diff --git a/doc/source/sysadmin.rst b/doc/source/sysadmin.rst index 9fd9ea6d7e..37ae284637 100644 --- a/doc/source/sysadmin.rst +++ b/doc/source/sysadmin.rst @@ -79,31 +79,7 @@ populating new groups with initial members is still quite simple $ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members some-new-group --add somebody@example.org" Another common example is bypassing Zuul to submit a change for merging -directly to a project. In this case we must first add our account to -another group which has permission to set the relevant labels (it doesn't -get that simply by being an administrator), and then do the -commenting/voting/submitting, followed by cleaning up the extra group -membership again at the end - -.. code-block:: shell-session - - $ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members 'Project Bootstrappers' --add myname.admin" - - $ ssh -p 29418 myname.admin@review.opendev.org "gerrit review 12345,6 --message 'Bypassing Zuul to merge this.' --code-review=2 --verified=2 --label workflow=1 --submit" - - $ ssh -p 29418 myname.admin@review.opendev.org "gerrit set-members 'Project Bootstrappers' --remove myname.admin" - -Note that it's possible to temporarily add your normal OpenID-associated -WebUI account to the ``Administrators`` group or other groups with similar -superuser permissions like ``Project Bootstrappers``, but keep in mind that -an attacker who has quietly gained control of your account at the OpenID -provider could be waiting for that opportunity to take advantage of the -added permissions, or you may simply forget to remove the account afterward -negating the added safety of this account separation. - -For more examples, see the detailed documentation for Gerrit's SSH CLI, -available on our server: -https://review.opendev.org/Documentation/cmd-index.html +directly to a project. See :ref:`force-merging-a-change` for details. GitHub Access ============= @@ -249,6 +225,11 @@ these cases, use the following procedure to force-merge a change. * Add yourself to the *Project Bootstrappers* group in Gerrit. +.. code-block:: shell-session + + $ ssh -p 29418 myname.admin@review.opendev.org \ + "gerrit set-members 'Project Bootstrappers' --add myname.admin" + * Navigate to the change which needs to be merged and reload the page. * Remove any -2 votes on the change. @@ -262,12 +243,31 @@ these cases, use the following procedure to force-merge a change. * At this point, a *Submit* Button should appear, click it. The change should now be merged. + $ ssh -p 29418 myname.admin@review.opendev.org \ + "gerrit review 12345,6 --message 'Bypassing Zuul to merge this.' \ + --code-review=2 --verified=2 --label workflow=1 --submit" + * Remove yourself from *Project Bootstrappers* + $ ssh -p 29418 myname.admin@review.opendev.org \ + "gerrit set-members 'Project Bootstrappers' --remove myname.admin" + This procedure is the safest way to force-merge a change, ensuring that all of the normal steps that Gerrit performs on repos still happen. +Note that it's possible to temporarily add your normal OpenID-associated +WebUI account to the ``Administrators`` group or other groups with similar +superuser permissions like ``Project Bootstrappers``, but keep in mind that +an attacker who has quietly gained control of your account at the OpenID +provider could be waiting for that opportunity to take advantage of the +added permissions, or you may simply forget to remove the account afterward +negating the added safety of this account separation. + +For more examples, see the detailed documentation for Gerrit's SSH CLI, +available on our server: +https://review.opendev.org/Documentation/cmd-index.html + Launching New Servers =====================