taskcluster-taskgraph 21.0.0__tar.gz → 22.0.0__tar.gz

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/.pre-commit-config.yaml

@@ -48,6 +48,5 @@ exclude: |
   (?x)^(
     src/taskgraph/run-task/fetch-content |
     src/taskgraph/run-task/robustcheckout.py |
-    src/taskgraph/run-task/run-task |
-    taskcluster/scripts/external_tools
+    src/taskgraph/run-task/run-task
   )

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/.taskcluster.yml

@@ -226,7 +226,6 @@ tasks:
                               - $if: 'isPullRequest'
                                 then:
                                     TASKGRAPH_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
-                                    TASKGRAPH_EXTRA_REFS: {$json: ["refs/notes/decision-parameters"]}
                               - $if: 'tasks_for == "action" || tasks_for == "pr-action"'
                                 then:
                                     ACTION_TASK_GROUP_ID: '${action.taskGroupId}'  # taskGroupId of the target task

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Change Log
 
+## [22.0.0] - 2026-04-16
+
+### Fixed
+
+- Decision task now fetches `refs/notes/decision-parameters` itself
+
+### Removed
+
+- BREAKING CHANGE: Removed ability for `run-task` to fetch arbitrary extra refs
+- BREAKING CHANGE: Removed docker-worker feature: relengapi-proxy
+
 ## [21.0.0] - 2026-04-13
 
 ### Added

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskcluster-taskgraph
-Version: 21.0.0
+Version: 22.0.0
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/docs/reference/migrations.rst

@@ -3,6 +3,14 @@ Migration Guide
 
 This page can help when migrating Taskgraph across major versions.
 
+21.x -> 22.x
+------------
+
+* If you have tasks using `docker-worker`'s `relengapi-proxy` feature, it is no
+  longer supported. Remove all references to it in your task definitions.
+* Remove references to `<REPO>_EXTRA_REFS` in all `run-task` based tasks. These
+  refs must now be fetched as part of the task payload.
+
 20.x -> 21.x
 ------------
 

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "21.0.0"
+version = "22.0.0"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [
@@ -94,7 +94,6 @@ source = ["src/taskgraph/", "src/taskgraph/run-task/", "packages", "test"]
 ### Lint and Format
 [tool.ruff]
 extend-exclude = [
-  "taskcluster/scripts/external_tools",
   "src/taskgraph/run-task/robustcheckout.py"
 ]
 line-length = 88

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/src/taskgraph/decision.py

@@ -267,7 +267,7 @@ def get_decision_parameters(graph_config, options):
     # load extra parameters from vcs note if able
     note_ref = "refs/notes/decision-parameters"
     if options.get("allow_parameter_override") and (
-        note_params := repo.get_note(note_ref)
+        note_params := repo.get_note(note_ref, parameters["head_repository"])
     ):
         try:
             note_params = json.loads(note_params)

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/src/taskgraph/run-task/run-task

@@ -31,7 +31,7 @@ import time
 import urllib.error
 import urllib.request
 from pathlib import Path
-from typing import Dict, List, Optional
+from typing import Dict, Optional
 
 SECRET_BASEURL_TPL = "{}/secrets/v1/secret/{{}}".format(
     os.environ.get("TASKCLUSTER_PROXY_URL", "http://taskcluster").rstrip("/")
@@ -640,7 +640,6 @@ def git_checkout(
     ssh_key_file: Optional[Path],
     ssh_known_hosts_file: Optional[Path],
     shallow: bool = False,
-    extra_refs: Optional[List[str]] = None,
 ):
     assert head_ref or head_rev
 
@@ -735,14 +734,6 @@ def git_checkout(
         env=env,
     )
 
-    if extra_refs:
-        git_fetch(
-            destination_path,
-            *[f"{ref}:{ref}" for ref in extra_refs],
-            remote=head_repo,
-            env=env,
-        )
-
     args = [
         "git",
         "checkout",
@@ -941,8 +932,6 @@ def collect_vcs_options(args, project, name):
     head_rev = os.environ.get(f"{env_prefix}_HEAD_REV")
     pip_requirements = os.environ.get(f"{env_prefix}_PIP_REQUIREMENTS")
     private_key_secret = os.environ.get(f"{env_prefix}_SSH_SECRET_NAME")
-    if extra_refs := os.environ.get(f"{env_prefix}_EXTRA_REFS"):
-        extra_refs = json.loads(extra_refs)
 
     store_path = os.environ.get("HG_STORE_PATH")
 
@@ -976,7 +965,6 @@ def collect_vcs_options(args, project, name):
         "ssh-secret-name": private_key_secret,
         "pip-requirements": pip_requirements,
         "shallow-clone": shallow_clone,
-        "extra-refs": extra_refs,
     }
 
 
@@ -1026,7 +1014,6 @@ def vcs_checkout_from_args(options):
                 ssh_key_file,
                 ssh_known_hosts_file,
                 shallow=options.get("shallow-clone", False),
-                extra_refs=options.get("extra-refs"),
             )
         elif options["repo-type"] == "hg":
             revision = hg_checkout(

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/src/taskgraph/transforms/task.py

@@ -268,7 +268,6 @@ class DockerWorkerPayloadSchema(Schema, forbid_unknown_fields=False, kw_only=Tru
     # image or in-tree docker image to run the task in.
     docker_image: DockerImage
     # worker features that should be enabled
-    relengapi_proxy: bool
     chain_of_trust: bool
     taskcluster_proxy: bool
     allow_ptrace: bool
@@ -340,9 +339,6 @@ def build_docker_worker_payload(config, task, task_def):
 
     features = {}
 
-    if worker.get("relengapi-proxy"):
-        features["relengAPIProxy"] = True
-
     if worker.get("taskcluster-proxy"):
         features["taskclusterProxy"] = True
 
@@ -798,7 +794,6 @@ def set_defaults(config, tasks):
 
         worker = task["worker"]
         if worker["implementation"] in ("docker-worker",):
-            worker.setdefault("relengapi-proxy", False)
             worker.setdefault("chain-of-trust", False)
             worker.setdefault("taskcluster-proxy", False)
             worker.setdefault("allow-ptrace", False)

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/src/taskgraph/util/vcs.py

@@ -215,9 +215,17 @@ class Repository(ABC):
         If this function returns an unexpected value, then make sure
         the revision was fetched from the remote repository."""
 
-    def get_note(self, note: str, revision: Optional[str] = None) -> Optional[str]:
+    def get_note(
+        self,
+        note: str,
+        remote: str,
+        revision: Optional[str] = None,
+    ) -> Optional[str]:
         """Read a note attached to the given revision (defaults to HEAD).
 
+        The notes ref is fetched from ``remote`` first; a missing ref on the
+        remote is tolerated while other fetch failures propagate.
+
         Returns the note content as a string, or ``None`` if no note exists.
         Only supported by Git; returns ``None`` for all other VCS types.
         """
@@ -594,13 +602,37 @@ class GitRepository(Repository):
                 return False
             raise
 
-    def get_note(self, note: str, revision: Optional[str] = None) -> Optional[str]:
+    def get_note(
+        self,
+        note: str,
+        remote: str,
+        revision: Optional[str] = None,
+    ) -> Optional[str]:
         if not note.startswith("refs/notes/"):
             note = f"refs/notes/{note}"
 
-        revision = revision or "HEAD"
         try:
-            return self.run("notes", f"--ref={note}", "show", revision).strip()
+            self.run("fetch", remote, f"{note}:{note}", stderr=subprocess.PIPE)
+        except subprocess.CalledProcessError:
+            ls_output = self.run(
+                "ls-remote",
+                "--exit-code",
+                remote,
+                note,
+                return_codes=(2,),
+                stderr=subprocess.PIPE,
+            )
+            if not ls_output:
+                logger.info(
+                    "Failed to fetch %s but the remote doesn't have it. Ignoring.", note
+                )
+                return None
+            raise
+
+        try:
+            return self.run(
+                "notes", f"--ref={note}", "show", revision or "HEAD"
+            ).strip()
         except subprocess.CalledProcessError as e:
             if e.returncode == 1:
                 return None

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/test/conftest.py

@@ -1,5 +1,6 @@
 import os
 import platform
+import tempfile
 from pathlib import Path
 
 import pytest
@@ -13,10 +14,22 @@ pytest_plugins = ("pytest-taskgraph",)
 # interference with tests.
 # This ignores ~/.hgrc
 os.environ["HGRCPATH"] = ""
-# This ignores system-level git config (eg: in /etc). There apperas to be
-# no way to ignore ~/.gitconfig other than overriding $HOME, which is overkill.
+# This ignores system-level git config (eg: in /etc).
 os.environ["GIT_CONFIG_NOSYSTEM"] = "1"
 
+
+@pytest.fixture(scope="session", autouse=True)
+def git_global_config():
+    # run-task writes to the global git config, so point it at a real
+    # (writable) empty file instead of ~/.gitconfig.
+    fd, path = tempfile.mkstemp(prefix="taskgraph-gitconfig-")
+    os.close(fd)
+    os.environ["GIT_CONFIG_GLOBAL"] = path
+    yield
+    del os.environ["GIT_CONFIG_GLOBAL"]
+    os.unlink(path)
+
+
 # Some of the tests marked with this may be fixable on Windows; we should
 # look into these in more depth at some point.
 nowin = pytest.mark.skipif(

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/test/test_decision.py

@@ -167,7 +167,9 @@ _BASE_OPTIONS = {
 def test_decision_parameters_note(mock_files_changed, mock_get_note):
     options = {**_BASE_OPTIONS, "allow_parameter_override": True}
     params = decision.get_decision_parameters(FAKE_GRAPH_CONFIG, options)
-    mock_get_note.assert_called_once_with("refs/notes/decision-parameters")
+    mock_get_note.assert_called_once_with(
+        "refs/notes/decision-parameters", _BASE_OPTIONS["head_repository"]
+    )
     assert params["build_number"] == 99
 
 

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/test/test_scripts_run_task.py

@@ -1,5 +1,4 @@
 import functools
-import json
 import os
 import site
 import stat
@@ -180,17 +179,6 @@ def test_install_pip_requirements_with_uv(
             {"shallow-clone": True},
             id="git_with_shallow_clone",
         ),
-        pytest.param(
-            {},
-            {
-                "REPOSITORY_TYPE": "git",
-                "HEAD_REPOSITORY": "https://github.com/example/repo",
-                "HEAD_REV": "abc123",
-                "EXTRA_REFS": json.dumps(["refs/notes/taskgraph", "refs/notes/other"]),
-            },
-            {"extra-refs": ["refs/notes/taskgraph", "refs/notes/other"]},
-            id="git_with_extra_refs",
-        ),
     ],
 )
 def test_collect_vcs_options(
@@ -228,7 +216,6 @@ def test_collect_vcs_options(
         "shallow-clone": False,
         "ssh-secret-name": env.get("SSH_SECRET_NAME"),
         "store-path": env.get("HG_STORE_PATH"),
-        "extra-refs": None,
     }
     if "PIP_REQUIREMENTS" in env:
         expected["pip-requirements"] = os.path.join(
@@ -651,36 +638,3 @@ def test_main_abspath_environment(mocker, run_main):
     assert env.get("MOZ_UV_HOME") == "/builds/worker/dir/uv"
     for key in envvars:
         assert env[key] == "/builds/worker/file"
-
-
-def test_git_checkout_extra_refs(mock_stdin, run_task_mod, mock_git_repo, tmp_path):
-    """extra_refs are fetched into the local repo during checkout."""
-    # Add a notes ref to the source repo
-    rev = mock_git_repo["main"][-1]
-    subprocess.check_call(
-        ["git", "notes", "--ref=refs/notes/taskgraph", "add", "-m", "test", rev],
-        cwd=mock_git_repo["path"],
-    )
-
-    destination = tmp_path / "destination"
-    run_task_mod.git_checkout(
-        destination_path=str(destination),
-        head_repo=mock_git_repo["path"],
-        base_repo=mock_git_repo["path"],
-        base_rev=None,
-        head_ref="main",
-        head_rev=None,
-        ssh_key_file=None,
-        ssh_known_hosts_file=None,
-        extra_refs=["refs/notes/taskgraph"],
-    )
-
-    # Verify the notes ref is available locally
-    result = subprocess.run(
-        ["git", "notes", "--ref=refs/notes/taskgraph", "show", rev],
-        cwd=str(destination),
-        capture_output=True,
-        text=True,
-    )
-    assert result.returncode == 0
-    assert "test" in result.stdout

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/test/test_util_vcs.py

@@ -653,19 +653,21 @@ def test_get_changed_files_with_null_base_revision_shallow_clone(
 
 def test_get_note_git(git_repo, tmpdir):
     """get_note returns note content when present, None otherwise."""
-    repo_path = tmpdir.join("git")
-    shutil.copytree(git_repo, repo_path)
-    repo = get_repository(str(repo_path))
+    src_path = str(tmpdir.join("git-src"))
+    dst_path = str(tmpdir.join("git-dst"))
+    shutil.copytree(git_repo, src_path)
+    shutil.copytree(git_repo, dst_path)
+    repo = get_repository(dst_path)
 
-    # No note yet
-    assert repo.get_note("try-config") is None
+    # No note yet on the remote
+    assert repo.get_note("try-config", src_path) is None
 
     rev = repo.head_rev
     subprocess.check_call(
         ["git", "notes", "--ref=refs/notes/try-config", "add", "-m", "test note", rev],
-        cwd=repo.path,
+        cwd=src_path,
     )
 
-    assert repo.get_note("try-config") == "test note"
-    assert repo.get_note("try-config", rev) == "test note"
-    assert repo.get_note("other") is None
+    assert repo.get_note("try-config", src_path) == "test note"
+    assert repo.get_note("try-config", src_path, revision=rev) == "test note"
+    assert repo.get_note("other", src_path) is None

{taskcluster_taskgraph-21.0.0 → taskcluster_taskgraph-22.0.0}/uv.lock

@@ -2587,7 +2587,7 @@ wheels = [
 
 [[package]]
 name = "taskcluster-taskgraph"
-version = "21.0.0"
+version = "22.0.0"
 source = { editable = "." }
 dependencies = [
     { name = "appdirs" },