[Conductor] Address tagging and pushing logic

[itsjustkevin]

With tagging and pushing now handled by a recipe that is behind Multi-party approval, we may want to consider a few approaches.

1. Remove the logic from conductor.
2. Hide tagging and pushing behind their own flags.
3. Leave as is.

We may want to keep the logic around for "Break glass in case of emergency" situations.

Manually tagging and pushing to the release branch is an error prone process that could introduce extra risk.

[itsjustkevin]

CC: @godofredoc @CaseyHillers @sealesj

[sealesj]

I like the idea of keeping the logic for emergency situations, but since the release workflow should always require multi-party approval if we are hoping to get SLSA verified on flutter/flutter, I wonder if we will have to remove the logic from Conductor in order to satisfy that requirement. @godofredoc what do you think?

[itsjustkevin]

Interesting perspective here that I did not consider. In the case that our recipes fail catastrophically, are we completely blocked from releasing if we want to maintain our SLSA level?

[godofredoc]

I'll recommend 2) hide the functionality with a flag to avoid as much as possible human errors.

@itsjustkevin yes, after validating the process with multiple releases we are removing individuals access to push to beta | release.

Once we're ready for SLSA L3 the release process will need to generate provenance that can be validated by the public.

Ideally the process will be:

• I'm a new user downloading release bundles - I run SLSA validator on the bundles to ensure it's valid, trusted and not compromised before installing.
• I'm an existing user running upgrade on beta | stable - the flutter tool validates the provenance of the current release and the engine artifacts before extracting them.
• The flutter tool has a SLSA compliant mode the ensures the current checkout is from beta | stable with all the artifacts provenance validated.
• The flutter tool generates provenance for flutter applications

A few of these items will happen after the flutter product gets to SLSA L2 compliance.

[CaseyHillers]

From a turn down perspective, we can continue to use the toolproxy approach for pushing releases. If we ship the next stable without issues, removing the tag + push logic from conductor SGTM.

[itsjustkevin]

From the feedback here it seems like the way to go while keeping with SLSA compliance is to remove the tag and push logic after the next stable release.

[XilaiZhang]

the remaining step is to delete the tagging and pushing logic in conductor