Proposal: Grant LF Release Engineering committer rights for `.github/` across FD.io repos

[vvalderrv]

Summary

Request that LF Release Engineering be granted committer rights on all FD.io repositories for changes limited to the .github/ directory.

Background

Today, Release Engineering has committer rights on the ci-management repository to support and maintain FD.io CI. As part of the migration to GitHub Actions, ci-management will be archived and CI configuration will live in each project repository under .github/.

Why this is needed

To continue supporting and maintaining CI after ci-management is archived, Release Engineering needs the ability to review and merge CI-related changes directly in the project repositories.

Scope / Constraints

• Scope of intended changes: .github/ only (GitHub Actions workflows, CI configuration, related templates).
• Release Engineering will only review and merge patches where the diff is limited to .github/.
• Release Engineering is discussing gating controls (similar to existing INFO.yaml validation) to validate that a proposed change’s diff is limited to .github/ before review and/or merge. There is no ETA for this gating solution at this time.

Requested action

Approve granting LF Release Engineering committer rights across FD.io repositories to enable ongoing CI support during and after the GitHub Actions migration.

[vrpolakatcisco]

I do not like this overlap of rights, but I understand the security needs and I think this is a good enough compromise for now.

In future, we may want to move the logic that handles sensitive layers (involving triggers, file uploads and other stuff that generally requires credentials) to separate repositories owned by LFIT (either fully such as lfit/releng-reusable-workflows or only mostly such as FDio/.github) and move all the rest of the logic to main parts of project repos (like and FDio/csit) so edits to those can be safely tested using verify workflows.

[fcoras]

Is it not possible to just create another fd.io repo that is just imported into .github folder in vpp/csit?

[vrpolakatcisco]

Is it not possible to just create another fd.io repo that is just imported into .github folder in vpp/csit?

I believe that is what FDio/.github is (also) for. But due to time constraints (production Jenkins to be migrated away at the end of 2025) Peter and Dave worked independently in csit and vpp repos.
Also I think there are some invisible configurations related to nomad cluster and other credentials that were hard to test in the early development (editing both GHA yaml parts and subsequent bash scripts in repo part).

There are some questions about who could start jobs manually, but such power users are not numerous (basically just me, but I am also a ci-management committer so no access problems for me).

So yes, I vote for removing fdio/csit/.github and fdio/vpp/.github (and associated special committers) after migrating everything to fdio/.github but Dave and Peter have other priorities than doing such infra maintenance improvements not motivated by missing or failing jobs.