3rd Party support tooling (scripts) need to be transparent - move them here

[hwine]

tl;dr: move support scripts from the config repository (restricted) to this public repository.

History

Historically, several support scripts have been created, and stored alongside, the secrets used in production. This wasn't bad when there were multiple developers intimately involved with the details of those scripts. That time is past, and the autograph team now relies on SMEs from our customer base. To maintain separation of duties, the SMEs can't see the config repo, and the autograph team can't see the 3rd party portals. That's a good thing.

These scripts do not contain any sensitive information. Placing them alongside the configuration files was a convenient way to ensure they were available to autograph team when they were working on the configuration files (which is what most of them support).

Current Practice

The current autograph team are primarily concerned with configuration, not development. As such, we don't have Autograph specific development environments readily available. Since Autograph is in maintenance mode, it uses some now-out-of-date versions of languages and utilities. Common practice has shifted to using the public container image to provide a suitable environment for executing scripts and utilities (such as the java pepk.jar file required for creating new Android apps on the Play Store).

Proposed Change

The scripts under discussion are tiny, and (as mentioned above) do not contain any sensitive information. Transferring them into this repository is thus safe, and immediately enables review-by-SMEs.

That does add the friction of getting access to the most recent version of the relevant scripts when they are needed. I propose to include the scripts in the docker image. They would not be utilized by the production code, but would be available in the public docker image, and thus available to maintainers.

Initially Targeted Scripts

• Scripts to support Configurations need someway to be explorable #863 (underway with Sanitize Configs & export to csv #864)
• Scripts to general Android APK keys and package for play store #866

Summary of Advantages

Switching to this approach to managing support scripts provides the following advantages:

• SMEs can review and update support scripts for their service as the service changes. (e.g. android developers can adjust to new requirements from the Play Store.)
• Autograph maintainers will always run tooling in a known environment.
• Less of the Autograph system will be hidden away, furthering broader ownership of the tooling and processes.

[hwine]

Please comment on this concept -- I do not believe it introduces any risk, and would have shortened recent cycle time from weeks to days.

Comments wanted from various constituencies:

• Autograph maintainers: @mlarsonweber
• Play Store SMEs: @marcin-kozinski, @zmckenney
• Management: @mostlygeek

[marcin-kozinski]

Speaking from the Android side, I love the idea of being able to review the scripts. I agree it would've greatly helped on our recent "quest". In general I also like the idea of making the non-sensitive parts of Autograph more transparent.

I don't have the context to comment on how this impacts Autograph maintenance, but sounds like you thought this through and it's minimal, so sounds good to me.