migrating Pipeline jenkinsio-cn from trusted to infra.ci

[smerle33]

Service(s)

infra.ci.jenkins.io

Summary

as this project evolve slowly, as per daniel demand, it could be migrate to infra.ci.jenkins.io

definition of done :

• duplicate the job on infra.ci.jenkins.io
• add a node "docker&&linux" as used in the pipeline
• duplicate the credentials for this pipeline on infra.ci.jenkins.io (BLOBXFER_STORAGEACCOUNTKEY)
  • decode BLOBXFER_STORAGEACCOUNTKEY from trusted
  • add it to infra
• when up and running on infra (with the blobxfer working), delete the entry on trusted

Reproduction steps

No response

[smerle33]

@dduportal WDYT ?

[dduportal]

Lgtm

[dduportal]

Handing over as @smerle33 is going to holidays.

Ping @daniel-beck : I understand that the job on trusted.ci.jenkins.io is responsible to deploy the site in production when there is change on the master branch.
Hence the request to move it out of trusted.ci as there has been no changes since months.

Is there a reason to not also migrate jenkins.io's deployment job out of trusted.ci.jenkins.io since they share the same production bucket (and crerdential)?

I wonder if (cn)jenkins.io websites deployment should not be on release.ci.jenkins.io, with Core, remoting (and Docker images of core).

[timja]

I wonder if (cn)jenkins.io websites deployment should not be on release.ci.jenkins.io, with Core, remoting (and Docker images of core).

I don't think it needs to be on release.ci.jenkins.io. but yes docker images should move there

[dduportal]

I wonder if (cn)jenkins.io websites deployment should not be on release.ci.jenkins.io, with Core, remoting (and Docker images of core).

I don't think it needs to be on release.ci.jenkins.io. but yes docker images should move there

Make sense. My question could be simplified to:

1 - Should we allow infra.ci.jenkins to deploy cn.jenkins.io ?
2 - Should we also do the same for jenkins.io ? If no why ?

[timja]

1. yes
2. yes
   makes sense to me

[daniel-beck]

Is there a reason to not also migrate jenkins.io's deployment job out of trusted.ci.jenkins.io since they share the same production bucket (and crerdential)?

I need to be able to disable, enable, and trigger builds during publishing. Agents should not take minutes to be available. Otherwise should be fine.

[timja]

What's the need for disable / enable?

infra.ci has webhooks so will trigger on commit.

[daniel-beck]

I don't want the site to update between taking ci.j.io back online (even more so once we remove this stupid dependency) and pushing the advisory, potentially already advertising new stuff with incomplete changelog (also as RSS) etc.

[timja]

even more so once we remove this stupid dependency

I couldn't see an issue for this so filed #3087

[dduportal]

For info: disabled the job on trusted.ci.jenkins.io (see screenshot below) with an explanation in the description, which point to this issue:

• The build are failing since beginning of the month and consumes resources for nothing
• Migration and fix are blocked by Publish pipeline-steps-doc-generator and backend-extension-indexer artifacts to some kind of storage #3087

[lemeurherve]

All of these elements should be cleaned up, cf #3379