I made this public since I've disclosed/discussed this elsewhere, including an indirect reference in the Spaces documentation, and I'm going to schedule it alongside some other stuff.

That one seemed straightforward.

Doing admin001 now.

Kicking secure001 now.

(It not being covered is covered by T12879.)

I think the only thing on secure or admin which isn't properly covered by deploy automation is the crontab on secure001:

I'm going to do admin001 and secure001 today.

@bgamari Did you ever find a solution?

I landed D19586 (the thing which breaks T13186) and pushed it here. This generally causes us to perform more policy checks, and may cause new policy exceptions which did not exist before (because the workflows relied implicitly on weak policy enforcement). If these crop up, the remedy is generally to explicitly weaken the required capability for the action.

I punted the rest of this to T13189.

The actual evidence about webhooks is a little spotty and it's possible that they "work" and are just undocumented and not officially supported. It's possible that CircleCI just needs a nudge to actually document/support them.

See T13188 for CircleCI 2.0. Upshot: they removed webhooks so we can no longer interact with them.

We actually just ran into a situation where this would be extremely useful. We're adding a rudimentary start/end time tracing listener so we can keep tabs on our service calls. That listener uploads the data to an endpoint using an HTTPSFuture, but we want to configure it to not show up in the default echoListener (or to not be profiled at all).

Pushing the requireCapabilities() change out one more week since I had some stuff crop up early this week and it didn't get a chance to soak.

• your business faces regulatory/compliance issues which are satisfied by encrypting the connection, even if it provides no direct security benefit.

unless you believe this is just a different manifestation of the same underlying bug.

In T13187#240394, @epriestley wrote:

See PHI757. Leaving inline comments on the right hand side of files not touched by diff B in an interdiff between A and B raises an error.

This is at least somewhat involved. Related behavior:

• In the standalone view, you can leave comments on either side -- and they swap sides!
• Deleting comments from either side raises a JS error ("TypeError: null is not an object (evaluating 'templates.r')"). (Actually, this looks like it applies to all standalone deletion?)

We haven't seen any PHP7 issues in ~6 months and the last few have been very minor things with edge cases like error handling behavior, so I think we can safely call this resolved.

Even with OAuth, you still can't make AJAX requests to Conduit from client-side JavaScript, right? Is the idea that the backend code uses OAuth to talk to Conduit on a user's behalf?

Think I got through the easy ones without any issues. I suspect admin and secure may be a little more involved so I'm going to leave the cat in the bag for the moment.

I'm going to stop/start at least some of these now.

See PHI757. Leaving inline comments on the right hand side of files not touched by diff B in an interdiff between A and B raises an error.

I'm going to push this out to next week since D19586 probably has a few minor issues with it and it's close to the release cut. It adds a lot of new policy checks which weren't explicit before, so I'd guess it may cause a few improper policy errors on things which are actually allowed. I caught a bunch of them (like "Mute Thread") but probably didn't get every single one.

These are actually removed in 2018 Week 33. See T13186 for a small amount of followup and discussion, although there isn't too much new information beyond what's here.

Oh, right, "meetings". I've heard of those!

In T13062#235217, @epriestley wrote:

This is also showing up in initial email, which is silly and pointless.