Better error message for request-ci failures during CI lockdowns?

[richardlau]

Now that nodejs/node-core-utils#655 and #45218 have fixed the error reporting from the auto-start-ci workflow we now get errors reported when someone tries to start a CI with the request-ci label during a CI lockdown (when access is restricted), e.g.

While technically correct (the github-bot does not have permissions to access Jenkins during the lockdown), the message is not indicative that it is expected to not be able to start CI runs unless you're involved with the security release. We've had a few questions about this during the recent lockdown (nodejs/build#3065, https://openjs-foundation.slack.com/archives/C019Y2T6STH/p1667594031302289) that it would be more informative if we can somehow indicate a lockdown is in progress in this case.

[aduh95]

Is there any way for the bot to check if there's a lockdown in progress? Alternatively, we could add to the process of locking CI down to also disable the GHA workflow, and re-enable it when the CI opens again.

[targos]

+1 on disabling the workflow when we know Jenkins isn't available.

[MoLow]

disabling the workflow would create a huge queue of PRS with request-ci Add this label to start a Jenkins CI on a PR. once the lockdown is open.

[aduh95]

We are talking about request-ci Add this label to start a Jenkins CI on a PR. , not commit-queue Add this label to land a pull request using GitHub Actions. . I don't see how disabling the workflow would have any effect on the size of the queue, we still want to run CIs on those PRs once the lockdown ends, right?

[MoLow]

my bad, I edited my comment.
what I meant is that there will be a lot of PRs with request-ci Add this label to start a Jenkins CI on a PR. label that will start running all at the same time.
the current situation is that there is some pressure on the CI when the lockdown ends but it is smaller pressure since pepole run ci manually in the current situation (and not all people are in the same timezone, some are ok with waiting etc).
so currently the fact that auto-start-ci removes the request-ci Add this label to start a Jenkins CI on a PR. label on lockdown does reduce the pressure

[aduh95]

I'm not sure if that would be an issue at all as I think Jenkins would simply queue the jobs without much problem, but if it was an issue we should probably lower the value of PRs handled by the automation:

node/.github/workflows/auto-start-ci.yml

Line 37 in b2a6083

--limit 100)