taskcluster-taskgraph 24.3.0__tar.gz → 24.4.1__tar.gz

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
       #   echo "Run, Build Application using script"
       #   ./location_of_script_within_repo/buildscript.sh
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/.github/workflows/codspeed.yml

@@ -19,7 +19,7 @@ jobs:
       id-token: write  # required for OIDC authentication with CodSpeed
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: "3.12"
       - name: Install dependencies

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/.pre-commit-config.yaml

@@ -13,13 +13,13 @@ repos:
         exclude: template
       - id: check-added-large-files
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.5
+    rev: v0.16.9
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.12.8
+    rev: 0.12.19
     hooks:
       - id: uv-lock
   - repo: https://github.com/adrienverge/yamllint.git

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Change Log
 
+## [24.4.1] - 2026-10-08
+
+### Fixed
+
+- `github-issue-comment` tasks now use the PR cache namespaces
+- perf: look up kind dependency tasks by kind in the generator (#1054)
+- perf: extract tar archives while they download in `fetch-content` (#1068)
+- perf: let tar decompress zstd archives in `fetch-content` (#1068)
+- perf: read downloads in 1MiB chunks in `fetch-content` (#1068)
+- perf: resolve each dependent's deadline only once in `optimize` (#1056)
+
+## [24.4.0] - 2026-10-05
+
+### Added
+
+- Merge concurrently extracted fetches in a fixed order in `fetch-content`
+- Hook point in `run-task` before the task payload
+- Prefix `run_python_script` output in `run-task` with `[script <timestamp>]`
+
+### Changed
+
+- `taskgraph init` template and tutorial docs now default to the `public_restricted` PR policy
+- BREAKING CHANGE: `run-task` requires Python 3.8
+
+### Fixed
+
+- `filter_for_git_branch` target task filter now works with untrusted PRs
+- Update `@taskcluster/client` dependency to v110 (#1060)
+- perf: compute `optionally_keyed_by` fields once per Schema class (#1049)
+- perf: speed up resolving task definition references (#1051)
+- perf: cache parsed relative time strings (#1052)
+- perf: cache the visit order of graphs (#1053)
+- perf: stop re-parsing the full task graph in the decision task (#1055)
+
 ## [24.3.0] - 2026-09-17
 
 ### Added

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskcluster-taskgraph
-Version: 24.3.0
+Version: 24.4.1
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/docs/howto/use-fetches.rst

@@ -105,3 +105,16 @@ There are a few differences from the earlier ``build`` examples here:
 
    It is not possible to configure the ``dest`` or ``extract`` values when using
    ``fetch`` or ``toolchain`` kinds.
+
+Tuning Download Performance
+---------------------------
+
+The following environment variable tunes how ``fetch-content`` downloads
+artifacts.
+
+``TASKGRAPH_FETCH_STREAM``
+   Tar archives that are extracted are extracted while they download, rather
+   than written to disk and read back, into a staging directory that is only
+   merged into place once the download is complete and verified. This is on
+   by default; set to ``0`` to download to a file first. Zip archives, and
+   fetches that aren't extracted, always go through a file.

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/docs/reference/parameters.rst

@@ -96,9 +96,17 @@ project
 
 level
 ~~~~~
-   The `SCM level`_ associated with this tree.
-
-.. _SCM level: https://www.mozilla.org/en-US/about/governance/policies/commit/access-policy/
+   The trust level associated with this task group. Trust levels provide a
+   convenient way to segregate resources such as worker-pools, secrets and
+   caches based on how the task group was triggered. This creates security
+   boundaries between various degrees of trust.
+
+   The meaning of a trust level can vary from project to project, but typically
+   level 1 is the lowest trust and corresponds to pull requests from external
+   contributors. Level 2 is a degree higher and denotes pull requests from repo
+   collaborators or pushes to unprotected branches. Level 3 is the highest
+   degree of trust and is reserved for pushes to protected branches and
+   releases.
 
 Target Set
 ----------

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/docs/tutorials/connecting-taskcluster.rst

@@ -79,7 +79,7 @@ here is the recommended method:
     version: 1
     reporting: checks-v1
     policy:
-        pullRequests: collaborators
+        pullRequests: public_restricted
     tasks:
         -
 
@@ -109,7 +109,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.pusher.email}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.user.login}@users.noreply.github.com'
                       else:
                           $if: 'tasks_for == "github-release"'
@@ -118,22 +118,22 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.base.repo.html_url}'
               repoUrl:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.html_url}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.html_url}'
               project:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.repository.name}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.repo.name}'
               headBranch:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: ${event.pull_request.head.ref}
                   else:
                       $if: 'tasks_for == "github-push"'
@@ -142,7 +142,7 @@ here is the recommended method:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.after}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then: '${event.pull_request.head.sha}'
 
    This isn't strictly necessary, but the format of the various Github events
@@ -165,7 +165,7 @@ here is the recommended method:
           in:
               $if: >
                   tasks_for == "github-push" && headBranch == "main"
-                  || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+                  || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
               then:
                   # Task definition goes here. Since there is no "else" clause, if
                   # the above if statement evaluates to false, there will be no
@@ -236,9 +236,11 @@ here is the recommended method:
                    # while ${headBranch[11:]} strips out 'refs/heads/'
                    - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                else:
-                   $if: 'tasks_for == "github-pull-request"'
+                   $if: 'tasks_for[:19] == "github-pull-request"'
                    then:
-                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                       # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                       # either 'pull-request' or 'pull-request-untrusted'.
+                       - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
 
       Notice how we assume different roles depending on whether the task is
       coming from a push or a pull request. This is useful when you have tasks
@@ -246,6 +248,17 @@ here is the recommended method:
       accidentally running on a pull request! By using different scopes, you can
       ensure it won't ever happen.
 
+      With the ``public_restricted`` policy set above, Github reports pull
+      requests from repository collaborators with ``tasks_for ==
+      "github-pull-request"`` and pull requests from everyone else with
+      ``tasks_for == "github-pull-request-untrusted"``. Slicing ``tasks_for[7:]``
+      turns those into the role names ``pull-request`` and
+      ``pull-request-untrusted``, so you can grant non-collaborator pull
+      requests a more restricted set of scopes than collaborator ones. This
+      matters because collapsing that distinction (e.g. by using the ``public``
+      policy) means any external contributor's pull request gets the same
+      scopes as a trusted collaborator's.
+
       The roles assumed above may vary depending on the Taskcluster
       configuration.
 
@@ -310,7 +323,7 @@ here is the recommended method:
                          # running your command
                          MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                          REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                       - $if: 'tasks_for in ["github-pull-request"]'
+                       - $if: 'tasks_for[:19] == "github-pull-request"'
                          then:
                              MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                command:

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/docs/tutorials/example-taskcluster.yml

@@ -2,7 +2,7 @@
 version: 1
 reporting: checks-v1
 policy:
-    pullRequests: collaborators
+    pullRequests: public_restricted
 tasks:
     - $let:
           # Variable definitions
@@ -13,7 +13,7 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.pusher.email}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.user.login}@users.noreply.github.com'
                   else:
                       $if: 'tasks_for == "github-release"'
@@ -22,22 +22,22 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.base.repo.html_url}'
           repoUrl:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.html_url}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.html_url}'
           project:
               $if: 'tasks_for == "github-push"'
               then: '${event.repository.name}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.repo.name}'
           headBranch:
-              $if: 'tasks_for == "github-pull-request"'
+              $if: 'tasks_for[:19] == "github-pull-request"'
               then: ${event.pull_request.head.ref}
               else:
                   $if: 'tasks_for == "github-push"'
@@ -46,13 +46,13 @@ tasks:
               $if: 'tasks_for == "github-push"'
               then: '${event.after}'
               else:
-                  $if: 'tasks_for == "github-pull-request"'
+                  $if: 'tasks_for[:19] == "github-pull-request"'
                   then: '${event.pull_request.head.sha}'
       in:
           # Guard that controls when to schedule tasks.
           $if: >
               tasks_for == "github-push" && headBranch == "main"
-              || (tasks_for == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
+              || (tasks_for[:19] == "github-pull-request" && ${event.action} in ["opened", "reopened", "synchronize"])
           then:
               # Task Definition
               taskId: '${ownTaskId}'
@@ -74,9 +74,14 @@ tasks:
                       # while ${headBranch[11:]} strips out 'refs/heads/'
                       - 'assume:repo:${repoUrl[8:]}:branch:${headBranch[11:]}'
                   else:
-                      $if: 'tasks_for == "github-pull-request"'
+                      $if: 'tasks_for[:19] == "github-pull-request"'
                       then:
-                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                          # ${tasks_for[7:]} strips the 'github-' prefix, leaving
+                          # 'pull-request' or 'pull-request-untrusted'. With the
+                          # 'public_restricted' policy these map to two separate
+                          # roles, so pull requests from collaborators get more
+                          # scopes than those from non-collaborators.
+                          - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
               payload:
                   image:
                       mozillareleases/taskgraph:decision-cf4b4b4baff57d84c1f9ec8fcd70c9839b70a7d66e6430a6c41ffe67252faa19@sha256:425e07f6813804483bc5a7258288a7684d182617ceeaa0176901ccc7702dfe28
@@ -97,7 +102,7 @@ tasks:
                             # bootstrapped
                             MYREPO_PIP_REQUIREMENTS: taskcluster/requirements.txt
                             REPOSITORIES: {$json: {myrepo: "MyRepo"}}
-                          - $if: 'tasks_for in ["github-pull-request"]'
+                          - $if: 'tasks_for[:19] == "github-pull-request"'
                             then:
                                 MYREPO_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
                   command:

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "24.3.0"
+version = "24.4.1"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [
@@ -52,6 +52,7 @@ dev = [
   "sphinx-book-theme >=1.1.4",
   "sphinx-taskgraph>=0.1.0",
   "sphinxcontrib-mermaid>=1.0.0",
+  "vermin>=1.8.0",
   "zstandard>=0.25.0",
 ]
 

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/decision.py

@@ -17,7 +17,6 @@ from taskgraph.actions import render_actions_json
 from taskgraph.create import create_tasks
 from taskgraph.generator import TaskGraphGenerator
 from taskgraph.parameters import Parameters, get_version
-from taskgraph.taskgraph import TaskGraph
 from taskgraph.util import json
 from taskgraph.util.python_path import find_object
 from taskgraph.util.schema import Schema, validate_schema
@@ -131,9 +130,6 @@ def taskgraph_decision(options, parameters=None):
         "runnable-jobs.json", full_task_graph_to_runnable_tasks(full_task_json)
     )
 
-    # this is just a test to check whether the from_json() function is working
-    _, _ = TaskGraph.from_json(full_task_json)
-
     # write out the target task set to allow reproducing this as input
     write_artifact("target-tasks.json", list(tgg.target_task_set.tasks.keys()))
 

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/generator.py

@@ -282,8 +282,21 @@ class TaskGraphGenerator:
                 except KindNotFound:
                     continue
 
+    @staticmethod
+    def _get_kind_dependencies_tasks(kind, tasks_by_kind):
+        """Return the tasks of the kinds `kind` depends on, in the order in
+        which they were loaded."""
+        kind_dependencies = kind.config.get("kind-dependencies", [])
+        return {
+            label: task
+            for kind_name, tasks in tasks_by_kind.items()
+            if kind_name in kind_dependencies
+            for label, task in tasks.items()
+        }
+
     def _load_tasks_serial(self, kinds, kind_graph, parameters):
         all_tasks = {}
+        tasks_by_kind = {}
         for kind_name in kind_graph.visit_postorder():
             logger.debug(f"Loading tasks for kind {kind_name}")
 
@@ -297,11 +310,7 @@ class TaskGraphGenerator:
             try:
                 new_tasks = kind.load_tasks(
                     parameters,
-                    {
-                        k: t
-                        for k, t in all_tasks.items()
-                        if t.kind in kind.config.get("kind-dependencies", [])
-                    },
+                    self._get_kind_dependencies_tasks(kind, tasks_by_kind),
                     self._write_artifacts,
                 )
             except SchemaValidationError as exc:
@@ -310,15 +319,18 @@ class TaskGraphGenerator:
             except Exception:
                 logger.exception(f"Error loading tasks for kind {kind_name}:")
                 raise
+            kind_tasks = tasks_by_kind.setdefault(kind_name, {})
             for task in new_tasks:
                 if task.label in all_tasks:
                     raise Exception("duplicate tasks with label " + task.label)
                 all_tasks[task.label] = task
+                kind_tasks[task.label] = task
 
         return all_tasks
 
     def _load_tasks_parallel(self, kinds, kind_graph, parameters, executor):
         all_tasks = {}
+        tasks_by_kind = {}
         futures_to_kind = {}
         futures = set()
         edges = set(kind_graph.edges)
@@ -328,7 +340,6 @@ class TaskGraphGenerator:
             def submit_ready_kinds():
                 """Create the next batch of tasks for kinds without dependencies."""
                 nonlocal kinds, edges, futures
-                loaded_tasks = all_tasks.copy()
                 kinds_with_deps = {edge[0] for edge in edges}
                 ready_kinds = (
                     set(kinds) - kinds_with_deps - set(futures_to_kind.values())
@@ -346,11 +357,7 @@ class TaskGraphGenerator:
                     future = executor.submit(
                         kind.load_tasks,
                         dict(parameters),
-                        {
-                            k: t
-                            for k, t in loaded_tasks.items()
-                            if t.kind in kind.config.get("kind-dependencies", [])
-                        },
+                        self._get_kind_dependencies_tasks(kind, tasks_by_kind),
                         self._write_artifacts,
                     )
                     futures.add(future)
@@ -376,10 +383,12 @@ class TaskGraphGenerator:
                     kind = futures_to_kind.pop(future)
                     futures.remove(future)
 
+                    kind_tasks = tasks_by_kind.setdefault(kind, {})
                     for task in future.result():
                         if task.label in all_tasks:
                             raise Exception("duplicate tasks with label " + task.label)
                         all_tasks[task.label] = task
+                        kind_tasks[task.label] = task
 
                     # Update state for next batch of futures.
                     del kinds[kind]

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/graph.py

@@ -107,6 +107,15 @@ class Graph(_Graph):
                 f"Dependency loop detected involving the following nodes: {loopy_nodes}"
             )
 
+    @functools.cache
+    def _visit_order(self, reverse):
+        """
+        Return the order in which `_visit` yields nodes as a tuple. The graph
+        is immutable, so this is cached to avoid sorting it again every time
+        it is visited.
+        """
+        return tuple(self._visit(reverse))
+
     def visit_postorder(self):
         """
         Generate a sequence of nodes in postorder, such that every node is
@@ -114,14 +123,14 @@ class Graph(_Graph):
 
         Raises an exception if the graph contains a cycle.
         """
-        return self._visit(False)
+        return iter(self._visit_order(False))
 
     def visit_preorder(self):
         """
         Like visit_postorder, but in reverse: evrey node is visited *before*
         any nodes it links to.
         """
-        return self._visit(True)
+        return iter(self._visit_order(True))
 
     @functools.cache
     def links_and_reverse_links_dict(self):

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/optimize/base.py

@@ -78,7 +78,7 @@ def optimize_task_graph(
 
     # Gather each relevant task's index
     indexes = set()
-    for label in target_task_graph.graph.visit_postorder():
+    for label in target_task_graph.tasks:
         if label in do_not_optimize:
             continue
         _, strategy, arg = optimizations(label)
@@ -157,7 +157,7 @@ def remove_tasks(
     opt_counts = defaultdict(int)
     opt_reasons = {}
     removed = set()
-    dependents_of = target_task_graph.graph.reverse_links_dict()
+    _, dependents_of = target_task_graph.graph.links_and_reverse_links_dict()
     tasks = target_task_graph.tasks
     prune_candidates = set()
 
@@ -301,6 +301,18 @@ def replace_tasks(
         target_task_graph.graph.links_and_reverse_links_dict()
     )
 
+    # Many tasks share dependents (e.g. docker images or toolchains), so
+    # resolve the deadline of each dependent only once.
+    now = datetime.datetime.now(datetime.timezone.utc)
+    deadlines = {}
+
+    def get_deadline(label):
+        if label not in deadlines:
+            deadlines[label] = resolve_timestamps(
+                now, target_task_graph.tasks[label].task["deadline"]
+            )
+        return deadlines[label]
+
     for label in target_task_graph.graph.visit_postorder():
         logger.debug(f"replace_tasks: {label}")
         # if we're not allowed to optimize, that's easy..
@@ -331,14 +343,9 @@ def replace_tasks(
         opt_by, opt, arg = optimizations(label)
 
         # compute latest deadline of dependents (if any)
-        dependents = [target_task_graph.tasks[l] for l in dependents_of[label]]
         deadline = None
-        if dependents:
-            now = datetime.datetime.now(datetime.timezone.utc)
-            deadline = max(
-                resolve_timestamps(now, task.task["deadline"])
-                for task in dependents  # type: ignore
-            )
+        if dependents_of[label]:
+            deadline = max(get_deadline(l) for l in dependents_of[label])
 
         if isinstance(opt, IndexSearch):
             arg = arg, index_to_taskid, taskid_to_status

{taskcluster_taskgraph-24.3.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/optimize/strategies.py

@@ -1,3 +1,4 @@
+import functools
 import logging
 from datetime import datetime
 
@@ -10,6 +11,13 @@ from taskgraph.util.taskcluster import find_task_id, status_task
 logger = logging.getLogger("optimization")
 
 
+@functools.cache
+def _parse_time(timestamp, fmt):
+    # Many tasks share the same deadline or replacement task, so avoid parsing
+    # the same timestamps over and over.
+    return datetime.strptime(timestamp, fmt)
+
+
 @register_strategy("index-search")
 class IndexSearch(OptimizationStrategy):
     # A task with no dependencies remaining after optimization will be replaced
@@ -56,10 +64,10 @@ class IndexSearch(OptimizationStrategy):
                     )
                     continue
 
-                if deadline and datetime.strptime(
+                if deadline and _parse_time(
                     status["expires"],  # type: ignore
                     self.fmt,
-                ) < datetime.strptime(deadline, self.fmt):
+                ) < _parse_time(deadline, self.fmt):
                     logger.debug(
                         f"not replacing {task.label} with {task_id} because it expires before {deadline}"
                     )