allow github concourse contributor team to rerun builds

and check resources so they could retrigger failure build on PR pipeline and check pr resource in case wanted version is not available. Note: they could also rerun any builds and check any resources by this change. Signed-off-by: Rui Yang <[email protected]>
concourse · May 11, 2020 · 13d8872 · 13d8872
1 parent 0ac641f
commit 13d8872
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 0 deletions.
diff --git a/deployments/with-creds/ci/contributor-team-config.yml b/deployments/with-creds/ci/contributor-team-config.yml
@@ -0,0 +1,5 @@
+# fly -t ci set-team -n contributor --config contributor-team-config.yml
+roles:
+- name: pipeline-operator
+  github:
+    teams: ["concourse:contributors"]
diff --git a/deployments/with-creds/ci/values.yaml b/deployments/with-creds/ci/values.yaml
@@ -87,6 +87,27 @@ concourse:
             team: concourse:Pivotal
         github:
           enabled: true
+      # so pipeline-operator ended up with two permissions
+      # - RerunJobBuild
+      # - CheckResource
+      # which will be granted to concourse:contributors for
+      # operating PR pipeline
+      configRBAC: |
+        member:
+        - AbortBuild
+        - CreateJobBuild
+        - PauseJob
+        - UnpauseJob
+        - ClearTaskCache
+        - UnpinResource
+        - SetPinCommentOnResource
+        - CheckResourceWebHook
+        - CheckResourceType
+        - EnableResourceVersion
+        - DisableResourceVersion
+        - PinResourceVersion
+        - PausePipeline
+        - UnpausePipeline
       bindPort: 80
       clusterName: ci
       containerPlacementStrategy: limit-active-tasks