Hrm, so I see the mediawiki-libs-metrics-platform group probably has the rights you seek.

Currently only @Jdlrobson and @Mholloway which seems out-of-date.

We could either revert to having this owned by the MediaWiki group (all MediaWiki +2ers can verify) or we can add to the group—what do you think @phuedx?

To me the proper fix would be to fix the CI so that a manual +2 and submit is not a part of the "normal" workflow.

The fault lies in the CI workflow (Zuul):

The Gerrit project is configured with:

- name: mediawiki/libs/metrics-platform
  test: 
    - trigger-metrics-platform-pipeline-test-js
    - trigger-metrics-platform-pipeline-test-php
    - trigger-metrics-platform-pipeline-test-java
    - trigger-metrics-platform-pipeline-test-swift
  gate-and-submit:
    - trigger-metrics-platform-pipeline-test-js
    - trigger-metrics-platform-pipeline-test-php
    - trigger-metrics-platform-pipeline-test-java
    - trigger-metrics-platform-pipeline-test-swift
  experimental:
    - metrics-platform-maven-java8-docker
    - metrics-platform-maven-java8-docker-site-publish

And those jobs have a filter to have them only run when some specific files are altered by the proposed change:

- name: trigger-metrics-platform-pipeline-test-php
  files:
    - '.pipeline/blubber/php.yaml'
    - '.pipeline/config.yaml'
    - 'composer.json'
    - 'php/.*'
  
- name: trigger-metrics-platform-pipeline-test-js
  files:
      - '.pipeline/blubber/js.yaml'
      - '.pipeline/config.yaml'
      - 'js/.*'

- name: trigger-metrics-platform-pipeline-test-java
  files:
      - '.pipeline/blubber/java.yaml'
      - '.pipeline/config.yaml'
      - 'java/.*'
      - 'mvnw.*'
      - 'Maven.*'
      - 'maven.*'

I guess we need to update those files filters to have those jobs trigger on change made to tests. At a quick glance they should all trigger for anything matching tests/consistency/.*json and we should add:

• tests/.*\.js to trigger-metrics-platform-pipeline-test-js
• tests/.*\.php to trigger-metrics-platform-pipeline-test-php

Or maybe simplify to match any js or php files: .*\.php and .*\.js.

In T327301#8535735, @thcipriani wrote:

We could either revert to having this owned by the MediaWiki group (all MediaWiki +2ers can verify) or we can add to the group—what do you think @phuedx?

It's not a particularly special project so I don't see a problem with reverting to having this owned by the MediaWiki group.

In T327301#8535744, @taavi wrote:

To me the proper fix would be to fix the CI so that a manual +2 and submit is not a part of the "normal" workflow.

For sure. Ideally, there shouldn't be a need to manually V+2 patches at all. Indeed, for the majority of patches to the repository this is not the "normal" workflow. However, the project's permissions seem exceptional and shouldn't be.

As for Gerrit permissions: submitting a change requires the label Code-Review and Verified to be at their max score: +2.

The repository inherits from mediawiki hierarchy. It grants Verified +2 right to member of the mediawiki group and you are not a member of it. Thus you can not Verified +2 and Gerrit does not enable submit. Those requirements will be shown in the web UI in a future version of Gerrit (I can't remember whether it is 3.6 or 3.7).

Change 881457 had a related patch set uploaded (by Hashar; author: Hashar):

[integration/config@master] zuul: mediawiki/libs/metrics-platform trigger for tests

https://gerrit.wikimedia.org/r/881457

Change 881457 merged by jenkins-bot:

[integration/config@master] zuul: mediawiki/libs/metrics-platform trigger for tests

https://gerrit.wikimedia.org/r/881457

Mentioned in SAL (#wikimedia-releng) [2023-01-18T17:55:15Z] <hashar> Reloaded Zuul for https://gerrit.wikimedia.org/r/c/integration/config/+/881457 | T327301

With CI adjusted, a recheck on the change now triggers the js and php jobs:

Thanks again, @hashar <3.

In T327301#8535842, @hashar wrote:

The repository inherits from mediawiki hierarchy.

According to https://gerrit.wikimedia.org/r/admin/repos/mediawiki/libs/metrics-platform,access, the repository inherits from mediawiki/libs. I'm not sure that this changes anything though…

Change 881665 had a related patch set uploaded (by Phuedx; author: Phuedx):

[integration/config@master] zuul: Update mediawiki/libs/metrics-platform trigger

https://gerrit.wikimedia.org/r/881665

Change 881665 merged by jenkins-bot:

[integration/config@master] Zuul: [mediawiki/libs/metrics-platform] Update triggers

https://gerrit.wikimedia.org/r/881665

In T327301#8540801, @phuedx wrote:

...
According to https://gerrit.wikimedia.org/r/admin/repos/mediawiki/libs/metrics-platform,access, the repository inherits from mediawiki/libs. I'm not sure that this changes anything though…

Indeed, mediawiki/libs in turn inherits from the mediawiki repo which is where the mediawiki group is granted Verified +2. To add to the complexity, groups can include other groups or LDAP groups ;)

Mentioned in SAL (#wikimedia-releng) [2023-01-20T06:19:42Z] <hashar> Reloaded Zuul for https://gerrit.wikimedia.org/r/c/integration/config/+/881665 | T327301