From d68a06aedf2919abea8c5728dfa64c2205dc9537 Mon Sep 17 00:00:00 2001
From: Jeremy Leconte <jleconte@google.com>
Date: Wed, 18 May 2022 21:26:53 +0200
Subject: [PATCH] Move pinpoint acl to the perf bucket.

The perf builders have been moved from the 'ci' to the 'perf' bucket.

Bug: b/233159334
Change-Id: Ic5de4489892599d3a9cf94696a4db8a708c1f0e3
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/262808
Commit-Queue: Jeremy Leconte <jleconte@google.com>
Reviewed-by: Christoffer Jansson <jansson@webrtc.org>
Reviewed-by: Mirko Bonadei <mbonadei@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#36928}
---
 infra/config/config.star        | 8 ++++----
 infra/config/cr-buildbucket.cfg | 8 ++++----
 infra/config/realms.cfg         | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/infra/config/config.star b/infra/config/config.star
index e8e753ff68..ab57d77444 100755
--- a/infra/config/config.star
+++ b/infra/config/config.star
@@ -259,10 +259,6 @@ luci.bucket(
         acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
             "project-webrtc-ci-schedulers",
         ]),
-        acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
-            # Allow Pinpoint to trigger builds for bisection
-            "service-account-chromeperf",
-        ]),
     ],
 )
 
@@ -272,6 +268,10 @@ luci.bucket(
         acl.entry(acl.BUILDBUCKET_TRIGGERER, users = [
             "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
         ]),
+        acl.entry(acl.BUILDBUCKET_TRIGGERER, groups = [
+            # Allow Pinpoint to trigger builds for bisection
+            "service-account-chromeperf",
+        ]),
     ],
 )
 
diff --git a/infra/config/cr-buildbucket.cfg b/infra/config/cr-buildbucket.cfg
index 68b8432b42..5b76c44601 100644
--- a/infra/config/cr-buildbucket.cfg
+++ b/infra/config/cr-buildbucket.cfg
@@ -13,10 +13,6 @@ buckets {
     role: SCHEDULER
     group: "project-webrtc-ci-schedulers"
   }
-  acls {
-    role: SCHEDULER
-    group: "service-account-chromeperf"
-  }
   swarming {
     builders {
       name: "Android32 (M Nexus5X)"
@@ -2152,6 +2148,10 @@ buckets {
     role: SCHEDULER
     identity: "user:webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
+  acls {
+    role: SCHEDULER
+    group: "service-account-chromeperf"
+  }
   swarming {
     builders {
       name: "Android32 Builder arm"
diff --git a/infra/config/realms.cfg b/infra/config/realms.cfg
index c88f5a147e..818c101b80 100644
--- a/infra/config/realms.cfg
+++ b/infra/config/realms.cfg
@@ -64,7 +64,6 @@ realms {
   bindings {
     role: "role/buildbucket.triggerer"
     principals: "group:project-webrtc-ci-schedulers"
-    principals: "group:service-account-chromeperf"
   }
   bindings {
     role: "role/resultdb.invocationCreator"
@@ -87,6 +86,7 @@ realms {
   }
   bindings {
     role: "role/buildbucket.triggerer"
+    principals: "group:service-account-chromeperf"
     principals: "user:webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
   bindings {