On 2020-02-04 12:04:15 -0800 (-0800), Saul Wold wrote:
I got a look at the one of the reviews for this and I wonder if we can do this via a template in zuul-jobs so that we have have one secret shared for all the github mirror jobs?
If needed we can check with the Infra team, and perhaps you already have. [...]
The reason is explained in Zuul's documentation on secrets: "If a job with secrets is defined in an untrusted-project, allowed-projects is automatically set to that project only, and can not be overridden (though a config-project may still add the job to any project’s pipeline regardless of this setting; do so with caution as other projects may expose the source project’s secrets)." https://zuul-ci.org/docs/zuul/reference/secret_def.html This is a safety measure, to prevent job definition changes merged to one project from being able to expose secrets belonging to another project. Also secrets are tied to the repository in which they're defined, encrypted with different keys per project, so copying the same secret into a different repository will only yield undecryptable garbage. Further, for related safety reasons, secrets can't be used by child job definitions or job variants, meaning that it would be impossible to override some variables in a secret-using job (for example, the git_mirror_repository variable on which the upload-git-mirror parent job relies) with a job variant in another repository. -- Jeremy Stanley