quality/tickets

Fork 0

Perform QA groups cleanup #900

New issue

Closed

opened 2026-05-05 12:44:44 +00:00 by kparal · 8 comments

kparal commented

2026-05-05 12:44:44 +00:00

Owner

And the same for staging:

Let's make sure we update the groups, and limit the access appropriately for security purposes.

As a follow-up to #898 , we should look at the existing QA groups members from time to time and make sure all the access rights are still correct. We currently have these important groups to care about: * https://accounts.fedoraproject.org/group/qa-admin/ * https://accounts.fedoraproject.org/group/qa-tools-sig/ * https://accounts.fedoraproject.org/group/sysadmin-qa/ And the same for staging: * https://accounts.stg.fedoraproject.org/group/qa-admin/ * https://accounts.stg.fedoraproject.org/group/qa-tools-sig/ * https://accounts.stg.fedoraproject.org/group/sysadmin-qa/ Let's make sure we update the groups, and limit the access appropriately for security purposes.

kparal added the

labels

2026-05-05 12:44:44 +00:00

kparal self-assigned this

2026-05-05 12:44:44 +00:00

kparal added this to the Sprint 9 project

2026-05-05 12:44:44 +00:00

adamwill self-assigned this

2026-05-05 15:55:06 +00:00

adamwill commented

2026-05-05 16:01:36 +00:00

Owner

@tflink says "I'm certainly not using any of that so it's probably better to remove me"

adamwill commented

2026-05-05 16:13:41 +00:00

Owner

So I would say from qa-admin we can remove tflink and frantisekz.

from sysadmin-qa remove tflink, frantisekz , asaleh (I believe he was probably added for dashboard purposes, he has no commits in ansible since 2023), jskladan, lbrabec, lrossett (I think he was an OSCI person who helped with resultsdb-ci-listener deployment but he has no ansible commits since 2022, we can give access to @lecris or someone for this purpose if necessary), mbrysa (can't find any explanation why he's in the group, can't find any ansible commits, mailing list mails...), mjia (looks like he did greenwave deployment stuff but no commits to ansible since 2012 or greenwave since 2017), mtoman (can't find any recent activity, looks like he was an RHer but no longer is), pschindl. Make me and you sponsors maybe?

For qa-tools-sig I'm not quite sure. Do we know what the significance of that group is? It's the Bugzilla assignee for some things...what else? Does it affect forge access? We might potentially want to keep some of the old team members in it if they still intend to lurk in any of the upstreams?

So I would say from qa-admin we can remove tflink and frantisekz. from sysadmin-qa remove tflink, frantisekz , asaleh (I believe he was probably added for dashboard purposes, he has no commits in ansible since 2023), jskladan, lbrabec, lrossett (I think he was an OSCI person who helped with resultsdb-ci-listener deployment but he has no ansible commits since 2022, we can give access to @lecris or someone for this purpose if necessary), mbrysa (can't find any explanation why he's in the group, can't find any ansible commits, mailing list mails...), mjia (looks like he did greenwave deployment stuff but no commits to ansible since 2012 or greenwave since 2017), mtoman (can't find any recent activity, looks like he was an RHer but no longer is), pschindl. Make me and you sponsors maybe? For qa-tools-sig I'm not quite sure. Do we know what the significance of that group is? It's the Bugzilla assignee for some things...what else? Does it affect forge access? We might *potentially* want to keep some of the old team members in it if they still intend to lurk in any of the upstreams?

lecris commented

2026-05-05 16:21:02 +00:00

For qa-tools-sig I'm not quite sure.

Could be repurposed (or have a similar one) and share it with fedora-ci members since that could be a good place to put some repos that we plan to share like https://forge.fedoraproject.org/quality/python-ci_messages?

Would be interesting if forge could sync a membership there for both organizations 😅.

> For qa-tools-sig I'm not quite sure. Could be repurposed (or have a similar one) and share it with fedora-ci members since that could be a good place to put some repos that we plan to share like https://forge.fedoraproject.org/quality/python-ci_messages? Would be interesting if forge could sync a membership there for both organizations 😅.

kparal commented

2026-05-06 12:54:06 +00:00

Author

Owner

Thanks, Adam, for your investigation. That helps a lot.

@lecris wrote in #900 (comment):

that could be a good place to put some repos that we plan to share like https://forge.fedoraproject.org/quality/python-ci_messages?

For sharing work on particular repos, I think the best approach is to simply specify additional collaborators (that are outside of the owning organization). This is very easy to do, just go do repo -> Settings -> Collaborators.

Thanks, Adam, for your investigation. That helps a lot. @lecris wrote in https://forge.fedoraproject.org/quality/tickets/issues/900#issuecomment-693631: > that could be a good place to put some repos that we plan to share like https://forge.fedoraproject.org/quality/python-ci_messages? For sharing work on particular repos, I think the best approach is to simply specify additional collaborators (that are outside of the owning organization). This is very easy to do, just go do repo -> Settings -> Collaborators.

kparal commented

2026-05-06 13:15:38 +00:00

Author

Owner

@adamwill wrote in #900 (comment):

For qa-tools-sig I'm not quite sure. Do we know what the significance of that group is? It's the Bugzilla assignee for some things...what else?

If only we already did #840 😆️

Yes it has a lot of significance. It populates https://accounts.fedoraproject.org/group/forge-quality-members/ which populates https://forge.fedoraproject.org/org/quality/teams/members which have admin access to all our Forge repos. Also there's the Bugzilla group/mailing list. I don't know what else. But because of the Forge stuff, I believe we want to keep it minimal. I would drop all people who are currently not in our team.

@adamwill wrote in https://forge.fedoraproject.org/quality/tickets/issues/900#issuecomment-693626: > For qa-tools-sig I'm not quite sure. Do we know what the significance of that group is? It's the Bugzilla assignee for some things...what else? If only we already did #840 😆️ Yes it has a lot of significance. It populates https://accounts.fedoraproject.org/group/forge-quality-members/ which populates https://forge.fedoraproject.org/org/quality/teams/members which have admin access to all our Forge repos. Also there's the Bugzilla group/mailing list. I don't know what else. But because of the Forge stuff, I believe we want to keep it minimal. I would drop all people who are currently not in our team.

lecris commented

2026-05-06 13:27:36 +00:00

This is very easy to do, just go do repo -> Settings -> Collaborators.

Sure, just thought that doing it at a team level would be easier to manage, even if the team is not synced to a FAS group.

> This is very easy to do, just go do repo -> Settings -> Collaborators. Sure, just thought that doing it at a team level would be easier to manage, even if the team is not synced to a FAS group.

kparal referenced this issue from infra/tickets

2026-05-06 13:40:01 +00:00

Update Quality groups sponsors #13327

kparal commented

2026-05-06 13:43:56 +00:00

Author

Owner

I have filed infra/tickets#13327 . @adamwill please ack that change, thank you.

I requested that the two of us are sponsors in all these groups except sysadmin-qa in production. For that one, I think we should be even stricter, and keep just you (and Kevin/Infra of course) as sponsors. If there was a need and you weren't available, we can always create an Infra ticket.

I've updated all groups except sysadmin-qa in production (where I don't have rights to do so). Once you're a sponsor, please make it match the current sysadmin-qa staging group, thank you. Then we can close this ticket, I believe.

I have filed https://forge.fedoraproject.org/infra/tickets/issues/13327 . @adamwill please ack that change, thank you. I requested that the two of us are sponsors in all these groups except sysadmin-qa in production. For that one, I think we should be even stricter, and keep just you (and Kevin/Infra of course) as sponsors. If there was a need and you weren't available, we can always create an Infra ticket. I've updated all groups except sysadmin-qa in production (where I don't have rights to do so). Once you're a sponsor, please make it match the current sysadmin-qa staging group, thank you. Then we can close this ticket, I believe.

kparal added a new dependency

2026-05-06 13:45:07 +00:00

infra/tickets#13327 - Update Quality groups sponsors

adamwill referenced this issue from infra/tickets

2026-05-06 17:34:57 +00:00

Update Quality groups sponsors #13327

adamwill commented

2026-05-06 17:37:54 +00:00

Owner

Done.

adamwill

2026-05-06 17:37:55 +00:00