.taskcluster.yml

---
version: 1
reporting: checks-v1
policy:
  # Restricted to public_restricted to avoid leaking secrets in PRs
  pullRequests: public_restricted
tasks:
  - $let:
      trustDomain: mozillavpn
      # Github events have this stuff in different places...
      ownerEmail:
        $if: 'tasks_for in ["cron", "action"]'
        then: "${tasks_for}@noreply.mozilla.org"
        else:
          $if: 'tasks_for == "github-push"'
          then: "${event.pusher.email}"
          else:
            $if: 'tasks_for[:19] == "github-pull-request"'
            then: "${event.pull_request.user.login}@users.noreply.github.com"
            else:
              $if: 'tasks_for == "github-release"'
              then: "${event.sender.login}@users.noreply.github.com"
      baseRepoUrl:
        $if: 'tasks_for in ["github-push", "github-release"]'
        then: "${event.repository.html_url}"
        else:
          $if: 'tasks_for[:19] == "github-pull-request"'
          then: "${event.pull_request.base.repo.html_url}"
          else:
            $if: 'tasks_for in ["cron", "action"]'
            then: "${repository.url}"
      repoUrl:
        $if: 'tasks_for in ["github-push", "github-release"]'
        then: "${event.repository.html_url}"
        else:
          $if: 'tasks_for[:19] == "github-pull-request"'
          then: "${event.pull_request.head.repo.html_url}"
          else:
            $if: 'tasks_for in ["cron", "action"]'
            then: "${repository.url}"
      project:
        $if: 'tasks_for in ["github-push", "github-release"]'
        then: "${event.repository.name}"
        else:
          $if: 'tasks_for[:19] == "github-pull-request"'
          then: "${event.pull_request.head.repo.name}"
          else:
            $if: 'tasks_for in ["cron", "action"]'
            then: "${repository.project}"
      head_branch:
        $if: 'tasks_for[:19] == "github-pull-request"'
        then: ${event.pull_request.head.ref}
        else:
          $if: 'tasks_for == "github-push"'
          then: ${event.ref}
          else:
            $if: 'tasks_for == "github-release"'
            then: "${event.release.target_commitish}"
            else:
              $if: 'tasks_for in ["action", "cron"]'
              then: "${push.branch}"
      head_sha:
        $if: 'tasks_for == "github-push"'
        then: "${event.after}"
        else:
          $if: 'tasks_for[:19] == "github-pull-request"'
          then: "${event.pull_request.head.sha}"
          else:
            $if: 'tasks_for == "github-release"'
            then: "${event.release.tag_name}"
            else:
              $if: 'tasks_for in ["action", "cron"]'
              then: "${push.revision}"
      head_tag:
        $if: 'tasks_for == "github-release"'
        then: "${event.release.tag_name}"
        else: ""
      ownTaskId:
        $if: '"github" in tasks_for'
        then: { $eval: as_slugid("decision_task") }
        else:
          $if: 'tasks_for in ["cron", "action"]'
          then: "${ownTaskId}"
      pullRequestAction:
        $if: 'tasks_for[:19] == "github-pull-request"'
        then: ${event.action}
        else: "UNDEFINED"
      releaseAction:
        $if: 'tasks_for == "github-release"'
        then: ${event.action}
        else: "UNDEFINED"
      isPullRequest:
        $eval: 'tasks_for[:19] == "github-pull-request"'
    in:
      $if: >
        tasks_for in ["action", "cron"]
        || (isPullRequest && pullRequestAction in ["opened", "reopened", "synchronize"])
        || (tasks_for == "github-push" && (head_branch == "refs/heads/main" || head_branch[:19] == "refs/heads/releases"))
        || (tasks_for == "github-release" && releaseAction == "published")
      then:
        $let:
          level:
            $if: 'tasks_for in ["github-push", "github-release", "action", "cron"] && repoUrl == "https://github.com/mozilla-mobile/mozilla-vpn-client"'
            then: "3"
            else: "1"
          short_head_branch:
            $if: 'head_branch[:11] == "refs/heads/"'
            then: { $eval: "head_branch[11:]" }
        in:
          taskId:
            $if: 'tasks_for != "action"'
            then: "${ownTaskId}"
          taskGroupId:
            $if: 'tasks_for == "action"'
            then: "${action.taskGroupId}"
            else: "${ownTaskId}" # same as taskId; this is how automation identifies a decision task
          schedulerId: "${trustDomain}-level-${level}"
          created: { $fromNow: "" }
          deadline: { $fromNow: "1 day" }
          expires: { $fromNow: "1 year 1 second" } # 1 second so artifacts expire first, despite rounding errors
          metadata:
            $merge:
              - owner: "${ownerEmail}"
                source: "${repoUrl}/raw/${head_sha}/.taskcluster.yml"
              - $if: 'tasks_for in ["github-push", "github-release"] || isPullRequest'
                then:
                  name: "Decision Task (${tasks_for[7:]})" # strip out "github-" from tasks_for
                  description: "The task that creates all of the other tasks in the task graph"
              - $if: 'tasks_for == "action"'
                then:
                  name: "Action: ${action.title}"
                  description: |
                    ${action.description}

                    Action triggered by clientID `${clientId}`
              - $if: 'tasks_for == "cron"'
                then:
                  name: "Decision Task for cron job ${cron.job_name}"
                  description: "Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id})"
          provisionerId: "mozillavpn-${level}"
          workerType: "decision-gcp"

          tags:
            $if: 'tasks_for == "github-push" || isPullRequest'
            then:
              kind: decision-task
            else:
              $if: 'tasks_for == "action"'
              then:
                kind: "action-callback"
              else:
                $if: 'tasks_for == "cron"'
                then:
                  kind: cron-task

          routes:
            $flattenDeep:
              - checks
              - $if: "!isPullRequest"
                then:
                  - tc-treeherder.v2.${project}.${head_sha}
                  # ${project} uniquely identifies the repo within this trust domain, and each project only has scopes
                  # to its own index namespace to avoid collisions
                  - $if: 'tasks_for == "github-push"'
                    then:
                      - index.mozillavpn.v2.${project}.branch.${short_head_branch}.latest.taskgraph.decision
                      - index.mozillavpn.v2.${project}.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision
                      - index.mozillavpn.v2.${project}.revision.${head_sha}.taskgraph.decision
                  - $if: 'tasks_for == "github-release"'
                    then:
                      - index.mozillavpn.v2.${project}.release.${head_tag}.taskgraph.decision
                  - $if: 'tasks_for == "cron"'
                    then:
                      # cron context provides ${head_branch} as a short one
                      - index.mozillavpn.v2.${project}.branch.${head_branch}.latest.taskgraph.decision-${cron.job_name}
                      - index.mozillavpn.v2.${project}.branch.${head_branch}.revision.${head_sha}.taskgraph.decision-${cron.job_name}
                      - index.mozillavpn.v2.${project}.branch.${head_branch}.revision.${head_sha}.taskgraph.cron.${ownTaskId}

          scopes:
            $if: 'tasks_for == "github-push"'
            then:
              # `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.
              - "assume:repo:${repoUrl[8:]}:branch:${short_head_branch}"
              - "secrets:get:project/mozillavpn/tokens"
            else:
              $if: "isPullRequest"
              then:
                - "assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}"
              else:
                $if: 'tasks_for == "github-release"'
                then:
                  - "assume:repo:${repoUrl[8:]}:release:${releaseAction}"
                else:
                  $if: 'tasks_for == "action"'
                  then:
                    # when all actions are hooks, we can calculate this directly rather than using a variable
                    - "${action.repo_scope}"
                  else:
                    - "assume:repo:${repoUrl[8:]}:cron:${cron.job_name}"

          requires: all-completed
          priority: lowest
          retries: 5

          payload:
            env:
              # run-task uses these to check out the source; the inputs
              # to `mach taskgraph decision` are all on the command line.
              $merge:
                - MOZILLAVPN_BASE_REPOSITORY: "${baseRepoUrl}"
                  MOZILLAVPN_HEAD_REPOSITORY: "${repoUrl}"
                  MOZILLAVPN_HEAD_REF: "${head_branch}"
                  MOZILLAVPN_HEAD_REV: "${head_sha}"
                  MOZILLAVPN_HEAD_TAG: "${head_tag}"
                  MOZILLAVPN_REPOSITORY_TYPE: git
                  # This project depends on mozilla-taskgraph, so we still install requirements during decision task
                  MOZILLAVPN_PIP_REQUIREMENTS: taskcluster/requirements.txt
                  REPOSITORIES: { $json: { mozillavpn: "MozillaVPN" } }
                  ANDROID_SDK_ROOT: /builds/worker/android-sdk
                - $if: "isPullRequest"
                  then:
                    MOZILLAVPN_PULL_REQUEST_NUMBER: "${event.pull_request.number}"
                - $if: 'tasks_for == "action"'
                  then:
                    ACTION_TASK_GROUP_ID: "${action.taskGroupId}" # taskGroupId of the target task
                    ACTION_TASK_ID: { $json: { $eval: "taskId" } } # taskId of the target task (JSON-encoded)
                    ACTION_INPUT: { $json: { $eval: "input" } }
                    ACTION_CALLBACK: "${action.cb_name}"
            features:
              taskclusterProxy: true
              chainOfTrust: true

            # Note: This task is built server side without the context or tooling that
            # exist in tree so we must hard code the hash
            image: mozillareleases/taskgraph:decision-v11.2.4@sha256:eb53b1ca6b86b1344d61f55aab77b130048c0ae007eef181ec82eec327e91e07

            maxRunTime: 1800

            command:
              - run-task
              - "--mozillavpn-checkout=/builds/worker/checkouts/src"
              - "--task-cwd=/builds/worker/checkouts/src"
              - "--"
              - bash
              - -cx
              - $let:
                  extraArgs:
                    {
                      $if: 'tasks_for == "cron"',
                      then: "${cron.quoted_args}",
                      else: "",
                    }
                in:
                  $if: 'tasks_for == "action"'
                  then: >
                    ln -s /builds/worker/artifacts artifacts &&
                    taskgraph action-callback
                  else: >
                    ln -s /builds/worker/artifacts artifacts &&
                    taskgraph decision
                    --pushlog-id='0'
                    --pushdate='0'
                    --project='${project}'
                    --message=""
                    --owner='${ownerEmail}'
                    --level='${level}'
                    --base-repository="$MOZILLAVPN_BASE_REPOSITORY"
                    --head-repository="$MOZILLAVPN_HEAD_REPOSITORY"
                    --head-ref="$MOZILLAVPN_HEAD_REF"
                    --head-rev="$MOZILLAVPN_HEAD_REV"
                    --head-tag="$MOZILLAVPN_HEAD_TAG"
                    --repository-type="$MOZILLAVPN_REPOSITORY_TYPE"
                    --tasks-for='${tasks_for}'
                    ${extraArgs}

            artifacts:
              "public":
                type: "directory"
                path: "/builds/worker/artifacts"
                expires: { $fromNow: "1 year" }
              "public/docker-contexts":
                type: "directory"
                path: "/builds/worker/checkouts/src/docker-contexts"
                # This needs to be at least the deadline of the
                # decision task + the docker-image task deadlines.
                # It is set to a week to allow for some time for
                # debugging, but they are not useful long-term.
                expires: { $fromNow: "7 day" }

          extra:
            $merge:
              - treeherder:
                  $merge:
                    - machine:
                        platform: gecko-decision
                    - $if: 'tasks_for == "github-push" || isPullRequest'
                      then:
                        symbol: D
                      else:
                        $if: 'tasks_for == "github-release"'
                        then:
                          symbol: "ship_mozillavpn"
                        else:
                          $if: 'tasks_for == "action"'
                          then:
                            groupName: "action-callback"
                            groupSymbol: AC
                            symbol: "${action.symbol}"
                          else:
                            groupSymbol: cron
                            symbol: "${cron.job_symbol}"
              - $if: 'tasks_for == "action"'
                then:
                  parent: "${action.taskGroupId}"
                  action:
                    name: "${action.name}"
                    context:
                      taskGroupId: "${action.taskGroupId}"
                      taskId: { $eval: "taskId" }
                      input: { $eval: "input" }
                      clientId: { $eval: "clientId" }
              - $if: 'tasks_for == "cron"'
                then:
                  cron: { $json: { $eval: "cron" } }
              - tasks_for: "${tasks_for}"