taskcluster-taskgraph 24.3.0__tar.gz → 24.4.0__tar.gz

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
       #   echo "Run, Build Application using script"
       #   ./location_of_script_within_repo/buildscript.sh
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/.github/workflows/codspeed.yml

@@ -19,7 +19,7 @@ jobs:
       id-token: write  # required for OIDC authentication with CodSpeed
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: "3.12"
       - name: Install dependencies

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/.pre-commit-config.yaml

@@ -13,13 +13,13 @@ repos:
         exclude: template
       - id: check-added-large-files
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.5
+    rev: v0.16.9
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.12.8
+    rev: 0.12.19
     hooks:
       - id: uv-lock
   - repo: https://github.com/adrienverge/yamllint.git

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Change Log
 
+## [24.4.0] - 2026-10-05
+
+### Added
+
+- Merge concurrently extracted fetches in a fixed order in `fetch-content`
+- Hook point in `run-task` before the task payload
+- Prefix `run_python_script` output in `run-task` with `[script <timestamp>]`
+
+### Changed
+
+- `taskgraph init` template and tutorial docs now default to the `public_restricted` PR policy
+
+### Fixed
+
+- `filter_for_git_branch` target task filter now works with untrusted PRs
+- Update `@taskcluster/client` dependency to v110 (#1060)
+- perf: compute `optionally_keyed_by` fields once per Schema class (#1049)
+- perf: speed up resolving task definition references (#1051)
+- perf: cache parsed relative time strings (#1052)
+- perf: cache the visit order of graphs (#1053)
+- perf: stop re-parsing the full task graph in the decision task (#1055)
+
 ## [24.3.0] - 2026-09-17
 
 ### Added

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskcluster-taskgraph
-Version: 24.3.0
+Version: 24.4.0
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/docs/reference/parameters.rst

@@ -96,9 +96,17 @@ project
 
 level
 ~~~~~
-   The `SCM level`_ associated with this tree.
-
-.. _SCM level: https://www.mozilla.org/en-US/about/governance/policies/commit/access-policy/
+   The trust level associated with this task group. Trust levels provide a
+   convenient way to segregate resources such as worker-pools, secrets and
+   caches based on how the task group was triggered. This creates security
+   boundaries between various degrees of trust.
+
+   The meaning of a trust level can vary from project to project, but typically
+   level 1 is the lowest trust and corresponds to pull requests from external
+   contributors. Level 2 is a degree higher and denotes pull requests from repo
+   collaborators or pushes to unprotected branches. Level 3 is the highest
+   degree of trust and is reserved for pushes to protected branches and
+   releases.
 
 Target Set
 ----------

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/docs/tutorials/connecting-taskcluster.rst

@@ -79,7 +79,7 @@ here is the recommended method:
     version: 1
     reporting: checks-v1
     policy:
-        pullRequests: collaborators
+        pullRequests: public_restricted
     tasks:
         -
 
@@ -109,7 +109,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.pusher.email}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.user.login}@users.noreply.github.com'
                       else:
                           $if: 'tasks_for == "github-release"'
@@ -118,22 +118,22 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.base.repo.html_url}'
               repoUrl:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.html_url}'
               project:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.name}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.name}'
               headBranch:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: ${event.pull_request.head.ref}
                   else:
                       $if: 'tasks_for == "github-push"'
@@ -142,7 +142,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.after}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.sha}'
 
    This isn't strictly necessary, but the format of the various Github events
@@ -165,7 +165,7 @@ here is the recommended method:
           in:
               $if: >
                   tasks_for == "github-push" && headBranch == "main"
-                  || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+                  || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
               then:
                   # Task definition goes here. Since there is no "else" clause, if
                   # the above if statement evaluates to false, there will be no
@@ -236,9 +236,11 @@ here is the recommended method:
                    # while ${headBranch[11:]} strips out 'refs/heads/'
                    - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                else:
-                   $if: 'tasks_for == "github-pull-request"'
+                   $if: 'tasks_for[:19] == "github-pull-request"'
                    then:
-                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                       # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                       # either 'pull-request' or 'pull-request-untrusted'.
+                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
 
       Notice how we assume different roles depending on whether the task is
       coming from a push or a pull request. This is useful when you have tasks
@@ -246,6 +248,17 @@ here is the recommended method:
       accidentally running on a pull request! By using different scopes, you can
       ensure it won't ever happen.
 
+      With the ``public_restricted`` policy set above, Github reports pull
+      requests from repository collaborators with ``tasks_for ==
+      "github-pull-request"`` and pull requests from everyone else with
+      ``tasks_for == "github-pull-request-untrusted"``. Slicing ``tasks_for[7:]``
+      turns those into the role names ``pull-request`` and
+      ``pull-request-untrusted``, so you can grant non-collaborator pull
+      requests a more restricted set of scopes than collaborator ones. This
+      matters because collapsing that distinction (e.g. by using the ``public``
+      policy) means any external contributor's pull request gets the same
+      scopes as a trusted collaborator's.
+
       The roles assumed above may vary depending on the Taskcluster
       configuration.
 
@@ -310,7 +323,7 @@ here is the recommended method:
                          # running your command
                          MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                          REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                       - $if: 'tasks_for in ["github-pull-request"]'
+                       - $if: 'tasks_for[:19] == "github-pull-request"'
                          then:
                              MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                command:

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/docs/tutorials/example-taskcluster.yml

@@ -2,7 +2,7 @@
 version: 1
 reporting: checks-v1
 policy:
-    pullRequests: collaborators
+    pullRequests: public_restricted
 tasks:
     - $let:
           # Variable definitions
@@ -13,7 +13,7 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.pusher.email}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.user.login}@users.noreply.github.com'
                   else:
                       $if: 'tasks_for == "github-release"'
@@ -22,22 +22,22 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.base.repo.html_url}'
           repoUrl:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.html_url}'
           project:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.name}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.name}'
           headBranch:
-              $if: 'tasks_for == "github-pull-request"'
+              $if: 'tasks_for[:19] == "github-pull-request"'
               then: ${event.pull_request.head.ref}
               else:
                   $if: 'tasks_for == "github-push"'
@@ -46,13 +46,13 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.after}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.sha}'
       in:
           # Guard that controls when to schedule tasks.
           $if: >
               tasks_for == "github-push" && headBranch == "main"
-              || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+              || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
           then:
               # Task Definition
               taskId: '${ownTaskId}'
@@ -74,9 +74,14 @@ tasks:
                       # while ${headBranch[11:]} strips out 'refs/heads/'
                       - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then:
-                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                          # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                          # 'pull-request' or 'pull-request-untrusted'. With the
+                          # 'public_restricted' policy these map to two separate
+                          # roles, so pull requests from collaborators get more
+                          # scopes than those from non-collaborators.
+                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
               payload:
                   image:
                       mozillareleases/taskgraph:decision-cf4b4b4baff57d84c1f9ec8fcd70c9839b70a7d66e6430a6c41ffe67252faa19@sha256:425e07f6813804483bc5a7258288a7684d182617ceeaa0176901ccc7702dfe28
@@ -97,7 +102,7 @@ tasks:
                             # bootstrapped
                             MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                             REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                          - $if: 'tasks_for in ["github-pull-request"]'
+                          - $if: 'tasks_for[:19] == "github-pull-request"'
                             then:
                                 MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                   command:

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "24.3.0"
+version = "24.4.0"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/decision.py

@@ -17,7 +17,6 @@ from taskgraph.actions import render_actions_json
 from taskgraph.create import create_tasks
 from taskgraph.generator import TaskGraphGenerator
 from taskgraph.parameters import Parameters, get_version
-from taskgraph.taskgraph import TaskGraph
 from taskgraph.util import json
 from taskgraph.util.python_path import find_object
 from taskgraph.util.schema import Schema, validate_schema
@@ -131,9 +130,6 @@ def taskgraph_decision(options, parameters=None):
         "runnable-jobs.json", full_task_graph_to_runnable_tasks(full_task_json)
     )
 
-    # this is just a test to check whether the from_json() function is working
-    _, _ = TaskGraph.from_json(full_task_json)
-
     # write out the target task set to allow reproducing this as input
     write_artifact("target-tasks.json", list(tgg.target_task_set.tasks.keys()))
 

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/graph.py

@@ -107,6 +107,15 @@ class Graph(_Graph):
                 f"Dependency loop detected involving the following nodes: {loopy_nodes}"
             )
 
+    @functools.cache
+    def _visit_order(self, reverse):
+        """
+        Return the order in which `_visit` yields nodes as a tuple. The graph
+        is immutable, so this is cached to avoid sorting it again every time
+        it is visited.
+        """
+        return tuple(self._visit(reverse))
+
     def visit_postorder(self):
         """
         Generate a sequence of nodes in postorder, such that every node is
@@ -114,14 +123,14 @@ class Graph(_Graph):
 
         Raises an exception if the graph contains a cycle.
         """
-        return self._visit(False)
+        return iter(self._visit_order(False))
 
     def visit_preorder(self):
         """
         Like visit_postorder, but in reverse: evrey node is visited *before*
         any nodes it links to.
         """
-        return self._visit(True)
+        return iter(self._visit_order(True))
 
     @functools.cache
     def links_and_reverse_links_dict(self):

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/optimize/base.py

@@ -78,7 +78,7 @@ def optimize_task_graph(
 
     # Gather each relevant task's index
     indexes = set()
-    for label in target_task_graph.graph.visit_postorder():
+    for label in target_task_graph.tasks:
         if label in do_not_optimize:
             continue
         _, strategy, arg = optimizations(label)
@@ -157,7 +157,7 @@ def remove_tasks(
     opt_counts = defaultdict(int)
     opt_reasons = {}
     removed = set()
-    dependents_of = target_task_graph.graph.reverse_links_dict()
+    _, dependents_of = target_task_graph.graph.links_and_reverse_links_dict()
     tasks = target_task_graph.tasks
     prune_candidates = set()
 

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/run-task/fetch-content

@@ -683,6 +683,36 @@ def repack_archive(
             )
 
 
+def merge_tree(src, dest):
+    """Move the contents of the src directory into dest and remove src.
+
+    Directories present on both sides are merged entry by entry and take
+    the mode from src. Any other path present on both sides is replaced by
+    the one from src.
+    """
+    dest.mkdir(parents=True, exist_ok=True)
+    os.chmod(src, stat.S_IMODE(os.stat(src).st_mode) | stat.S_IWUSR)
+    for entry in os.scandir(src):
+        target = dest / entry.name
+        if (
+            entry.is_dir(follow_symlinks=False)
+            and target.is_dir()
+            and not target.is_symlink()
+        ):
+            mode = stat.S_IMODE(entry.stat(follow_symlinks=False).st_mode)
+            merge_tree(pathlib.Path(entry.path), target)
+            os.chmod(target, mode)
+            continue
+        if target.is_symlink() or target.exists():
+            log(f"{target} is provided by more than one fetch, replacing it")
+            if target.is_dir() and not target.is_symlink():
+                shutil.rmtree(target)
+            else:
+                target.unlink()
+        os.replace(entry.path, target)
+    src.rmdir()
+
+
 def fetch_and_extract(url, dest_dir, extract=True, sha256=None, size=None):
     """Fetch a URL and extract it to a destination path.
 
@@ -708,15 +738,25 @@ def fetch_and_extract(url, dest_dir, extract=True, sha256=None, size=None):
 
 
 def fetch_urls(downloads):
-    """Fetch URLs pairs to a pathlib.Path."""
-    with concurrent.futures.ThreadPoolExecutor(CONCURRENCY) as e:
-        fs = []
-
-        for download in downloads:
-            fs.append(e.submit(fetch_and_extract, *download))
+    """Fetch URLs pairs to a pathlib.Path.
 
-        for f in fs:
-            f.result()
+    Each fetch is downloaded and extracted into a staging directory under
+    its destination, all in parallel. The staging directories are then
+    merged into the destinations sequentially, in the order the fetches
+    were given. Two archives never write to the same directory at the
+    same time, and when they contain the same path the later fetch wins.
+    """
+    with concurrent.futures.ThreadPoolExecutor(CONCURRENCY) as e:
+        extractions = []
+        for url, dest_dir, *rest in downloads:
+            staging_dir = pathlib.Path(tempfile.mkdtemp(prefix=".fetch.", dir=dest_dir))
+            future = e.submit(fetch_and_extract, url, staging_dir, *rest)
+            extractions.append((future, staging_dir, dest_dir))
+
+        for future, staging_dir, dest_dir in extractions:
+            future.result()
+            log(f"Merging {staging_dir} into {dest_dir}")
+            merge_tree(staging_dir, dest_dir)
 
 
 def _git_checkout_github_archive(

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/run-task/run-task

@@ -22,6 +22,7 @@ import json
 import os
 import platform
 import re
+import runpy
 import shutil
 import socket
 import stat
@@ -30,6 +31,7 @@ import sys
 import tempfile
 import threading
 import time
+import traceback
 import urllib.error
 import urllib.request
 from pathlib import Path
@@ -112,16 +114,58 @@ IS_WINDOWS = os.name == "nt"
 NULL_REVISION = "0000000000000000000000000000000000000000"
 
 
-def print_line(prefix, m):
+def format_line(prefix, m):
     now = (
         datetime.datetime.now(tz=datetime.timezone.utc)
         .isoformat(timespec="milliseconds")
         .encode("utf-8")
     )
-    sys.stdout.buffer.write(b"[%s %s] %s" % (prefix, now, m))
+    return b"[%s %s] %s" % (prefix, now, m)
+
+
+def print_line(prefix, m):
+    sys.stdout.buffer.write(format_line(prefix, m))
     sys.stdout.buffer.flush()
 
 
+class _PrefixedLineWriter:
+    """File-like object that prefixes each complete line written to it
+    with the current time, before forwarding it to the given buffer."""
+
+    def __init__(self, prefix, buffer):
+        self.prefix = prefix
+        self.buffer = buffer
+        self._pending = ""
+
+    def write(self, s):
+        self._pending += s
+        *lines, self._pending = self._pending.split("\n")
+        for line in lines:
+            self.buffer.write(format_line(self.prefix, b"%s\n" % line.encode("utf-8")))
+        self.buffer.flush()
+        return len(s)
+
+    def flush(self):
+        if self._pending:
+            self.buffer.write(format_line(self.prefix, self._pending.encode("utf-8")))
+            self._pending = ""
+        self.buffer.flush()
+
+
+@contextlib.contextmanager
+def prefix_output(prefix):
+    """Redirect stdout/stderr so each line written is prefixed with the
+    current time, like output from `run_command`."""
+    writer = _PrefixedLineWriter(prefix, sys.stdout.buffer)
+    old_stdout, old_stderr = sys.stdout, sys.stderr
+    sys.stdout = sys.stderr = writer
+    try:
+        yield
+    finally:
+        writer.flush()
+        sys.stdout, sys.stderr = old_stdout, old_stderr
+
+
 def reap_zombies(main_subprocess):
     """Wait for main_subprocess to exit, while awaiting any other child processes"""
     while main_subprocess.poll() is None:
@@ -319,6 +363,24 @@ def run_command(prefix, args, *, extra_env=None, cwd=None, stdin_data=None):
     return p.wait()
 
 
+def run_python_script(path):
+    """Execute a Python script in-process."""
+    print_line(
+        b"setup",
+        b"running python script: %s\n" % path.encode("utf-8"),
+    )
+    try:
+        with prefix_output(b"script"):
+            runpy.run_path(path)
+    except Exception:
+        print_line(
+            b"setup",
+            b"script %s failed:\n%s"
+            % (path.encode("utf-8"), traceback.format_exc().encode("utf-8")),
+        )
+        sys.exit(1)
+
+
 def get_posix_user_group(user, group):
     import grp  # noqa: PLC0415
     import pwd  # noqa: PLC0415
@@ -1668,6 +1730,7 @@ def main(args):
         "MOZ_FETCHES_DIR",
         "MOZ_PYTHON_HOME",
         "MOZ_UV_HOME",
+        "RUN_TASK_PRE_COMMAND_HOOK",
         "PIP_CACHE_DIR",
         "UPLOAD_DIR",
         "UV_CACHE_DIR",
@@ -1691,6 +1754,9 @@ def main(args):
     # fetches to grab dependencies.
     install_pip_requirements(repositories)
 
+    if hook_path := os.environ.get("RUN_TASK_PRE_COMMAND_HOOK"):
+        run_python_script(hook_path)
+
     return run_command(b"task", task_args, cwd=args.task_cwd)
 
 

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/target_tasks.py

@@ -53,7 +53,7 @@ def filter_for_git_branch(task, parameters):
         return True
 
     # Pull requests usually have arbitrary names, let's not filter git branches on them.
-    if parameters["tasks_for"] == "github-pull-request":
+    if parameters["tasks_for"].startswith("github-pull-request"):
         return True
 
     run_on_git_branches = set(task.attributes.get("run_on_git_branches", ["all"]))

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.0}/src/taskgraph/util/parameterization.py

@@ -15,20 +15,18 @@ ARTIFACT_REFERENCE_PATTERN = re.compile("<([^/]+)/([^>]+)>")
 
 def _recurse(val, param_fns):
     def recurse(val):
-        if isinstance(val, list):
-            return [recurse(v) for v in val]
-        elif isinstance(val, dict):
+        if isinstance(val, dict):
             if len(val) == 1:
-                for param_key, param_fn in param_fns.items():
-                    if set(val.keys()) == {param_key}:
-                        if isinstance(val[param_key], dict):
-                            # handle `{"task-reference": {"<foo>": "bar"}}`
-                            return {
-                                param_fn(key): recurse(v)
-                                for key, v in val[param_key].items()
-                            }
-                        return param_fn(val[param_key])
+                ((key, value),) = val.items()
+                param_fn = param_fns.get(key)
+                if param_fn is not None:
+                    if isinstance(value, dict):
+                        # handle `{"task-reference": {"<foo>": "bar"}}`
+                        return {param_fn(k): recurse(v) for k, v in value.items()}
+                    return param_fn(value)
             return {k: recurse(v) for k, v in val.items()}
+        elif isinstance(val, list):
+            return [recurse(v) for v in val]
         else:
             return val