Add test for issue 6789 (which should fail CI) since fix is in follow…

…ing commit

changelog/issue-6789.md

@@ -0,0 +1,15 @@
+audience: users
+level: patch
+reference: issue 6789
+---
+Generic Worker no longer modifies task scopes passed to Taskcluster Proxy.
+Previously there was a bug where Taskcluster Proxy would be passed the
+d2g-modified scopes by Generic Worker rather than the original task scopes from
+the task definition of the `queue.claimWork` response body. If the task was not
+also explicitly assigned the required generic-worker scopes, this would result
+in HTTP 401 errors from Taskcluster Proxy calls.
+
+This has now been fixed, so that it is sufficient for tasks with a Docker
+Worker payload to contain only Docker Worker scopes, not have the associated
+generic-worker scopes, yet still work under Generic Worker and use the
+Taskcluster Proxy feature without causing HTTP 401 errors.

workers/generic-worker/d2g_test.go

@@ -56,3 +56,29 @@ func TestWithInvalidDockerWorkerPayload(t *testing.T) {
 
 	_ = submitAndAssert(t, td, payload, "exception", "malformed-payload")
 }
+
+func TestIssue6789(t *testing.T) {
+	setup(t)
+	payload := dockerworker.DockerWorkerPayload{
+		Command: []string{"/bin/bash", "-c", "URL=\"${TASKCLUSTER_PROXY_URL}/api/queue/v1/task/${TASK_ID}\"\ncurl -v \"${URL}\"\ncurl -sf \"${URL}\""},
+		Image:   json.RawMessage(`"denolehov/curl"`),
+		Features: dockerworker.FeatureFlags{
+			TaskclusterProxy: true,
+		},
+		MaxRunTime: 10,
+		Cache: map[string]string{
+			"d2g-test": "/foo",
+		},
+	}
+	defaults.SetDefaults(&payload)
+	td := testTask(t)
+	td.Scopes = append(td.Scopes, "docker-worker:cache:d2g-test")
+
+	switch fmt.Sprintf("%s:%s", runtime.GOOS, engine) {
+	case "linux:multiuser":
+		_ = submitAndAssert(t, td, payload, "completed", "completed")
+	default:
+		_ = submitAndAssert(t, td, payload, "exception", "malformed-payload")
+	}
+	t.Log(LogText(t))
+}