On Mon, Mar 3, 2014 at 9:25 AM, Antoine Musso <amusso(a)wikimedia.org> wrote:
> > * Cutting the branch should be automatic. Jenkins could do this easily
> > and make the timing predictable for all parties.
>
> Can you fill in as a bug under either the Deployment or Continuous
> Integration component? Would be more than happy to pair with someone to
> craft the job.
>
> We might want to have that job on a secured/private Jenkins instead of
> the CI one though.
I know we talked about maybe someday doing this, as it would solve a lot of
issues. Is this something we should wait on? It would definitely help with
the tarball process too, and as I was thinking about it, it seems like this
is something a few of us could do pretty quickly. I don't actually know
Gerrit or Jenkins, but it seems like these would all be things someone in
our team has done before, so it's should just be banging it out instead of
trying to do something new.
Assuming ops was able to get the hardware, all we need to do is:
* We setup a machine (well 2, and mirror them somehow for redundancy..) on
an isolated network inside the cluster
* It runs gerrit and jenkins
* We merge in new patches from the current git repo automatically
** If there's a conflict with a security patch, alert/page/etc (<- this is
the major downside I see, if someone is trying to merge an emergency patch
to deploy, but it conflicts with an existing security patch, and it's
midnight in SFO, we will have problems..)
* Security patches are submitted and +2'ed in the gerrit instance
* Jenkins cuts the weekly (or daily) branches on some schedule and tarballs
when new tags are pushed
* Tin points to the private repo to get its code, and a cron job creates
the new directory structure when new wmf branches are available.
Am I way off thinking this isn't actually that difficult? Maybe something
we could schedule for q2?
