Add a Prow command to create branches

[zacharysarah]

What to add

Consider adding a Prow command to create new branches.

Why it matters

SIG Docs handles localizations for Kubernetes docs.

When SIG Docs adds a new localization, we add the team's leaders to a repo team with write permissions so that leaders can create long-running branches for team collaboration.

As the number of localizations increases, the number of people with write access to k/website also increases. This poses a security risk that worsens at scale. We've already seen two incidents in the past two months of contributors using write permissions to bypass Prow:

• Isolate permissions for user markthink org#1293
• Remove SIG Docs approver permissions org#1468

We need to minimize the number of people with write permissions to k/website while preserving the ability of localization teams to work on collaborative branches.

Thanks in advance for your consideration!

Additional context

#sig-docs Slack

cc @jimangel @kbarnard10 @cblecker

[zacharysarah]

/sig docs

[justaugustus]

@zacharysarah -- This is timely! Releng is discussing possibilities here: kubernetes/release#857

cc: @kubernetes/release-engineering

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[zacharysarah]

This is still important.

/remove-lifecycle stale
/lifecycle frozen
/priority important-longterm

[cblecker]

/remove-lifecycle frozen

We haven't decided if/how we would do this, so it doesn't really qualify for frozen.

I'm not sure what the workflow would even look like for this.. we don't really do repo-scoped commands. They are all issue or PR scoped.

[stevekuznetsov]

If we implement branch creation as a plugin, we can just enable the plugin on a single repo.

[cblecker]

@stevekuznetsov That's not what I mean. I mean where would you issue the command to create a branch?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[jimangel]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.