.taskcluster.yml

---
version: 1
reporting: checks-v1
policy:
    pullRequests: public_restricted
tasks:
    - $let:
        # Project-specific trustDomain
        trustDomain: mobile
        canonicalRepo: https://github.com/mozilla-mobile/firefox-ios

        # Github events have this stuff in different places...
        ownerEmail:
            $if: 'tasks_for in ["cron", "action"]'
            then: '${tasks_for}@noreply.mozilla.org'
            else:
                $if: 'tasks_for == "github-push"'
                then: '${event.pusher.email}'
                # Assume Pull Request
                else:
                    $if: 'tasks_for[:19] == "github-pull-request"'
                    then: '${event.pull_request.user.login}@users.noreply.github.com'
                    else:
                        $if: 'tasks_for == "github-release"'
                        then: '${event.sender.login}@users.noreply.github.com'
        baseRepoUrl:
            $if: 'tasks_for in ["github-push", "github-release"]'
            then: '${event.repository.html_url}'
            else:
                $if: 'tasks_for[:19] == "github-pull-request"'
                then: '${event.pull_request.base.repo.html_url}'
                else:
                    $if: 'tasks_for in ["cron", "action"]'
                    then: '${repository.url}'
        repoUrl:
            $if: 'tasks_for in ["github-push", "github-release"]'
            then: '${event.repository.html_url}'
            else:
                $if: 'tasks_for[:19] == "github-pull-request"'
                then: '${event.pull_request.head.repo.html_url}'
                else:
                    $if: 'tasks_for in ["cron", "action"]'
                    then: '${repository.url}'
        project:
            $if: 'tasks_for in ["github-push", "github-release"]'
            then: '${event.repository.name}'
            else:
                $if: 'tasks_for[:19] == "github-pull-request"'
                then: '${event.pull_request.head.repo.name}'
                else:
                    $if: 'tasks_for in ["cron", "action"]'
                    then: '${repository.project}'
        head_branch:
            $if: 'tasks_for[:19] == "github-pull-request"'
            then: ${event.pull_request.head.ref}
            else:
                $if: 'tasks_for == "github-push"'
                then: ${event.ref}
                else:
                    $if: 'tasks_for == "github-release"'
                    then: '${event.release.target_commitish}'
                    else:
                        $if: 'tasks_for in ["action", "cron"]'
                        then: '${push.branch}'
        head_sha:
            $if: 'tasks_for == "github-push"'
            then: '${event.after}'
            else:
                $if: 'tasks_for[:19] == "github-pull-request"'
                then: '${event.pull_request.head.sha}'
                else:
                    $if: 'tasks_for == "github-release"'
                    then: '${event.release.tag_name}'
                    else:
                        $if: 'tasks_for in ["action", "cron"]'
                        then: '${push.revision}'
        head_tag:
            $if: 'tasks_for == "github-release"'
            then: '${event.release.tag_name}'
            else: ''
        ownTaskId:
            $if: '"github" in tasks_for'
            then: {$eval: as_slugid("decision_task")}
            else:
                $if: 'tasks_for in ["cron", "action"]'
                then: '${ownTaskId}'
        pullRequestAction:
            $if: 'tasks_for[:19] == "github-pull-request"'
            then: ${event.action}
            else: 'UNDEFINED'
        releaseAction:
            $if: 'tasks_for == "github-release"'
            then: ${event.action}
            else: 'UNDEFINED'
        isPullRequest:
            $eval: 'tasks_for[:19] == "github-pull-request"'
      in:
        $let:
            level:
                $if: 'tasks_for in ["github-push", "github-release", "action", "cron"] && repoUrl == canonicalRepo'
                then: '3'
                else: '1'
            short_head_branch:
                $if: 'head_branch[:11] == "refs/heads/"'
                then: {$eval: 'head_branch[11:]'}
                else: '${head_branch}'
        in:
            $if: >
              tasks_for in ["action", "cron"]
              || (isPullRequest && pullRequestAction in ["opened", "reopened", "synchronize"])
              || (tasks_for == "github-push" && short_head_branch == "main")
              || (tasks_for == "github-release" && releaseAction == "published")
            then:
                taskId:
                    $if: 'tasks_for != "action"'
                    then: '${ownTaskId}'
                taskGroupId:
                    $if: 'tasks_for == "action"'
                    then: '${action.taskGroupId}'
                    else: '${ownTaskId}'  # same as taskId; this is how automation identifies a decision task
                schedulerId: '${trustDomain}-level-${level}'
                created: {$fromNow: ''}
                deadline: {$fromNow: '1 day'}
                expires: {$fromNow: '1 year 1 second'}  # 1 second so artifacts expire first, despite rounding errors
                metadata:
                    $merge:
                        - owner: "${ownerEmail}"
                          source: '${repoUrl}/raw/${head_sha}/.taskcluster.yml'
                        - $if: 'isPullRequest || tasks_for in ["github-push", "github-release"]'
                          then:
                            name: "Decision Task (${tasks_for[7:]})"  # strip out "github-" from tasks_for
                            description: 'The task that creates all of the other tasks in the task graph'
                          else:
                            $if: 'tasks_for == "action"'
                            then:
                                name: "Action: ${action.title}"
                                description: '${action.description}'
                            else:
                                name: "Decision Task for cron job ${cron.job_name}"
                                description: 'Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id})'
                provisionerId: "${trustDomain}-${level}"
                workerType: "decision-gcp"
                tags:
                    $if: 'tasks_for == "github-push" || isPullRequest'
                    then:
                        kind: decision-task
                    else:
                        $if: 'tasks_for == "action"'
                        then:
                            kind: 'action-callback'
                        else:
                            $if: 'tasks_for == "cron"'
                            then:
                                kind: cron-task
                routes:
                    $flattenDeep:
                        - checks
                        - $if: '!isPullRequest'
                          then:
                            - tc-treeherder.v2.${project}.${head_sha}
                            - $if: 'tasks_for == "github-push"'
                              then:
                                - index.${trustDomain}.v2.${project}.branch.${short_head_branch}.latest.taskgraph.decision
                                - index.${trustDomain}.v2.${project}.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision
                                - index.${trustDomain}.v2.${project}.revision.${head_sha}.taskgraph.decision
                            - $if: 'tasks_for == "cron"'
                              then:
                                # cron context provides ${head_branch} as a short one
                                - index.${trustDomain}.v2.${project}.branch.${head_branch}.latest.taskgraph.decision-${cron.job_name}
                                - index.${trustDomain}.v2.${project}.branch.${head_branch}.revision.${head_sha}.taskgraph.decision-${cron.job_name}
                                - index.${trustDomain}.v2.${project}.branch.${head_branch}.revision.${head_sha}.taskgraph.cron.${ownTaskId}
                scopes:
                    $if: 'tasks_for == "github-push"'
                    then:
                        # `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.
                        - 'assume:repo:${repoUrl[8:]}:branch:${short_head_branch}'
                    else:
                        $if: 'isPullRequest'
                        then:
                            - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
                        else:
                            $if: 'tasks_for == "github-release"'
                            then:
                                - 'assume:repo:${repoUrl[8:]}:release:${releaseAction}'
                            else:
                                $if: 'tasks_for == "action"'
                                then:
                                    # when all actions are hooks, we can calculate this directly rather than using a variable
                                    - '${action.repo_scope}'
                                else:
                                    - 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'

                requires: all-completed
                priority: lowest
                retries: 5

                payload:
                    env:
                        # run-task uses these to check out the source; the inputs
                        # to `mach taskgraph decision` are all on the command line.
                        $merge:
                            - MOBILE_BASE_REPOSITORY: '${baseRepoUrl}'
                              MOBILE_HEAD_REPOSITORY: '${repoUrl}'
                              MOBILE_HEAD_REF: '${head_branch}'
                              MOBILE_HEAD_REV: '${head_sha}'
                              MOBILE_HEAD_TAG: '${head_tag}'
                              MOBILE_REPOSITORY_TYPE: git
                              MOBILE_PIP_REQUIREMENTS: taskcluster/requirements.txt
                              REPOSITORIES: {$json: {mobile: "Firefox for iOS"}}
                              HG_STORE_PATH: /builds/worker/checkouts/hg-store
                              ANDROID_SDK_ROOT: /builds/worker/android-sdk
                              TASKCLUSTER_CACHES: /builds/worker/checkouts
                            - $if: 'isPullRequest'
                              then:
                                MOBILE_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                            - $if: 'tasks_for == "action"'
                              then:
                                ACTION_TASK_GROUP_ID: '${action.taskGroupId}'  # taskGroupId of the target task
                                ACTION_TASK_ID: {$json: {$eval: 'taskId'}}  # taskId of the target task (JSON-encoded)
                                ACTION_INPUT: {$json: {$eval: 'input'}}
                                ACTION_CALLBACK: '${action.cb_name}'
                            - $if: 'tasks_for == "github-release"'
                              then:
                                MOBILE_HEAD_TAG: '${event.release.tag_name}'
                    cache:
                        "${trustDomain}-level-${level}-checkouts-v1": /builds/worker/checkouts
                    features:
                        taskclusterProxy: true
                        chainOfTrust: true

                    # Note: This task is built server side without the context or tooling that
                    # exist in tree so we must hard code the hash
                    image:
                        mozillareleases/taskgraph:decision-v13.1.0@sha256:8ff59a0d89e8fd7bbdc236cf1fb15e03be9ef67d7e74ed8ffe15f27765593ecd
                    maxRunTime: 1800

                    command:
                        - /usr/local/bin/run-task
                        - '--mobile-checkout=/builds/worker/checkouts/src'
                        - '--task-cwd=/builds/worker/checkouts/src'
                        - '--'
                        - bash
                        - -cx
                        - $let:
                              extraArgs: {$if: 'tasks_for == "cron"', then: '${cron.quoted_args}', else: ''}
                          in:
                              $if: 'tasks_for == "action"'
                              then: >
                                  ln -s /builds/worker/artifacts artifacts &&
                                  taskgraph action-callback
                              else: >
                                  ln -s /builds/worker/artifacts artifacts &&
                                  taskgraph decision
                                  --pushlog-id='0'
                                  --pushdate='0'
                                  --project='${project}'
                                  --message=""
                                  --owner='${ownerEmail}'
                                  --level='${level}'
                                  --base-repository="$MOBILE_BASE_REPOSITORY"
                                  --head-repository="$MOBILE_HEAD_REPOSITORY"
                                  --head-ref="$MOBILE_HEAD_REF"
                                  --head-rev="$MOBILE_HEAD_REV"
                                  --head-tag="$MOBILE_HEAD_TAG"
                                  --repository-type="$MOBILE_REPOSITORY_TYPE"
                                  --tasks-for='${tasks_for}'
                                  ${extraArgs}

                    artifacts:
                        'public':
                            type: 'directory'
                            path: '/builds/worker/artifacts'
                            expires: {$fromNow: '1 year'}
                        'public/docker-contexts':
                            type: 'directory'
                            path: '/builds/worker/checkouts/src/docker-contexts'
                            # This needs to be at least the deadline of the
                            # decision task + the docker-image task deadlines.
                            # It is set to a week to allow for some time for
                            # debugging, but they are not useful long-term.
                            expires: {$fromNow: '7 day'}

                extra:
                    $merge:
                        - treeherder:
                            $merge:
                                - machine:
                                    platform: gecko-decision
                                - $if: 'tasks_for  == "github-push" || isPullRequest'
                                  then:
                                    symbol: D
                                  else:
                                    $if: 'tasks_for == "action"'
                                    then:
                                        groupName: 'action-callback'
                                        groupSymbol: AC
                                        symbol: "${action.symbol}"
                                    else:
                                        groupSymbol: cron
                                        symbol: "${cron.job_symbol}"
                        - $if: 'tasks_for == "action"'
                          then:
                            parent: '${action.taskGroupId}'
                            action:
                                name: '${action.name}'
                                context:
                                    taskGroupId: '${action.taskGroupId}'
                                    taskId: {$eval: 'taskId'}
                                    input: {$eval: 'input'}
                        - $if: 'tasks_for == "cron"'
                          then:
                            cron: {$json: {$eval: 'cron'}}
                        - tasks_for: '${tasks_for}'