---

version: 1

reporting: checks-v1

policy:

pullRequests: public

tasks:

$let:

taskgraph:

branch: taskgraph

revision: a8366f88fc8b35b284ad550358c89ec10133fb42

trustDomain: app-services

decision_task_id: {$eval: as_slugid("decision_task")}

expires_in: {$fromNow: '1 year'}

# We define the following variable at the very top, because they are used in the

# default definition

head_rev:

$if: 'tasks_for == "github-pull-request"'

then: ${event.pull_request.head.sha}

else:

$if: 'tasks_for == "github-push"'

then: ${event.after}

else: ${event.release.tag_name}

repository:

$if: 'tasks_for == "github-pull-request"'

then: ${event.pull_request.head.repo.html_url}

else: ${event.repository.html_url}

is_repo_trusted:

# Pull requests on main repository can't be trusted because anybody can open a PR on it, without a review

$if: 'tasks_for in ["github-push", "github-release"] && event.repository.html_url == "https://github.com/mozilla/application-services"'

then: true

else: false

user:

$if: 'event.sender.login == "dependabot-preview[bot]"'

then: dependabot

else: ${event.sender.login}

in:

$let:

provisioner_id:

$if: 'is_repo_trusted'

then: 'app-services-3'

else: 'app-services-1'

# TODO: revisit once bug 1533314 is done to possibly infer better priorities

tasks_priority: highest

# Github events have this stuff in different places...

ownerEmail:

$if: 'tasks_for in ["cron", "action"]'

then: '${tasks_for}@noreply.mozilla.org'

else:

$if: 'tasks_for == "github-push"'

then: '${event.pusher.email}'

# Assume Pull Request

else:

$if: 'tasks_for == "github-pull-request"'

then: '${event.pull_request.user.login}@users.noreply.github.com'

else:

$if: 'tasks_for == "github-release"'

then: '${event.sender.login}@users.noreply.github.com'

baseRepoUrl:

$if: 'tasks_for in ["github-push", "github-release"]'

then: '${event.repository.html_url}'

else:

$if: 'tasks_for == "github-pull-request"'

then: '${event.pull_request.base.repo.html_url}'

else:

$if: 'tasks_for in ["cron", "action"]'

then: '${repository.url}'

repoUrl:

$if: 'tasks_for in ["github-push", "github-release"]'

then: '${event.repository.html_url}'

else:

$if: 'tasks_for == "github-pull-request"'

then: '${event.pull_request.head.repo.html_url}'

else:

$if: 'tasks_for in ["cron", "action"]'

then: '${repository.url}'

project:

$if: 'tasks_for in ["github-push", "github-release"]'

then: '${event.repository.name}'

else:

$if: 'tasks_for == "github-pull-request"'

then: '${event.pull_request.head.repo.name}'

else:

$if: 'tasks_for in ["cron", "action"]'

then: '${repository.project}'

head_branch:

$if: 'tasks_for == "github-pull-request"'

then: ${event.pull_request.head.ref}

else:

$if: 'tasks_for == "github-push"'

then: ${event.ref}

else:

$if: 'tasks_for == "github-release"'

then: '${event.release.target_commitish}'

else:

$if: 'tasks_for in ["cron", "action"]'

then: '${push.branch}'

head_sha:

$if: 'tasks_for == "github-push"'

then: '${event.after}'

else:

$if: 'tasks_for == "github-pull-request"'

then: '${event.pull_request.head.sha}'

else:

$if: 'tasks_for == "github-release"'

then: '${event.release.tag_name}'

else:

$if: 'tasks_for in ["cron", "action"]'

then: '${push.revision}'

ownTaskId:

$if: '"github" in tasks_for'

then: {$eval: as_slugid("decision_task")}

else:

$if: 'tasks_for == "cron"'

then: '${ownTaskId}'

pullRequestAction:

$if: 'tasks_for == "github-pull-request"'

then: ${event.action}

else: 'UNDEFINED'

releaseAction:

$if: 'tasks_for == "github-release"'

then: ${event.action}

else: 'UNDEFINED'

in:

$let:

default_task_definition:

taskId: ${decision_task_id}

taskGroupId: ${decision_task_id}

# because we're not using `reporting: checks-v1`, we need to keep using taskcluster-github as scheduler_id.

# This will change in the near future when https://github.com/mozilla/application-services/pull/1945 lands

schedulerId: taskcluster-github

created: {$fromNow: ''}

deadline: {$fromNow: '4 hours'}

expires: ${expires_in}

provisionerId: ${provisioner_id}

workerType: 'decision'

priority: ${tasks_priority}

requires: all-completed

retries: 5

scopes:

- queue:scheduler-id:taskcluster-github

routes:

- checks

metadata:

owner: &task_owner ${user}@users.noreply.github.com

source: &task_source ${repository}/raw/${head_rev}/.taskcluster.yml

extra:

tasks_for: ${tasks_for}

payload:

artifacts:

public/task-graph.json:

type: file

path: /repo/task-graph.json

expires: ${expires_in}

public/actions.json:

type: file

path: /repo/actions.json

expires: ${expires_in}

public/parameters.yml:

type: file

path: /repo/parameters.yml

expires: ${expires_in}

maxRunTime: {$eval: '20 * 60'}

# https://github.com/servo/taskcluster-bootstrap-docker-images#decision-task

image: "servobrowser/taskcluster-bootstrap:decision-task@sha256:28045b7ec0485ef363f8cb14f194008b47e9ede99f2ea40a1e945e921fce976e"

command: # TODO: servo decision-task image doesn't include pyyaml.

- /bin/bash

- --login

- -cx

- >-

env:

APPSERVICES_HEAD_REPOSITORY: ${repository}

APPSERVICES_HEAD_BRANCH: ${head_branch}

APPSERVICES_HEAD_REV: ${head_rev}

BUILD_WORKER_TYPE: b-linux

IMAGES_WORKER_TYPE: images

TASK_FOR: ${tasks_for}

TASK_OWNER: *task_owner

TASK_SOURCE: *task_source

SCHEDULER_ID: taskcluster-github

PROVISIONER_ID: ${provisioner_id}

features:

taskclusterProxy: true

in:

$match:

"(tasks_for == 'github-pull-request' && event['action'] in ['opened', 'reopened', 'synchronize']) || (tasks_for == 'github-push' && head_branch == 'refs/heads/master')":

$let:

level:

$if: 'tasks_for in ["github-push", "github-release"] && repoUrl == "https://github.com/mozilla/application-services"'

then: '3'

else: '1'

short_head_branch:

$if: 'head_branch[:11] == "refs/heads/"'

then: {$eval: 'head_branch[11:]'}

in:

$mergeDeep:

- taskGroupId:

$if: 'tasks_for == "action"'

then:

'${action.taskGroupId}'

else:

'${ownTaskId}' # same as taskId; this is how automation identifies a decision task

taskId: '${ownTaskId}'

schedulerId: '${trustDomain}-level-${level}'

created: {$fromNow: ''}

deadline: {$fromNow: '1 day'}

expires: {$fromNow: '1 year 1 second'} # 1 second so artifacts expire first, despite rounding errors

metadata:

$merge:

- owner: "${ownerEmail}"

source: '${repoUrl}/raw/${head_sha}/.taskcluster.yml'

- $if: 'tasks_for in ["github-push", "github-pull-request", "github-release"]'

then:

name: "Decision Task"

description: 'The task that creates all of the other tasks in the task graph'

provisionerId: "app-services-${level}"

workerType: "decision"

tags:

$if: 'tasks_for in ["github-push", "github-pull-request"]'

then:

kind: decision-task

routes:

$flattenDeep:

- checks

- $if: 'level == "3"'

then:

# TODO Bug 1601928: Make this scope fork-friendly once ${project} is better defined. This will enable

# staging release promotion on forks.

- $if: 'tasks_for == "github-push"'

then:

- index.project.${project}.v2.branch.${short_head_branch}.latest.taskgraph.decision

- index.project.${project}.v2.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision

- $if: 'tasks_for == "cron"'

then:

# cron context provides ${head_branch} as a short one

- index.project.${project}.v2.branch.${head_branch}.latest.taskgraph.decision-${cron.job_name}

- index.project.${project}.v2.branch.${head_branch}.revision.${head_sha}.taskgraph.decision-${cron.job_name}

- index.project.${project}.v2.branch.${head_branch}.revision.${head_sha}.taskgraph.cron.${ownTaskId}

scopes:

$if: 'tasks_for == "github-push"'

then:

# `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.

- 'assume:repo:${repoUrl[8:]}:branch:${short_head_branch}'

else:

$if: 'tasks_for == "github-pull-request"'

then:

- 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'

else:

$if: 'tasks_for == "github-release"'

then:

- 'assume:repo:${repoUrl[8:]}:release'

else:

$if: 'tasks_for == "action"'

then:

# when all actions are hooks, we can calculate this directly rather than using a variable

- '${action.repo_scope}'

else:

- 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'

requires: all-completed

priority: lowest

retries: 5

payload:

env:

# run-task uses these to check out the source; the inputs

# to `mach taskgraph decision` are all on the command line.

$merge:

- APPSERVICES_BASE_REPOSITORY: '${baseRepoUrl}'

APPSERVICES_HEAD_REPOSITORY: '${repoUrl}'

APPSERVICES_HEAD_REF: '${head_branch}'

APPSERVICES_HEAD_REV: '${head_sha}'

APPSERVICES_REPOSITORY_TYPE: git

TASKGRAPH_BASE_REPOSITORY: https://hg.mozilla.org/ci/taskgraph

TASKGRAPH_HEAD_REPOSITORY: https://hg.mozilla.org/ci/${taskgraph.branch}

TASKGRAPH_HEAD_REV: ${taskgraph.revision}

TASKGRAPH_REPOSITORY_TYPE: hg

REPOSITORIES: {$json: {appservices: "Application Services", taskgraph: "Taskgraph"}}

HG_STORE_PATH: /builds/worker/checkouts/hg-store

ANDROID_SDK_ROOT: /builds/worker/android-sdk

MOZ_FETCHES_DIR: /builds/worker/checkouts/src

- $if: 'tasks_for in ["github-pull-request"]'

then:

APPSERVICES_PULL_REQUEST_TITLE: '${event.pull_request.title}'

APPSERVICES_PULL_REQUEST_NUMBER: '${event.pull_request.number}'

features:

taskclusterProxy: true

chainOfTrust: true

# Note: This task is built server side without the context or tooling that

# exist in tree so we must hard code the hash

image:

mozillareleases/taskgraph:decision-mobile-6020473b1a928d8df50e234a7ca2e81ade2220a4fb5fbe16b02477dd64a49728@sha256:98d226736b7d03907114bf37938002b90e8a37cbe3a297690e349f1ddddb1d7c

maxRunTime: 1800

command:

- /usr/local/bin/run-task

- '--appservices-checkout=/builds/worker/checkouts/src'

- '--taskgraph-checkout=/builds/worker/checkouts/taskgraph'

- '--task-cwd=/builds/worker/checkouts/src'

- '--'

- bash

- -cx

- >

artifacts:

'public':

type: 'directory'

path: '/builds/worker/artifacts'

expires: {$fromNow: '1 year'}

extra:

$merge:

- treeherder:

$merge:

- machine:

platform: gecko-decision

- $if: 'tasks_for in ["github-push", "github-pull-request"]'

then:

symbol: D

- tasks_for: '${tasks_for}'

"tasks_for == 'github-release' && event['action'] == 'published'":

$let:

is_staging:

$if: 'event.repository.html_url != "https://github.com/mozilla/application-services"'

then: true

else: false

in:

$let:

beetmover_worker_type:

$if: 'is_staging'

then: appservices-1-beetmover

else: appservices-3-beetmover

beetmover_bucket:

$if: 'is_staging'

then: maven-staging

else: maven-production

beetmover_bucket_public_url:

$if: 'is_staging'

then: https://maven-default.stage.mozaws.net/

else: https://maven.mozilla.org/

tag: ${event.release.tag_name}

release_task_definition:

payload:

features:

chainOfTrust: true

in:

$mergeDeep:

- {$eval: 'default_task_definition'}

- {$eval: 'release_task_definition'}

- scopes:

- assume:repo:${event.repository.html_url[8:]}:release

- payload:

env:

IS_STAGING: ${is_staging}

BEETMOVER_WORKER_TYPE: ${beetmover_worker_type}

BEETMOVER_BUCKET: ${beetmover_bucket}

BEETMOVER_BUCKET_PUBLIC_URL: ${beetmover_bucket_public_url}

- metadata:

name: Application Services - Decision task (${tag})

description: Build and publish release versions.