Consider retiring the Tails Gitolite service

TPA would like to retire Gitolite, but that is blocked by:

• Having an alternative for git-annex (GitLab doesn't support it and LFS doesn't support partial checkouts)
• Having an alternative for Git hooks:
  • jenkins-jobs.git
  • tails.git
  • weblate-gatekeeper.git

Part of: #41721 (closed) / TPA-RFC-73.

marked this issue as related to #41721 (closed)

changed the description

Having an alternative for git-annex (GitLab doesn't support it and LFS doesn't support partial checkouts)

git-annex does support LFS though, would that be an option? i think we could back LFS objects by our S3 storage here as well (which is probably not done yet), so that would be a precondition.

otherwise i would argue for storing git-annex objects... elsewhere. it could be done on a regular web server (there's an rsync remote, for example) or, again, object storage directly.

Having an alternative for Git hooks: [...]

so expanding this, from what i can tell those do this:

1. sync files to jenkins and start test jobs (this could be done with GitLab's jenkins integration
2. ping jenkins to run "deploy"(?) jobs (presumably this could also be done with the integration)
3. check branch policies and notifiy jenkins of commits (could be done with a webhook and gitlab's native branch policies)
4. run policy checks for weblate, which would need to be checked for compatibility with native GitLab checks, but otherwise would need to be turned into server-side hooks

There are also other hooks in puppet but i suspect they are not used.

All in all, this seems to be totally feasible. I would recommend making an RFC to at least detail stakeholders and a timeline, and who this needs to be approved by.

added Git Gitlab RFC Roadmap::Future labels

assigned to @zen