Page MenuHomePhabricator
Create Task
Maniphest T391674

@Maintenance_bot can't see/doesn't act on security tasks
Open, Needs TriagePublic
Actions

Description

See e.g., T385792#10732958

As far as I can see, this could cause a problem for the use-case of using
@Maintenance_bot to automatically add team-projects in response to certain codebase tags; as a team might then not be notified of a security task in a component it stewards.

Related Objects

Event Timeline

A_smart_kitten created this task.Apr 11 2025, 11:14 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 11 2025, 11:15 AM
• sassybritches set Due Date to Jun 29 2025, 12:00 AM.Jun 29 2025, 3:59 PM
• sassybritches updated the task description. (Show Details)
Ladsgroup updated the task description. (Show Details)Jun 29 2025, 4:00 PM
Ladsgroup removed Due Date which was set to Jun 29 2025, 12:00 AM.
Bugreporter subscribed.EditedJun 30 2025, 4:30 AM

We can add the bot to acl*security, but the not still can not see NDA protected tasks until being added to WMF-NDA.

A_smart_kitten mentioned this in T398440: Consider documenting the stewardship of the MediaWiki-Notifications component.Jul 22 2025, 6:42 AM
Urbanecm subscribed.Fri, Sep 18, 9:25 AM

FWIW, this would also mean "Toolforge has credentials that can see any security ticket". Which, given the disclaimers the Cloud's ToU have (https://wikitech.wikimedia.org/wiki/Wikitech:Cloud_Services_Terms_of_use#9.2_Disclaimers) may or may not be advisable.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits