agable@, do you mind helping grant Predator service account predator-for-me@appspot.gserviceaccount.com read-only access to https://chrome-internal.googlesource.com/chrome/tools/buildspec.git/?

Assigned this bug to you because you are the Git admin sheriff today.
Thanks for your help in advance!

Please also grant Predator staging service account predator-for-me-staging@appspot.gserviceaccount.com read-only access, thanks

After migrating Predator from findit-for-me.googleplex.com to the new appspot app, we should also revoke the same permission granted to the googleplex account.
@katesonia, please confirm whether we could revoke the permission now or file a separate bug for that.

Done. Also revoked access for "findit-for-me@appspot.gserviceaccount.com", which stgao@ and katesonia@ confirmed was not being used. Access for "findit-for-me.google.com@appspot.gserviceaccount.com" will be revoked in the followup bug.

It seems that the 403 errors still occur in "predator-for-me" after adding authentication scope - https://www.googleapis.com/auth/gerritcodereview

Request to https://chrome-internal.googlesource.com/chrome/tools/buildspec.git/+/master/releases/60.0.3112.4/DEPS?format=text resulted in 403, headers:[["strict-transport-security", "max-age=31536000; includeSubDomains; preload"], ["x-content-type-options", "nosniff"], ["transfer-encoding", "chunked"], ["expires", "Mon, 01 Jan 1990 00:00:00 GMT"], ["server", "GSE"], ["x-xss-protection", "1; mode=block"], ["pragma", "no-cache"], ["cache-control", "no-cache, no-store, max-age=0, must-revalidate"], ["date", "Tue, 30 May 2017 23:15:51 GMT"], ["x-frame-options", "SAMEORIGIN"], ["alt-svc", "quic=\":443\"; ma=2592000; v=\"38,37,36,35\""], ["content-type", "text/html; charset=UTF-8"]] (/base/data/home/apps/s~predator-for-me/backend-process:katesonia.401629179548451088/first_party/gae_libs/http/http_client_appengine.py:65)