From d0a8837c0750ab54948a5a8f39486ea34711228c Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Feb 18 2021 08:26:48 +0000
Subject: distgit/pagure: remove the commit ACL for API keys in prod


This ACL turns out to be too confusing to users as it currently
does not work with our OIDC set-up with fedpkg.
Once we'll have figured out how to make both work together or
keep one and remove the other, we can revisit.

Keeping this in staging so we have a place where we can experiment
with this.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/roles/distgit/pagure/templates/pagure.cfg b/roles/distgit/pagure/templates/pagure.cfg
index 9b6c778..826aef9 100644
--- a/roles/distgit/pagure/templates/pagure.cfg
+++ b/roles/distgit/pagure/templates/pagure.cfg
@@ -233,7 +233,9 @@ ACLS = {
     'commit_flag': 'Flag a commit',
     "update_watch_status": "Update the watch status on a project",
     "tag_project": "Allows adding git tags to a project",
+{% if env == 'staging' %}
     "commit": "Commit to a git repository via http(s)",
+{% endif %}
 }
 
 REQUIRED_GROUPS = {
@@ -264,7 +266,9 @@ USER_ACLS = [
     'pull_request_merge',
     'modify_project',
     'update_watch_status',
+{% if env == 'staging' %}
     'commit',
+{% endif %}
 ]
 
 CROSS_PROJECT_ACLS = [
@@ -275,7 +279,9 @@ CROSS_PROJECT_ACLS = [
     'pull_request_merge',
     'pull_request_flag',
     'update_watch_status',
+{% if env == 'staging' %}
     'commit',
+{% endif %}
 ]
 
 ADMIN_API_ACLS = [