application-services/.taskcluster.yml

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
---
version: 1
reporting: checks-v1
policy:
  pullRequests: public
tasks:
  $let:
    taskgraph:
      branch: taskgraph
      revision: a8366f88fc8b35b284ad550358c89ec10133fb42
    trustDomain: app-services
    decision_task_id: {$eval: as_slugid("decision_task")}
    expires_in: {$fromNow: '1 year'}
    # We define the following variable at the very top, because they are used in the
    # default definition

    head_rev:
      $if: 'tasks_for == "github-pull-request"'
      then: ${event.pull_request.head.sha}
      else:
        $if: 'tasks_for == "github-push"'
        then: ${event.after}
        else: ${event.release.tag_name}

    repository:
      $if: 'tasks_for == "github-pull-request"'
      then: ${event.pull_request.head.repo.html_url}
      else: ${event.repository.html_url}

    is_repo_trusted:
      # Pull requests on main repository can't be trusted because anybody can open a PR on it, without a review
      $if: 'tasks_for in ["github-push", "github-release"] && event.repository.html_url == "https://github.com/mozilla/application-services"'
      then: true
      else: false

    user:
      $if: 'event.sender.login == "dependabot-preview[bot]"'
      then: dependabot
      else: ${event.sender.login}
  in:
    $let:
      provisioner_id:
        $if: 'is_repo_trusted'
        then: 'app-services-3'
        else: 'app-services-1'
      # TODO: revisit once bug 1533314 is done to possibly infer better priorities
      tasks_priority: highest
      # Github events have this stuff in different places...
      ownerEmail:
          $if: 'tasks_for in ["cron", "action"]'
          then: '${tasks_for}@noreply.mozilla.org'
          else:
              $if: 'tasks_for == "github-push"'
              then: '${event.pusher.email}'
              # Assume Pull Request
              else:
                  $if: 'tasks_for == "github-pull-request"'
                  then: '${event.pull_request.user.login}@users.noreply.github.com'
                  else:
                      $if: 'tasks_for == "github-release"'
                      then: '${event.sender.login}@users.noreply.github.com'

      baseRepoUrl:
          $if: 'tasks_for in ["github-push", "github-release"]'
          then: '${event.repository.html_url}'
          else:
              $if: 'tasks_for == "github-pull-request"'
              then: '${event.pull_request.base.repo.html_url}'
              else:
                  $if: 'tasks_for in ["cron", "action"]'
                  then: '${repository.url}'
      repoUrl:
          $if: 'tasks_for in ["github-push", "github-release"]'
          then: '${event.repository.html_url}'
          else:
              $if: 'tasks_for == "github-pull-request"'
              then: '${event.pull_request.head.repo.html_url}'
              else:
                  $if: 'tasks_for in ["cron", "action"]'
                  then: '${repository.url}'
      project:
          $if: 'tasks_for in ["github-push", "github-release"]'
          then: '${event.repository.name}'
          else:
              $if: 'tasks_for == "github-pull-request"'
              then: '${event.pull_request.head.repo.name}'
              else:
                  $if: 'tasks_for in ["cron", "action"]'
                  then: '${repository.project}'
      head_branch:
          $if: 'tasks_for == "github-pull-request"'
          then: ${event.pull_request.head.ref}
          else:
              $if: 'tasks_for == "github-push"'
              then: ${event.ref}
              else:
                  $if: 'tasks_for == "github-release"'
                  then: '${event.release.target_commitish}'
                  else:
                      $if: 'tasks_for in ["cron", "action"]'
                      then: '${push.branch}'
      head_sha:
          $if: 'tasks_for == "github-push"'
          then: '${event.after}'
          else:
              $if: 'tasks_for == "github-pull-request"'
              then: '${event.pull_request.head.sha}'
              else:
                  $if: 'tasks_for == "github-release"'
                  then: '${event.release.tag_name}'
                  else:
                      $if: 'tasks_for in ["cron", "action"]'
                      then: '${push.revision}'
      ownTaskId:
          $if: '"github" in tasks_for'
          then: {$eval: as_slugid("decision_task")}
          else:
              $if: 'tasks_for == "cron"'
              then: '${ownTaskId}'
      pullRequestAction:
          $if: 'tasks_for == "github-pull-request"'
          then: ${event.action}
          else: 'UNDEFINED'

      releaseAction:
          $if: 'tasks_for == "github-release"'
          then: ${event.action}
          else: 'UNDEFINED'
    in:
      $let:
        default_task_definition:
          taskId: ${decision_task_id}
          taskGroupId: ${decision_task_id}
          # because we're not using `reporting: checks-v1`, we need to keep using taskcluster-github as scheduler_id.
          # This will change in the near future when https://github.com/mozilla/application-services/pull/1945 lands
          schedulerId: taskcluster-github
          created: {$fromNow: ''}
          deadline: {$fromNow: '4 hours'}
          expires: ${expires_in}
          provisionerId: ${provisioner_id}
          workerType: 'decision'
          priority: ${tasks_priority}
          requires: all-completed
          retries: 5
          scopes:
            - queue:scheduler-id:taskcluster-github
          routes:
            - checks
          metadata:
            owner: &task_owner ${user}@users.noreply.github.com
            source: &task_source ${repository}/raw/${head_rev}/.taskcluster.yml
          extra:
            tasks_for: ${tasks_for}
          payload:
            artifacts:
              public/task-graph.json:
                type: file
                path: /repo/task-graph.json
                expires: ${expires_in}
              public/actions.json:
                type: file
                path: /repo/actions.json
                expires: ${expires_in}
              public/parameters.yml:
                type: file
                path: /repo/parameters.yml
                expires: ${expires_in}
            maxRunTime: {$eval: '20 * 60'}
            # https://github.com/servo/taskcluster-bootstrap-docker-images#decision-task
            image: "servobrowser/taskcluster-bootstrap:decision-task@sha256:28045b7ec0485ef363f8cb14f194008b47e9ede99f2ea40a1e945e921fce976e"
            command: # TODO: servo decision-task image doesn't include pyyaml.
              - /bin/bash
              - --login
              - -cx
              - >-
                python3 -m pip install --upgrade pip &&
                python3 -m pip install pyyaml &&
                git init repo &&
                cd repo &&
                git fetch --tags ${repository} ${head_branch} &&
                git reset --hard ${head_rev} &&
                python3 automation/taskcluster/decision_task.py
            env:
              APPSERVICES_HEAD_REPOSITORY: ${repository}
              APPSERVICES_HEAD_BRANCH: ${head_branch}
              APPSERVICES_HEAD_REV: ${head_rev}
              BUILD_WORKER_TYPE: b-linux
              IMAGES_WORKER_TYPE: images
              TASK_FOR: ${tasks_for}
              TASK_OWNER: *task_owner
              TASK_SOURCE: *task_source
              SCHEDULER_ID: taskcluster-github
              PROVISIONER_ID: ${provisioner_id}
            features:
              taskclusterProxy: true
      in:
        $match:
          "(tasks_for == 'github-pull-request' && event['action'] in ['opened', 'reopened', 'synchronize']) || (tasks_for == 'github-push' && head_branch == 'refs/heads/master')":
            $let:
              level:
                $if: 'tasks_for in ["github-push", "github-release"] && repoUrl == "https://github.com/mozilla/application-services"'
                then: '3'
                else: '1'
              short_head_branch:
                $if: 'head_branch[:11] == "refs/heads/"'
                then: {$eval: 'head_branch[11:]'}
            in:
              $mergeDeep:
                - taskGroupId:
                    $if: 'tasks_for == "action"'
                    then:
                        '${action.taskGroupId}'
                    else:
                        '${ownTaskId}'  # same as taskId; this is how automation identifies a decision task
                  taskId: '${ownTaskId}'
                  schedulerId: '${trustDomain}-level-${level}'
                  created: {$fromNow: ''}
                  deadline: {$fromNow: '1 day'}
                  expires: {$fromNow: '1 year 1 second'}  # 1 second so artifacts expire first, despite rounding errors
                  metadata:
                    $merge:
                      - owner: "${ownerEmail}"
                        source: '${repoUrl}/raw/${head_sha}/.taskcluster.yml'
                      - $if: 'tasks_for in ["github-push", "github-pull-request", "github-release"]'
                        then:
                          name: "Decision Task"
                          description: 'The task that creates all of the other tasks in the task graph'
                  provisionerId: "app-services-${level}"
                  workerType: "decision"
                  tags:
                    $if: 'tasks_for in ["github-push", "github-pull-request"]'
                    then:
                      kind: decision-task
                  routes:
                    $flattenDeep:
                      - checks
                      - $if: 'level == "3"'
                        then:
                          # TODO Bug 1601928: Make this scope fork-friendly once ${project} is better defined. This will enable
                          # staging release promotion on forks.
                          - $if: 'tasks_for == "github-push"'
                            then:
                              - index.project.${project}.v2.branch.${short_head_branch}.latest.taskgraph.decision
                              - index.project.${project}.v2.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision
                          - $if: 'tasks_for == "cron"'
                            then:
                              # cron context provides ${head_branch} as a short one
                              - index.project.${project}.v2.branch.${head_branch}.latest.taskgraph.decision-${cron.job_name}
                              - index.project.${project}.v2.branch.${head_branch}.revision.${head_sha}.taskgraph.decision-${cron.job_name}
                              - index.project.${project}.v2.branch.${head_branch}.revision.${head_sha}.taskgraph.cron.${ownTaskId}
                  scopes:
                    $if: 'tasks_for == "github-push"'
                    then:
                      # `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.
                      - 'assume:repo:${repoUrl[8:]}:branch:${short_head_branch}'
                    else:
                      $if: 'tasks_for == "github-pull-request"'
                      then:
                        - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
                      else:
                        $if: 'tasks_for == "github-release"'
                        then:
                          - 'assume:repo:${repoUrl[8:]}:release'
                        else:
                          $if: 'tasks_for == "action"'
                          then:
                            # when all actions are hooks, we can calculate this directly rather than using a variable
                            - '${action.repo_scope}'
                          else:
                            - 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'
                  requires: all-completed
                  priority: lowest
                  retries: 5

                  payload:
                    env:
                      # run-task uses these to check out the source; the inputs
                      # to `mach taskgraph decision` are all on the command line.
                      $merge:
                        - APPSERVICES_BASE_REPOSITORY: '${baseRepoUrl}'
                          APPSERVICES_HEAD_REPOSITORY: '${repoUrl}'
                          APPSERVICES_HEAD_REF: '${head_branch}'
                          APPSERVICES_HEAD_REV: '${head_sha}'
                          APPSERVICES_REPOSITORY_TYPE: git
                          TASKGRAPH_BASE_REPOSITORY: https://hg.mozilla.org/ci/taskgraph
                          TASKGRAPH_HEAD_REPOSITORY: https://hg.mozilla.org/ci/${taskgraph.branch}
                          TASKGRAPH_HEAD_REV: ${taskgraph.revision}
                          TASKGRAPH_REPOSITORY_TYPE: hg
                          REPOSITORIES: {$json: {appservices: "Application Services", taskgraph: "Taskgraph"}}
                          HG_STORE_PATH: /builds/worker/checkouts/hg-store
                          ANDROID_SDK_ROOT: /builds/worker/android-sdk
                          MOZ_FETCHES_DIR: /builds/worker/checkouts/src
                        - $if: 'tasks_for in ["github-pull-request"]'
                          then:
                            APPSERVICES_PULL_REQUEST_TITLE: '${event.pull_request.title}'
                            APPSERVICES_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                    features:
                      taskclusterProxy: true
                      chainOfTrust: true
                    # Note: This task is built server side without the context or tooling that
                    # exist in tree so we must hard code the hash
                    image:
                      mozillareleases/taskgraph:decision-mobile-6020473b1a928d8df50e234a7ca2e81ade2220a4fb5fbe16b02477dd64a49728@sha256:98d226736b7d03907114bf37938002b90e8a37cbe3a297690e349f1ddddb1d7c

                    maxRunTime: 1800

                    command:
                      - /usr/local/bin/run-task
                      - '--appservices-checkout=/builds/worker/checkouts/src'
                      - '--taskgraph-checkout=/builds/worker/checkouts/taskgraph'
                      - '--task-cwd=/builds/worker/checkouts/src'
                      - '--'
                      - bash
                      - -cx
                      - >
                        PIP_IGNORE_INSTALLED=0 pip install --user /builds/worker/checkouts/taskgraph &&
                        PIP_IGNORE_INSTALLED=0 pip install --user arrow taskcluster pyyaml &&
                        ln -s /builds/worker/artifacts artifacts &&
                        ~/.local/bin/taskgraph decision
                        --pushlog-id='0'
                        --pushdate='0'
                        --project='${project}'
                        --message=""
                        --owner='${ownerEmail}'
                        --level='${level}'
                        --base-repository="$APPSERVICES_BASE_REPOSITORY"
                        --head-repository="$APPSERVICES_HEAD_REPOSITORY"
                        --head-ref="$APPSERVICES_HEAD_REF"
                        --head-rev="$APPSERVICES_HEAD_REV"
                        --repository-type="$APPSERVICES_REPOSITORY_TYPE"
                        --tasks-for='${tasks_for}'
                    artifacts:
                      'public':
                        type: 'directory'
                        path: '/builds/worker/artifacts'
                        expires: {$fromNow: '1 year'}
                  extra:
                    $merge:
                        - treeherder:
                              $merge:
                                  - machine:
                                        platform: gecko-decision
                                  - $if: 'tasks_for in ["github-push", "github-pull-request"]'
                                    then:
                                        symbol: D
                        - tasks_for: '${tasks_for}'
          "tasks_for == 'github-release' && event['action'] == 'published'":
            $let:
              is_staging:
                $if: 'event.repository.html_url != "https://github.com/mozilla/application-services"'
                then: true
                else: false
            in:
              $let:
                beetmover_worker_type:
                  $if: 'is_staging'
                  then: appservices-1-beetmover
                  else: appservices-3-beetmover
                beetmover_bucket:
                  $if: 'is_staging'
                  then: maven-staging
                  else: maven-production
                beetmover_bucket_public_url:
                  $if: 'is_staging'
                  then: https://maven-default.stage.mozaws.net/
                  else: https://maven.mozilla.org/
                tag: ${event.release.tag_name}
                release_task_definition:
                  payload:
                    features:
                      chainOfTrust: true
              in:
                $mergeDeep:
                  - {$eval: 'default_task_definition'}
                  - {$eval: 'release_task_definition'}
                  - scopes:
                    - assume:repo:${event.repository.html_url[8:]}:release
                  - payload:
                      env:
                        IS_STAGING: ${is_staging}
                        BEETMOVER_WORKER_TYPE: ${beetmover_worker_type}
                        BEETMOVER_BUCKET: ${beetmover_bucket}
                        BEETMOVER_BUCKET_PUBLIC_URL: ${beetmover_bucket_public_url}
                  - metadata:
                      name: Application Services - Decision task (${tag})
                      description: Build and publish release versions.