We discussed it during our team meeting and agreed that it would be great to have.

@Aklapper do you know if it's possible to grand write only (or even "comment only") access to this bot?

If it's possible then that's great. If not we will have a closer look at who have access to this bot's credentials to know if it's safe to grant it read/write.

I cannot spot any such grants differentiation in https://secure.phabricator.com/book/phabricator/article/users/#bot-accounts or https://phabricator.wikimedia.org/settings/user/ops-monitoring-bot/ - looks like it's all or nothing

The credentials for this bot are managed by puppet, it's currently installed in those hosts:

alert[1001,2001].wikimedia.org,cumin2002.codfw.wmnet,cumin1001.eqiad.wmnet

in /etc/phabricator_ops-monitoring-bot.conf with permissions -r--r----- 1 root root
with the password defined in the puppet's private repo.
AFAIK it's currently used only by Spicerack (cumin hosts) and the Icinga raid event handler (alert hosts).

In both cases, with the current feature set, its access is basically write-only as in both cases it's just either creating a new task or appending a comment to an existing task. But that might change in the future, in particular in the wmflib implementation used by Spicerack.

That said, given the current setup model I would not see it a security issue to grant the bot the WMF-NDA permission. I'll re-check in today's team meeting with the rest of the group.

In T314917#8210934, @Volans wrote:

I'll re-check in today's team meeting with the rest of the group.

We discussed it in a previous IF meeting (while you were on vacation) and the consensus was that noone had objections, but wanted to ask you still :-)