Interest in establishing a "Build Helper" role

[AshCripps]

@nodejs/build As we all know we have a lot of burden in the build working group with never enough volunteers to shoulder it all.

I propose we look into creating a sort of "Build Helper" style role that can help expand our reach and help solve problems faster. I was thinking something along of the lines of offering a subset of the node/collaborators to be come "Build Helpers".

Initially, i'm thinking a "Build Helper" would have access to a subset of our test machines, allowing them to deal with simple problems (restarting the Jenkins agent, file permissions, clearing up workspace, etc.). By limiting the "Build Helper" role to a subset of node/collaborators, I think we can still ensure that everyone with access fulfils the trust requirement. The aim would be that the "Build Helper" role only allows permissions to solve the simple problems/perform certain actions on the machine.

I think this could maybe be achieved through jenkins jobs that only the "build helpers" can access to run like "force workspace clean" or similar (similar to the force windows updates jobs)

I'm opening this issue to just brainstorm what ideas other members have, I think possibly asking the collaborators what common problems they face, and whether they would be willing to fix it themselves if its a small issue.

[rvagg]

I think we've tried to achieve this in the past by being fairly liberal with handing out nodejs/build membership and therefore build_test access to folks, particularly collaborators. build_test has a lower bar for trust and is easier to add people to but gives them access to most of our test cluster machines to perform maintenance.
I'm fine with branding this as something special / different and making it its own thing to try and get more support. I'm a little pessimistic about actually getting more support and finding folks that have the skills, interest (and bravery) to take on even minor responsibilities. It might take a bit of work to drum up support and convince folks. But if you're offering to do that work then great!

[AshCripps]

Yeah thats why I want to pose it to the collaborators asking what problems they face using the CI and whether they would be willing to fix it themselves if given a simple route to the solution. An example I think would be useful would be for releasers being able to fix minor machines problems when run RC builds or the regular builds themselves - that would for sure save them some time if they could fix it themselves in 2 minutes rather then ping build and wait an unknown amount of time for someone to turn up and fix it.

[mhdawson]

I'm hoping that if we can scope/brand as something less than joining the build WG that will make it require less skill/bravery. Having the interest to join/do the general work of the Build WG I think is a much larger scope/more daunting than being a build helper. Key to success is limiting the scope to something that seems manageable. I think its worth trying as we've not had success in growing the Build WG members.

[sxa]

Might be useful to get some input from @mmarchini since based on #2357 (comment) she is likely in the category we're talking about here, so understanding those use cases would be ueful (it may just be "let me log in and stop processes/restart jenkins agents" - also worth considering if the build helper role would require root access - it may do if we anticipate helpers will need to reboot systems)

[targos]

I would be interested in such a role. I didn't apply for build WG membership because I don't want to add more responsibilities to the things I do in the Node.js org.

[AshCripps]

Have updated the disscussion here - https://github.com/nodejs/node/discussions/37915#discussioncomment-660574 would appreciate some input from people based on the feasibility of the solutions/any improvements they might have.

[AshCripps]

as part of this I think the best solution would be to revisit ansible tower/AWX #1390. I think it ticks a lot of the boxes with regards to access etc, and a lot of what we would like to do is already in our ansible playbooks so we should be able to easily extract them to a simple playbook for the build helper role. I also think the https problem from when this was last attempted should be resolved now with our wildcard cert? I assume as much as grafana.nodejs.org runs on https.

Im going to carve some time out to starting on this from late next week unless any has any objections?

[sxa]

I've set up an AWX server from scratch before :-)

[AshCripps]

@sxa great you can help me as part of your onboarding then :)