scriptworker 63.4.3__tar.gz → 63.4.5__tar.gz

{scriptworker-63.4.3 → scriptworker-63.4.5}/HISTORY.rst

@@ -4,6 +4,22 @@ Change Log
 All notable changes to this project will be documented in this file.
 This project adheres to `Semantic Versioning <http://semver.org/>`__.
 
+63.4.5 - 2026-09-11
+-------------------
+
+Fixed
+~~~~~
+
+- Add `mozilla-firefox/firefox` as a trusted repo for Firefox
+
+63.4.4 - 2026-09-08
+-------------------
+
+Fixed
+~~~~~
+
+- Add chain-of-trust check against generic-worker's "interactive" feature (#828)
+
 63.4.3 - 2026-09-02
 -------------------
 

{scriptworker-63.4.3 → scriptworker-63.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scriptworker
-Version: 63.4.3
+Version: 63.4.5
 Summary: Taskcluster scriptworker
 Author-email: Mozilla Release Engineering <releng@mozilla.com>
 License-File: LICENSE

{scriptworker-63.4.3 → scriptworker-63.4.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scriptworker"
-version = "63.4.3"
+version = "63.4.5"
 description = "Taskcluster scriptworker"
 authors = [
     { name = "Mozilla Release Engineering", email = "releng@mozilla.com" },

{scriptworker-63.4.3 → scriptworker-63.4.5}/src/scriptworker/constants.py

@@ -356,6 +356,13 @@ DEFAULT_CONFIG: immutabledict[str, Any] = immutabledict(
                                     ),
                                 }
                             ),
+                            immutabledict(
+                                {
+                                    "schemes": ("https", "ssh"),
+                                    "netlocs": ("github.com",),
+                                    "path_regexes": (r"^(?P<path>/mozilla-firefox/firefox)(/|.git|$)",),
+                                }
+                            ),
                         ),
                         "glean": (
                             immutabledict(

{scriptworker-63.4.3 → scriptworker-63.4.5}/src/scriptworker/cot/verify.py

@@ -493,6 +493,7 @@ def check_interactive_docker_worker(link):
 def check_interactive_generic_worker(link):
     """Given a task, make sure the task was not defined as interactive.
 
+    * ``task.payload.features.interactive`` must be absent or False.
     * ``task.payload.rdpInfo`` must be absent or False.
     * ``task.payload.scopes`` must not contain a scope starting with ``generic-worker:allow-rdp:``
 
@@ -506,6 +507,8 @@ def check_interactive_generic_worker(link):
     errors = []
     log.info("Checking for {} {} interactive generic-worker".format(link.name, link.task_id))
     try:
+        if link.task["payload"].get("features", {}).get("interactive"):
+            errors.append("{} is interactive: task.payload.features.interactive!".format(link.name))
         if link.task["payload"].get("rdpInfo"):
             errors.append("{} is interactive: task.payload.rdpInfo!".format(link.name))
         for scope in link.task["scopes"]: