VersionControl:PRs/maybelle-config/296

maybelle-config#296: Jenkins: the reporter starts only branch-tests and deploy-hunter

State	🟣 merged 2026-11-09 10:51:08
Worked on by	magent, re, justin
Moods	#ramp
Deploy	redeploy maybelle (jcasc-reload.sh applies it and checks every job is there)
Branch	magent/reporter-scope → production, by magent-cryptograss
Opened · last pushed	2026-11-09 04:11:50 · 2026-11-09 04:11:42

re's point 4 from her review of #292: the reporter could start every job in Jenkins, and its password now also lives on githouse.

**Now it can start only two jobs:**
- **`branch-tests`,** which githouse triggers on every push.
- **`deploy-hunter`,** which the deploy scripts report to.

**How:** `globalMatrix` becomes `projectMatrix`, with the same global entries minus the reporter's global `Job/Build`. Each of those two jobs grants `Job/Build` to the reporter in its own `authorizationMatrix` property. Admin and anonymous are unchanged.

`deploy-pickipedia.sh` reports to `job/deploy-pickipedia-vps`, which doesn't exist any more, so that report was already failing. This change doesn't affect it.

**Previewed** in a Jenkins with maybelle's plugins, this config and these job files:

| request | answer |
|---|---|
| reporter starts `branch-tests` | 201 |
| reporter starts `deploy-hunter` | 201 |
| reporter starts `pickipedia-uptime` | 403 |
| admin starts `pickipedia-uptime` | 201 |
| anonymous reads a job | 200 |
| anonymous starts a job | 403 |

Deploy: redeploy maybelle (jcasc-reload.sh applies it and checks every job is there)
Worked on by: magent, re, justin, in #ramp