Support exclusive CD mode, disallow CD releases if there are no maint…

…ainers (#3616)

Co-authored-by: Daniel Beck <[email protected]>

README.md

@@ -98,13 +98,25 @@ cd:
   enabled: true
 ```
 
+For this to work, there needs to be at least one developers listed.
+If the list of developers is empty or missing entirely (e.g., after the last maintainer steps down), no new releases can be published through JEP-229 CD.
+
 **IMPORTANT:**
 When using JEP-229 CD, [every committer to your repository](https://www.jenkins.io/doc/developer/publishing/source-code-hosting/) can create new releases by merging pull requests.
 As a result, the list of maintainer accounts maintained in your plugin's YAML file is no longer the single reference on who can publish new releases.
 Be sure to check [which users have commit access](https://www.jenkins.io/doc/developer/publishing/source-code-hosting/) to your repository and remove any that are unexpected before enabling CD, as well as any unexpected [deploy keys](https://docs.github.com/en/developers/overview/managing-deploy-keys).
 Additionally, the users listed in this repository still serve as the contacts for security issues and plugin/component governance questions.
+For that reason, CD permissions are also only granted to components with at least one maintainer.
 In particular, the Jenkins security team will _not_ make an effort to reach out to GitHub committers when maintainers (and security contacts, see below) are unresponsive before [announcing vulnerabilities without a fix](https://www.jenkins.io/security/plugins/#unresolved).
 
+It is also possible to enable JEP-229 CD exclusively, i.e., the listed users will not be able to create new releases, but remain contacts for security issues and plugin/component governance questions. 
+
+```yaml
+cd:
+  enabled: true
+  exclusive: true
+```
+
 
 Managing Security Process
 -------------------------

permissions/component-core-annotation-processors.yml

@@ -3,6 +3,8 @@ name: "core-annotation-processors"
 github: "jenkinsci/core-annotation-processors"
 cd:
   enabled: true
+  exclusive: true
 paths:
   - "org/jenkins-ci/core-annotation-processors"
-developers: []
+developers:
+  - "@core"

permissions/component-jellydoc-annotations.yml

@@ -6,3 +6,6 @@ paths:
   - "io/jenkins/tools/maven/jellydoc-annotations"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"

permissions/component-jellydoc-maven-plugin.yml

@@ -6,3 +6,6 @@ paths:
   - "io/jenkins/tools/maven/jellydoc-maven-plugin"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"

permissions/component-license-maven-plugin.yml

@@ -8,3 +8,6 @@ paths:
   - "io/jenkins/tools/maven/license-maven-plugin"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"

permissions/component-stapler-maven-plugin.yml

@@ -7,3 +7,6 @@ paths:
   - "io/jenkins/tools/maven/stapler-maven-plugin"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"

permissions/component-stapler.yml

@@ -3,6 +3,8 @@ name: "stapler"
 github: "jenkinsci/stapler"
 cd:
   enabled: true
+  exclusive: true
 paths:
   - "org/kohsuke/stapler/stapler*"
-developers: []
+developers:
+  - "@core"

permissions/component-taglib-xml-writer.yml

@@ -6,3 +6,6 @@ paths:
   - "io/jenkins/tools/maven/taglib-xml-writer"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"

permissions/plugin-any-buildstep.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/any-buildstep"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-anything-goes-formatter.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/anything-goes-formatter"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-backup-interrupt-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "jenkins/ci/plugins/backup/backup-interrupt-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-build-cause-run-condition.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/build-cause-run-condition"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-build-keeper-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/build-keeper-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-console-tail.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/console-tail"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-copy-project-link.yml

@@ -7,6 +7,5 @@ paths:
   - "hudson/plugins/copyProjectLink/copy-project-link"
   - "org/jenkins-ci/plugins/copy-project-link"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-create-fingerprint.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/create-fingerprint"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-downstream-buildview.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jvnet/hudson/plugins/downstream-buildview"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-downstream-ext.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/downstream-ext"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-envfile.yml

@@ -7,6 +7,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/envfile"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-fail-the-build-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/fail-the-build-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-favorite-view.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/favorite-view"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-groovy-remote.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkinsci/plugins/groovy-remote"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-hsts-filter-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/hsts-filter-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-jqs-monitoring.yml

@@ -7,6 +7,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/jqs-monitoring"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-kpp-management-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "sic/software/kpp-management-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-nant.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/nant"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-openid4java.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/openid4java"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-progress-bar-column-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/progress-bar-column-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-project-stats-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/project-stats-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-sbt.yml

@@ -7,6 +7,5 @@ paths:
   - "org/jenkins-ci/plugins/sbt"
   - "org/jvnet/hudson/plugins/sbt"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-scoring-load-balancer.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "jp/ikedam/jenkins/plugins/scoring-load-balancer"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-slave-status.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jvnet/hudson/plugins/slave-status"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-statusmonitor.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jvnet/hudson/plugins/statusmonitor"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-svn-revert-plugin.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/svn-revert-plugin"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-svncompat14.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jvnet/hudson/plugins/svncompat14"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-template-workflows.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins/plugin/templateWorkflows/template-workflows"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-text-finder-run-condition.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/text-finder-run-condition"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/plugin-windows-exe-runner.yml

@@ -6,6 +6,5 @@ issues:
 paths:
   - "org/jenkins-ci/plugins/windows-exe-runner"
 developers: []
-#CD blocked for lack of maintainers
-#cd:
-#  enabled: true
+cd:
+  enabled: true

permissions/pom-jellydoc.yml

@@ -6,3 +6,6 @@ paths:
   - "io/jenkins/tools/maven/jellydoc"
 cd:
   enabled: true
+  exclusive: true
+developers:
+  - "@core"