Untrusted CI tasks can't download the git bundle

[jdm]

https://community-tc.services.mozilla.com/tasks/NB1MLnKPQbOGcAgukiGbdA/runs/0/logs/https%3A%2F%2Fcommunity-tc.services.mozilla.com%2Fapi%2Fqueue%2Fv1%2Ftask%2FNB1MLnKPQbOGcAgukiGbdA%2Fruns%2F0%2Fartifacts%2Fpublic%2Flogs%2Flive.log from #24845 fails with this mesage:

+ curl --retry 5 --connect-timeout 10 -Lf https://community-tc.services.mozilla.com/api/queue/v1/task/NhzMQ6aqS_qQd4kcXS9njA/artifacts/public/repo.bundle -o repo.bundle
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 404 

This looks like a regression from #24811.

[SimonSapin]

The problem is that the decision task didn’t upload the bundle in the first place: it’s not under Artifacts in https://community-tc.services.mozilla.com/tasks/NhzMQ6aqS_qQd4kcXS9njA.

This is another case of https://bugzilla.mozilla.org/show_bug.cgi?id=1539523, similar to servo/taskcluster-config#2: for PR events, tc-github uses .taskcluster.yml from the PR’s "head" branch rather than from the merge commit. This will affect all PRs whose branch are based before #24811, until they rebase. This does not affect Homu since it relies on push events of merge commits.

We could implement a work-around to fall back to GitHub when the bundle is not found, but I don’t know if it’s worth the trouble since existing PRs will get merged/close/rebased eventually and new ones are not affected.

[SimonSapin]

We could implement a work-around

… or fix tc-github: https://bugzilla.mozilla.org/show_bug.cgi?id=1539523#c4