123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168 |
- # Copyright 2020 The Chromium Authors. All rights reserved.
- # Use of this source code is governed by a BSD-style license that can be
- # found in the LICENSE file.
- """Permissions for Chromium main swarming pools (CI, try, tests).
- They are actually shared with a bunch other projects.
- """
- load("//lib/swarming.star", "swarming")
- load("//project.star", "ACTIVE_MILESTONES")
- # Set up permissions that apply to all Chromium pools.
- swarming.root_permissions()
- # Task accounts for isolated tests.
- #
- # For simplicity of configuration we allow *any* task in the project (in any
- # realm) to run as any of these accounts. This is fine since all CI and Try
- # builders trigger isolated tasks in an identical way, using identical accounts
- # for isolated tests anyway.
- #
- # Note that this is declared on all branches, since task accounts "live" in a
- # project they are defined in, so we need to declare them for per-milestone
- # projects as well.
- swarming.task_accounts(
- realm = "@root", # i.e. inherit by all realms
- groups = [
- "project-chromium-test-task-accounts",
- ],
- users = [
- # TODO(crbug.com/793982): Migrate uses of this account to a dedicated
- # public test task account that's part of the group above, then delete
- # this.
- "ios-isolated-tester@chops-service-accounts.iam.gserviceaccount.com",
- ],
- )
- # LED users that can trigger tasks in *any* realm in *any* pool.
- #
- # This should be used relatively sparingly. Prefer to configure the permissions
- # more precisely. E.g. see "chromium-led-users" below.
- swarming.task_triggerers(
- builder_realm = "@root",
- pool_realm = "@root",
- groups = [
- "mdb/chrome-troopers",
- ],
- )
- # Realm with bots that run CI builds (aka main waterfall bots).
- #
- # The tasks here are triggered via Buildbucket (which authenticates as
- # "project:<project that defines the bucket>"), so we enumerate projects
- # (besides "project:chromium" itself) that are allowed to use Chromium CI pools
- # in their Buildbucket configs (which are currently only per-milestone Chromium
- # projects).
- swarming.pool_realm(
- name = "pools/ci",
- projects = [details.project for details in ACTIVE_MILESTONES.values()],
- )
- swarming.task_triggerers(
- builder_realm = "ci",
- pool_realm = "pools/ci",
- users = [
- "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
- # Used by Findit to re-run swarming tasks for bisection purposes.
- "findit-for-me@appspot.gserviceaccount.com",
- ],
- )
- # Realm with bots that run try builds.
- #
- # The tasks here are also triggered via Buildbucket. See comment above.
- swarming.pool_realm(
- name = "pools/try",
- projects = [details.project for details in ACTIVE_MILESTONES.values()],
- )
- # LED users that can trigger try builds via LED.
- swarming.task_triggerers(
- builder_realm = "try",
- pool_realm = "pools/try",
- groups = [
- "chromium-led-users",
- ],
- users = [
- # Build Recipes Tester launches orchestrator led builds which needs to
- # trigger compilator led builds
- "chromium-orchestrator@chops-service-accounts.iam.gserviceaccount.com",
- # An account used by "Build Recipes Tester" builder infra/try bucket
- # used to tests changes to Chromium recipes using LED before commit.
- "infra-try-recipes-tester@chops-service-accounts.iam.gserviceaccount.com",
- ],
- )
- # Realm with bots that run isolated tests.
- #
- # Tasks here are triggered directly on Swarming (not via Buildbucket) by various
- # CI and Try builder (not only Chromium ones!) and also directly by users.
- swarming.pool_realm(
- name = "pools/tests",
- groups = [
- # Various Chromium CI and Try LUCI builders that trigger isolated tests.
- "project-chromium-ci-task-accounts",
- "project-chromium-findit-task-accounts",
- "project-chromium-try-task-accounts",
- # DevTools uses Chrome pools for Layout tests.
- "project-devtools-frontend-ci-task-accounts",
- "project-devtools-frontend-try-task-accounts",
- # V8 are reusing Chrome pools for isolated tests too.
- "project-v8-ci-task-accounts",
- "project-v8-try-task-accounts",
- # ... and WebRTC.
- "project-webrtc-ci-task-accounts",
- "project-webrtc-try-task-accounts",
- # ... and Angle.
- "project-angle-ci-task-accounts",
- "project-angle-try-task-accounts",
- # Used by Pinpoint to trigger bisect jobs on machines in the Chrome-GPU pool.
- "service-account-chromeperf",
- ],
- users = [
- # Skia uses this pool directly.
- "skia-external-ct-skps@skia-swarming-bots.iam.gserviceaccount.com",
- # TODO(borenet): Remove the below after we're fully switched to Kitchen.
- "chromium-swarm-bots@skia-swarming-bots.iam.gserviceaccount.com",
- ],
- )
- # Anyone with Chromium tryjob access can use isolate testers pool directly.
- #
- # We assume isolated tests triggered from workstation go to the "try" realm,
- # just like tasks triggered by try jobs.
- swarming.task_triggerers(
- builder_realm = "try",
- pool_realm = "pools/tests",
- groups = ["project-chromium-tryjob-access"],
- )
- # A separate realm for mac-arm64 bots, since they have different permissions.
- swarming.pool_realm(
- name = "pools/tests-mac-arm64",
- groups = [
- # Allow CI builders (mac*-arm64-rel-tests) to trigger tests.
- "project-chromium-ci-task-accounts",
- # V8 *CI* is using these Macs, too.
- "project-v8-ci-task-accounts",
- ],
- )
- # Users that can trigger mac-arm64 tasks.
- swarming.task_triggerers(
- builder_realm = "try",
- pool_realm = "pools/tests-mac-arm64",
- groups = [
- # Allowlist of people working on the mac-arm64 project. Contact
- # srinivassista@ for access.
- "project-chromium-mac-arm64-tests-access",
- ],
- )
|