Sorry @valhallasw to leave this part-done. Logging into Phab gets me into @Forrestbot and not @ReleaseTaggerBot, too. :-(

Sorry, that's an old venv that should be removed.

/data/project/forrestbot/venv-py35-stretch/bin/python /data/project/forrestbot/forrestbot/forrestbot.py

does start the bot but it crashes with

Traceback (most recent call last):
  File "/data/project/forrestbot/forrestbot/forrestbot.py", line 209, in <module>
    main()
  File "/data/project/forrestbot/forrestbot/forrestbot.py", line 176, in main
    add_PHIDs.add(get_slug_PHID(slug))
  File "/data/project/forrestbot/forrestbot/forrestbot.py", line 74, in get_slug_PHID
    phab.request('project.query', {'slugs': [slug]})['slugMap']
  File "/data/project/forrestbot/venv-py35-stretch/lib/python3.5/site-packages/phabricator/__init__.py", line 68, in request
    self.connect()
  File "/data/project/forrestbot/venv-py35-stretch/lib/python3.5/site-packages/phabricator/__init__.py", line 53, in connect
    'sessionKey': result['sessionKey'],
TypeError: 'NoneType' object is not subscriptable

I can take a longer look tomorrow.

I reverted the config.py back to use certificates. I'm not entirely sure how api keys are supposed to be used in phab; should they just be passed as part of the API request, the same way the session key is passed at the moment?

Certificates are so deprecated that you can't view them in the interface and will break soon, I was told.

I have no idea how Lego's custom Phab python connector works, but yes, theoretically just passing the API token in its place should work…

Looking at the examples, a call is now supposed to be done along these lines:

$ curl https://phabricator.wikimedia.org/api/project.query \
    -d api.token=api-token \
    -d param=value \
    ...

whereas we currently use a magic conduit token. Unfortunately the rest of the request system has also changed...

curl https://phabricator.wikimedia.org/api/project.query \
    -d api.token=api-token \
    -d phids[0]=PHID-TASK-bc37zzm5ct4wi2ill4xq \
    -d offset=12

versus

curl https://phabricator.wikimedia.org/api/project.query \
    -d api.token=api-token \
    -d params='{"phids": ["PHID-TASK-bc37zzm5ct4wi2ill4xq"], "offset": 12}'
    -d output=json

(or something along those lines, I haven't done curl for a while).

python-phabricator supports tokens as well: https://github.com/disqus/python-phabricator/blob/master/phabricator/__init__.py#L378
and still uses params: https://github.com/disqus/python-phabricator/blob/master/phabricator/__init__.py#L307

looking at that implementation we could indeed just get rid of the whole login cycle and just pass the token as part of the request.

Or switch to python-phabricator and outsource the maintenance of the library to disqus :-)