Scap/SpiderPig

What does a SpiderPig do?

SpiderPig is a web frontend to scap backport. Scap backport is used to deploy changes to MediaWiki code or configuration in production.

Access to SpiderPig

To access SpiderPig you need:

Deployment access – See How to deploy code – rights needed to deploy
Membership in the spiderpig-access LDAP group

`spiderpig-access` group membership

Navigate to https://idm.wikimedia.org/permissions/
In the "Request permissions" table, on the "spiderpig-access" row, click "Request this permission"

No further action is necessary. Your request will be sent to the release manager for approval. After initial approval, it will need to be approved again by a Bitu admin. Once all approvals are complete, you will receive an email indicating your access has been approved, and you will be a member of the spiderpig-access LDAP group.

Log in to SpiderPig

Visit https://spiderpig.wikimedia.org

Log in with your Wikimedia Developer account.

Next, the web UI will prompt you to run a command to retrieve a one-time password from the deployment host (2FA). Run the command and enter the one-time password it provides, then click "Login" to finish logging in.

For now, the scap spiderpig-otp command run on the deployment host provides a time-based, one-time password. In future, we hope to avoid requiring ssh access to the deployment host and 2FA will be provided by idp.wikimedia.org.

Overview page

After logging in you are presented with the SpiderPig overview page. This page shows the history of recent backport jobs as well as a way to start a new backport. Clicking on a row in the history will bring you to a page showing more details about the job, including information about the Gerrit commits that were backported, and the job execution log.

From any page you can click the SpiderPig logo to go back to the SpiderPig overview page.

Running a backport

Enter one or more change numbers into the “Enter change numbers” edit box at the top of the overview page. As you enter a change number, a Gerrit search is performed to locate the matching change, which will be displayed in a box below the edit box.

Click on this new box to complete the input of a change number.

Repeat this process for any additional changes that need to be deployed at the same time.

Click the “Start Backport” button to start the job (Note: this button will be disabled if there is already a backport in progress).

Each job will display its status in the "status" column. When you need to interact with a job (for example, to confirm your change is ready to backport), the job will prompt you, displaying buttons to allow you to respond. In most circumstances you can run a backport operation entirely from the overview page.

For more details on backport handling, see Scap#Backport Deployments.

Job detail page

The job detail page shows details about a job, including information about the Gerrit commits that were backported (with links), and the job execution log. Interaction prompts for running jobs will be displayed on this page too.

If the job is running, a button with three dots will be available next to the “Close” button in the top right of the page. The three dots button displays a menu offering the ability to interrupt (control-c) or kill the job (not recommended!).

By default the job log hides sensitive information, such as information about security patches. This is to lower the risk of exposing secret information when copying and pasting a job log into another system (for example Phabricator). If you need to see the secret information, click the “Show sensitive information” checkbox above the job log.

Sign out

Click on the person icon in the top right of any page and select “Sign Out” from the menu. Note that this will perform a full signout from the single-sign-on system.

Admin operations

Click on the person icon in the top right of any page and select “Admin operations” from the menu. This will take you to a page where you can perform administrative operations. Currently the only live operation is logging out all users. A manual way to achieve this is to delete /srv/mediawiki-staging/scap/spiderpig/session-epoch on the deployment server. This file is accessed on every HTTP request and will automatically be recreated if not found.