Skip to content

scap clean: delete branches as gerrit_push_user

Hashar requested to merge delete-branches-as-trainbranchbot into master

We have stopped cleaning wmf branches from Gerrit since 2019 due to the removal of Gerrit HTTP tokens at the time. With git using the keyholder SSH_AUTH_SOCK, ssh tries each keys from the keyholder, which fail and eventually Gerrit legitimely rejects the auth attempts:

Received disconnect from 2620:0:861:3:208:80:154:85 port 29418:2: Too many authentication failures: 7

To resume the MediaWiki train, the branches deletion has been moved behind a feature flag --delete-gerrit-branch.

Some years later, I have taught scap to interact with Gerrit using a dedicated user (T306425) and that logic should be usable to delete the branches as well.

The configuration is done via Application.get_gerrit_ssh_env(), the resulting environment variables setup GIT_SSH_COMMAND to use the trainbranchbot user and its key.

Bug: T218783

Merge request reports