco/tickets/settings/collaboration) to fesco/tickets for Change wrangling, and that has seemed to stick. If we can get the IPA + Noggin + Forgejo integration working properly, that's of course preferable, but otherwise, since we only need to sync these users to a single repository, that seems easier.

kevin commented

2026-07-31 18:36:51 +00:00

Owner

Alright. Go for it. ;) If that breaks somehow we can deal with it...

Rows
Columns

Request team for packager sponsors in Forgejo #13277

Description of request

Background

Request