Better error message for request-ci failures during CI lockdowns?

[richardlau]

Now that nodejs/node-core-utils#655 and #45218 have fixed the error reporting from the auto-start-ci workflow we now get errors reported when someone tries to start a CI with the request-ci label during a CI lockdown (when access is restricted), e.g.

While technically correct (the github-bot does not have permissions to access Jenkins during the lockdown), the message is not indicative that it is expected to not be able to start CI runs unless you're involved with the security release. We've had a few questions about this during the recent lockdown (nodejs/build#3065, https://openjs-foundation.slack.com/archives/C019Y2T6STH/p1667594031302289) that it would be more informative if we can somehow indicate a lockdown is in progress in this case.

[aduh95]

Is there any way for the bot to check if there's a lockdown in progress? Alternatively, we could add to the process of locking CI down to also disable the GHA workflow, and re-enable it when the CI opens again.

[targos]

+1 on disabling the workflow when we know Jenkins isn't available.

[MoLow]

disabling the workflow would create a huge queue of PRS with request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. once the lockdown is open.

[aduh95]

We are talking about request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. , not commit-queue PRs queued for automated landing through the Commit Queue. . I don't see how disabling the workflow would have any effect on the size of the queue, we still want to run CIs on those PRs once the lockdown ends, right?

[MoLow]

my bad, I edited my comment.
what I meant is that there will be a lot of PRs with request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label that will start running all at the same time.
the current situation is that there is some pressure on the CI when the lockdown ends but it is smaller pressure since pepole run ci manually in the current situation (and not all people are in the same timezone, some are ok with waiting etc).
so currently the fact that auto-start-ci removes the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label on lockdown does reduce the pressure

[aduh95]

I'm not sure if that would be an issue at all as I think Jenkins would simply queue the jobs without much problem, but if it was an issue we should probably lower the value of PRs handled by the automation:

node/.github/workflows/auto-start-ci.yml

Line 37 in b2a6083

--limit 100)

[github-actions]

This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

[github-actions]

This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 120 days).
If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.