opendev/system-config
Code Issues Proposed changes

Combine / reconcile two force-merge docs

Browse Source 
The force-merge procedure was documented twice, neither one complete.
Combine them.

Change-Id: If4350a0a90d455b64227befde2f1be7475ac8120
This commit is contained in:
James E. Blair 2022-07-28 07:57:21 -07:00
parent 2afc0ea097
commit 1ff685488e
1 changed files with 25 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
doc/source/sysadmin.rst
View File

@ -79,31 +79,7 @@ populating new groups with initial members is still quite simple
$ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members some-new-group --add somebody@example.org"
Another common example is bypassing Zuul to submit a change for merging
directly to a project. In this case we must first add our account to
another group which has permission to set the relevant labels (it doesn't
get that simply by being an administrator), and then do the
commenting/voting/submitting, followed by cleaning up the extra group
membership again at the end
.. code-block:: shell-session
$ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members 'Project Bootstrappers' --add myname.admin"
$ ssh -p 29418 myname.admin@review.opendev.org "gerrit review 12345,6 --message 'Bypassing Zuul to merge this.' --code-review=2 --verified=2 --label workflow=1 --submit"
$ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members 'Project Bootstrappers' --remove myname.admin"
Note that it's possible to temporarily add your normal OpenID-associated
WebUI account to the ``Administrators`` group or other groups with similar
superuser permissions like ``Project Bootstrappers``, but keep in mind that
an attacker who has quietly gained control of your account at the OpenID
provider could be waiting for that opportunity to take advantage of the
added permissions, or you may simply forget to remove the account afterward
negating the added safety of this account separation.
For more examples, see the detailed documentation for Gerrit's SSH CLI,
available on our server:
https://review.opendev.org/Documentation/cmd-index.html
directly to a project. See :ref:`force-merging-a-change` for details.
GitHub Access
=============
@ -249,6 +225,11 @@ these cases, use the following procedure to force-merge a change.
* Add yourself to the *Project Bootstrappers* group in Gerrit.
.. code-block:: shell-session
$ ssh -p 29418 myname.admin@review.opendev.org \
"gerrit set-members 'Project Bootstrappers' --add myname.admin"
* Navigate to the change which needs to be merged and reload the page.
* Remove any -2 votes on the change.
@ -262,12 +243,31 @@ these cases, use the following procedure to force-merge a change.
* At this point, a *Submit* Button should appear, click it. The
change should now be merged.
$ ssh -p 29418 myname.admin@review.opendev.org \
"gerrit review 12345,6 --message 'Bypassing Zuul to merge this.' \
--code-review=2 --verified=2 --label workflow=1 --submit"
* Remove yourself from *Project Bootstrappers*
$ ssh -p 29418 myname.admin@review.opendev.org \
"gerrit set-members 'Project Bootstrappers' --remove myname.admin"
This procedure is the safest way to force-merge a change, ensuring
that all of the normal steps that Gerrit performs on repos still
happen.
Note that it's possible to temporarily add your normal OpenID-associated
WebUI account to the ``Administrators`` group or other groups with similar
superuser permissions like ``Project Bootstrappers``, but keep in mind that
an attacker who has quietly gained control of your account at the OpenID
provider could be waiting for that opportunity to take advantage of the
added permissions, or you may simply forget to remove the account afterward
negating the added safety of this account separation.
For more examples, see the detailed documentation for Gerrit's SSH CLI,
available on our server:
https://review.opendev.org/Documentation/cmd-index.html
Launching New Servers
=====================