.taskcluster.yml

version: 1
policy:
  pullRequests: collaborators
tasks:
  $let:
    user: ${event.sender.login}

    task_group: {$eval: as_slugid("group")}

    fetch_rev:
      $if: 'tasks_for == "github-pull-request"'
      then: ${event.pull_request.head.sha}
      else:
        $if: 'tasks_for == "github-push"'
        then: ${event.after}
        else: ${event.release.tag_name}

    fetch_ref:
      $if: 'tasks_for == "github-pull-request"'
      then: ${event.pull_request.head.sha}
      else:
        $if: 'tasks_for == "github-push"'
        then: ${event.ref}
        else: "refs/tags/${event.release.tag_name}:refs/tags/${event.release.tag_name}"

    http_repo:
      $if: 'tasks_for == "github-pull-request"'
      then: ${event.pull_request.base.repo.clone_url}
      else: ${event.repository.clone_url}

    codecov_secret:
      codecov-fuzzmanager

    pypi_secret:
      pypi-fuzzmanager

    project_name:
      FuzzManager

    matrix:
      language: python
      secrets:
        - type: env
          secret: project/fuzzing/codecov-fuzzmanager
          name: CODECOV_TOKEN
          key: token
      script:
        - bash
        - '-xec'
        - tox; tox -e codecov
      jobs:
        include:
          - name: tests python 3.9 django 4.x
            version: "3.9"
            env:
              TOXENV: py39
          - name: tests python 3.10 django 4.x
            version: "3.10"
            env:
              TOXENV: py310
          - name: tests python 3.11 django 4.x
            version: "3.11"
            env:
              TOXENV: py311
          - name: tests python 3.12 (no django)
            version: "3.12"
            env:
              TOXENV: py312
          - name: linting
            version: "3.9"
            script:
              - bash
              - '-xec'
              - >
                retry-curl () { curl --connect-timeout 25 --fail --location --retry 5 --show-error --silent "$@"; };
                mkdir -p ~/.local/bin ~/.local/lib;
                PATH=~/.local/bin:$PATH;
                retry-curl https://nodejs.org/dist/v18.20.3/node-v18.20.3-linux-x64.tar.xz | tar -C ~/.local/lib -I xz -x;
                cd ~/.local/bin;
                for i in ~/.local/lib/node-v18.20.3-linux-x64/bin/*; do ln -s "$i" .; done;
                cd -;
                cd server/frontend;
                npm i;
                cd ../..;
                pre-commit run -a;
          - name: build frontend node 18
            language: node
            version: "18"
            script:
              - bash
              - '-xec'
              - >
                retry () { for _ in {1..9}; do if "$@"; then return; else sleep 30; fi; done; "$@"; };
                cd server/frontend;
                retry npm install;
                npm run test;
                npm run production;
                npm run codecov;
          - name: PyPI upload
            version: "3.9"
            env:
              TOXENV: pypi
            script:
              - tox
            when:
              release: true
              all_passed: true
            secrets:
              - type: env
                secret: project/fuzzing/pypi-fuzzmanager
                name: TWINE_USERNAME
                key: username
              - type: env
                secret: project/fuzzing/pypi-fuzzmanager
                name: TWINE_PASSWORD
                key: password

  in:
    $if: >
      (tasks_for == "github-push")
      || (tasks_for == "github-pull-request" && event["action"] in ["opened", "reopened", "synchronize"])
      || (tasks_for == "github-release" && event["action"] in ["published"])
    then:
      - taskId: ${task_group}
        taskGroupId: ${task_group}
        created: {$fromNow: ''}
        deadline: {$fromNow: '1 hour'}
        provisionerId: proj-fuzzing
        workerType: ci
        payload:
          features:
            taskclusterProxy: true
          maxRunTime: 3600
          image:
            type: indexed-image
            path: public/orion-decision.tar.zst
            namespace: project.fuzzing.orion.orion-decision.master
          env:
            PROJECT_NAME: ${project_name}
            CI_MATRIX: {$json: {$eval: matrix}}
            GITHUB_EVENT: {$json: {$eval: event}}
            GITHUB_ACTION: ${tasks_for}
            TASKCLUSTER_NOW: ${now}
          command:
            - ci-decision
            - -v
        scopes:
          - queue:create-task:highest:proj-fuzzing/ci
          - queue:create-task:highest:proj-fuzzing/ci-*
          - queue:scheduler-id:taskcluster-github
          - secrets:get:project/fuzzing/${codecov_secret}
          - secrets:get:project/fuzzing/${pypi_secret}
        metadata:
          name: ${project_name} CI decision
          description: Schedule CI tasks for ${project_name}
          owner: '${user}@users.noreply.github.com'
          source: ${http_repo}/raw/${fetch_rev}/.taskcluster.yml
      - taskId: {$eval: as_slugid("docker")}
        taskGroupId: ${task_group}
        provisionerId: proj-fuzzing
        workerType: ci
        dependencies: []
        created: {$fromNow: ''}
        deadline: {$fromNow: '1 hour'}
        payload:
          image:
            namespace: project.fuzzing.orion.orion-builder.master
            path: public/orion-builder.tar.zst
            type: indexed-image
          maxRunTime: 3600
          capabilities:
            privileged: true
          env:
            LOAD_DEPS: "0"
            GIT_REPOSITORY: ${http_repo}
            GIT_REVISION: ${fetch_rev}
            BUILD_TOOL: podman
            DOCKERFILE: Dockerfile
            IMAGE_NAME: mozillasecurity/fuzzmanager
            ARCHIVE_PATH: /image.tar
          command:
            - sh
            - -c
            - uname -a && exec build
          artifacts:
            public/fuzzmanager.tar.zst:
              expires: {$fromNow: '6 months'}
              path: /image.tar.zst
              type: file
        scopes:
          - docker-worker:capability:privileged
        metadata:
          name: FuzzManager Docker build
          description: FuzzManager Docker build
          owner: '${user}@users.noreply.github.com'
          source: ${http_repo}/raw/${fetch_rev}/.taskcluster.yml
      - $if: 'tasks_for in ["github-push"] && fetch_ref == "refs/heads/master"'
        then:
          taskId: {$eval: as_slugid("docker_push")}
          taskGroupId: ${task_group}
          provisionerId: proj-fuzzing
          workerType: ci
          dependencies:
            - {$eval: as_slugid("docker")}
          created: {$fromNow: ''}
          deadline: {$fromNow: '1 hour'}
          payload:
            image:
              namespace: project.fuzzing.orion.orion-builder.master
              path: public/orion-builder.tar.zst
              type: indexed-image
            maxRunTime: 3600
            features:
              taskclusterProxy: true
            env:
              TASK_ID: {$eval: as_slugid("docker")}
              TASKCLUSTER_SECRET: "project/fuzzing/docker-hub"
              GIT_REPOSITORY: ${http_repo}
              GIT_REVISION: ${fetch_rev}
              SERVICE_NAME: fuzzmanager
            command:
              - sh
              - -c
              - uname -a && exec push
          scopes:
            - secrets:get:project/fuzzing/docker-hub
          metadata:
            name: FuzzManager Docker push
            description: FuzzManager Docker push
            owner: '${user}@users.noreply.github.com'
            source: ${http_repo}/raw/${fetch_rev}/.taskcluster.yml
    else: []