)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"1e54cd1ef35b0f01949f532c456e1ab644558b15","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Add test_srbac.py with three test classes that verify persona-based"},{"line_number":10,"context_line":"RBAC enforcement when enforce_scope.cyborg is True:"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"TestSRBACServiceRole:"},{"line_number":13,"context_line":"  - Service role can create and delete ARQs (project_member_or_service)"},{"line_number":14,"context_line":"  - Service role is denied ARQ list (no reader implication)"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"TestSRBACAdminImpliedRoles:"},{"line_number":17,"context_line":"  - Admin can read/write ARQs via implied roles"},{"line_number":18,"context_line":"    (admin -\u003e manager -\u003e member -\u003e reader)"},{"line_number":19,"context_line":"  - Admin can list devices and deployables via implied manager"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"TestSRBACNegativeAccess:"},{"line_number":22,"context_line":"  - Reader cannot create/delete ARQs (needs member or service)"},{"line_number":23,"context_line":"  - Reader cannot list devices/deployables (needs manager)"},{"line_number":24,"context_line":"  - Member cannot list devices/deployables (needs manager)"},{"line_number":25,"context_line":"  - Member/reader cannot create device profiles (needs admin)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"All tests are skipped when CONF.enforce_scope.cyborg is False so"},{"line_number":28,"context_line":"they do not affect existing CI jobs."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"ab248dc5_0bb7b752","line":26,"range":{"start_line":12,"start_character":0,"end_line":26,"end_character":1},"updated":"2026-06-29 10:14:05.000000000","message":"Results verified based for each cases:\n\n\nTempest results from cyborg-tempest-srbac https://review.opendev.org/c/openstack/cyborg/+/992332 \nhttps://5126e99bb555fcd10074-f8d3aa66ce3962c6e3c5c35044bdfdd4.ssl.cf1.rackcdn.com/openstack/21ccea317c924406b12ce9ab3cc22cc5/job-output.txt\n\narq tests:\n```\n  SRBAC tests proving new arq policies work:\n  - test_service_create_and_delete_arq — ok (service satisfies project_member_or_service)\n  - test_service_cannot_list_arqs — ok (service lacks reader role)\n  - test_admin_can_read_arqs — ok (admin via implied reader) \n  - test_admin_can_write_arqs — ok (admin via implied member)\n  - test_reader_can_list_arqs — ok (reader satisfies project_reader_or_admin)\n  - test_reader_cannot_create_arq — ok (reader lacks member)\n  - test_reader_cannot_delete_arq — ok (reader lacks member)\n```\nDevice policies test:\n\n```\n  SRBAC tests for device policies:\n  - test_admin_can_read_devices — ok (admin via implied manager)\n  - test_reader_cannot_list_devices — ok (reader lacks manager)\n  - test_member_cannot_list_devices — ok (member lacks manager)\n\n```\n\nDeployables tests:\n\n```\n  SRBAC tests for deployables:\n  - test_admin_can_read_deployables — ok (admin via implied manager)\n  - test_reader_cannot_list_deployables — ok (reader lacks manager)\n  - test_member_cannot_list_deployables — ok (member lacks manager)\n\n```\nAttributes tests:\n```\n  SRBAC tests for attribites:\n  - test_admin_can_list_attributes — ok (admin via implied manager)\n  - test_reader_cannot_list_attributes — ok (reader lacks manager)\n  - test_member_cannot_list_attributes — ok (member lacks manager)\n```\n\nDevice profile tests.\n```\n  SRBAC tests for device profile:\n  - test_reader_can_list_device_profiles — ok (reader satisfies project_reader_or_admin)\n  - test_member_cannot_create_device_profile — ok (member lacks admin)\n  - test_reader_cannot_create_device_profile — ok (reader lacks admin)\n  - test_member_cannot_delete_device_profile — ok (member lacks admin)\n  - test_reader_cannot_delete_device_profile — ok (reader lacks admin)\n```","commit_id":"251e09854dc6065a032d9145872ed6cb4901df6f"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"1e54cd1ef35b0f01949f532c456e1ab644558b15","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"e32a7272_2b9023bb","updated":"2026-06-29 10:14:05.000000000","message":"+1 for covering all cases, helpful while reviewing the existing implementation in this series on cyborg side.","commit_id":"251e09854dc6065a032d9145872ed6cb4901df6f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"e28fff7eb5ac926688ff10118e5d7c9096de35a8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"15023ba1_bde9a699","updated":"2026-06-22 23:46:49.000000000","message":"teim-ci: auto","commit_id":"251e09854dc6065a032d9145872ed6cb4901df6f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"90132616acaee1530609d0464da41de8cf8c2a58","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c75adfb7_2ad42570","updated":"2026-06-22 08:36:30.000000000","message":"teim-ci: auto","commit_id":"251e09854dc6065a032d9145872ed6cb4901df6f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"83827cdb4ac26bd642e87655cad87427e4387a91","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3b55c797_6ca22c35","updated":"2026-07-06 20:54:21.000000000","message":"just rebased","commit_id":"54cf7e93ab9de47c143a0c27640cbb2e47f0d61f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"f36f92902b14fcc35b2d3d577a1d641321bc7399","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"0c4f7aa2_a2993380","updated":"2026-07-21 13:15:29.000000000","message":"recheck parent","commit_id":"b470452ab44cc7021b192b88caa2f436c69358bf"}],"cyborg_tempest_plugin/tests/api/test_srbac.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4ae33763937247e9eb840baa6cfe6e585b8d55d1","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    def test_service_create_and_delete_arq(self):"},{"line_number":79,"context_line":"        \"\"\"Service role satisfies project_member_or_service on ARQ writes.\"\"\""},{"line_number":80,"context_line":"        body \u003d _arq_body(self._dp_name)"},{"line_number":81,"context_line":"        resp \u003d self.cyborg_service_client.create_accelerator_request(body)"},{"line_number":82,"context_line":"        arq_uuid \u003d resp[\u0027arqs\u0027][0][\u0027uuid\u0027]"},{"line_number":83,"context_line":"        self.cyborg_service_client.delete_accelerator_request(arq_uuid)"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"8ed78ef7_f25bda0d","line":81,"updated":"2026-07-06 21:41:47.000000000","message":"The test creates an ARQ (line 81) and deletes it inline (line 83) without registering cleanup via self.addCleanup. If the delete call fails or raises, the ARQ is leaked with no cleanup fallback. This is inconsistent with the pattern in test_admin_can_write_arqs (same file, lines 137-140) which us...\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A leaked ARQ from a failed test run could cause subsequent list-based assertions in other tests to see unexpected ARQs, leading to flaky test failures.\n\n**Recommendation**:\nRegister cleanup immediately after creation: self.addCleanup(self.cyborg_service_client.delete_accelerator_request, arq_uuid) and remove the inline delete, or use a safe-delete wrapper that ignores errors if the ARQ was already deleted.","commit_id":"54cf7e93ab9de47c143a0c27640cbb2e47f0d61f"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"6af7424f6b01903c26acc51b2c86a10510a52525","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        resp \u003d self.cyborg_admin_client.list_deployables()"},{"line_number":152,"context_line":"        self.assertIn(\u0027deployables\u0027, resp)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"    @decorators.idempotent_id(\u0027a1b2c3d4-e5f6-7890-abcd-ef1234567890\u0027)"},{"line_number":155,"context_line":"    def test_admin_can_list_attributes(self):"},{"line_number":156,"context_line":"        \"\"\"Admin passes project_manager_or_admin via implied manager.\"\"\""},{"line_number":157,"context_line":"        resp \u003d self.cyborg_admin_client.list_attributes()"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a03b586_2423d29e","line":154,"updated":"2026-07-20 17:16:28.000000000","message":"Eight of the 21 @decorators.idempotent_id values are clearly sequential or synthetic placeholder UUIDs (e.g., a1b2c3d4-e5f6-7890-abcd-ef1234567890, b2c3d4e5-f6a7-8901-bcde-f12345678901) rather than randomly generated UUID4 values. Tempest uses idempotent_id to uniquely track individual test resul...\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: Tempest test tracking systems rely on unique, stable idempotent IDs to correlate test results across runs and infrastructures. Sequential placeholder UUIDs may collide with other tests and make test result tracking unreliable.\n\n**Suggestion**:\nGenerate real UUID4 values for all eight placeholder IDs using `uuidgen` or `python -c \"import uuid; print(uuid.uuid4())\"` and replace the synthetic IDs.","commit_id":"6d3221083ae3e3747eb24c50a71c5c62d33e6824"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"6af7424f6b01903c26acc51b2c86a10510a52525","unresolved":false,"context_lines":[{"line_number":157,"context_line":"        resp \u003d self.cyborg_admin_client.list_attributes()"},{"line_number":158,"context_line":"        self.assertIn(\u0027attributes\u0027, resp)"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"    @decorators.idempotent_id(\u0027b2c3d4e5-f6a7-8901-bcde-f12345678901\u0027)"},{"line_number":161,"context_line":"    def test_reader_can_list_device_profiles(self):"},{"line_number":162,"context_line":"        \"\"\"Reader satisfies project_reader_or_admin on device profiles.\"\"\""},{"line_number":163,"context_line":"        resp \u003d ("}],"source_content_type":"text/x-python","patch_set":6,"id":"2aa578db_2890c0b5","line":160,"updated":"2026-07-20 17:16:28.000000000","message":"test_reader_can_list_device_profiles and test_reader_can_list_arqs are defined inside TestSRBACAdminImpliedRoles, whose class docstring states it covers \u0027Admin access to project-scoped resources via implied roles.\u0027 These two tests verify reader persona access, not admin implied-role access, creat...\n\n**Severity**: SUGGESTION | **Confidence**: 0.9\n\n**Benefit**: Future maintainers searching for reader-access tests will not find them in the admin class, and the class docstring becomes misleading. This increases maintenance effort when adding or modifying reader-access coverage.\n\n**Recommendation**:\nMove test_reader_can_list_device_profiles and test_reader_can_list_arqs to a dedicated reader-access test class (or to TestSRBACNegativeAccess if appropriate), or broaden the TestSRBACAdminImpliedRoles docstring and class name to reflect mixed persona coverage.","commit_id":"6d3221083ae3e3747eb24c50a71c5c62d33e6824"}]}