Bug 1523321 - Run the wrupdater on m-c pushes that touch gfx/wr. r=tomprince,jrmuizel

Differential Revision: https://phabricator.services.mozilla.com/D33548

--HG--
extra : moz-landing-system : lando

build/sparse-profiles/docker-image

@@ -19,3 +19,6 @@ path:tools/lint/tox/tox_requirements.txt
 
 # Required for the webrender docker image
 path:gfx/wr/ci-scripts/docker-image/setup.sh
+# Required for the webrender-updater docker image
+path:gfx/wr/ci-scripts/wrupdater/docker-setup.sh
+path:gfx/wr/ci-scripts/wrupdater/requirements.txt

gfx/wr/ci-scripts/wrupdater/docker-setup.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o xtrace
+
+test "$(whoami)" == 'root'
+
+# Install stuff we need
+apt-get -y update
+apt-get install -y \
+    cmake \
+    curl \
+    gcc \
+    git \
+    g++ \
+    libffi-dev \
+    libgit2-dev/stretch-backports \
+    libssl-dev \
+    python3 \
+    python3-dev \
+    python3-pip \
+    python3-setuptools
+
+# Python packages
+pip3 install -r /tmp/requirements.txt

gfx/wr/ci-scripts/wrupdater/requirements.txt

@@ -0,0 +1,3 @@
+requests==2.21.0
+pygit2==0.27.0    # this requires libgit2 v0.27.*
+python-hglib==2.6.1

taskcluster/ci/docker-image/kind.yml

@@ -202,3 +202,6 @@ jobs:
     webrender:
         symbol: I(webrender)
         parent: debian9-base
+    webrender-updater:
+        symbol: I(wrupdater)
+        parent: debian9-base

taskcluster/ci/webrender/kind.yml

@@ -8,6 +8,7 @@ kind-dependencies:
     - toolchain
 
 transforms:
+    - taskgraph.transforms.webrender:transforms
     - taskgraph.transforms.use_toolchains:transforms
     - taskgraph.transforms.job:transforms
     - taskgraph.transforms.task:transforms
@@ -462,3 +463,23 @@ jobs:
                 - 'gfx/wr/**'
                 - 'testing/mozharness/scripts/android_wrench.py'
                 - 'testing/mozharness/configs/android/wrench.py'
+
+    wrupdater-sync:
+        run-on-projects:
+            - mozilla-central
+        description: Sync webrender to github mirror
+        worker-type: b-linux
+        worker:
+            max-run-time: 3600
+            docker-image: {in-tree: webrender-updater}
+            wrupdater-secrets: true
+        run:
+            using: run-task
+            command: '$GECKO_PATH/gfx/wr/ci-scripts/wrupdater/sync-to-github.sh'
+        treeherder:
+            platform: linux64-qr/opt
+            symbol: WR(sync)
+            tier: 2
+        when:
+            files-changed:
+                - 'gfx/wr/**'

taskcluster/docker/webrender-updater/Dockerfile

@@ -0,0 +1,17 @@
+# %ARG DOCKER_IMAGE_PARENT
+FROM $DOCKER_IMAGE_PARENT
+MAINTAINER Kartikaya Gupta <kgupta@mozilla.com>
+
+VOLUME /builds/worker/checkouts
+VOLUME /builds/worker/workspace
+VOLUME /builds/worker/tooltool-cache
+VOLUME /builds/worker/.wrupdater
+
+# %include gfx/wr/ci-scripts/wrupdater/docker-setup.sh
+ADD topsrcdir/gfx/wr/ci-scripts/wrupdater/docker-setup.sh /tmp/wrup-setup.sh
+# %include gfx/wr/ci-scripts/wrupdater/requirements.txt
+ADD topsrcdir/gfx/wr/ci-scripts/wrupdater/requirements.txt /tmp/requirements.txt
+RUN /bin/bash /tmp/wrup-setup.sh && rm /tmp/wrup-setup.sh
+
+# Set a default command useful for debugging
+CMD ["/bin/bash", "--login"]

taskcluster/taskgraph/transforms/webrender.py

@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def webrender(config, tasks):
+    """Do transforms specific to webrender tasks.
+    """
+    for task in tasks:
+        # Replace the worker attribute wrupdater-secrets: true with permissions
+        # to access the github token, but only tier-3 trees (i.e. m-c and
+        # integration branches).
+        worker = task['worker']
+        if worker.get('wrupdater-secrets', False):
+            del worker['wrupdater-secrets']
+            if int(config.params['level']) == 3:
+                task.setdefault('scopes', [])
+                task['scopes'].append('secrets:get:project/webrender-ci/wrupdater-github-token')
+        yield task