infra: Set up basic 'shadow' buckets for ci & try

This should let anyone in "project-boringssl-tryjob-access" run "led"
builds for any builder in the "ci" or "try" buckets. A "led" build is
a copy of the normal build, with unreviewed changes to the underlying
recipe. Ideally it runs with a more-restricted set of permissions.

For led builds of try, they simply re-use the exact same
pools/machines/accounts since try is (or at least should be) already
very unprivileged.

But for led builds of ci, this configures them to re-use the same
pools/machines/accounts of try since try is designed for running
unreviewed code, unlike ci. This is how chromium's led builds work.

See http://go/luci-how-to-led for more info on led.

Bug: None
Change-Id: Idacfd71f383ac27e3809fa891cf5c175003bbddc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98167
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>

infra/config/generated/cr-buildbucket.cfg

diff --git a/infra/config/generated/cr-buildbucket.cfg b/infra/config/generated/cr-buildbucket.cfg
index 7493d45..cbc2620 100644
--- a/infra/config/generated/cr-buildbucket.cfg
+++ b/infra/config/generated/cr-buildbucket.cfg
@@ -33,6 +33,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_aarch64_fips_noasm_rel"
@@ -57,6 +62,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_aarch64_fips_rel"
@@ -81,6 +91,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_aarch64_fips_static_rel"
@@ -105,6 +120,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_aarch64_prefixed_compile"
@@ -133,6 +153,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_aarch64_rel"
@@ -157,6 +182,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm"
@@ -181,6 +211,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm_armmode_prefixed_compile"
@@ -209,6 +244,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm_armmode_rel"
@@ -233,6 +273,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm_fips_rel"
@@ -257,6 +302,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm_prefixed_compile"
@@ -285,6 +335,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_arm_rel"
@@ -309,6 +364,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_riscv64_compile_only"
@@ -336,6 +396,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "android_riscv64_prefixed_compile"
@@ -364,6 +429,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "docs"
@@ -387,6 +457,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "ios64_compile"
@@ -417,6 +492,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "ios64_prefixed_compile"
@@ -448,6 +528,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux"
@@ -474,6 +559,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux32"
@@ -499,6 +589,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux32_nosse2_noasm"
@@ -523,6 +618,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux32_prefixed_compile"
@@ -551,6 +651,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux32_rel"
@@ -575,6 +680,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux32_sde"
@@ -601,6 +711,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_bazel"
@@ -624,6 +739,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_cfi"
@@ -649,6 +769,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_prefixed_compile"
@@ -676,6 +801,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_rel"
@@ -701,6 +831,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_rel_msan"
@@ -727,6 +862,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_rel_tsan"
@@ -754,6 +894,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_clang_ubsan"
@@ -779,6 +924,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fips"
@@ -803,6 +953,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fips_clang"
@@ -828,6 +983,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fips_clang_rel"
@@ -853,6 +1013,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fips_noasm_asan"
@@ -878,6 +1043,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fips_rel"
@@ -902,6 +1072,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_fuzz"
@@ -928,6 +1103,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_noasm_asan"
@@ -953,6 +1133,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_nosse2_noasm"
@@ -977,6 +1162,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_nosse2_noasm_prefixed_compile"
@@ -1004,6 +1194,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_nothreads"
@@ -1028,6 +1223,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_prefixed_compile"
@@ -1057,6 +1257,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_rel"
@@ -1081,6 +1286,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_sde"
@@ -1107,6 +1317,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_shared"
@@ -1131,6 +1346,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "linux_small"
@@ -1155,6 +1375,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac"
@@ -1184,6 +1409,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_arm64"
@@ -1213,6 +1443,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_arm64_bazel"
@@ -1240,6 +1475,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_arm64_prefixed_compile"
@@ -1270,6 +1510,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_prefixed_compile"
@@ -1300,6 +1545,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_rel"
@@ -1328,6 +1578,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "mac_small"
@@ -1356,6 +1611,11 @@
         path: "osx_sdk"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32"
@@ -1380,6 +1640,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_clang"
@@ -1406,6 +1671,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_clang_prefixed_compile"
@@ -1435,6 +1705,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_prefixed_compile"
@@ -1462,6 +1737,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_rel"
@@ -1487,6 +1767,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_sde"
@@ -1514,6 +1799,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_shared"
@@ -1539,6 +1829,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_shared_prefixed"
@@ -1565,6 +1860,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_small"
@@ -1590,6 +1890,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win32_vs2022"
@@ -1615,6 +1920,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64"
@@ -1639,6 +1949,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_clang"
@@ -1664,6 +1979,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_clang_prefixed_compile"
@@ -1692,6 +2012,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_prefixed_compile"
@@ -1719,6 +2044,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_rel"
@@ -1745,6 +2075,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_sde"
@@ -1772,6 +2107,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_shared"
@@ -1797,6 +2137,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_shared_prefixed"
@@ -1823,6 +2168,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_small"
@@ -1848,6 +2198,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win64_vs2022"
@@ -1873,6 +2228,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win_arm64_compile"
@@ -1902,6 +2262,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win_arm64_msvc_compile"
@@ -1930,6 +2295,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win_arm64_msvc_prefixed_compile"
@@ -1959,6 +2329,11 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
     builders {
       name: "win_arm64_prefixed_compile"
@@ -1989,8 +2364,33 @@
         path: "gopath"
       }
       service_account: "boringssl-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+      shadow_builder_adjustments {
+        service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+        pool: "luci.flex.try"
+        dimensions: "pool:luci.flex.try"
+      }
     }
   }
+  shadow: "ci.shadow"
+}
+buckets {
+  name: "ci.shadow"
+  acls {
+    group: "all"
+  }
+  acls {
+    role: SCHEDULER
+    group: "project-boringssl-tryjob-access"
+  }
+  acls {
+    role: SCHEDULER
+    group: "service-account-cq"
+  }
+  constraints {
+    pools: "luci.flex.try"
+    service_accounts: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  dynamic_builder_template {}
 }
 buckets {
   name: "try"
@@ -3625,4 +4025,16 @@
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
     }
   }
+  shadow: "try.shadow"
+}
+buckets {
+  name: "try.shadow"
+  acls {
+    group: "all"
+  }
+  constraints {
+    pools: "luci.flex.try"
+    service_accounts: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  dynamic_builder_template {}
 }

infra/config/generated/realms.cfg

diff --git a/infra/config/generated/realms.cfg b/infra/config/generated/realms.cfg
index 920450f..50f543e 100644
--- a/infra/config/generated/realms.cfg
+++ b/infra/config/generated/realms.cfg
@@ -47,6 +47,18 @@
   }
 }
 realms {
+  name: "ci.shadow"
+  bindings {
+    role: "role/buildbucket.triggerer"
+    principals: "group:project-boringssl-tryjob-access"
+    principals: "group:service-account-cq"
+  }
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+}
+realms {
   name: "try"
   bindings {
     role: "role/buildbucket.builderServiceAccount"
@@ -58,3 +70,10 @@
     principals: "group:service-account-cq"
   }
 }
+realms {
+  name: "try.shadow"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+}

infra/config/main.star

diff --git a/infra/config/main.star b/infra/config/main.star
index 9f14d57..bfebb09 100755
--- a/infra/config/main.star
+++ b/infra/config/main.star
@@ -61,6 +61,22 @@
 
 luci.bucket(name = "ci")
 
+# "Shadow" version of the "ci" bucket, for use with led.
+luci.bucket(
+    name = "ci.shadow",
+    shadows = "ci",
+    dynamic = True,
+    acls = [
+        acl.entry(
+            roles = acl.BUILDBUCKET_TRIGGERER,
+            groups = [
+                "project-boringssl-tryjob-access",
+                "service-account-cq",
+            ],
+        ),
+    ],
+)
+
 luci.bucket(
     name = "try",
     acls = [
@@ -75,6 +91,21 @@
     ],
 )
 
+# "Shadow" version of the "ci" bucket, for use with led.
+luci.bucket(
+    name = "try.shadow",
+    shadows = "try",
+    dynamic = True,
+    constraints = luci.bucket_constraints(
+        pools = [
+            "luci.flex.try",
+        ],
+        service_accounts = [
+            "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
+    ),
+)
+
 luci.milo(
     logo = "https://storage.googleapis.com/chrome-infra/boringssl-logo.png",
 )
@@ -352,6 +383,8 @@
         notifies = [notifier],
         triggered_by = [poller],
         properties = properties,
+        shadow_service_account = "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com",
+        shadow_pool = "luci.flex.try",
     )
     luci.console_view_entry(
         builder = builder,