MediaWiki Engineering/Runbook/Access control

Phabricator

Workboards in Phabricator are where you can view open tasks for each team. Most things in Phabricator are freely editable by default to any logged-in account. No special per-team or per-workboard access is required to browse, move, or edit tasks on a workboard:

MediaWiki-Platform-Team
MW-Interfaces-Team
MediaWiki-Media-Platform-Team
Content-Transform-Team
MediaWiki-Engineering, used as fallback intake and parking spot for tasks before a team is found.

General user groups grant you access to certain permissions. See mw:Phabricator/Permissions for more complete list of groups and how to request or remove membership:

Trusted-Contributors: All staff should be in this group, and any existing member can add you. It enables common permissions such as editing workboards, editing project descriptions, and converting a public task to a security task.
Project-Admins: When considering creation of new workboards or tags, review Phabricator/Creating and renaming projects on mediawiki.org and use the request form linked there. If you regularly create workboards, consider joining this group via the process linked there.

Security tasks are by default only visible to the reporter and to individuals directly subscribed to the task. To see a security issue, someone must subscribe to that specific task, or you need to be a member of a group that can see all Wikimedia Foundation security issues, via the security access form:
- acl*security_product_manager: Product managers should join this group.
- acl*security_developer: Developers who are leads for a component or otherwise find themselves regularly needing to be subscribed to a security issue should consider joining this group.

Special user groups:

acl*mediawiki_platform_team: This group grants edit access to the Web Perf Hero award badge.

Gerrit

You can find a list of open changes and recently merged changes in the Gerrit dashboard for each team.

MediaWiki Platform Team:

Gerrit dashboard: MediaWiki Platform Team
Gerrit group: mediawiki-platform-team, controls owner access to mediawiki/php/excimer, mediawiki/libs/less.php, and other repos.

MW Interfaces Team:

Content Transform Team:

Gerrit dashboard: Content Transform Team
Gerrit group: content-transform-team, controls owner access to mediawiki/services/parsoid and other repos.

MediaWiki Media Platform Team: TODO.

IRC

See also: IRC on office.wikimedia.org (restricted).

Channel permissions

To add a team member to the channel, we grant the "Operator" flags. We have defined this to give the person a "voice" indicator (which helps others discover who's in the team and to easily remember their name), and to gives administrator rights (such as: edit the "topic" text, ban unwanted guests, and the viral ability to give Operator to other people). While in the channel, run these two commands:

/cs flags #mediawiki-core TheirNicknameHere operator

For example, to grant Operator rights to Krinkle, you'd run /cs flags #mediawiki-core Krinkle operator.

To remove special rights from someone in the channel (this does not ban them), run these two commands:

/cs flags #mediawiki-core TheirNicknameHere -*

The Operator group is defined as follows (see also ChanServ flags).

/cs template #mediawiki-core operator +ARVefiorstv

The #mediawiki-core-bots channel inherits rights from #mediawiki-core and does not have to be managed separately.

Activity feed

The Phabricator and Gerrit feed in #mediawiki-core-bots is configured via the Wikibugs bot. Specifically the channels.yaml and gerrit-channels.yaml files in the wikibugs2 Git repo.