[Bug]: Mismatch between firefox-ci-tc.services and github apk files

[ehdis]

Steps to reproduce

In the past the apk files in

https://firefox-ci-tc.services.mozilla.com/tasks/index/mobile.v2.fenix.release

were the same as in

https://github.com/mozilla-mobile/fenix/releases/latest

but this is not anymore. Why?

Should it be restored (for the sake of integrity and reproducibility)?

Expected behaviour

$ ls -al fenix-91.1.0-armeabi-v7a.apk target.apk
-rw-rw-r--. 1 fenix fenix 69670223 12. Aug 14:11 fenix-91.1.0-armeabi-v7a.apk
-rw-rw-r--. 1 fenix fenix 69670223 12. Aug 14:12 target.apk

$ md5sum fenix-91.1.0-armeabi-v7a.apk target.apk
403c23b5071c4be2845616adf5a8a979 fenix-91.1.0-armeabi-v7a.apk
403c23b5071c4be2845616adf5a8a979 target.apk

Actual behaviour

$ md5sum fenix-91.1.0-armeabi-v7a.apk target.apk
403c23b5071c4be2845616adf5a8a979 fenix-91.1.0-armeabi-v7a.apk
6cce866b5ec707628383ff4c19c363e8 target.apk

Device name

No response

Android version

Android

Firefox release type

Firefox

Firefox version

91.1.0

Device logs

No response

Additional information

No response

┆Issue is synchronized with this Jira Task

[bhearsum]

So, we're expecting tasks like https://firefox-ci-tc.services.mozilla.com/tasks/IXVvyIUXQqKXwnFVyZ2iBw#artifacts to publish the signed builds to Github. If we look in the log (https://firefox-ci-tc.services.mozilla.com/tasks/IXVvyIUXQqKXwnFVyZ2iBw/runs/0/logs/public/logs/live_backing.log) there's lines like:

2021-10-14 16:47:03,490 - githubscript.github - DEBUG - Existing release has the following artifacts attached: [<Asset [fenix-93.2.0-arm64-v8a.apk]>, <Asset [fenix-93.2.0-armeabi-v7a.apk]>, <Asset [fenix-93.2.0-x86.apk]>, <Asset [fenix-93.2.0-x86_64.apk]>]
/app/lib/python3.8/site-packages/aiohttp_retry/retry_options.py:51: UserWarning: RetryOptions is deprecated, use ExponentialRetry
  warn("RetryOptions is deprecated, use ExponentialRetry")
2021-10-14 16:47:03,492 - aiohttp_retry - DEBUG - Attempt 0 out of 3
2021-10-14 16:47:03,493 - aiohttp_retry - DEBUG - Attempt 0 out of 3
2021-10-14 16:47:03,494 - aiohttp_retry - DEBUG - Attempt 0 out of 3
2021-10-14 16:47:03,494 - aiohttp_retry - DEBUG - Attempt 0 out of 3
2021-10-14 16:47:03,837 - githubscript.github - INFO - Artifact "fenix-93.2.0-arm64-v8a.apk" has already been correctly uploaded to this Github release. Nothing to do.
2021-10-14 16:47:03,919 - githubscript.github - INFO - Artifact "fenix-93.2.0-x86_64.apk" has already been correctly uploaded to this Github release. Nothing to do.
2021-10-14 16:47:03,963 - githubscript.github - INFO - Artifact "fenix-93.2.0-armeabi-v7a.apk" has already been correctly uploaded to this Github release. Nothing to do.
2021-10-14 16:47:04,032 - githubscript.github - INFO - Artifact "fenix-93.2.0-x86.apk" has already been correctly uploaded to this Github release. Nothing to do.

...which means something else already did it (and presumably created the release as well).

[bhearsum]

@jcristau helped debug this. It turns out that we created two separate graphs in Taskcluster for releases -- one when we kicked it off through Ship It, and one when the github-release event fired. This is a fairly recent regression caused by a change in some account names, which we include in an ignore list.

#22100 will fix this here by ignoring all release events in Taskcluster, which we no longer have a use case for caring about.

[bhearsum]

For posterity, I created mozilla-mobile/focus-android#5689 & mozilla-mobile/android-components#11159 to fix this in those repos, too.

[bhearsum]

And to be 100% clear: both sets of release builds that were generated are fully valid, and both from the same code. There's some difference in the binaries due to non-deterministic compilation, but that's it. There's no security issues here or anything of the sort.

[jcristau]

This should be fixed now for future releases. Thanks @ehdis for the report!