taskcluster-taskgraph 24.2.2__tar.gz → 24.3.0__tar.gz

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/.github/workflows/codeql-analysis.yml

@@ -39,10 +39,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
       #   echo "Run, Build Application using script"
       #   ./location_of_script_within_repo/buildscript.sh
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/.github/workflows/codspeed.yml

@@ -18,14 +18,14 @@ jobs:
       contents: read  # required for actions/checkout
       id-token: write  # required for OIDC authentication with CodSpeed
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           python-version: "3.12"
       - name: Install dependencies
         run: uv sync
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f  # v4.18.1
+        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea  # v5.2.1
         with:
           mode: simulation
           run: uv run pytest test/ --codspeed

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/.github/workflows/pypi-publish.yml

@@ -12,8 +12,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -28,7 +28,7 @@ jobs:
       #       Renovate offsets that by bumping the pinned SHA (tracked via the
       #       trailing `# vX.Y.Z` comment), so merge those bump PRs promptly.
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
   pypi-publish-pytest-taskgraph:
     name: upload release to PyPI
     if: startsWith(github.ref, 'refs/tags/pytest-taskgraph')
@@ -38,8 +38,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -49,7 +49,7 @@ jobs:
           pip install build
           python -m build
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           packages-dir: packages/pytest-taskgraph/dist
   pypi-publish-sphinx-taskgraph:
@@ -61,8 +61,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -72,6 +72,6 @@ jobs:
           pip install build
           python -m build
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           packages-dir: packages/sphinx-taskgraph/dist

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/.pre-commit-config.yaml

@@ -13,13 +13,13 @@ repos:
         exclude: template
       - id: check-added-large-files
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.5
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.11.26
+    rev: 0.12.8
     hooks:
       - id: uv-lock
   - repo: https://github.com/adrienverge/yamllint.git
@@ -28,7 +28,7 @@ repos:
       - id: yamllint
         exclude: template
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
     hooks:
       - id: codespell
         entry: codespell -I .codespell-ignore-words.txt

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Change Log
 
+## [24.3.0] - 2026-09-17
+
+### Added
+
+- Git sparse checkout support (#1039)
+- Support for checking out git trees in parallel (#1041)
+
+### Fixed
+
+- Improve performance of Graph.transitive_closure (#1014)
+- Don't assume treeherder.group-names exists in graph config (#1024)
+- Avoid seeking during tarball extraction on Windows in fetch-content (#1042)
+
+## [24.2.3] - 2026-07-29
+
+### Fixed
+
+- Vendor latest robustcheckout
+
 ## [24.2.2] - 2026-07-28
 
 ### Fixed

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: taskcluster-taskgraph
-Version: 24.2.2
+Version: 24.3.0
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "24.2.2"
+version = "24.3.0"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/src/taskgraph/graph.py

@@ -61,20 +61,24 @@ class Graph(_Graph):
                 f"Unknown nodes in transitive closure: {nodes - self.nodes}"
             )
 
-        # generate a new graph by expanding along edges until reaching a fixed
-        # point
-        new_nodes, new_edges = nodes, set()
-        nodes, edges = set(), set()
-        while (new_nodes, new_edges) != (nodes, edges):
-            nodes, edges = new_nodes, new_edges
-            add_edges = {
-                (left, right, name)
-                for (left, right, name) in self.edges
-                if (right if reverse else left) in nodes
-            }
-            add_nodes = {(left if reverse else right) for (left, right, _) in add_edges}
-            new_nodes = nodes | add_nodes
-            new_edges = edges | add_edges
+        # Build an adjacency map keyed by the node to expand from. This reduces
+        # traversal below from O(V·E) -> O(V+E).
+        adjacency = collections.defaultdict(list)
+        for edge in self.edges:
+            left, right, _ = edge
+            adjacency[right if reverse else left].append(edge)
+
+        new_nodes = set(nodes)
+        new_edges = set()
+        queue = collections.deque(nodes)
+        while queue:
+            node = queue.popleft()
+            for edge in adjacency.get(node, ()):
+                new_edges.add(edge)
+                neighbor = edge[0] if reverse else edge[1]
+                if neighbor not in new_nodes:
+                    new_nodes.add(neighbor)
+                    queue.append(neighbor)
         return Graph(new_nodes, new_edges)
 
     def _visit(self, reverse):

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/src/taskgraph/run-task/fetch-content

@@ -18,6 +18,7 @@ import os
 import pathlib
 import random
 import re
+import shutil
 import ssl
 import stat
 import subprocess
@@ -377,6 +378,70 @@ def archive_type(path: pathlib.Path):
         return None
 
 
+class TarFile(tarfile.TarFile):
+    # When a tarball contains symbolic links, the python tarfile module ends up
+    # trying to seek in the tar, which doesn't quite work when the tar is a
+    # stream (which it is when decompressing at the same time). We wrap TarFile
+    # so as to handle the symbolic link situation ourselves, and when we can't
+    # create symbolic links (e.g. on Windows), we instead create a copy of the
+    # file the link points to.
+    def _do_extract(
+        self, extract, member, path="", set_attrs=True, numeric_owner=False, **kwargs
+    ):
+        deferred_links = getattr(self, "_deferred_links", None)
+        if not isinstance(member, tarfile.TarInfo):
+            member = self.getmember(member)
+        targetpath = os.path.normcase(os.path.join(path, member.name))
+
+        if deferred_links is not None and member.issym():
+            if os.path.lexists(targetpath):
+                # Avoid FileExistsError on following os.symlink.
+                os.unlink(targetpath)
+            try:
+                os.symlink(member.linkname, targetpath)
+            except (NotImplementedError, OSError):
+                # On Windows, os.symlink can fail, in this case fallback to
+                # creating a copy. If the destination was not already created,
+                # defer the link creation.
+                source = os.path.normcase(
+                    os.path.join(os.path.dirname(targetpath), member.linkname)
+                )
+
+                if source in self._extracted_members:
+                    shutil.copy(source, targetpath)
+                    self.chown(member, targetpath, numeric_owner)
+                else:
+                    deferred_links.setdefault(source, []).append(
+                        (member, targetpath, numeric_owner)
+                    )
+            return
+
+        extract(member, path, set_attrs, numeric_owner=numeric_owner, **kwargs)
+        if deferred_links is not None:
+            for tarinfo, linkpath, numeric_owner in deferred_links.pop(targetpath, []):
+                shutil.copy(targetpath, linkpath)
+                self.chown(tarinfo, linkpath, numeric_owner)
+            self._extracted_members.add(targetpath)
+
+    def extract(self, *args, **kwargs):
+        self._do_extract(super(TarFile, self).extract, *args, **kwargs)
+
+    # extractall in versions for cpython that implement PEP 706 call _extract_one
+    # instead of extract.
+    def _extract_one(self, *args, **kwargs):
+        self._do_extract(super(TarFile, self)._extract_one, *args, **kwargs)
+
+    def extractall(self, *args, **kwargs):
+        self._deferred_links = {}
+        self._extracted_members = set()
+        super(TarFile, self).extractall(*args, **kwargs)
+        for links in self._deferred_links.values():
+            for tarinfo, linkpath, numeric_owner in links:
+                log(f"Cannot create dangling symbolic link: {linkpath}")
+        delattr(self, "_deferred_links")
+        delattr(self, "_extracted_members")
+
+
 def extract_archive(path, dest_dir):
     """Extract an archive to a destination directory."""
 
@@ -398,7 +463,7 @@ def extract_archive(path, dest_dir):
         # also not much slower on Windows, presumably because of the
         # notoriously bad I/O).
         if sys.platform == "win32":
-            tar = tarfile.open(fileobj=ifh, mode="r|")
+            tar = TarFile.open(fileobj=ifh, mode="r|")
             tar.extractall(str(dest_dir))
             args = []
         else:

{taskcluster_taskgraph-24.2.2 → taskcluster_taskgraph-24.3.0}/src/taskgraph/run-task/robustcheckout.py

@@ -18,6 +18,7 @@ import random
 import re
 import socket
 import ssl
+import stat
 import time
 
 from mercurial.i18n import _
@@ -38,6 +39,22 @@ from mercurial import (
     vfs,
 )
 
+# TRACKING hg72 - `hg.repository`/`hg.peer` moved to `mercurial.repo.factory`.
+try:
+    from mercurial.repo import factory as _repofactory
+
+    _repository = _repofactory.repository
+    _peer = _repofactory.peer
+except ImportError:
+    _repository = hg.repository
+    _peer = hg.peer
+
+# TRACKING hg72 - `hg.clone` moved to `mercurial.cmd_impls.clone.clone`.
+try:
+    from mercurial.cmd_impls.clone import clone as _clone
+except ImportError:
+    _clone = hg.clone
+
 # Causes worker to purge caches on process exit and for task to retry.
 EXIT_PURGE_CACHE = 72
 
@@ -67,6 +84,57 @@ def peerlookup(remote, v):
         return e.callcommand(b"lookup", {b"key": v}).result()
 
 
+def remove_dangling_links(ui, path):
+    """On Windows, remove dangling symlinks and junctions under ``path``.
+
+    npm's ``file:`` protocol dependencies create directory junctions in
+    ``node_modules/`` with absolute targets.  When a Taskcluster cache
+    is restored to a different task directory those targets no longer
+    exist, and Mercurial's purge crashes in ``vfs.listdir()`` with
+    ``FileNotFoundError``.  Removing them first lets purge proceed.
+    """
+    if os.name != "nt":
+        return
+
+    ui.write(b"windows detected, removing dangling links\n")
+
+    stack = [path]
+    while stack:
+        dirpath = stack.pop()
+        try:
+            entries = os.scandir(dirpath)
+        except OSError:
+            continue
+
+        with entries:
+            for entry in entries:
+                p = entry.path
+                try:
+                    attrs = entry.stat(follow_symlinks=False).st_file_attributes
+                except OSError:
+                    continue
+
+                if attrs & stat.FILE_ATTRIBUTE_REPARSE_POINT:
+                    if not os.path.exists(p):
+                        ui.write(
+                            b"(removing dangling link %s)\n"
+                            % os.fsencode(os.path.relpath(p, path))
+                        )
+                        try:
+                            os.rmdir(p)
+                        except OSError:
+                            os.remove(p)
+                    continue
+
+                try:
+                    is_dir = entry.is_dir(follow_symlinks=False)
+                except OSError:
+                    continue
+
+                if is_dir:
+                    stack.append(p)
+
+
 @command(
     b"robustcheckout",
     [
@@ -427,7 +495,7 @@ def _docheckout(
     def handlerepoerror(e):
         if pycompat.bytestr(e) == _(b"abandoned transaction found"):
             ui.warn(b"(abandoned transaction found; trying to recover)\n")
-            repo = hg.repository(ui, dest)
+            repo = _repository(ui, dest)
             if not repo.recover():
                 ui.warn(b"(could not recover repo state; deleting shared store)\n")
                 with timeit("remove_unrecovered_shared_store", "remove-store"):
@@ -535,7 +603,7 @@ def _docheckout(
     cloneurl = upstream or url
 
     try:
-        clonepeer = hg.peer(ui, {}, cloneurl)
+        clonepeer = _peer(ui, {}, cloneurl)
         rootnode = peerlookup(clonepeer, b"0")
     except error.RepoLookupError:
         raise error.Abort(b"unable to resolve root revision from clone source")
@@ -623,12 +691,12 @@ def _docheckout(
             ui.write(b"(cloning from upstream repo %s)\n" % upstream)
 
         if not storevfs.exists():
-            behaviors.add(b"create-store")
+            behaviors.add("create-store")
 
         try:
             with timeit("clone", "clone"):
                 shareopts = {b"pool": sharebase, b"mode": b"identity"}
-                res = hg.clone(
+                res = _clone(
                     ui,
                     {},
                     clonepeer,
@@ -667,7 +735,7 @@ def _docheckout(
     # The destination .hg directory should exist. Now make sure we have the
     # wanted revision.
 
-    repo = hg.repository(ui, dest)
+    repo = _repository(ui, dest)
 
     # We only pull if we are using symbolic names or the requested revision
     # doesn't exist.
@@ -694,7 +762,7 @@ def _docheckout(
 
         remote = None
         try:
-            remote = hg.peer(repo, {}, url)
+            remote = _peer(repo, {}, url)
             pullrevs = [peerlookup(remote, revision or branch)]
             checkoutrevision = hex(pullrevs[0])
             if branch:
@@ -741,6 +809,10 @@ def _docheckout(
     # guaranteed to not have conflicts on `hg update`.
     if purge and not created:
         ui.write(b"(purging working directory)\n")
+
+        with timeit("purge", "dangling_link_remove"):
+            remove_dangling_links(ui, dest)
+
         purge = getattr(commands, "purge", None)
         if not purge:
             purge = extensions.find(b"purge").purge