Adding QS-Test-Automation to keep aware of this, this is a great effort. Where's test coverage going to be documented? Will it flow to https://doc.wikimedia.org/cover-extensions/ or somewhere else?

To be clear, I agree. I'm just trying to figure out who needs to do that work based on where the code lives that needs to be updated.

@KReid-WMF Can you add links to the following to help us out:

@vaughnwalters Can we estimate how long this test would take to create? We may hold off on implementing this until we can rely on Catalyst to set up CentralAuth and use it.

What code changes would need to be made to make this happen? That will help determine what team needs to make the changes:

for QS-Test-Automation and anyone else who might be able to answer:

Agreed the layer you're looking at (code-level testing of API requests) fits the need - we (QS) have successfully used Pytest in the past but as you mention there's integration costs. Some early attempts at documentation are here. As you can see, it required a fairly robust effort to create and support.

Hey folks! I'm very interested in helping out here, since you mentioned liaising with QA. From what I've read so far some general thoughts:

It's worth reviewing anyway - there's a couple of assumptions I'd like to answer:

So was the root cause here that external crawlers were causing an overload of our ability to handle traffic, and the root cause was blocking those IPs? Just trying to learn here.

Thanks - this helps. Do you have a query or something you can share to help me see these easier?

Yep, I'll close it

That makes sense. And yeah, timeouts are definitely still a thing. I'm curious how many of them are caused by truly slow performance vs something more simple like a missing/incorrect selector. If it's the latter, QS-Test-Automation could help.

Hey folks!

Latest flake: https://integration.wikimedia.org/ci/job/quibble-vendor-mysql-php83-selenium/7571/

Open questions mk 2:

Open questions:

While general CI slowness is a problem, we need to figure out why selenium timeouts are not terminating the build immediately.

Can we add some information here about further work that's going to be necessary to do the upgrade? Determine what methods within WDIO package might need to be added for compatibility?

I'd love for Vaughn to take the lead making this happen here, so that he knows how to adjust blocking/unblocking tests in Gitlab. Would he need to work with Jeena/James to do that?

It is! And one of the draft hypotheses I'm considering for the next fiscal year involves creating and maintaining this as part of Quality Services' work. t's possible we could pull it in sooner, depending on other commitments.

Makes sense, thanks. Like you mentioned, null is tricky. Glad you figured it out!

@vaughnwalters Are there automated tests to validate navigation on this? Either UI, integration or unit tests? If we can set up data appropriately for this situation in Catalyst this would be a decent opportunity to create a test automation ticket for future work to make sure it doesn't happen again

Just out of curiosity here - was the root cause that the following user had null for username? Which is acceptable data because it's a nullable column.

FYI there's folks on Test Platform (@armeniki 's team) that can help understand options and time commitment here. Or I can! I love performance testing.

Hey folks! I'm the Engineering Manager of the Quality Services team (formerly part of the QTE team). Kosta let me know about this ongoing discussion and I wanted to see if I could help out.

@ABorbaWMF Mind attaching your test plan here?

Subscribing to this because it's going to be a very useful document for my team.

This is an interesting task that might be useful to pick up again and move to the Quality-Services mediawiki. Accessibility is important but not urgent, currently.

Hey folks!

From Native Apps: They're researching the impact this may have on Native Apps currently. @ABorbaWMF will be producing a test plan in the near future around any necessary testing based on that investigation.

@Edtadros Would you be able to put some brain power to this to determine if there are specific flows within the context of "Readers Growth" we should be specifically hitting for this potential change.

Hey folks! I was made aware of this a couple of weeks ago and will help keep things organized and reported here (since I manage the QS team). I've flagged it with them and am following up individually to ensure that as teams get on top of this we make sure to track and provide updates here.

Adding this to the tech docs team backlog so we can review and prioritize

In T398648#11141750, @sbassett wrote:

I'd agree and we've tried this before, a couple of times, e.g. T319318. But those efforts mostly failed, likely for not being pioritized or treated like an actual project.

@Ryasmeen @EstherAmoo flagging this as it might be good to do a Root Cause Analysis on this since it escaped all the way to production and now has to be redone. An initial glance makes me wonder if we could write an automated test for it?

Genuine question: is there a reason why the Security-Team/Tech-Docs-Team can't do this? I only ask as (I assume) these will be the teams within the WMF with the greatest domain knowledge on security/documentation-writing matters. I appreciate that teams have limited amounts of time in which to do things, but this seems like it should hopefully be a relatively minor documentation refactor for those with the relevant knowledge.

This can't really be started until we have a good understanding of what constitutes a "smoke test" plus what functionality will be touched by the MFA project. It only makes sense to start on this after we sync with the security team on August 11th, depending on what they say.

In T398156#10959426, @ABran-WMF wrote:

thanks @TBurmeister for the log extraction, you can confirm that on location with websites like https://whatismyipaddress.com/ to have a visual confirmation.

The x-client-ip you extracted belongs to AWS. If you discover that your coworking space is using this IP address as an exit point, I recommend temporarily switching to another connection (such as a mobile hotspot from your smartphone) while we sort this out.

https://docs.google.com/document/d/13JtfFGIos3AUB1i3tZiXI5XIRXt4G7jzKyaBrtsT338/edit?usp=sharing

What's Tested?

In T396055#11007149, @Seddon wrote:

@SLong-WMF & @ABorbaWMF: This epic is ready for review by QTE and an assessment for automated logging.

@ABorbaWMF is out sick, I'm taking a brief pass at what test should be automated as part of this work - to provide a critical user journey coverage for this specific epic.

Mistakenly assigned to Anthony. I'll be creating the template.