project.config: remove use of release-managers mdb/golang-release-eng-policy is a better-maintained superset, and should be used where we want people to have ambient access. Remove ambient branch and tag creation permissions -- these are dangerous things that don't happen enough to justify ambient access. Change-Id: I55499416f24cf5f280c0ed3d9fc0b4f0150944b3 Reviewed-on: https://go-review.googlesource.com/c/All-Projects/+/456619 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
diff --git a/groups b/groups index 9251848..1b1efc6 100644 --- a/groups +++ b/groups
@@ -2,7 +2,6 @@ # 28af6c56d29f40fcca6fef99686e58212a7177bf trybot-result-changers 50396072908fc1bf97ed3163533dc7c7381bdbfb may-start-trybots -52491aff3ace4546702cbb04d61112bcfb3cf4a3 release-managers 69728fadfa4b65b76c1ab6279e3811c7bac871ca gobot a68e77fe594e959daaacc2fb670298964f78acfa approvers adf76ba6894d57eca12698844876eafed66f9990 gerritbot @@ -18,5 +17,6 @@ mdb:gerritcodereview-eng mdb/gerritcodereview-eng mdb:golang-gob-eng-policy mdb/golang-gob-eng-policy mdb:golang-gob-owners mdb/golang-gob-owners +mdb:golang-release-eng-policy mdb/golang-release-eng-policy mdb:google-cla-gerrit-robot-accounts mdb/google-cla-gerrit-robot-accounts mdb:gwsq mdb/gwsq
diff --git a/project.config b/project.config index 345eabf..81222bb 100644 --- a/project.config +++ b/project.config
@@ -21,7 +21,6 @@ pushMerge = group Registered Users [access "refs/heads/*"] create = group may-push - create = group release-managers forgeAuthor = group gerritbot forgeAuthor = group may-forge-author-identity forgeAuthor = group may-push @@ -60,23 +59,18 @@ push = group mdb/golang-gob-owners [access "refs/tags/*"] push = group may-push - push = group release-managers create = group gobot create = group may-push - create = group release-managers forgeAuthor = group may-push - forgeAuthor = group release-managers forgeCommitter = group may-push - forgeCommitter = group release-managers createTag = group gobot createTag = group may-push - createTag = group release-managers [access "^refs/heads/(release|internal)-branch.+"] exclusiveGroupPermissions = label-Auto-Submit submit submit = group gobot - submit = group release-managers + submit = group mdb/golang-release-eng-policy label-Auto-Submit = +0..+1 group gobot - label-Auto-Submit = +0..+1 group release-managers + label-Auto-Submit = +0..+1 group mdb/golang-release-eng-policy [label "Code-Review"] function = NoOp defaultValue = 0