For jenkins@contint1001.wikimedia.org the emails will have the header:

From: "Jenkins,,," <jenkins@contint1001.wikimedia.org>

Is everything done here or are changes still being made?

Nothing has been done. It is a random idea I had a couple months ago which I filled as a task to make sure it is not forgotten. I haven't even looked at all places using the jenkins-bot email address.

I've recently been getting a few of these (mostly from @Jdforrester-WMF cleaning up portalsbuild?). It's not a major problem, but looking at the list of who's on jenkins-bot@ (https://groups.google.com/a/wikimedia.org/g/jenkins-bot/members ) this seems like an odd setup indeed.

Anyway, still Low priority, just keeping logs for next time this happens and I search phab again :)

In T151642#7135831, @greg wrote:

I've recently been getting a few of these (mostly from @Jdforrester-WMF cleaning up portalsbuild?).

Sorry! ;-)

Change 732968 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/puppet@production] zuul: use releng list rather than jenkins-bot for email

https://gerrit.wikimedia.org/r/732968

Change 732968 merged by Dzahn:

[operations/puppet@production] zuul: use releng list rather than jenkins-bot for email

https://gerrit.wikimedia.org/r/732968

After I have updated the CI Jenkins admin address from jenkins-bot to releng, email notifications sent to qa-alerts@lists.wikimedia.org would bounce back:

Your message to the QA-Alerts mailing-list was rejected for the following reasons:

The message is not from a list member

Before changing the system admin email, we should audit all the lists being recipients, make sure releng is a member (and disable mail notification to it).

(I have rolled back the change on CI Jenkins which is now back to using the jenkins-bot email)

I have created a jenkins-bot account on lists.wikimedia.org and stored its credentials in releng secrets store.

Whenever Jenkins emits an email from jenkins-bot@lists.wikimedia.org it might get bounced by the recipient mailing list, over time the email has been added to the target lists and we would need to do the same for releng@lists.wikimedia.org.

From integration/config.git we can retrieve all the emails Jenkins jobs send email too with git grep -hoP '[\w-]+@lists.wikimedia.org'|sort|uniq.

The jobs sending to multimedia-alerts have been removed a while back.

I tried to create an account on mailman for releng@lists.wikimedia.org and that results in a server side error, I guess cause it is a list.

So in the end, we need releng@lists.wikimedia.org to be allowed to post on the list, which in mailman 3 can be granted even if the email is not an account nor a member of the list. But that requires each list owners to set the preference.

Example for qa-alerts for which I am a owner. Looking at https://lists.wikimedia.org/postorius/lists/qa-alerts.lists.wikimedia.org/members/nonmember/?q=releng gives:

Since I am a list owner, I have access Non-members Options for that email which let me change the Delivery Status (none for a non member) or more importantly how the list react when it receives an email from that email:

And it shows List default which depends on the list. I could not find the default setting for the list, but I guess that for each recipient list we can set it this non member to either Accept or Default Processing (which does "additional checks" whatever it can mean).

The list Jenkins sends email to are:

In T151642#7454987, @hashar wrote:

So in the end, we need releng@lists.wikimedia.org to be allowed to post on the list, which in mailman 3 can be granted even if the email is not an account nor a member of the list. But that requires each list owners to set the preference.
<snip>

List
betacluster-alerts@lists.wikimedia.org
discovery-alerts@lists.wikimedia.org
portals@lists.wikimedia.org
qa-alerts@lists.wikimedia.org
releng@lists.wikimedia.org
security-admin-feed@lists.wikimedia.org
wdqs-gui-build@lists.wikimedia.org

Done for all of these lists.

Thank you so much @Legoktm for proposing your help and fixing the rights. I will switch Jenkins to emit emails from releng@ tomorrow \o/

discovery-alerts@lists.wikimedia.org is now accepting emails from releng@

Thank you @Gehel.

I have send an email to each mailing lists owners with the detailed instructions.

I received the email, but it doesn’t look like there’s anything left to be done for wdqs-gui-build, releng@ is already set to “accept immediately” there. (I guess that’s what @Legoktm did, but then I’m not sure why the email was sent.)