Gerrit 3.7.x Submit Requirements

[Pranab Panda]

Hi

Migrated to 3.7.1 from 2.14  and find something odd

Change Owner is able to merge own change by giving a CR+2 !

Had to add the submit-requirement  check  as explained in Documentation to plug this hole.

[submit-requirement "Code-Review"]

description = A maximum vote from a non-uploader is required for the \

              'Code-Review' label. A minimum vote is blocking.

submittableIf = label:Code-Review=MAX,user=non_uploader AND -label:Code-Review=MIN

canOverrideInChildProjects = true

However it seems odd to see that change Owner is able to do a CR+2 for his/her own change

In 2.14 we only had label definition and change owner is not allowed to CR+2 own change.

Is there a way to disallow change owner doing CR+2 on own change?

Please let me know

thanks

Pranab

[Ben Rohlfs]

Typically the owner is also the uploader, so `user=non_uploader` in the above rule should take care of that. Did you give it a try?

-Ben

Please let me know

thanks

Pranab

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/7f3bee93-ea07-44ed-b28d-fdd2dcd1c255n%40googlegroups.com.

[Edwin Kempin]

On Tue, Mar 28, 2023 at 10:38 AM 'Ben Rohlfs' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:

On Tue, 28 Mar 2023 at 08:21, Pranab Panda <pra...@pacbell.net> wrote:

Hi

Migrated to 3.7.1 from 2.14  and find something odd

Change Owner is able to merge own change by giving a CR+2 !

Had to add the submit-requirement  check  as explained in Documentation to plug this hole.

[submit-requirement "Code-Review"]

description = A maximum vote from a non-uploader is required for the \

              'Code-Review' label. A minimum vote is blocking.

submittableIf = label:Code-Review=MAX,user=non_uploader AND -label:Code-Review=MIN

canOverrideInChildProjects = true

However it seems odd to see that change Owner is able to do a CR+2 for his/her own change

In 2.14 we only had label definition and change owner is not allowed to CR+2 own change.

Is there a way to disallow change owner doing CR+2 on own change?

Typically the owner is also the uploader, so `user=non_uploader` in the above rule should take care of that. Did you give it a try?

Submit requirements only control when a change is submittable, e.g. which votes are required and which votes are ignored.

They don't influence which votes the user can apply on the change, so `user=non_uploader` only means that a non-uploader vote is required for submission, but it doesn't prevent the uploader from voting on the own change. Whether voting is possible solely depends on the permissions. 

If you want to disallow change owners to vote with CR+2 on their own changes you may try to block the CR-label permission for the magic Change Owner group [1]. It may be necessary to block this permission on a parent project [2].

HTH

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#change_owner

[2] https://gerrit-review.git.corp.google.com/c/gerrit/+/112078

 

-Ben

Please let me know

thanks

Pranab

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/7f3bee93-ea07-44ed-b28d-fdd2dcd1c255n%40googlegroups.com.

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/CAEWS%2BaNU71d-a5eRamvNfgc8YOYRkB8eYn%3DyVc_0j5--F-pXsw%40mail.gmail.com.

[Pranab Panda]

On Tuesday, March 28, 2023 at 1:59:55 AM UTC-7 Edwin Kempin wrote:

On Tue, Mar 28, 2023 at 10:38 AM 'Ben Rohlfs' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:

On Tue, 28 Mar 2023 at 08:21, Pranab Panda <pra...@pacbell.net> wrote:

Hi

Migrated to 3.7.1 from 2.14  and find something odd

Change Owner is able to merge own change by giving a CR+2 !

Had to add the submit-requirement  check  as explained in Documentation to plug this hole.

[submit-requirement "Code-Review"]

description = A maximum vote from a non-uploader is required for the \

              'Code-Review' label. A minimum vote is blocking.

submittableIf = label:Code-Review=MAX,user=non_uploader AND -label:Code-Review=MIN

canOverrideInChildProjects = true

However it seems odd to see that change Owner is able to do a CR+2 for his/her own change

In 2.14 we only had label definition and change owner is not allowed to CR+2 own change.

Is there a way to disallow change owner doing CR+2 on own change?

Typically the owner is also the uploader, so `user=non_uploader` in the above rule should take care of that. Did you give it a try?

Submit requirements only control when a change is submittable, e.g. which votes are required and which votes are ignored.

They don't influence which votes the user can apply on the change, so `user=non_uploader` only means that a non-uploader vote is required for submission, but it doesn't prevent the uploader from voting on the own change. Whether voting is possible solely depends on the permissions. 

If you want to disallow change owners to vote with CR+2 on their own changes you may try to block the CR-label permission for the magic Change Owner group [1]. It may be necessary to block this permission on a parent project [2].

HTH

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#change_owner

[2] https://gerrit-review.git.corp.google.com/c/gerrit/+/112078

 

-Ben

Thanks Ben and Edwin for you prompt response.

Yes I have added user=non_uploader to block the self merge.

We have elevated Change Owner to support an internal cherry-pick tool,

will need to revisit that or users needs to get used to this new behavior

Regards

Pranab

[Pranab Panda]

On Tuesday, March 28, 2023 at 1:59:55 AM UTC-7 Edwin Kempin wrote:

On Tue, Mar 28, 2023 at 10:38 AM 'Ben Rohlfs' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:

On Tue, 28 Mar 2023 at 08:21, Pranab Panda <pra...@pacbell.net> wrote:

Hi

Migrated to 3.7.1 from 2.14  and find something odd

Change Owner is able to merge own change by giving a CR+2 !

Had to add the submit-requirement  check  as explained in Documentation to plug this hole.

[submit-requirement "Code-Review"]

description = A maximum vote from a non-uploader is required for the \

              'Code-Review' label. A minimum vote is blocking.

submittableIf = label:Code-Review=MAX,user=non_uploader AND -label:Code-Review=MIN

canOverrideInChildProjects = true

However it seems odd to see that change Owner is able to do a CR+2 for his/her own change

In 2.14 we only had label definition and change owner is not allowed to CR+2 own change.

Is there a way to disallow change owner doing CR+2 on own change?

Typically the owner is also the uploader, so `user=non_uploader` in the above rule should take care of that. Did you give it a try?

Submit requirements only control when a change is submittable, e.g. which votes are required and which votes are ignored.

They don't influence which votes the user can apply on the change, so `user=non_uploader` only means that a non-uploader vote is required for submission, but it doesn't prevent the uploader from voting on the own change. Whether voting is possible solely depends on the permissions. 

If you want to disallow change owners to vote with CR+2 on their own changes you may try to block the CR-label permission for the magic Change Owner group [1]. It may be necessary to block this permission on a parent project [2].

HTH

[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#change_owner

[2] https://gerrit-review.git.corp.google.com/c/gerrit/+/112078

 

-Ben

thanks Ben and Edwin 

I added

but it doesn't seem like it made any difference

change owner can stil do CR+2

Anything else I need to do?

Also it seem Odd to have Two Code Review lines as seen in the attached picture

I feel this is where the old version was neater

And also labels are Not is Sorted order

So while in 2.14 we could easily see

Code-Review label Above say 

SmokeTest labels

in 3..x

The Submit requirement labels are not immm Sorted order

SmokeTest label can be at the top and Code-Review label at the bottom!

Is there any way to get the labels displayed in Sorted alphabetical order?

[Pranab Panda]

Meant to say I added 

label-Code-Review = deny group Change Owner

but it didn't help.

[Edwin Kempin]

I would try this with block instead of deny.

 

To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/d10beb89-3150-40ff-b21e-26cdf37e1eban%40googlegroups.com.

[Pranab Panda]

Thanks Edwin

will this a try

What about the Display of Labels in Sorted Order?

is there a way to to do this?

Please let me know

thanks

Pranab 

 

Please let me know

thanks

Pranab

[Pranab Panda]

The Submit requirement labels are not in Sorted order

SmokeTest label can be at the top and Code-Review label at the bottom!

Is there any way to get the labels displayed in Sorted alphabetical order?

Please let me know

thanks

Pranab

 

Meant to say I added 

label-Code-Review = deny group Change Owner

but it didn't help.

I would try this with block instead of deny.

I tried with Block but it is not helping

anything else I can do?

Please let me know

thanks

Pranab

 

 

Please let me know

thanks

Pranab