Automatically run maint. scripts to demote ineligible users on Wikimedia production
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	mszwarc
	May 5 2026, 8:44 AM

Project Tags

Referenced Files

None

Subscribers

Description

In T418579 and T425395, two maintenance scripts for demoting ineligible users were created. For now, they are only run manually when we expand the scope of 2FA enforcement. However, in a longer run, these scripts should be invoked autometically every now and then (e.g., once a week).

Acceptance criteria

demoteIneligibleUsers is automatically invoked every week
- on all wikis (public, fishbowl and private)
- uses log relaying to Meta-Wiki (args: --relay-log checkuser=metawiki --relay-log suppress=metawiki)
CentralAuth:demoteIneligibleCentralUsers is automatically invoked every week
- only on Meta-Wiki

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Periodic jobs: add demote_ineligible_users (and _central_ counterpart)	operations/puppet	production	+41 -0

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
Resolved	mszwarc	T425396 Automatically run maint. scripts to demote ineligible users on Wikimedia production
Resolved	mszwarc	T425395 Add a script to demote ineligible users from restricted global groups
Resolved	mszwarc	T418579 Implement a maintenance script to demote users who don't meet conditions specified in $wgRestrictedGroups
Resolved	mszwarc	T6055 Interwiki rights logs should be duplicated at related wikis
Resolved	Ladsgroup	T422942 Consider fixing invalid titles in rights log (Meta-Wiki and ptwiki)

Event Timeline

mszwarc created this task.May 5 2026, 8:44 AM

Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptMay 5 2026, 8:44 AM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

mszwarc added subtasks: T425395: Add a script to demote ineligible users from restricted global groups, T418579: Implement a maintenance script to demote users who don't meet conditions specified in $wgRestrictedGroups.May 5 2026, 8:44 AM

mszwarc added a parent task: T150898: Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis.

mszwarc moved this task from Backlog to Ready on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.

Johannnes89 subscribed.May 5 2026, 11:22 AM

mszwarc moved this task from Ready to In progress on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.May 7 2026, 10:56 AM

Change #1285315 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[operations/puppet@production] Periodic jobs: add demote_ineligible_users (and _central_ counterpart)

https://gerrit.wikimedia.org/r/1285315

gerritbot added a project: Patch-For-Review.May 8 2026, 9:03 AM

Proposed patch has been prepared, but has to wait for the maintenance script in CentralAuth to be merged and then rolled out to all wikis (actually, just to Meta-Wiki would be sufficient).

mszwarc moved this task from In progress to Ready on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.May 8 2026, 9:29 AM

JTweed-WMF edited projects, added: MediaWiki-Platform-Team (Radar); removed: MediaWiki-Platform-Team.May 11 2026, 2:42 PM

OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)); removed: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)).Mon, May 25, 12:24 PM

OKryva-WMF moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.

OKryva-WMF moved this task from In progress to Ready on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.

mszwarc closed subtask T425395: Add a script to demote ineligible users from restricted global groups as Resolved.Wed, May 27, 7:47 AM