<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello Twisted maintainers,<div class=""><br class=""></div><div class="">I realized today that not not everyone is aware of this quirk in our build infrastructure, and since it's a required step, y'all should probably know about it.</div><div class=""><br class=""></div><div class="">Any PR that we merge should run not just on public CI (travis, appveyor, codecov) but also our own Buildbot infrastructure. Many of our supported platforms, particularly desktop Windows and OS X, do not have good support from multi-tenant CI vendors. This has always been true, but recently it became <i class="">mechanically</i> necessary because the OS X status from buildbot became a required status, which means that it appears in the "waiting" state even if no build has actually been started. No twisted PR will have a successful build unless some TM Labs member has done the following.</div><div class=""><br class=""></div><div class="">Since our buildbots do not have adequate security to run totally untrusted code, only project <i class="">members</i> may submit builds to them. The way a project member submits such a build is they cause a ref to exist in the official Twisted repo's namespace.</div><div class=""><br class=""></div><div class="">So, a necessary step in the code review process is to scan the diff to ensure that it's not malicious, and to then ensure that a branch exists in the <a href="https://github.com/twisted/twisted/" class="">https://github.com/twisted/twisted/</a> namespace pointing at the exact commit that you want buildbot builds to run tests for. (Don't worry: the buildbots are not fully secured, but neither do they contain particularly sensitive data. If you screw this check up, the main potentially bad consequence is to availability of the build fleet, not compromise of PyPI releases or anything like that. That said, if you screw up the security check in the <i class="">full</i> review and it lands on master, then some really bad stuff can happen...)</div><div class=""><br class=""></div><div class="">The way to express this intent to Git is something like:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class="">$ git fetch origin "refs/pull/${PR_NUMBER}/head"</div><div class="">$ git push origin FETCH_HEAD:"${TICKET_NUMBER}-branchname"</div></blockquote><div class=""><br class=""></div><div class="">I don't know of a way to do it through the github web UI but perhaps someone more knowledgeable could chime in.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""></div><div class="">-glyph</div><div class=""><br class=""></div></body></html>