swarming.star 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. # Copyright 2020 The Chromium Authors. All rights reserved.
  2. # Use of this source code is governed by a BSD-style license that can be
  3. # found in the LICENSE file.
  4. """Permissions for Chromium main swarming pools (CI, try, tests).
  5. They are actually shared with a bunch other projects.
  6. """
  7. load("//lib/swarming.star", "swarming")
  8. load("//project.star", "ACTIVE_MILESTONES")
  9. # Set up permissions that apply to all Chromium pools.
  10. swarming.root_permissions()
  11. # Task accounts for isolated tests.
  12. #
  13. # For simplicity of configuration we allow *any* task in the project (in any
  14. # realm) to run as any of these accounts. This is fine since all CI and Try
  15. # builders trigger isolated tasks in an identical way, using identical accounts
  16. # for isolated tests anyway.
  17. #
  18. # Note that this is declared on all branches, since task accounts "live" in a
  19. # project they are defined in, so we need to declare them for per-milestone
  20. # projects as well.
  21. swarming.task_accounts(
  22. realm = "@root", # i.e. inherit by all realms
  23. groups = [
  24. "project-chromium-test-task-accounts",
  25. ],
  26. users = [
  27. # TODO(crbug.com/793982): Migrate uses of this account to a dedicated
  28. # public test task account that's part of the group above, then delete
  29. # this.
  30. "ios-isolated-tester@chops-service-accounts.iam.gserviceaccount.com",
  31. ],
  32. )
  33. # LED users that can trigger tasks in *any* realm in *any* pool.
  34. #
  35. # This should be used relatively sparingly. Prefer to configure the permissions
  36. # more precisely. E.g. see "chromium-led-users" below.
  37. swarming.task_triggerers(
  38. builder_realm = "@root",
  39. pool_realm = "@root",
  40. groups = [
  41. "mdb/chrome-troopers",
  42. ],
  43. )
  44. # Realm with bots that run CI builds (aka main waterfall bots).
  45. #
  46. # The tasks here are triggered via Buildbucket (which authenticates as
  47. # "project:<project that defines the bucket>"), so we enumerate projects
  48. # (besides "project:chromium" itself) that are allowed to use Chromium CI pools
  49. # in their Buildbucket configs (which are currently only per-milestone Chromium
  50. # projects).
  51. swarming.pool_realm(
  52. name = "pools/ci",
  53. projects = [details.project for details in ACTIVE_MILESTONES.values()],
  54. )
  55. swarming.task_triggerers(
  56. builder_realm = "ci",
  57. pool_realm = "pools/ci",
  58. users = [
  59. "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
  60. # Used by Findit to re-run swarming tasks for bisection purposes.
  61. "findit-for-me@appspot.gserviceaccount.com",
  62. ],
  63. )
  64. # Realm with bots that run try builds.
  65. #
  66. # The tasks here are also triggered via Buildbucket. See comment above.
  67. swarming.pool_realm(
  68. name = "pools/try",
  69. projects = [details.project for details in ACTIVE_MILESTONES.values()],
  70. )
  71. # LED users that can trigger try builds via LED.
  72. swarming.task_triggerers(
  73. builder_realm = "try",
  74. pool_realm = "pools/try",
  75. groups = [
  76. "chromium-led-users",
  77. ],
  78. users = [
  79. # Build Recipes Tester launches orchestrator led builds which needs to
  80. # trigger compilator led builds
  81. "chromium-orchestrator@chops-service-accounts.iam.gserviceaccount.com",
  82. # An account used by "Build Recipes Tester" builder infra/try bucket
  83. # used to tests changes to Chromium recipes using LED before commit.
  84. "infra-try-recipes-tester@chops-service-accounts.iam.gserviceaccount.com",
  85. ],
  86. )
  87. # Realm with bots that run isolated tests.
  88. #
  89. # Tasks here are triggered directly on Swarming (not via Buildbucket) by various
  90. # CI and Try builder (not only Chromium ones!) and also directly by users.
  91. swarming.pool_realm(
  92. name = "pools/tests",
  93. groups = [
  94. # Various Chromium CI and Try LUCI builders that trigger isolated tests.
  95. "project-chromium-ci-task-accounts",
  96. "project-chromium-findit-task-accounts",
  97. "project-chromium-try-task-accounts",
  98. # DevTools uses Chrome pools for Layout tests.
  99. "project-devtools-frontend-ci-task-accounts",
  100. "project-devtools-frontend-try-task-accounts",
  101. # V8 are reusing Chrome pools for isolated tests too.
  102. "project-v8-ci-task-accounts",
  103. "project-v8-try-task-accounts",
  104. # ... and WebRTC.
  105. "project-webrtc-ci-task-accounts",
  106. "project-webrtc-try-task-accounts",
  107. # ... and Angle.
  108. "project-angle-ci-task-accounts",
  109. "project-angle-try-task-accounts",
  110. # Used by Pinpoint to trigger bisect jobs on machines in the Chrome-GPU pool.
  111. "service-account-chromeperf",
  112. ],
  113. users = [
  114. # Skia uses this pool directly.
  115. "skia-external-ct-skps@skia-swarming-bots.iam.gserviceaccount.com",
  116. # TODO(borenet): Remove the below after we're fully switched to Kitchen.
  117. "chromium-swarm-bots@skia-swarming-bots.iam.gserviceaccount.com",
  118. ],
  119. )
  120. # Anyone with Chromium tryjob access can use isolate testers pool directly.
  121. #
  122. # We assume isolated tests triggered from workstation go to the "try" realm,
  123. # just like tasks triggered by try jobs.
  124. swarming.task_triggerers(
  125. builder_realm = "try",
  126. pool_realm = "pools/tests",
  127. groups = ["project-chromium-tryjob-access"],
  128. )
  129. # A separate realm for mac-arm64 bots, since they have different permissions.
  130. swarming.pool_realm(
  131. name = "pools/tests-mac-arm64",
  132. groups = [
  133. # Allow CI builders (mac*-arm64-rel-tests) to trigger tests.
  134. "project-chromium-ci-task-accounts",
  135. # V8 *CI* is using these Macs, too.
  136. "project-v8-ci-task-accounts",
  137. ],
  138. )
  139. # Users that can trigger mac-arm64 tasks.
  140. swarming.task_triggerers(
  141. builder_realm = "try",
  142. pool_realm = "pools/tests-mac-arm64",
  143. groups = [
  144. # Allowlist of people working on the mac-arm64 project. Contact
  145. # srinivassista@ for access.
  146. "project-chromium-mac-arm64-tests-access",
  147. ],
  148. )