infra: Add buildbucket.creator binding to shadow buckets

Follow-up to
https://boringssl-review.googlesource.com/c/boringssl/+/98167.

Trying to run a led job fails with:
"user:bpastene@google.com" does not have permission "buildbucket.builds.create" in bucket "boringssl/ci.shadow"

So this adds that missing binding.

Bug: None
Change-Id: Ia082a3f6efff21f4abcc33ca1707ed38a8eebbee
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98207
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: Ben Pastene <bpastene@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit is contained in:
Ben Pastene
2026-06-29 23:01:23 +00:00
committed by boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
parent 20351f2661
commit deb0d558b2
2 changed files with 24 additions and 0 deletions
+8
View File
@@ -48,6 +48,10 @@ realms {
}
realms {
name: "ci.shadow"
bindings {
role: "role/buildbucket.creator"
principals: "group:project-boringssl-tryjob-access"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "group:project-boringssl-tryjob-access"
@@ -76,4 +80,8 @@ realms {
role: "role/buildbucket.builderServiceAccount"
principals: "user:boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.creator"
principals: "group:project-boringssl-tryjob-access"
}
}
+16
View File
@@ -75,6 +75,14 @@ luci.bucket(
],
),
],
bindings = [
luci.binding(
roles = "role/buildbucket.creator",
groups = [
"project-boringssl-tryjob-access",
],
),
],
)
luci.bucket(
@@ -104,6 +112,14 @@ luci.bucket(
"boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com",
],
),
bindings = [
luci.binding(
roles = "role/buildbucket.creator",
groups = [
"project-boringssl-tryjob-access",
],
),
],
)
luci.milo(