Skip to content

Adjust CoT verification for new action and cron roles - #823

Draft
ahal wants to merge 2 commits into
mozilla-releng:mainfrom
ahal:ahal/pyooluolywvt
Draft

Adjust CoT verification for new action and cron roles#823
ahal wants to merge 2 commits into
mozilla-releng:mainfrom
ahal:ahal/pyooluolywvt

Conversation

@ahal

@ahal ahal commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@ahal ahal self-assigned this Aug 20, 2026
ahal added 2 commits August 21, 2026 15:01
The action repo roles are changing to include the level. We need to
account for that in CoT.
Cron tasks can now run against specific Git branches, so we can't just
assume they're running on the default branch anymore.
@ahal
ahal force-pushed the ahal/pyooluolywvt branch from 8f50612 to d2f0468 Compare August 21, 2026 19:07
@ahal

ahal commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

I somewhat tested this here:
https://treeherder.mozilla.org/jobs?repo=try&revision=aa42e4ef18696cfd45a3b8c7884e97f28884e716

Which is using this PR. In this case the associated fxci-config PR hasn't landed yet, so the CoT error is exactly as expected:

2026-08-21T18:28:13 CRITICAL - scriptworker:parent IPph5MjSTdKbKc6rHdesQw: the runtime task doesn't match any rebuilt definition!
["[('change',\n"
" ['scopes', 0],\n"
" ('assume:repo:hg.mozilla.org/try:action-1:generic',\n"
" 'assume:repo:hg.mozilla.org/try:action:generic'))]"]
2026-08-21T18:28:13 CRITICAL - Chain of Trust verification error!

@ahal

ahal commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

The failures are in test_production.py which hits live config. Not something I can fix in this PR, we'll need to co-ordinate this with the fxci-config PR.

@ahal
ahal marked this pull request as ready for review August 24, 2026 15:18
@ahal
ahal requested a review from a team as a code owner August 24, 2026 15:18

@hneiva hneiva left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

if branch["name"] == default_branch:
return str(branch["level"])
if branch is None:
branch = config.get("default_branch", "main")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like we should crash if a default_branch is not set on the repo.
No need to fix this here, we can fix this in the future.

branch = config.get("default_branch", "main")
for b in config["branches"]:
if fnmatch.fnmatch(branch, b["name"]):
return str(b["level"])

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I got a bit confused at first glance here. b variable (b["foo"]) vs byte-string (b"foo")

@ahal

ahal commented Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

I think we're going to try to fix this in a backwards compatible way.. But I think we'll still likely want this in the future. Marking back as draft for now.

@ahal
ahal marked this pull request as draft August 25, 2026 19:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants