taskcluster-taskgraph 24.2.3__tar.gz → 24.4.0__tar.gz

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/.github/workflows/codeql-analysis.yml

@@ -39,10 +39,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
       #   echo "Run, Build Application using script"
       #   ./location_of_script_within_repo/buildscript.sh
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/.github/workflows/codspeed.yml

@@ -18,14 +18,14 @@ jobs:
       contents: read  # required for actions/checkout
       id-token: write  # required for OIDC authentication with CodSpeed
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: "3.12"
       - name: Install dependencies
         run: uv sync
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f  # v4.18.1
+        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea  # v5.2.1
         with:
           mode: simulation
           run: uv run pytest test/ --codspeed

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/.github/workflows/pypi-publish.yml

@@ -12,8 +12,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -28,7 +28,7 @@ jobs:
       #       Renovate offsets that by bumping the pinned SHA (tracked via the
       #       trailing `# vX.Y.Z` comment), so merge those bump PRs promptly.
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
   pypi-publish-pytest-taskgraph:
     name: upload release to PyPI
     if: startsWith(github.ref, 'refs/tags/pytest-taskgraph')
@@ -38,8 +38,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -49,7 +49,7 @@ jobs:
           pip install build
           python -m build
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           packages-dir: packages/pytest-taskgraph/dist
   pypi-publish-sphinx-taskgraph:
@@ -61,8 +61,8 @@ jobs:
       id-token: write
     steps:
       - name: Checkout sources
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14'
           cache: 'pip'
@@ -72,6 +72,6 @@ jobs:
           pip install build
           python -m build
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           packages-dir: packages/sphinx-taskgraph/dist

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/.pre-commit-config.yaml

@@ -13,13 +13,13 @@ repos:
         exclude: template
       - id: check-added-large-files
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.9
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.11.26
+    rev: 0.12.19
     hooks:
       - id: uv-lock
   - repo: https://github.com/adrienverge/yamllint.git
@@ -28,7 +28,7 @@ repos:
       - id: yamllint
         exclude: template
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
     hooks:
       - id: codespell
         entry: codespell -I .codespell-ignore-words.txt

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Change Log
 
+## [24.4.0] - 2026-10-05
+
+### Added
+
+- Merge concurrently extracted fetches in a fixed order in `fetch-content`
+- Hook point in `run-task` before the task payload
+- Prefix `run_python_script` output in `run-task` with `[script <timestamp>]`
+
+### Changed
+
+- `taskgraph init` template and tutorial docs now default to the `public_restricted` PR policy
+
+### Fixed
+
+- `filter_for_git_branch` target task filter now works with untrusted PRs
+- Update `@taskcluster/client` dependency to v110 (#1060)
+- perf: compute `optionally_keyed_by` fields once per Schema class (#1049)
+- perf: speed up resolving task definition references (#1051)
+- perf: cache parsed relative time strings (#1052)
+- perf: cache the visit order of graphs (#1053)
+- perf: stop re-parsing the full task graph in the decision task (#1055)
+
+## [24.3.0] - 2026-09-17
+
+### Added
+
+- Git sparse checkout support (#1039)
+- Support for checking out git trees in parallel (#1041)
+
+### Fixed
+
+- Improve performance of Graph.transitive_closure (#1014)
+- Don't assume treeherder.group-names exists in graph config (#1024)
+- Avoid seeking during tarball extraction on Windows in fetch-content (#1042)
+
 ## [24.2.3] - 2026-07-29
 
 ### Fixed

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: taskcluster-taskgraph
-Version: 24.2.3
+Version: 24.4.0
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/docs/reference/parameters.rst

@@ -96,9 +96,17 @@ project
 
 level
 ~~~~~
-   The `SCM level`_ associated with this tree.
-
-.. _SCM level: https://www.mozilla.org/en-US/about/governance/policies/commit/access-policy/
+   The trust level associated with this task group. Trust levels provide a
+   convenient way to segregate resources such as worker-pools, secrets and
+   caches based on how the task group was triggered. This creates security
+   boundaries between various degrees of trust.
+
+   The meaning of a trust level can vary from project to project, but typically
+   level 1 is the lowest trust and corresponds to pull requests from external
+   contributors. Level 2 is a degree higher and denotes pull requests from repo
+   collaborators or pushes to unprotected branches. Level 3 is the highest
+   degree of trust and is reserved for pushes to protected branches and
+   releases.
 
 Target Set
 ----------

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/docs/tutorials/connecting-taskcluster.rst

@@ -79,7 +79,7 @@ here is the recommended method:
     version: 1
     reporting: checks-v1
     policy:
-        pullRequests: collaborators
+        pullRequests: public_restricted
     tasks:
         -
 
@@ -109,7 +109,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.pusher.email}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.user.login}@users.noreply.github.com'
                       else:
                           $if: 'tasks_for == "github-release"'
@@ -118,22 +118,22 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.base.repo.html_url}'
               repoUrl:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.html_url}'
               project:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.name}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.name}'
               headBranch:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: ${event.pull_request.head.ref}
                   else:
                       $if: 'tasks_for == "github-push"'
@@ -142,7 +142,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.after}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.sha}'
 
    This isn't strictly necessary, but the format of the various Github events
@@ -165,7 +165,7 @@ here is the recommended method:
           in:
               $if: >
                   tasks_for == "github-push" && headBranch == "main"
-                  || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+                  || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
               then:
                   # Task definition goes here. Since there is no "else" clause, if
                   # the above if statement evaluates to false, there will be no
@@ -236,9 +236,11 @@ here is the recommended method:
                    # while ${headBranch[11:]} strips out 'refs/heads/'
                    - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                else:
-                   $if: 'tasks_for == "github-pull-request"'
+                   $if: 'tasks_for[:19] == "github-pull-request"'
                    then:
-                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                       # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                       # either 'pull-request' or 'pull-request-untrusted'.
+                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
 
       Notice how we assume different roles depending on whether the task is
       coming from a push or a pull request. This is useful when you have tasks
@@ -246,6 +248,17 @@ here is the recommended method:
       accidentally running on a pull request! By using different scopes, you can
       ensure it won't ever happen.
 
+      With the ``public_restricted`` policy set above, Github reports pull
+      requests from repository collaborators with ``tasks_for ==
+      "github-pull-request"`` and pull requests from everyone else with
+      ``tasks_for == "github-pull-request-untrusted"``. Slicing ``tasks_for[7:]``
+      turns those into the role names ``pull-request`` and
+      ``pull-request-untrusted``, so you can grant non-collaborator pull
+      requests a more restricted set of scopes than collaborator ones. This
+      matters because collapsing that distinction (e.g. by using the ``public``
+      policy) means any external contributor's pull request gets the same
+      scopes as a trusted collaborator's.
+
       The roles assumed above may vary depending on the Taskcluster
       configuration.
 
@@ -310,7 +323,7 @@ here is the recommended method:
                          # running your command
                          MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                          REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                       - $if: 'tasks_for in ["github-pull-request"]'
+                       - $if: 'tasks_for[:19] == "github-pull-request"'
                          then:
                              MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                command:

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/docs/tutorials/example-taskcluster.yml

@@ -2,7 +2,7 @@
 version: 1
 reporting: checks-v1
 policy:
-    pullRequests: collaborators
+    pullRequests: public_restricted
 tasks:
     - $let:
           # Variable definitions
@@ -13,7 +13,7 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.pusher.email}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.user.login}@users.noreply.github.com'
                   else:
                       $if: 'tasks_for == "github-release"'
@@ -22,22 +22,22 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.base.repo.html_url}'
           repoUrl:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.html_url}'
           project:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.name}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.name}'
           headBranch:
-              $if: 'tasks_for == "github-pull-request"'
+              $if: 'tasks_for[:19] == "github-pull-request"'
               then: ${event.pull_request.head.ref}
               else:
                   $if: 'tasks_for == "github-push"'
@@ -46,13 +46,13 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.after}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.sha}'
       in:
           # Guard that controls when to schedule tasks.
           $if: >
               tasks_for == "github-push" && headBranch == "main"
-              || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+              || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
           then:
               # Task Definition
               taskId: '${ownTaskId}'
@@ -74,9 +74,14 @@ tasks:
                       # while ${headBranch[11:]} strips out 'refs/heads/'
                       - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then:
-                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                          # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                          # 'pull-request' or 'pull-request-untrusted'. With the
+                          # 'public_restricted' policy these map to two separate
+                          # roles, so pull requests from collaborators get more
+                          # scopes than those from non-collaborators.
+                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
               payload:
                   image:
                       mozillareleases/taskgraph:decision-cf4b4b4baff57d84c1f9ec8fcd70c9839b70a7d66e6430a6c41ffe67252faa19@sha256:425e07f6813804483bc5a7258288a7684d182617ceeaa0176901ccc7702dfe28
@@ -97,7 +102,7 @@ tasks:
                             # bootstrapped
                             MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                             REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                          - $if: 'tasks_for in ["github-pull-request"]'
+                          - $if: 'tasks_for[:19] == "github-pull-request"'
                             then:
                                 MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                   command:

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "24.2.3"
+version = "24.4.0"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/src/taskgraph/decision.py

@@ -17,7 +17,6 @@ from taskgraph.actions import render_actions_json
 from taskgraph.create import create_tasks
 from taskgraph.generator import TaskGraphGenerator
 from taskgraph.parameters import Parameters, get_version
-from taskgraph.taskgraph import TaskGraph
 from taskgraph.util import json
 from taskgraph.util.python_path import find_object
 from taskgraph.util.schema import Schema, validate_schema
@@ -131,9 +130,6 @@ def taskgraph_decision(options, parameters=None):
         "runnable-jobs.json", full_task_graph_to_runnable_tasks(full_task_json)
     )
 
-    # this is just a test to check whether the from_json() function is working
-    _, _ = TaskGraph.from_json(full_task_json)
-
     # write out the target task set to allow reproducing this as input
     write_artifact("target-tasks.json", list(tgg.target_task_set.tasks.keys()))
 

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/src/taskgraph/graph.py

@@ -61,20 +61,24 @@ class Graph(_Graph):
                 f"Unknown nodes in transitive closure: {nodes - self.nodes}"
             )
 
-        # generate a new graph by expanding along edges until reaching a fixed
-        # point
-        new_nodes, new_edges = nodes, set()
-        nodes, edges = set(), set()
-        while (new_nodes, new_edges) != (nodes, edges):
-            nodes, edges = new_nodes, new_edges
-            add_edges = {
-                (left, right, name)
-                for (left, right, name) in self.edges
-                if (right if reverse else left) in nodes
-            }
-            add_nodes = {(left if reverse else right) for (left, right, _) in add_edges}
-            new_nodes = nodes | add_nodes
-            new_edges = edges | add_edges
+        # Build an adjacency map keyed by the node to expand from. This reduces
+        # traversal below from O(V·E) -> O(V+E).
+        adjacency = collections.defaultdict(list)
+        for edge in self.edges:
+            left, right, _ = edge
+            adjacency[right if reverse else left].append(edge)
+
+        new_nodes = set(nodes)
+        new_edges = set()
+        queue = collections.deque(nodes)
+        while queue:
+            node = queue.popleft()
+            for edge in adjacency.get(node, ()):
+                new_edges.add(edge)
+                neighbor = edge[0] if reverse else edge[1]
+                if neighbor not in new_nodes:
+                    new_nodes.add(neighbor)
+                    queue.append(neighbor)
         return Graph(new_nodes, new_edges)
 
     def _visit(self, reverse):
@@ -103,6 +107,15 @@ class Graph(_Graph):
                 f"Dependency loop detected involving the following nodes: {loopy_nodes}"
             )
 
+    @functools.cache
+    def _visit_order(self, reverse):
+        """
+        Return the order in which `_visit` yields nodes as a tuple. The graph
+        is immutable, so this is cached to avoid sorting it again every time
+        it is visited.
+        """
+        return tuple(self._visit(reverse))
+
     def visit_postorder(self):
         """
         Generate a sequence of nodes in postorder, such that every node is
@@ -110,14 +123,14 @@ class Graph(_Graph):
 
         Raises an exception if the graph contains a cycle.
         """
-        return self._visit(False)
+        return iter(self._visit_order(False))
 
     def visit_preorder(self):
         """
         Like visit_postorder, but in reverse: evrey node is visited *before*
         any nodes it links to.
         """
-        return self._visit(True)
+        return iter(self._visit_order(True))
 
     @functools.cache
     def links_and_reverse_links_dict(self):

{taskcluster_taskgraph-24.2.3 → taskcluster_taskgraph-24.4.0}/src/taskgraph/optimize/base.py

@@ -78,7 +78,7 @@ def optimize_task_graph(
 
     # Gather each relevant task's index
     indexes = set()
-    for label in target_task_graph.graph.visit_postorder():
+    for label in target_task_graph.tasks:
         if label in do_not_optimize:
             continue
         _, strategy, arg = optimizations(label)
@@ -157,7 +157,7 @@ def remove_tasks(
     opt_counts = defaultdict(int)
     opt_reasons = {}
     removed = set()
-    dependents_of = target_task_graph.graph.reverse_links_dict()
+    _, dependents_of = target_task_graph.graph.links_and_reverse_links_dict()
     tasks = target_task_graph.tasks
     prune_candidates = set()