.taskcluster.yml

version: 0
allowPullRequests: public
metadata:
  name: "Mozilla RelEng"
  description: "Mozilla RelEng Services"
  owner: "{{ event.head.user.email }}"
  source: "{{ event.head.repo.url }}"
tasks:

# --- frontend-common-example (master) ---

  - metadata:
      name: "frontend-common-example"
      description: "Test, build and deploy frontend-common-example"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/lib/frontend_common/example"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-frontend-common-example-*
      - assume:hook-id:project-releng/services-master-frontend-common-example-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "frontend-common-example"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- frontend-common-example (staging) ---

  - metadata:
      name: "frontend-common-example"
      description: "Test, build and deploy frontend-common-example"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/lib/frontend_common/example"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-frontend-common-example-*
      - assume:hook-id:project-releng/services-staging-frontend-common-example-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "frontend-common-example"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-archiver (master) ---

  - metadata:
      name: "releng-archiver"
      description: "Test, build and deploy releng-archiver"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_archiver"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-archiver-*
      - assume:hook-id:project-releng/services-master-releng-archiver-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-archiver"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-archiver (staging) ---

  - metadata:
      name: "releng-archiver"
      description: "Test, build and deploy releng-archiver"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_archiver"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-archiver-*
      - assume:hook-id:project-releng/services-staging-releng-archiver-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-archiver"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-clobberer (master) ---

  - metadata:
      name: "releng-clobberer"
      description: "Test, build and deploy releng-clobberer"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_clobberer"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-clobberer-*
      - assume:hook-id:project-releng/services-master-releng-clobberer-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-clobberer"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-clobberer (staging) ---

  - metadata:
      name: "releng-clobberer"
      description: "Test, build and deploy releng-clobberer"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_clobberer"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-clobberer-*
      - assume:hook-id:project-releng/services-staging-releng-clobberer-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-clobberer"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-docs (master) ---

  - metadata:
      name: "releng-docs"
      description: "Test, build and deploy releng-docs"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_docs"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-docs-*
      - assume:hook-id:project-releng/services-master-releng-docs-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-docs"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-docs (staging) ---

  - metadata:
      name: "releng-docs"
      description: "Test, build and deploy releng-docs"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_docs"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-docs-*
      - assume:hook-id:project-releng/services-staging-releng-docs-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-docs"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-docs (production) ---

  - metadata:
      name: "releng-docs"
      description: "Test, build and deploy releng-docs"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/releng_docs"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-releng-docs-*
      - assume:hook-id:project-releng/services-production-releng-docs-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-docs"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-frontend (master) ---

  - metadata:
      name: "releng-frontend"
      description: "Test, build and deploy releng-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-frontend-*
      - assume:hook-id:project-releng/services-master-releng-frontend-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-frontend (staging) ---

  - metadata:
      name: "releng-frontend"
      description: "Test, build and deploy releng-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-frontend-*
      - assume:hook-id:project-releng/services-staging-releng-frontend-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-frontend (production) ---

  - metadata:
      name: "releng-frontend"
      description: "Test, build and deploy releng-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/releng_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-releng-frontend-*
      - assume:hook-id:project-releng/services-production-releng-frontend-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-mapper (master) ---

  - metadata:
      name: "releng-mapper"
      description: "Test, build and deploy releng-mapper"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_mapper"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-mapper-*
      - assume:hook-id:project-releng/services-master-releng-mapper-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-mapper"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-mapper (staging) ---

  - metadata:
      name: "releng-mapper"
      description: "Test, build and deploy releng-mapper"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_mapper"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-mapper-*
      - assume:hook-id:project-releng/services-staging-releng-mapper-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-mapper"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-tooltool (master) ---

  - metadata:
      name: "releng-tooltool"
      description: "Test, build and deploy releng-tooltool"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_tooltool"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-tooltool-*
      - assume:hook-id:project-releng/services-master-releng-tooltool-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-tooltool"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-tooltool (staging) ---

  - metadata:
      name: "releng-tooltool"
      description: "Test, build and deploy releng-tooltool"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_tooltool"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-tooltool-*
      - assume:hook-id:project-releng/services-staging-releng-tooltool-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-tooltool"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-treestatus (master) ---

  - metadata:
      name: "releng-treestatus"
      description: "Test, build and deploy releng-treestatus"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/releng_treestatus"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-releng-treestatus-*
      - assume:hook-id:project-releng/services-master-releng-treestatus-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-treestatus"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-treestatus (staging) ---

  - metadata:
      name: "releng-treestatus"
      description: "Test, build and deploy releng-treestatus"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/releng_treestatus"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-releng-treestatus-*
      - assume:hook-id:project-releng/services-staging-releng-treestatus-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-treestatus"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- releng-treestatus (production) ---

  - metadata:
      name: "releng-treestatus"
      description: "Test, build and deploy releng-treestatus"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/releng_treestatus"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-releng-treestatus-*
      - assume:hook-id:project-releng/services-production-releng-treestatus-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "releng-treestatus"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-bot-uplift (master) ---

  - metadata:
      name: "shipit-bot-uplift"
      description: "Test, build and deploy shipit-bot-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_bot_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-bot-uplift-*
      - assume:hook-id:project-releng/services-master-shipit-bot-uplift-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-bot-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-bot-uplift (staging) ---

  - metadata:
      name: "shipit-bot-uplift"
      description: "Test, build and deploy shipit-bot-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_bot_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-bot-uplift-*
      - assume:hook-id:project-releng/services-staging-shipit-bot-uplift-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-bot-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-bot-uplift (production) ---

  - metadata:
      name: "shipit-bot-uplift"
      description: "Test, build and deploy shipit-bot-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/shipit_bot_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-shipit-bot-uplift-*
      - assume:hook-id:project-releng/services-production-shipit-bot-uplift-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-bot-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-code-coverage (master) ---

  - metadata:
      name: "shipit-code-coverage"
      description: "Test, build and deploy shipit-code-coverage"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_code_coverage"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-code-coverage-*
      - assume:hook-id:project-releng/services-master-shipit-code-coverage-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-code-coverage"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-code-coverage (staging) ---

  - metadata:
      name: "shipit-code-coverage"
      description: "Test, build and deploy shipit-code-coverage"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_code_coverage"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-code-coverage-*
      - assume:hook-id:project-releng/services-staging-shipit-code-coverage-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-code-coverage"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-frontend (master) ---

  - metadata:
      name: "shipit-frontend"
      description: "Test, build and deploy shipit-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-frontend-*
      - assume:hook-id:project-releng/services-master-shipit-frontend-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-frontend (staging) ---

  - metadata:
      name: "shipit-frontend"
      description: "Test, build and deploy shipit-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-frontend-*
      - assume:hook-id:project-releng/services-staging-shipit-frontend-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-frontend (production) ---

  - metadata:
      name: "shipit-frontend"
      description: "Test, build and deploy shipit-frontend"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/shipit_frontend"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-shipit-frontend-*
      - assume:hook-id:project-releng/services-production-shipit-frontend-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-frontend"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-pipeline (master) ---

  - metadata:
      name: "shipit-pipeline"
      description: "Test, build and deploy shipit-pipeline"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_pipeline"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-pipeline-*
      - assume:hook-id:project-releng/services-master-shipit-pipeline-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-pipeline"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-pipeline (staging) ---

  - metadata:
      name: "shipit-pipeline"
      description: "Test, build and deploy shipit-pipeline"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_pipeline"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-pipeline-*
      - assume:hook-id:project-releng/services-staging-shipit-pipeline-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-pipeline"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-pulse-listener (master) ---

  - metadata:
      name: "shipit-pulse-listener"
      description: "Test, build and deploy shipit-pulse-listener"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_pulse_listener"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-pulse-listener-*
      - assume:hook-id:project-releng/services-master-shipit-pulse-listener-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-pulse-listener"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-pulse-listener (staging) ---

  - metadata:
      name: "shipit-pulse-listener"
      description: "Test, build and deploy shipit-pulse-listener"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_pulse_listener"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-pulse-listener-*
      - assume:hook-id:project-releng/services-staging-shipit-pulse-listener-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-pulse-listener"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-risk-assessment (master) ---

  - metadata:
      name: "shipit-risk-assessment"
      description: "Test, build and deploy shipit-risk-assessment"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_risk_assessment"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-risk-assessment-*
      - assume:hook-id:project-releng/services-master-shipit-risk-assessment-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-risk-assessment"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-risk-assessment (staging) ---

  - metadata:
      name: "shipit-risk-assessment"
      description: "Test, build and deploy shipit-risk-assessment"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_risk_assessment"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-risk-assessment-*
      - assume:hook-id:project-releng/services-staging-shipit-risk-assessment-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-risk-assessment"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-signoff (master) ---

  - metadata:
      name: "shipit-signoff"
      description: "Test, build and deploy shipit-signoff"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_signoff"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-signoff-*
      - assume:hook-id:project-releng/services-master-shipit-signoff-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-signoff"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-signoff (staging) ---

  - metadata:
      name: "shipit-signoff"
      description: "Test, build and deploy shipit-signoff"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_signoff"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-signoff-*
      - assume:hook-id:project-releng/services-staging-shipit-signoff-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-signoff"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-static-analysis (master) ---

  - metadata:
      name: "shipit-static-analysis"
      description: "Test, build and deploy shipit-static-analysis"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_static_analysis"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-static-analysis-*
      - assume:hook-id:project-releng/services-master-shipit-static-analysis-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-static-analysis"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-static-analysis (staging) ---

  - metadata:
      name: "shipit-static-analysis"
      description: "Test, build and deploy shipit-static-analysis"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_static_analysis"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-static-analysis-*
      - assume:hook-id:project-releng/services-staging-shipit-static-analysis-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-static-analysis"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-taskcluster (master) ---

  - metadata:
      name: "shipit-taskcluster"
      description: "Test, build and deploy shipit-taskcluster"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_taskcluster"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-taskcluster-*
      - assume:hook-id:project-releng/services-master-shipit-taskcluster-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-taskcluster"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-taskcluster (staging) ---

  - metadata:
      name: "shipit-taskcluster"
      description: "Test, build and deploy shipit-taskcluster"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_taskcluster"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-taskcluster-*
      - assume:hook-id:project-releng/services-staging-shipit-taskcluster-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-taskcluster"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-uplift (master) ---

  - metadata:
      name: "shipit-uplift"
      description: "Test, build and deploy shipit-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/master/src/shipit_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:master
      - hooks:modify-hook:project-releng/services-master-shipit-uplift-*
      - assume:hook-id:project-releng/services-master-shipit-uplift-*
    extra:
      github:
        env: true
        events:
          - pull_request.*
          - push
        branches:
          - master
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:master"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-uplift (staging) ---

  - metadata:
      name: "shipit-uplift"
      description: "Test, build and deploy shipit-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/staging/src/shipit_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:staging
      - hooks:modify-hook:project-releng/services-staging-shipit-uplift-*
      - assume:hook-id:project-releng/services-staging-shipit-uplift-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - staging
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:staging"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"


# --- shipit-uplift (production) ---

  - metadata:
      name: "shipit-uplift"
      description: "Test, build and deploy shipit-uplift"
      owner: "{{ event.head.user.email }}"
      source: "https://github.com/mozilla-releng/services/tree/production/src/shipit_uplift"
    scopes:
      - secrets:get:repo:github.com/mozilla-releng/services:branch:production
      - hooks:modify-hook:project-releng/services-production-shipit-uplift-*
      - assume:hook-id:project-releng/services-production-shipit-uplift-*
    extra:
      github:
        env: true
        events:
          - push
        branches:
          - production
    provisionerId: "{{ taskcluster.docker.provisionerId }}"
    workerType: "{{ taskcluster.docker.workerType }}"
    payload:
      maxRunTime: 7200 # seconds (i.e. two hours)
      image: "nixos/nix:1.11"
      features:
        taskclusterProxy: true
      env:
        APP: "shipit-uplift"
        TASKCLUSTER_SECRETS: "taskcluster/secrets/v1/secret/repo:github.com/mozilla-releng/services:branch:production"
      command:
        - "/bin/bash"
        - "-c"
        - "nix-env -iA nixpkgs.gnumake nixpkgs.curl nixpkgs.cacert && export SSL_CERT_FILE=$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt && mkdir /src && cd /src && curl -L https://github.com/mozilla-releng/services/archive/$GITHUB_HEAD_SHA.tar.gz -o $GITHUB_HEAD_SHA.tar.gz && tar zxf $GITHUB_HEAD_SHA.tar.gz && cd services-$GITHUB_HEAD_SHA && ./.taskcluster.sh"