Bug 1879975 - Hooking up secret keys with try and release builds for new windows api taskbar pinning r=bhearsum,taskgraph-reviewers,ahal

Added new secret data storing the release keys. Modifying scripts to hook them up. Testing will be done thoroughly with try and release builds to confirm that pinning works on newer machines and falls back to the old mechanism on older machines. Differential Revision: https://phabricator.services.mozilla.com/D205361
2024-11-27 06:43:32 +00:00 · 2024-04-17 17:51:58 +00:00 · 2024-04-17 17:51:58 +00:00 · e85366d893
commit e85366d893
parent d50d44c62f
15 changed files with 89 additions and 0 deletions
--- a/browser/config/mozconfigs/win32/common-win32
+++ b/browser/config/mozconfigs/win32/common-win32
@ -1,5 +1,7 @@
 # This file is used by all Win32 builds

+. "$topsrcdir/browser/config/mozconfigs/windows-limited-access-features"
+
 ac_add_options --target=i686-pc-windows-msvc

 . $topsrcdir/build/mozconfig.clang-cl
--- a/browser/config/mozconfigs/win64-aarch64/common-win64
+++ b/browser/config/mozconfigs/win64-aarch64/common-win64
@ -1,5 +1,7 @@
 # This file is used by all AArch64 Win64 builds

+. "$topsrcdir/browser/config/mozconfigs/windows-limited-access-features"
+
 ac_add_options --target=aarch64-pc-windows-msvc

 . $topsrcdir/build/mozconfig.clang-cl
--- a/browser/config/mozconfigs/win64/common-win64
+++ b/browser/config/mozconfigs/win64/common-win64
@ -1,5 +1,7 @@
 # This file is used by all Win64 builds

+. "$topsrcdir/browser/config/mozconfigs/windows-limited-access-features"
+
 ac_add_options --target=x86_64-pc-windows-msvc

 . $topsrcdir/build/mozconfig.clang-cl
--- a/browser/config/mozconfigs/windows-limited-access-features
+++ b/browser/config/mozconfigs/windows-limited-access-features
@ -0,0 +1,13 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This file is included by windows specific mozconfigs
+
+if test `uname -s` != Linux; then
+APIKEYDIR="${APIKEYDIR:-${WORKSPACE}}"
+else
+APIKEYDIR="${APIKEYDIR:-/builds}"
+fi
+
+ac_add_options --with-windows-taskbar-pinning-api-keyfile=${APIKEYDIR}/windows-laf-tokens.data
--- a/taskcluster/ci/artifact-build/kind.yml
+++ b/taskcluster/ci/artifact-build/kind.yml
@ -30,6 +30,11 @@ job-defaults:
            PERFHERDER_EXTRA_OPTIONS: artifact
            MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE: system
            USE_ARTIFACT: '1'
+    # Note: this makes the tokens accessible to more than just the Windows builds,
+    # but we do not have Windows-specific mozharness configs, so it's simpler
+    # to just add this scope to all builds.
+    scopes:
+        - secrets:get:project/releng/gecko/build/windows-laf-tokens.data
    run:
        using: mozharness
        actions: [get-secrets, build]
--- a/taskcluster/ci/build/kind.yml
+++ b/taskcluster/ci/build/kind.yml
@ -37,6 +37,12 @@ job-defaults:
        env:
            MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE: system
    use-python: default
+
+    # Note: this makes the tokens accessible to more than just the Windows builds,
+    # but we do not have Windows-specific mozharness configs, so it's simpler
+    # to just add this scope to all builds.
+    scopes:
+        - secrets:get:project/releng/gecko/build/windows-laf-tokens.data
    run:
        mozconfig-variant:
            by-release-type:
--- a/taskcluster/ci/valgrind/kind.yml
+++ b/taskcluster/ci/valgrind/kind.yml
@ -21,6 +21,11 @@ job-defaults:
 jobs:
    linux64-valgrind-qr/opt-swr:
        description: "Linux64 Valgrind Opt WebRender"
+        # Not technically needed, but added here in the short term to unblock
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=1879975
+        # Will be removed as part of https://bugzilla.mozilla.org/show_bug.cgi?id=1890359
+        scopes:
+            - secrets:get:project/releng/gecko/build/windows-laf-tokens.data
        index:
            product: firefox
            job-name: linux64-valgrind-qr/opt-swr
--- a/taskcluster/gecko_taskgraph/transforms/build.py
+++ b/taskcluster/gecko_taskgraph/transforms/build.py
@ -233,3 +233,15 @@ def set_expiry(config, jobs):

        job["expiration-policy"] = expiration_policy
        yield job
+
+
+@transforms.add
+def add_windows_laf_secret_scope(config, jobs):
+    laf_secret = "secrets:get:project/releng/gecko/build/windows-laf-tokens.data"
+    scopes_key = "scopes"
+    for job in jobs:
+        job.setdefault(scopes_key, [])
+        if laf_secret not in job[scopes_key]:
+            job[scopes_key].append(laf_secret)
+
+        yield job
--- a/testing/mozharness/configs/builds/releng_base_android_64_builds.py
+++ b/testing/mozharness/configs/builds/releng_base_android_64_builds.py
@ -29,6 +29,12 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "/builds/windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
    "vcs_share_base": "/builds/hg-shared",
    "multi_locale": True,
--- a/testing/mozharness/configs/builds/releng_base_linux_64_builds.py
+++ b/testing/mozharness/configs/builds/releng_base_linux_64_builds.py
@ -32,6 +32,12 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "/builds/windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
    "vcs_share_base": "/builds/hg-shared",
    #########################################################################
--- a/testing/mozharness/configs/builds/releng_base_mac_64_cross_builds.py
+++ b/testing/mozharness/configs/builds/releng_base_mac_64_cross_builds.py
@ -28,6 +28,12 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "/builds/windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
    "enable_check_test": False,
    "vcs_share_base": "/builds/hg-shared",
--- a/testing/mozharness/configs/builds/releng_base_windows_32_mingw_builds.py
+++ b/testing/mozharness/configs/builds/releng_base_windows_32_mingw_builds.py
@ -28,6 +28,12 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "/builds/windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
    "vcs_share_base": "/builds/hg-shared",
    #########################################################################
--- a/testing/mozharness/configs/builds/releng_base_windows_64_mingw_builds.py
+++ b/testing/mozharness/configs/builds/releng_base_windows_64_mingw_builds.py
@ -28,6 +28,12 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "/builds/windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
    "vcs_share_base": "/builds/hg-shared",
    #########################################################################
--- a/testing/mozharness/configs/builds/taskcluster_base_macosx.py
+++ b/testing/mozharness/configs/builds/taskcluster_base_macosx.py
@ -40,5 +40,11 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
 }
--- a/testing/mozharness/configs/builds/taskcluster_base_windows.py
+++ b/testing/mozharness/configs/builds/taskcluster_base_windows.py
@ -42,5 +42,11 @@ config = {
            "min_scm_level": 2,
            "default": "try-build-has-no-secrets",
        },
+        {
+            "filename": "windows-laf-tokens.data",
+            "secret_name": "project/releng/gecko/build/windows-laf-tokens.data",
+            "min_scm_level": 1,
+            "default": "no-product-name no-token-key",
+        },
    ],
 }