Add-ons/QA/Testplan/Add-ons Post Reviews Process

Revision History

Date	Version	Author	Description
20/06/2017	1.0	Valentina Virlics	Created first draft
31/08/2017	1.0	Valentina Virlics	Updated

Overview

• Add-ons listed on AMO are all pre-reviewed by a team of employees and volunteers. This process creates problems with waiting times, especially for add-ons escalated for special review, leading to developers to choose self-hosting or not develop for Firefox at all.
• We aim to a post-review model (for WebExtensions), where they are approved and published - if they pass a series of automatic tests - and manually post-reviewed.

Goals

• Automatically approve WebExtensions without human intervention
  • Decrease the waiting time for publishing a WebExtension or a WebExtension update to approximately 15 minutes. Currently, waiting times vary between a few hours to several weeks.
  • Improve the value of user feedback channels (abuse reports, ratings on AMO) so they can be used to prioritize post-reviews.
  • Better expose developers to documentation on add-on policies and rules during the submission process.

Entry Criteria

• QA has access to PRD and some mocks (found in bugs)
• The feature has landed in -dev

Current Status

• The feature is under development

Exit Criteria

• All related bugs triaged
• All blockers fixed
• All resolved bugs verified by QA
• Found-fixed bugs rate going down in time

Scope

what's in scope?

1. Deploy Auto-approval

• WebExtensions will continue to be submitted through the regular flow, and a command will be run regularly (~every hour) to evaluate and auto-approve some of them, based on criteria defined in the linked PRD.

2. Implement post-review list for auto-approved add-ons

• Add-ons that are auto-approved will appear in the post-review queue from Reviewer Tools. List will contain: add-on name and version number (linking to the corresponding review page), last review - time since last manual review (in days), Flags and Weight (sorted after weight)

3. Changes to Reviewer Tools

• If the last review for an add-on was done manually or the user looking at the page doesn’t have the Addons:PostReview permission, show the current reviewer page.
• If the last review for an add-on was automatic and the user looking at the page has the Addons:PostReview permission, show the reviewer page with the following changes:

- Display recent user ratings (3 stars of fewer) and abuse reports (for the add-on or the developers, if there are any reports), with links to the full lists, below the add-on metadata and right above “More about this add-on”.  
- The "Confirm Approval" resolution should be available, and shouldn’t display the form for comments and canned responses. Instead, it should only show the Save button. Confirming doesn’t send any information to the developer or change its status. It only records it so the last manually-approved version is used to calculate the code changes compared to the latest version.  
- The Request super-review action shouldn’t send an email to the developer.  
- The Reject action should include a way to select which versions of the add-on are affected by the rejection. All of those versions should be disabled once the review is saved, and should be listed in the email sent to the developer.  
 

4. Post-review prioritization

• The post-review list will be sorted according to a weighted sum of the following risk factors:

- The add-on has the admin review flag.  
- Flags raised during static analysis.  
- Size of code changed since last manual approval.  
- User feedback obtained from abuse reports (for the add-on and the developers).  
- User feedback obtained from ratings left on add-on listings.  
- Add-on reputation, set by admin reviewers.
- Number of active users.  
- Past rejection history.  
 

Note: Add-on Reputation - is an admin-set override that helps rank down popular add-ons that are known to be high-quality and would generally rank higher due to code complexity and high volume of user feedback. This also includes add-ons developed by Mozilla. The reputation is an integer ranging between 0 and 3, that is set per-add-on, defaulting to 0.

5. Submission process updates

• The submission flow will have the following changes:

- Replace the Developer Agreement step with a step linking to the 3 main documents: Developer Agreement, Review Policy, and Review Rules. Each document will have a checkbox next to it indicating the developer has read them and agreed to them.  
- Ensure all developers see these documents on their next submission, even for an update.  
- For WebExtensions, a subset of flags raised by static validation will be shown after it completes. They are specified on this spreadsheet, in the column “Flag with developer during submission”.  
- For WebExtensions, the text in the last step should be adjusted to reflect the new process.  
 

6. Remove auto-approval restrictions

• All WebExtension submissions will be post-reviewed after this point

what's out of scope?

• Add-ons/Webextensions functionality

Risks

• This is major change in the way we review add-ons. The security implications are significant, so getting security review and approval as early as possible will ensure this project won’t be delayed.
• The current reviewer team is trained to use the pre-review system, and are more familiar with legacy APIs than WebExtensions.
• A group of contractors is in process of being hired to help with WebExtension reviews, and they would be the first to handle the post-review process. Any delays in their on-boarding will lead to insufficient post-review staffing and higher security risk.

Ownership

Product Manager: Jorge Villalobos; irc nick :jorgev
QA Manager: Krupa Raj; irc nick :krupa
QA Lead: Victor Carciu; irc nick :victorc
Add-ons QA: Valentina Virlics; irc nick :ValentinaV

Requirements for testing

Environments

• Windows
• Mac OS

Servers

• Stage: https://addons.allizom.org/en-US/
• Dev: https://addons-dev.allizom.org/en-US/
• Production: https://addons.mozilla.org/en-US/

Channels

• Release

Test Strategy

Test Execution Schedule

The following table identifies the anticipated testing period available for test execution.

Project phase	Date
Start project	14.03.2017
Study PRD/mocks received	20.04.2017
QA - Test plan creation	20.06.2017
QA - Test cases preparation
QA - Test cases execution
Release Date	Firefox Release 57

Testing Tools

Process	Tool
Test plan creation	Mozilla wiki
Test case creation	TestRail / Google doc
Test case execution	TestRail
Bugs management	Github

References

• PRD - https://docs.google.com/document/d/1BdiJSYD4aOMClasGxx5wVShHEk8VbxefE3Gf_6jpgkQ/edit#
• Tracker: https://github.com/mozilla/addons-server/issues/5211
• Add-ons Auto Approvals test plan: https://wiki.mozilla.org/Add-ons/QA/Testplan/Auto-Approvals
• Implementation plan for Q2: https://docs.google.com/document/d/1rZvM2QGk8WtkNUDRvLEvrbqZ190hvHfOle4zVRllQmw/edit
• Post-review weights for prioritization: https://docs.google.com/spreadsheets/d/1CZEECHHqEmK87fNiWNslAsFQBL7zxYF-c63-zZVZuqw/edit#gid=0

Testcases

Test Areas

• Review of extensions

Test suite

Full Test Suite: tba

Bug Work

• Feature implementation bug - 5210

Bug fix verification

• Open
• Closed

Sign off

Criteria

Check list

• All test cases should be executed
• All blockers must be fixed and verified or have an agreed-upon timeline for being fixed