Bug 1907217: remove * branch from RelEng github repositories and maple

[bhearsum]

Stage one of the plan written out in the bug.

This should be quite safe. For Maple, all of the scopes that branch:* has are already granted by branch:default.

For GitHub we have some differences, but as far as I can tell, only where the explicit branches have more scopes than branch:* due to grants such as

fxci-config/grants.yml

Lines 1185 to 1200 in 944ea85

	# - balrog specific roles
	- grant:
	- secrets:get:repo:github.com/mozilla-releng/balrog:coveralls
	to:
	- project:
	alias: balrog
	job: [pull-request:*, branch:main]
	- grant:
	- queue:route:index.project.balrog.*
	- queue:route:notify.*
	- secrets:get:repo:github.com/mozilla-releng/balrog:dockerhub
	to:
	- project:
	alias: balrog
	job: [branch:main]

.

Original revision/discussion in https://phabricator.services.mozilla.com/D216239

ci-admin diff for this is in https://gist.github.com/bhearsum/61df6555dea05bebb9c12b491d6259ce

[bhearsum]

Failure is just an intermittent that is being fixed in #30

[jcristau]

For the staging / level 1 repos, we may actually want to remove the main/master branch and keep just *?
AFAIK using the default branch is only necessary when we want to change actions, but for everything else using other branches is probably better (less chance of collision)?

[bhearsum]

Hm, I think that's probably reasonable. If we're doing that, we should probably keep a level 1 * branch in level 3 repos as well (I keep going back and forth on whether or not that's a good idea...but I don't think it does any harm).

AFAIK using the default branch is only necessary when we want to change actions, but for everything else using other branches is probably better (less chance of collision)?

Can you clarify what you mean by "less chance of collision"? I'm not sure I see how it connects to the rest of the comment.

[jcristau]

I don't think this applies to the same extent to other repos, where there's only a couple of branches we care about and the rest are pretty much only used for PRs, which get their own graphs.

For the staging repos though the entire point is to make arbitrary changes without going through PRs. I think of those a bit like try, where each push is basically its own mercurial head, and branch names are irrelevant.

[bhearsum]

If you're exclusively talking about staging repos, yeah, I agree those are different. If we're talking about non-staging level 1 repos as well (of which there are many that aren't staging), I'm not sure I see those as any different from level 3 repos.

[jcristau]

I was thinking about the staging repos specifically, yes. Sorry for the confusion.

[bhearsum]

Oh sure - yes. Let's do that.

[jcristau]

lgtm, thanks!