run_3072de01c6cc500e

input

{
  "request": "Triage Jira ticket SREIN-1708: Delete Linux condprof artifacts from Taskcluster public artifact bucket",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1708"
  ],
  "sourceContext": {
    "issue": "SREIN-1708"
  }
}

summary

SREIN-1708 requests deletion of Linux condprof profile artifacts from the Taskcluster public artifact GCS bucket (project moz-fx-taskcluster-prod-4b87) because they were found to be leaking sensitive credentials. The ticket is currently in Backlog with no comments and no linked runbook/design doc was found. The description references an attachment listing the specific affected artifacts, but the attachment itself is not accessible via the Jira read tool used here.

findings

• Ticket describes a security-sensitive issue: Linux condprof profile artifacts stored in a public Taskcluster artifact bucket are leaking sensitive credentials, and need to be deleted.
• The GCP project hosting the bucket is identified as moz-fx-taskcluster-prod-4b87, which should guide who has access/permissions to perform the deletion.
• The ticket references an attachment listing the specific affected artifacts, but this attachment was not retrievable via the current tooling, so the exact scope (list of object paths/prefixes) cannot be independently verified from this triage pass.
• The description begins with 'Per: ' followed by no visible reference, suggesting a link or person/ticket citation may have been stripped or lost in the source content (possibly a Slack thread, security bug, or another Jira ticket). This should be clarified with the reporter.
• Ticket is in Backlog status with zero comments, indicating it has not yet been triaged/prioritized or assigned an owner despite the credential-leak security implication.
• No Confluence runbook or design doc link was included in the ticket content, so no supplemental page could be pulled for deletion procedure context.

proposed actions

Thanks for filing this — given this involves leaked credentials in a *public* artifact bucket, I'd like to flag this for expedited triage rather than leaving it in Backlog.

A few clarifying questions/next steps before we proceed with deletion:
1. Could you attach or re-link the source reference cut off after "Per:" in the description (e.g. security bug, Slack thread, or related ticket) so we have full context on how this was discovered and whether it's already tracked by security/secops?
2. Please confirm the attached artifact list is the authoritative/current scope, and share the GCS object prefix(es)/paths so we can validate against moz-fx-taskcluster-prod-4b87 before deleting.
3. Since credentials were exposed, has secret rotation already happened (or is it in progress) for any leaked credentials? Deleting the artifacts alone won't remediate credentials that may already have been harvested — we should confirm rotation status and, if not yet filed, open a companion security/secops ticket to track rotation.
4. We'll want to double check whether these condprof artifacts are produced by a recurring Taskcluster task/hook — if so we should also fix the task config (e.g. add an artifact expiration or scrub credentials at generation time) to prevent recurrence, not just delete the existing copies.

Once the artifact list/prefix is confirmed, we can script a bulk delete (gsutil -m rm or lifecycle rule) against the specified GCS objects in moz-fx-taskcluster-prod-4b87. Recommend bumping priority given the security exposure and moving this out of Backlog once the above is confirmed.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1708"
    },
    "result": {
      "key": "SREIN-1708",
      "summary": "Delete Linux condprof artifacts from Taskcluster public artifact bucket",
      "status": "Backlog",
      "description_text": "Per:       We need to delete all Linux condprof profile artifacts as they\u2019ve been leaking sensitive credentials.   Affected artifacts are listed in the attachment. GCP project is  moz-fx-taskcluster-prod-4b87",
      "comment_count": 0,
      "comments": []
    }
  }
]

log