Blocked: figure out what discussion is needed for just a Beta deployment

To be clear: This extension is never planned to be enabled in any production wiki (not even testwiki)! The idea is to only enable it in a single beta-wiki, so that this can serve more of as a show-case.

A general alternative could be to make CommunityConfigurationExample available on patch-demo. But that would be much less nice to work with, and so it would be a less preferred solution.

In T372049#10885452, @Michael wrote:

To be clear: This extension is never planned to be enabled in any production wiki (not even testwiki)! The idea is to only enable it in a single beta-wiki, so that this can serve more of as a show-case.

Yes, that's my understanding too.

Sorry, I was quickly adding notes to tasks in backlog refinement, and I should have added more context.

Usually new extensions have to go through a more formal review, but since this extension will never get promoted to a production wiki, we wanted to review this use case with Security and the Release Engineering team. @Urbanecm_WMF agreed to follow up, but asked that we keep this task Blocked until we get the OK from them.

In T372049#10885452, @Michael wrote:

To be clear: This extension is never planned to be enabled in any production wiki (not even testwiki)!

This is well-understood. The problem here is that "beta-only extension" is not a well-supported concept, and it is pretty much impossible to deploy an extension to beta that does not impact production at all. Any deployed extension needs to satisfy two conditions:

1. Be present on the relevant hosts in the target realm (production MediaWiki hosts for a production deployment, beta MediaWiki hosts for a beta deployment)
2. Have its i18n messages built

The first condition has separate configuration for beta and production. On beta, this requires the extension being added as a submodule to the mediawiki/extensions repository. For CommunityConfigurationExample, this is already done, and the extension is available on beta hosts. On production, this means having the extension branched (so that it receives the wmf/* deployment branches), which is configured in this releng-owned file.

The second condition, however, has a shared configuration between production and beta: specifically, the extensions-list file. Adding an extension there triggers i18n build for both beta and production. Adding CommunityConfigurationExample there would break production builds: a production host cannot build the i18n cache for CommunityConfigurationExample, because the code for that repository is not present there (as it is not branched yet).

This means that any beta-deployed extension needs to be first deployed to production (however counter-intuitive that might seem). The extension doesn't need to be enabled on any production wiki, but it needs to be present on the production hosts, and the i18n building machinery needs to run on production as well. Hence, the need for the consult @KStoller-WMF mentioned.

(As a side-note: It would be technically possible to have a separate extensions-list for beta. In fact, we used to have a separate file called extensions-list-beta. This was discontinued, with a "let's never introduce this back again" note, so it is probably not advisable to add it back.)

Moving to Up Next because talking to the other teams as needed is still work that's needed and that should be represented on our board.

(tagging with Wikimedia-extension-review-queue to represent the idea of this being the extension's first Wikimedia deployment (even though it's to the beta cluster))

Hello @thcipriani and @sbassett, what would be your opinion on deploying this extension in a beta-only mode? It would still require making it branched (and shipped offline to prod), but hopefully risk would be lower, as we would never actually load in production? Do we still need security review? Or is there an alternate process we should follow?

In T372049#10980006, @Urbanecm_WMF wrote:

Hello @thcipriani and @sbassett, what would be your opinion on deploying this extension in a beta-only mode? It would still require making it branched (and shipped offline to prod), but hopefully risk would be lower, as we would never actually load in production? Do we still need security review? Or is there an alternate process we should follow?

Per step 4 in https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment#Preparing_for_deployment, a pre-beta-deployment security review is a strong recommendation, but not required. So if it is anticipated that potentially a few rounds of beta-testing and refactoring may occur, we'd probably want to wait on the security review until the code was closer to production-ready. Does that make sense?

In T372049#10980285, @sbassett wrote:

Per step 4 in https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment#Preparing_for_deployment, a pre-beta-deployment security review is a strong recommendation, but not required. So if it is anticipated that potentially a few rounds of beta-testing and refactoring may occur, we'd probably want to wait on the security review until the code was closer to production-ready. Does that make sense?

The code is beta-ready already. It is supposed to be minimum client code for community configuration (which is already deployed on all wikis). It is explicitly not production ready (and it is never planned to be), as this code is not intended for production deployment. We only want to deploy the code to beta (to serve the team's QA needs). In fact, the code wouldn't really make sense in production. However, deploying the extension to beta only is not possible without also shipping it to production (by adding it to the list of the branched extensions)

For what it's worth, the SOP says that code that is not a "strong candidate for deployment upon Wikimedia production infrastructure" is not likely to get reviewed.

In T372049#10980631, @Urbanecm_WMF wrote:

The code is beta-ready already. It is supposed to be minimum client code for community configuration (which is already deployed on all wikis). It is explicitly not production ready (and it is never planned to be), as this code is not intended for production deployment. We only want to deploy the code to beta (to serve the team's QA needs). In fact, the code wouldn't really make sense in production. However, deploying the extension to beta only is not possible without also shipping it to production (by adding it to the list of the branched extensions)

For what it's worth, the SOP says that code that is not a "strong candidate for deployment upon Wikimedia production infrastructure" is not likely to get reviewed.

Ok, that sounds pretty non-standard. I would classify this as low risk, given what is being proposed here, which would not require a formal security review. Of course if you or any other maintainers of this code have anything you're concerned about, please let us know.

urbanecm opened https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/188

Start branching CommunityConfigurationExample

Sounds good, thank you, Scott! I want a head and uploaded a change to start branching the repository.

thcipriani merged https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/188

Start branching CommunityConfigurationExample

I can confirm the newly-created wmf.12 branch is present in CC example:

urbanecm@wmf3345 CommunityConfigurationExample % git br -a | grep wmf
  remotes/origin/wmf/1.45.0-wmf.12
  remotes/origin/wmf/branch_cut_pretest
  remotes/origin/wmf/next
urbanecm@wmf3345 CommunityConfigurationExample %

Deploying extensions to beta requires having at least two deployment branches (*), which means this task is currently blocked on time. It will become unblocked next Tuesday (after the next branch cut). I'll prepare the necessary patches now.

(*) Technically, adding the extension to the extension-list (extensions we build i18n messages for) has this requirement. The list is used in both beta and production; in beta, i18n is built from master, in production, the deployment branch is used. As such, extensions cannot be added to the list unless it is guaranteed they will be present in a production deployment branch. Each week, up to two different MW versions are deployed => the extension can be only added if it has at least 2 deployment branches.

Change #1173924 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] Add CommunityConfigurationExample to extension-list

https://gerrit.wikimedia.org/r/1173924

Change #1173925 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] [beta] Add wmgUseCommunityConfigurationExample

https://gerrit.wikimedia.org/r/1173925

Change #1173926 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] [beta] cswiki: Enable CommunityConfigurationExample

https://gerrit.wikimedia.org/r/1173926

Waiting on Aug 05 before this can proceed.

This is now unblocked, as CommunityConfigurationExample has 2+ deployment branches:

urbanecm@wmf3345 CommunityConfigurationExample % git br -a | grep wmf
  remotes/origin/wmf/1.45.0-wmf.12
  remotes/origin/wmf/1.45.0-wmf.13
  remotes/origin/wmf/branch_cut_pretest
  remotes/origin/wmf/next
urbanecm@wmf3345 CommunityConfigurationExample %

Change #1173924 merged by jenkins-bot:

[operations/mediawiki-config@master] Add CommunityConfigurationExample to extension-list

https://gerrit.wikimedia.org/r/1173924

Mentioned in SAL (#wikimedia-operations) [2025-08-12T09:06:13Z] <urbanecm@deploy1003> Started scap sync-world: Backport for [[gerrit:1173924|Add CommunityConfigurationExample to extension-list (T372049)]]

Mentioned in SAL (#wikimedia-operations) [2025-08-12T09:49:35Z] <urbanecm@deploy1003> Finished scap sync-world: Backport for [[gerrit:1173924|Add CommunityConfigurationExample to extension-list (T372049)]] (duration: 43m 21s)

Change #1173925 merged by jenkins-bot:

[operations/mediawiki-config@master] [beta] Add wmgUseCommunityConfigurationExample

https://gerrit.wikimedia.org/r/1173925

Change #1173926 merged by jenkins-bot:

[operations/mediawiki-config@master] [beta] cswiki: Enable CommunityConfigurationExample

https://gerrit.wikimedia.org/r/1173926

https://cs.wikipedia.beta.wmcloud.org/wiki/Speci%C3%A1ln%C3%AD:Komunitn%C3%AD_konfigurace/CommunityConfigurationExample now exists. Moving to QA.