Loosen jenkins-bot approval requirements

[DemianX0]

I was trying to create a demo for https://gerrit.wikimedia.org/r/c/mediawiki/skins/Vector/+/592325

The previous patch in chain fails the build, I can't do anything about that.

Demo creation failed because of this:

Querying patch metadata...
https://gerrit.wikimedia.org/r/changes/?q=change:592325&o=LABELS&o=CURRENT_REVISION
https://gerrit.wikimedia.org/r/changes/mediawiki%2Fskins%2FVector~master~I182eedeff0b6eb62250f2682b89f30c8ff0f70de/revisions/ae3b99d9a3c4a1708936eda50ef883e4eb3c3c60/related
https://gerrit.wikimedia.org/r/changes/592325/revisions/5/commit
https://gerrit.wikimedia.org/r/changes/584694/revisions/25/commit
https://gerrit.wikimedia.org/r/changes/?q=change:I8e153c0ab927f9d880a68fb9efb0bf37b91d26b2&o=LABELS&o=CURRENT_REVISION
Patch must be approved (Verified+2) by jenkins-bot

I'm solving this by squashing the two patches, however that's not optimal as now the patch is not useful to present the changes I've applied.

Optional: Futhermore, it would be helpful to have an option to create a demo with an unapproved patch. jenkinsbot does certain strict tests that are necessary to pass for live code, but not for demonstration code. Sometimes it's not worth the time it takes to investigate and fix every issue jenkins reports.

[edg2s]

This feature already exists but is disabled on the wmflabs install for security. Personally I don't think it adds much security as you can still maliciously or accidentally deploy an insecure or dangerous environment.

[DemianX0]

This feature already exists but is disabled on the wmflabs install for security.

I assume you mean completely disabling the jenkins requirement?
It would be great to have the first part as a starter: only requiring jenkins approval for the patch applied, not its ancestors (imo that's more like a fix than a feature) and I have a feeling #52 (comment) would accomplish this too.

[MatmaRex]

The purpose of this requirement was to ensure that only patches by whitelisted users could be tested (https://www.mediawiki.org/wiki/Continuous_integration/Whitelist), and thus make it harder for malicious users to take down the service. But it indeed comes with some annoying side effects. There are probably better ways to do it, but we should still have some kind of user whitelist.

[edg2s]

We could fetch the whitelist ourselves and check it against the committer: https://github.com/wikimedia/integration-config/blob/master/zuul/layout.yaml

[MatmaRex]

YAML 🤢