Bug 1698511: Publish revisions as mach releases in Sentry r=aki

To identify regressions and existing exceptions in Sentry, we tag them
with their mach release (the current base revision).
To ensure that Sentry knows the correct order of revisions, we need to
tell it about each one that lands in mozilla-central.

Differential Revision: https://phabricator.services.mozilla.com/D109681

taskcluster/ci/config.yml

@@ -154,6 +154,7 @@ treeherder:
         'rust': 'Rust checks'
         'Static-Analysis': 'Full tree static-analysis'
         'SS': 'Shadow scheduler'
+        'Sentry': 'Sentry synchronization'
         'test-info': 'Test manifest skip/fail information'
         'condprof': 'Conditioned Profile Builder'
         'doc': 'Documentation'

taskcluster/ci/docker-image/kind.yml

@@ -167,6 +167,9 @@ jobs:
     github-sync:
         symbol: I(github-sync)
         parent: debian10-base
+    sentry:
+        symbol: I(sentry)
+        parent: debian10-base
     system-symbols-mac:
         symbol: I(system-symbols-mac)
         parent: debian10-base

taskcluster/ci/sentry/kind.yml

@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+---
+loader: taskgraph.loader.transform:loader
+
+transforms:
+    - taskgraph.transforms.sentry:transforms
+    - taskgraph.transforms.job:transforms
+    - taskgraph.transforms.task:transforms
+
+jobs:
+    mach-release:
+        description: Inform Sentry of new revisions (aka Mach releases)
+        worker-type: b-linux
+        worker:
+            taskcluster-proxy: true
+            max-run-time: 3600
+            docker-image: {in-tree: sentry}
+            env:
+                HG_PUSHLOG_URL: "{head_repository}/json-pushes?version=2&changeset={head_rev}"
+        scopes:
+            - secrets:get:project/engwf/gecko/3/tokens
+        run:
+            using: run-task
+            checkout: false
+            command: /bin/bash /usr/bin/submit_sentry_release.sh
+        run-on-projects: ['mozilla-central']
+        treeherder:
+            symbol: Sentry(mach-release)
+            platform: other/opt
+            tier: 2
+            kind: other

taskcluster/docker/sentry/Dockerfile

@@ -0,0 +1,11 @@
+FROM $DOCKER_IMAGE_PARENT
+LABEL maintainer="Mitchell Hentges mhentges@mozilla.com"
+
+VOLUME  /builds/worker/checkouts
+
+ADD prepare.sh /setup/prepare-docker.sh
+ADD submit_sentry_release.sh /usr/bin/submit_sentry_release.sh
+RUN /bin/bash /setup/prepare-docker.sh && rm -R /setup
+
+# Set a default command useful for debugging
+CMD ["/bin/sh", "--login"]

taskcluster/docker/sentry/prepare.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o xtrace
+
+apt-get -y update
+
+# Install:
+# * curl to fetch sentry-cli
+# * jq to parse hgmo pushlog
+# * pip so we can install yq
+apt-get install -y \
+    curl \
+    jq \
+    python3-pip
+
+# Install yq to parse secrets YAML
+pip3 install yq
+
+# Install sentry-cli to publish releases
+curl -L https://github.com/getsentry/sentry-cli/releases/download/1.63.1/sentry-cli-Linux-x86_64 -o /usr/bin/sentry-cli
+chmod +x /usr/bin/sentry-cli

taskcluster/docker/sentry/submit_sentry_release.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -o nounset
+set -o pipefail
+
+run() {
+    revisions=$(curl "$HG_PUSHLOG_URL" | jq -c -r ".pushes[].changesets | @sh" | tr -d \') || return 1
+    sentry_api_key=$(curl "http://taskcluster/secrets/v1/secret/project/engwf/gecko/3/tokens" | yq -r .sentryToken) || return 1
+    for revision in $revisions; do
+        SENTRY_API_KEY=$sentry_api_key SENTRY_ORG=operations sentry-cli --url https://sentry.prod.mozaws.net/ releases --project mach new "$revision" || return 1
+    done
+}
+
+with_backoff() {
+    failures=0
+    while ! "$@"; do
+        failures=$(( failures + 1 ))
+        if (( failures >= 5 )); then
+            echo "[with_backoff] Unable to succeed after 5 tries, failing the job."
+            return 1
+        else
+            seconds=$(( 2 ** (failures - 1) ))
+            echo "[with_backoff] Retrying in $seconds second(s)"
+            sleep $seconds
+        fi
+    done
+}
+
+with_backoff run

taskcluster/docs/kinds.rst

@@ -705,6 +705,10 @@ merge-automation
 ----------------
 Hook-driven tasks that automate "Merge Day" tasks during the release cycle.
 
+sentry
+------
+Interact with Sentry, such as by publishing new project releases.
+
 system-symbols
 --------------
 Generate missing macOS and windows system symbols from crash reports.

taskcluster/taskgraph/transforms/sentry.py

@@ -0,0 +1,22 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+
+
+transforms = TransformSequence()
+
+
+@transforms.add
+def sentry(config, tasks):
+    """Do transforms specific to github-sync tasks."""
+    for task in tasks:
+        task["worker"]["env"]["HG_PUSHLOG_URL"] = task["worker"]["env"][
+            "HG_PUSHLOG_URL"
+        ].format(
+            head_repository=config.params["head_repository"],
+            head_rev=config.params["head_rev"],
+        )
+        yield task