Bug 2015223: Rework Adding Release Branch

stephenking314 · stephenking314 · commit de882a4e1615 · 2026-02-28T17:55:38.000-07:00
- Moves `app_id` to task.  This gives us some flexibility without needing
  to update the scriptworker.  Particularly, this may be scritctly
neccesary while Thunderbird transitions the primary channel from ESR to
Release.  Otherwise, we will need to coordinate upates to our kind files
with updates to scriptworker, which may be tricky.

- Adds `branch` to task definition so the appropriate token can be
  selected without overloading `channel`
diff --git a/pushflatpakscript/docker.d/init_worker.sh b/pushflatpakscript/docker.d/init_worker.sh
@@ -26,18 +26,12 @@ case $ENV in
     echo $REPO_TOKEN_BETA | base64 -d > $REPO_TOKEN_BETA_PATH
     echo $REPO_TOKEN_STABLE | base64 -d > $REPO_TOKEN_STABLE_PATH
 
-
-    if [ "$COT_PRODUCT" = thunderbird ]; then
-      # test_var_set 'REPO_TOKEN_RELEASE'
-      # must either have REPO_TOKEN_RELEASE or REPO_TOKEN_ESR defined
-      if [[ -z "$REPO_TOKEN_RELEASE" ]] && [[ -z "$REPO_TOKEN_ESR" ]]; then
-        echo "error: must have token defined for release or esr channel"
-        exit 1
-      fi
-
+    if [ -n "$REPO_TOKEN_RELEASE" ]; then
       export REPO_TOKEN_RELEASE_PATH=$CONFIG_DIR/release_token.txt
       echo $REPO_TOKEN_RELEASE | base64 -d > $REPO_TOKEN_RELEASE_PATH
+    fi
 
+    if [ -n "$REPO_TOKEN_ESR" ]; then
       export REPO_TOKEN_ESR_PATH=$CONFIG_DIR/esr_token.txt
       echo $REPO_TOKEN_ESR | base64 -d > $REPO_TOKEN_ESR_PATH
     fi
@@ -54,8 +48,6 @@ case $COT_PRODUCT in
     ;;
   thunderbird)
     export APP_ID="org.mozilla.Thunderbird"
-    export APP_ID_RELEASE="org.mozilla.ThunderbirdRelease"
-    export APP_ID_ESR="org.mozilla.ThunderbirdESR"
     export TASKCLUSTER_SCOPE_PREFIX="project:comm:thunderbird:releng:flathub:"
     ;;
   *)
diff --git a/pushflatpakscript/docker.d/worker.yml b/pushflatpakscript/docker.d/worker.yml
@@ -1,17 +1,7 @@
 work_dir: { "$eval": "WORK_DIR" }
 artifact_dir: { "$eval": "ARTIFACTS_DIR" }
 verbose: { "$eval": "VERBOSE == 'true'" }
-app_ids:
-  beta: {"$eval": "APP_ID" }
-  stable: {"$eval": "APP_ID"}
-  release:
-    $if: defined("APP_ID_RELEASE")
-    then: {"$eval": "APP_ID_RELEASE"}
-    else: ''
-  esr:
-    $if: defined("APP_ID_ESR")
-    then: {"$eval": "APP_ID_ESR"}
-    else: ''
+app_id: { "$eval": "APP_ID" }
 taskcluster_scope_prefix: { "$eval": "TASKCLUSTER_SCOPE_PREFIX" }
 push_to_flathub: { "$eval": "ENV == 'prod'" }
 flathub_url: { "$eval": "FLATHUB_URL" }
@@ -24,11 +14,11 @@ token_locations:
     stable: { "$eval": "REPO_TOKEN_STABLE_PATH" }
     release:
       $if: defined("REPO_TOKEN_RELEASE_PATH")
-      then: {"$eval": "REPO_TOKEN_RELEASE_PATH"}
+      then: { "$eval": "REPO_TOKEN_RELEASE_PATH" }
       else: ''
     esr:
       $if: defined("REPO_TOKEN_ESR_PATH")
-      then: {"$eval": "REPO_TOKEN_ESR_PATH"}
+      then: { "$eval": "REPO_TOKEN_ESR_PATH" }
       else: ''
 
   else: {}
diff --git a/pushflatpakscript/examples/config.example.json b/pushflatpakscript/examples/config.example.json
@@ -1,10 +1,7 @@
 {
   "work_dir": "/some/work/dir",
   "verbose": true,
-  "app_ids": {
-    "stable": "org.mozilla.firefox",
-    "beta": "org.mozilla.firefox"
-  },
+  "app_id": "org.mozilla.firefox",
   "taskcluster_scope_prefix": "project:releng:flathub:firefox:",
   "push_to_flathub": true,
   "flathub_url": "flathub URL location",
diff --git a/pushflatpakscript/examples/push_flatpak_task_schema.json b/pushflatpakscript/examples/push_flatpak_task_schema.json
@@ -23,6 +23,12 @@
                 "channel": {
                     "type": "string"
                 },
+                "app_id": {
+                    "type": "string"
+                },
+                "branch": {
+                    "type": "string"
+                },
                 "upstreamArtifacts": {
                     "type": "array",
                     "items": {
diff --git a/pushflatpakscript/src/pushflatpakscript/data/config_schema.json b/pushflatpakscript/src/pushflatpakscript/data/config_schema.json
@@ -2,7 +2,7 @@
     "title": "pushflatpakscript config schema",
     "type": "object",
     "required": [
-        "app_ids",
+        "app_id",
         "taskcluster_scope_prefix",
         "push_to_flathub",
         "token_locations",
@@ -11,11 +11,8 @@
         "taskcluster_root_url"
     ],
     "properties": {
-        "app_ids": {
-            "type": "object",
-            "additionalProperties": {
-                "type": "string"
-            }
+        "app_id": {
+            "type": "string"
         },
         "taskcluster_scope_prefix": {
             "type": "string"
diff --git a/pushflatpakscript/src/pushflatpakscript/data/push_flatpak_task_schema.json b/pushflatpakscript/src/pushflatpakscript/data/push_flatpak_task_schema.json
@@ -23,6 +23,12 @@
                 "channel": {
                     "type": "string"
                 },
+                "app_id": {
+                    "type": "string"
+                },
+                "branch": {
+                    "type": "string"
+                },
                 "upstreamArtifacts": {
                     "type": "array",
                     "items": {
diff --git a/pushflatpakscript/src/pushflatpakscript/flathub.py b/pushflatpakscript/src/pushflatpakscript/flathub.py
@@ -142,30 +142,29 @@ def files(tar, path):
     return os.path.join(flatpak_tar_basedir, flatpak_deflated_dir)
 
 
-def check_app_id_matches_flatpak(context, flatpak_path, channel):
+def check_app_id_matches_flatpak(context, flatpak_path):
     # Extract all ostree refs from the supplied Flatpak repo
     flatpak_refs = subprocess.check_output(["ostree", "refs"], cwd=flatpak_path).decode().splitlines()
 
     # Consolidate ostree refs into list of Flatpak IDs available in repo
     flatpak_refs = [ref.split("/")[1] for ref in flatpak_refs if ref.startswith("app/")]
 
+    app_id = task.get_flatpak_app_id(context.config, context.task)
+
     # Create a list, if any, of all unexpected Flatpak IDs present in repo
-    invalid_refs = set(flatpak_refs) - set(context.config["app_ids"].values())
+    invalid_refs = set(flatpak_refs) - app_id
 
-    if context.config["app_ids"][channel] not in flatpak_refs:
-        raise TaskVerificationError(f"Supplied app ID ({context.config['app_ids'][channel]}) is not present in Flatpak!")
+    if app_id not in flatpak_refs:
+        raise TaskVerificationError(f"Supplied app ID ({app_id}) is not present in Flatpak!")
 
     if len(invalid_refs) > 0:
         raise TaskVerificationError("One or more invalid app IDs are present in Flatpak!")
 
 
-def check_config_for_channel(config, channel):
-    """Verify AppID and token location defined for supplied channel"""
-    if channel not in config["app_ids"]:
-        raise TaskVerificationError(f"Supplied channel ({channel}) does not have a configured appID")
-
-    if channel not in config["token_locations"]:
-        raise TaskVerificationError(f"Supplied channel ({channel}) does not have a configured token")
+def check_config_for_branch(config, branch):
+    """Verify Token location defined for supplied branch"""
+    if branch not in config["token_locations"]:
+        raise TaskVerificationError(f"Supplied branch ({branch}) does not have a configured token")
 
 
 def sanitize_buildid(bytes_input):
@@ -183,13 +182,14 @@ def push(context, flatpak_file_path, channel):
         # We don't raise an error because we still want green tasks on dev instances
         return
 
-    check_config_for_channel(context.config, channel)
+    branch = task.get_release_branch(context.config, context.task)
+
+    check_config_for_branch(context.config, branch)
 
-    token_args = ["--token-file", context.config["token_locations"][channel]]
+    token_args = ["--token-file", context.config["token_locations"][branch]]
     log.info("Grab a flatpak buildid from Flathub ...")
-    publish_channel = "beta" if channel == "beta" else "stable"
     publish_build_output = run_flat_manager_client_process(
-        context, token_args + ["create", context.config["flathub_url"], publish_channel, "--build-log-url", build_log]
+        context, token_args + ["create", context.config["flathub_url"], channel, "--build-log-url", build_log]
     )
 
     log.info("Sanitize the buildid received from Flathub ...")
@@ -203,7 +203,7 @@ def push(context, flatpak_file_path, channel):
     deflated_dir = check_and_extract_tar_archive(context, flatpak_file_path)
 
     log.info("Verifying supplied app ID matches flatpak app ID...")
-    check_app_id_matches_flatpak(context, deflated_dir, channel)
+    check_app_id_matches_flatpak(context, deflated_dir)
 
     log.info(f"Pushing the flatpak to the associated {publish_build_output}")
     run_flat_manager_client_process(context, token_args + ["push", publish_build_output, deflated_dir])
diff --git a/pushflatpakscript/src/pushflatpakscript/task.py b/pushflatpakscript/src/pushflatpakscript/task.py
@@ -1,6 +1,6 @@
 from scriptworker.exceptions import TaskVerificationError
 
-_CHANNELS_AUTHORIZED_TO_REACH_FLATHUB = ("beta", "stable", "release", "esr")
+_CHANNELS_AUTHORIZED_TO_REACH_FLATHUB = ("beta", "stable")
 ALLOWED_CHANNELS = ("mock", *_CHANNELS_AUTHORIZED_TO_REACH_FLATHUB)
 
 
@@ -20,5 +20,17 @@ def get_flatpak_channel(config, task):
     return channel
 
 
+def get_flatpak_app_id(config, task):
+    payload = task["payload"]
+
+    return payload.get("app_id", config["app_id"])
+
+
+def get_release_branch(config, task):
+    payload = task["payload"]
+
+    return payload.get("branch", config["channel"])
+
+
 def is_allowed_to_push_to_flathub(config, channel):
     return "push_to_flathub" in config and config["push_to_flathub"] and channel in _CHANNELS_AUTHORIZED_TO_REACH_FLATHUB
diff --git a/pushflatpakscript/tests/test_config.py b/pushflatpakscript/tests/test_config.py
@@ -10,8 +10,6 @@
     "ARTIFACTS_DIR": "",
     "VERBOSE": "true",
     "APP_ID": "",
-    "APP_ID_RELEASE": "",
-    "APP_ID_ESR": "",
     "COT_PRODUCT": "firefox",
     "TASKCLUSTER_SCOPE_PREFIX": "",
     "FLATHUB_URL": "https://flat.example",
diff --git a/pushflatpakscript/tests/test_task.py b/pushflatpakscript/tests/test_task.py
@@ -14,7 +14,7 @@ def test_get_flatpak_channel_without_payload_raises():
 @pytest.mark.parametrize("raises, channel", ((False, "stable"), (False, "beta"), (False, "mock"), (False, "beta"), (False, "beta"), (True, "bogus")))
 def test_get_flatpak_channel_dep(raises, channel):
     task = {"scopes": [], "payload": {"channel": channel}}
-    config = {"app_ids": {"stable": "org.mozilla.firefox", "beta": "org.mozilla.firefox"}, "taskcluster_scope_prefix": "project:releng:flathub:firefox:", "push_to_flathub": False}
+    config = {"app_id": "org.mozilla.firefox", "taskcluster_scope_prefix": "project:releng:flathub:firefox:", "push_to_flathub": False}
     if raises:
         with pytest.raises(TaskVerificationError):
             get_flatpak_channel(config, task)
@@ -35,7 +35,7 @@ def test_get_flatpak_channel_dep(raises, channel):
 )
 def test_get_flatpak_channel_prod(raises, scopes, channel):
     task = {"scopes": scopes, "payload": {"channel": channel}}
-    config = {"app_ids": {"stable": "org.mozilla.firefox", "beta": "org.mozilla.firefox"},
+    config = {"app_id": "org.mozilla.firefox",
               "token_locations": {"stable": "stable.txt", "beta": "beta.txt"},
               "taskcluster_scope_prefix": "project:releng:flathub:firefox:",
               "push_to_flathub": True}
@@ -58,5 +58,5 @@ def test_get_flatpak_channel_prod(raises, scopes, channel):
     ),
 )
 def test_is_allowed_to_push_to_flathub(channel, push_to_flathub, expected):
-    config = {"app_ids": {"stable": "org.mozilla.firefox", "beta": "org.mozilla.firefox"}, "taskcluster_scope_prefix": "project:releng:flathub:firefox:", "push_to_flathub": push_to_flathub}
+    config = {"app_id": "org.mozilla.firefox", "taskcluster_scope_prefix": "project:releng:flathub:firefox:", "push_to_flathub": push_to_flathub}
     assert is_allowed_to_push_to_flathub(config, channel) == expected
