potentially move production cot_restricted_scopes etc to the scriptworker-scripts repo

[escapewindow]

This may include:

• zeroing out, or minimizing, the production CoT configs in scriptworker.cot.config.DEFAULT_CONFIG
  • e.g. cot_restricted_scopes, trusted_vcs_rules. valid_tasks_for, cot_restricted_trees, etc.
• adding a single config file in scriptworker-scripts with the production CoT configs (or a config file per cot_product).
  • this file should be baked into the appropriate docker images.
• download and use the production scriptworker-scripts production CoT config file during scriptworker production tests
  • we should also run these tests in scriptworker-scripts, on CoT config file change.

Details:

tom.prince:matrix: 10:36
@aki I was wondering if it would make sense to move cot_restricted_scopes to the -scripts repo, now that there is a single script repo (possibly also some of the other default config as well).

aki 10:37
@tom.prince moving it makes some sense overall. however, we do use those for testing production cot in the scriptworker repo.
10:37
we may want to move those tests if the production config is elsewhere
10:38
and then it's harder to see if you broke something when you refactor cot

aki 10:51
we solved for that in puppet by allowing for it to be set in both places, with eventual consistency (landing a puppet change for emergency changes, updating scriptworker with less urgency) and removing the puppet copy once they were in sync
10:52
could also download a config file from scriptworker-scripts during scriptworker tests

tom.prince:matrix: 12:26
Yeah, the later seems like a better solution.

[escapewindow]

We may have a chicken/egg problem if we need to change both the config file and the cot logic at the same time. Ideally we can deal with this by making the code deal gracefully with the original config, and/or specifying the url / revision of the config file in the scriptworker repo (or the url/revision of the scriptworker test to run in the scriptworker-scripts repo). Then we can point at our PR config, and adjust back once both are landed.