Change Details

PHI979 is a specific issue where we could use better instance controls (around worker count) in the short term. An alternative approach is to hard-coded `if ($instance === 'X') { ... }` for now. `admin` could also probably use more workers, I think we get saturated by backups occasionally. See PHI857, which wants support for serial queues in repository operations. See PHI989, which notes some consistency issues with certain datasource queries, particularly when some components are empty. SSH key handling (mostly in T13123) is fairly ripe. Related are these HackerOne reports, which are primarily just informative, but solid reports: - https://hackerone.com/reports/474897 - Weak SSH keys should be detected and rejected. - https://hackerone.com/reports/475126 - The SSH key "comment" field is exposed via the API, but it turns out that a whole lot of users put their entire personal diary into the "comment" field of their "public" keys. Phacility instances don't allow administrators to manage auth providers. This is good, but it also means that administrators can't manage MFA. We should either separate these permissions or maybe automatically create a TOTP MFA provider for now? PHI985 would like smarter block boundary detection (T11738) and "click to expand block". T13161 should generally get at least an initial pass. Change attributes (T784) could use a pass on at least the server side for PHI675, PHI1061, and the various other issues linked there. PHI1121 wants user/project import/sync. This can at least be planned more cohesively. PHI1118 hit an issue with "Audit Unreviewed Commits" not working as expected. PHI1141 would like viability on T8092. PHI1159 et al. would like Herald access to "This revision landed with ongoing or failed builds.", either to block commits or trigger audits. PHI1172 would like a revisit of "move project under another project", see T10350. PHI1166 requests we document all the project dependencies somewhere. --- // Done // PHI1125 is hitting some issues with JIRA integration on a modern version of JIRA. (Noted on T5422.) See <https://phabricator.wikimedia.org/T185213>. Two minor things: - Offsets (UTC+X vs UTC-X) might be inverted in the timezone dialog? - {nav Settings > Date and Time > Timezone} didn't pick up the `0:30` UI thing and still just shows UTC+X even for X:30 timezones. PHI1127 has an instance rename request. We can likely ship instance renames in the next release. PHI1105 would like a "View All" on dashboard tab panels. In some other cases (including recent cases in Build Plans), I'd like to look at putting a "More Results" element at the bottom of a query UI where a pager would otherwise go. Although including this kind of element isn't quite as pristine as omitting it, I think this is significantly more usable, and the distinction between "exactly 10 results" and "first 10 of 10+ results" is broadly not as clear as it could/should be in many interfaces. See <https://discourse.phabricator-community.org/t/image-uploads-for-forms-too-restricted-by-default/2594>. The remarkup instructions blocks in custom forms aren't being marked properly as remarkup transactions. PHI1175 would like a "JIRA Issue URIs" field in Herald. See <https://discourse.phabricator-community.org/t/call-to-undefined-method-getprofilemenu/> for a likely missed ProfileMenu callsite on the project background controller (?) `bin/search query --query <key>` isn't working right (and maybe never did). On Instances, the "name prefix" search is now somewhat obsolete given that instances can be renamed. It searches by instance internal name, but this may be unrelated to the display name. This ain't right: {F6366548} This ain't either: {F6366550}

PHI1125 is hitting some issues with JIRA integration on a modern version of JIRA. (Noted on T5422.) See <https://phabricator.wikimedia.org/T185213>. Two minor things: - Offsets (UTC+X vs UTC-X) might be inverted in the timezone dialog? - {nav Settings > Date and Time > Timezone} didn't pick up the `0:30` UI thing and still just shows UTC+X even for X:30 timezones. PHI1127 has an instance rename request. We can likely ship instance renames in the next release. PHI1105 would like a "View All" on dashboard tab panels. In some other cases (including recent cases in Build Plans), I'd like to look at putting a "More Results" element at the bottom of a query UI where a pager would otherwise go. Although including this kind of element isn't quite as pristine as omitting it, I think this is significantly more usable, and the distinction between "exactly 10 results" and "first 10 of 10+ results" is broadly not as clear as it could/should be in many interfaces. See <https://discourse.phabricator-community.org/t/image-uploads-for-forms-too-restricted-by-default/2594>. The remarkup instructions blocks in custom forms aren't being marked properly as remarkup transactions. PHI1175 would like a "JIRA Issue URIs" field in Herald. See <https://discourse.phabricator-community.org/t/call-to-undefined-method-getprofilemenu/> for a likely missed ProfileMenu callsite on the project background controller (?) `bin/search query --query <key>` isn't working right (and maybe never did). On Instances, the "name prefix" search is now somewhat obsolete given that instances can be renamed. It searches by instance internal name, but this may be unrelated to the display name. This ain't right: {F6366548} This ain't either: {F6366550} PHI1166 requests we document all the project dependencies somewhere. PHI1159 et al. would like Herald access to "This revision landed with ongoing or failed builds.", either to block commits or trigger audits.

PHI979 is a specific issue where we could use better instance controls (around worker count) in the short term. An alternative approach is to hard-coded `if ($instance === 'X') { ... }` for now. `admin` could also probably use more workers, I think we get saturated by backups occasionally. See PHI857, which wants support for serial queues in repository operations. See PHI989, which notes some consistency issues with certain datasource queries, particularly when some components are empty. SSH key handling (mostly in T13123) is fairly ripe. Related are these HackerOne reports, which are primarily just informative, but solid reports: - https://hackerone.com/reports/474897 - Weak SSH keys should be detected and rejected. - https://hackerone.com/reports/475126 - The SSH key "comment" field is exposed via the API, but it turns out that a whole lot of users put their entire personal diary into the "comment" field of their "public" keys. Phacility instances don't allow administrators to manage auth providers. This is good, but it also means that administrators can't manage MFA. We should either separate these permissions or maybe automatically create a TOTP MFA provider for now? PHI985 would like smarter block boundary detection (T11738) and "click to expand block". T13161 should generally get at least an initial pass. Change attributes (T784) could use a pass on at least the server side for PHI675, PHI1061, and the various other issues linked there. PHI1121 wants user/project import/sync. This can at least be planned more cohesively. PHI1118 hit an issue with "Audit Unreviewed Commits" not working as expected. PHI1141 would like viability on T8092. PHI1159 et al. would like Herald access to "This revision landed with ongoing or failed builds.", either to block commits or trigger audits. PHI1172 would like a revisit of "move project under another project", see T10350. PHI1166 requests we document all the project dependencies somewhere. --- // Done // PHI1125 is hitting some issues with JIRA integration on a modern version of JIRA. (Noted on T5422.) See <https://phabricator.wikimedia.org/T185213>. Two minor things: - Offsets (UTC+X vs UTC-X) might be inverted in the timezone dialog? - {nav Settings > Date and Time > Timezone} didn't pick up the `0:30` UI thing and still just shows UTC+X even for X:30 timezones. PHI1127 has an instance rename request. We can likely ship instance renames in the next release. PHI1105 would like a "View All" on dashboard tab panels. In some other cases (including recent cases in Build Plans), I'd like to look at putting a "More Results" element at the bottom of a query UI where a pager would otherwise go. Although including this kind of element isn't quite as pristine as omitting it, I think this is significantly more usable, and the distinction between "exactly 10 results" and "first 10 of 10+ results" is broadly not as clear as it could/should be in many interfaces. See <https://discourse.phabricator-community.org/t/image-uploads-for-forms-too-restricted-by-default/2594>. The remarkup instructions blocks in custom forms aren't being marked properly as remarkup transactions. PHI1175 would like a "JIRA Issue URIs" field in Herald. See <https://discourse.phabricator-community.org/t/call-to-undefined-method-getprofilemenu/> for a likely missed ProfileMenu callsite on the project background controller (?) `bin/search query --query <key>` isn't working right (and maybe never did). On Instances, the "name prefix" search is now somewhat obsolete given that instances can be renamed. It searches by instance internal name, but this may be unrelated to the display name. This ain't right: {F6366548} This ain't either: {F6366550} PHI1166 requests we document all the project dependencies somewhere. PHI1159 et al. would like Herald access to "This revision landed with ongoing or failed builds.", either to block commits or trigger audits.