scriptworker 63.4.2__tar.gz → 63.4.4__tar.gz

{scriptworker-63.4.2 → scriptworker-63.4.4}/HISTORY.rst

@@ -4,7 +4,24 @@ Change Log
 All notable changes to this project will be documented in this file.
 This project adheres to `Semantic Versioning <http://semver.org/>`__.
 
+63.4.4 - 2026-09-08
+-------------------
+
+Fixed
+~~~~~
+
+- Add chain-of-trust check against generic-worker's "interactive" feature (#828)
+
+63.4.3 - 2026-09-02
+-------------------
+
+Fixed
+~~~~~
+
+- Added 'thunderbird' as a secondary owner for enterprise repos
+
 63.4.2 - 2026-08-12
+-------------------
 
 Fixed
 ~~~~~

{scriptworker-63.4.2 → scriptworker-63.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scriptworker
-Version: 63.4.2
+Version: 63.4.4
 Summary: Taskcluster scriptworker
 Author-email: Mozilla Release Engineering <releng@mozilla.com>
 License-File: LICENSE

{scriptworker-63.4.2 → scriptworker-63.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scriptworker"
-version = "63.4.2"
+version = "63.4.4"
 description = "Taskcluster scriptworker"
 authors = [
     { name = "Mozilla Release Engineering", email = "releng@mozilla.com" },

{scriptworker-63.4.2 → scriptworker-63.4.4}/src/scriptworker/constants.py

@@ -335,7 +335,10 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                 {
                                     "schemes": ("https", "ssh"),
                                     "netlocs": ("github.com",),
-                                    "path_regexes": (r"^(?P<path>/mozilla/enterprise-firefox)(/|.git|$)",),
+                                    "path_regexes": (
+                                        r"^(?P<path>/mozilla/enterprise-firefox)(/|.git|$)",
+                                        r"^(?P<path>/thunderbird/thunderbird-desktop)(/|.git|$)",
+                                    ),
                                 }
                             ),
                         ),
@@ -500,7 +503,10 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                     {
                         "adhoc": "mozilla-releng",
                         "app-services": "mozilla",
-                        "enterprise": "mozilla",
+                        "enterprise": (
+                            "mozilla",
+                            "thunderbird",
+                        ),
                         "firefox": "",
                         "glean": "mozilla",
                         "mobile": "mozilla-mobile",
@@ -650,7 +656,14 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                             }
                         ),
                         "app-services": immutabledict({"app-services-repo": ("/mozilla/application-services",)}),
-                        "enterprise": immutabledict({"enterprise-firefox-repo": ("/mozilla/enterprise-firefox",)}),
+                        "enterprise": immutabledict(
+                            {
+                                "enterprise-firefox-repo": (
+                                    "/mozilla/enterprise-firefox",
+                                    "/thunderbird/thunderbird-desktop",
+                                )
+                            }
+                        ),
                         "firefox": immutabledict(
                             {
                                 # Which repos can perform release actions?

{scriptworker-63.4.2 → scriptworker-63.4.4}/src/scriptworker/cot/verify.py

@@ -493,6 +493,7 @@ def check_interactive_docker_worker(link):
 def check_interactive_generic_worker(link):
     """Given a task, make sure the task was not defined as interactive.
 
+    * ``task.payload.features.interactive`` must be absent or False.
     * ``task.payload.rdpInfo`` must be absent or False.
     * ``task.payload.scopes`` must not contain a scope starting with ``generic-worker:allow-rdp:``
 
@@ -506,6 +507,8 @@ def check_interactive_generic_worker(link):
     errors = []
     log.info("Checking for {} {} interactive generic-worker".format(link.name, link.task_id))
     try:
+        if link.task["payload"].get("features", {}).get("interactive"):
+            errors.append("{} is interactive: task.payload.features.interactive!".format(link.name))
         if link.task["payload"].get("rdpInfo"):
             errors.append("{} is interactive: task.payload.rdpInfo!".format(link.name))
         for scope in link.task["scopes"]:

{scriptworker-63.4.2 → scriptworker-63.4.4}/src/scriptworker/github.py

@@ -296,6 +296,8 @@ def is_github_repo_owner_the_official_one(context, repo_owner):
             'This worker does not have a defined owner for official GitHub repositories. Given "official_github_repos_owner": {}'.format(official_repo_owner)
         )
 
+    elif isinstance(official_repo_owner, tuple):
+        return repo_owner in official_repo_owner
     return official_repo_owner == repo_owner