uplift_worker: disable auto try push for secure uplifts (bug 2053811)

[Magnolia-Liu]

Automatic try-pushes for for security uplift requests currently give an error sent in a email notification.

Avoid automatically pushing to try for security uplifts by adding a new is_secure boolean field in UpliftSubmission model, setting the status in the uplift post request, detecting this status in the uplift worker, and skipping the try push based on this detection.

---

Lando: link
Bugzilla: bug 2053811

⚠️ This pull request has 7 warnings.
🚫 This pull request has 1 blocker.

[github-actions]

View this pull request in Lando to land it once approved.

[cgsheeh]

I think we should use BugReferencesCheck in the worker here instead of using revision_is_secure to check the Phabricator secure-project tag. This gate is really about whether a commit references a private bug, so reusing the check skips try only when the push would actually break/leak, preserves CI coverage for secure-tagged revisions that reference public bugs (common when phab-bot is stalled), and survives the GitHub migration since it only needs commit messages + BMO.

[shtrom]

I think we should use BugReferencesCheck in the worker here instead of using revision_is_secure to check the Phabricator secure-project tag. This gate is really about whether a commit references a private bug, so reusing the check skips try only when the push would actually break/leak, preserves CI coverage for secure-tagged revisions that reference public bugs (common when phab-bot is stalled), and survives the GitHub migration since it only needs commit messages + BMO.

Perhaps we should apply all of the landing checks enabled for the target repo?

[zzzeid]

I think we should use BugReferencesCheck in the worker here instead of using revision_is_secure to check the Phabricator secure-project tag. This gate is really about whether a commit references a private bug, so reusing the check skips try only when the push would actually break/leak, preserves CI coverage for secure-tagged revisions that reference public bugs (common when phab-bot is stalled), and survives the GitHub migration since it only needs commit messages + BMO.

Perhaps we should apply all of the landing checks enabled for the target repo?

Yeah good point, this would also prevent hard-coding the check name, which would be good in case we ever add any other additional checks that affect security patches.

It would be good to update the docstrings and helptext of the hooks to make it more obvious that those are no longer only running at landing time.

Edit: removed comment (see more detail in bug 2056365)