Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suspend Github third-party app: Mergify in MozillaFoundation GHO #837

Open
jencohoon opened this issue Jun 13, 2023 · 2 comments
Open

Suspend Github third-party app: Mergify in MozillaFoundation GHO #837

jencohoon opened this issue Jun 13, 2023 · 2 comments

Comments

@jencohoon
Copy link

Tasks

  1. Review Github Issues that relate to Mergify
  2. Review repos that are supposed to be using Mergify 
  3. Login to Mergify and review usage information
  4. If all looks clear - Suspend the Mergify App in MozillaFoundation GHO - wait 1-2 weeks to evaluate impact to Github workflows
@jencohoon
Copy link
Author

Review Github Issues that relate to Mergify

The desired outcome from the Mergify tool was to: streamline the merging of dependabot PRs, per comment on #743 (comment) from Mar 2020.
The Mergify tool had already passed MoCo security eval. And Mergify was added to the Mozilla GHO in Mar 2020, per comment here: #746 (comment).

A configuration file, mergify.yml, has to be present in the repo for Mergify to be used. Mergify Docs: Getting Started
But it looks like mergify.yml frequently updates their yml configuration, which causes developer headaches and ongoing maintenance.

For Mergify developer headaches see: MozillaFoundation/foundation.mozilla.org#10096

For Mergify ongoing maintenance see:
https://github.com/MozillaFoundation/foundation.mozilla.org/pull/10068/files
MozillaFoundation/foundation.mozilla.org#8102
MozillaFoundation/donate-wagtail#1610

@jencohoon
Copy link
Author

Review repos that are supposed to be using Mergify

So it looks like there were two separate levels of Mergify integration on some repos:

  1. using Mergify by setting up a mergify.yml file
  2. using Mergify information to automatically merge PRs that Mergify tagged as ready-to-merge into the main branch of the repo using Mergify

Per this Issue Add ready-to-merge feature to all repos it appears Mergify was added to the following repos:
MozillaFoundation/donate-wagtail#971
mozilla/network-pulse-api#643
mozilla/network-pulse#1308

Additionally Mergify was added to the repo MozillaFoundation/foundation.mozilla.org

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant