tor-browser

commit e47eac6f065c1840056990b54d04a583bf289ee6
parent 84ff681604f3a64b18d4502d475603cd0cf069d3
Author: Julien Cristau <jcristau@mozilla.com>
Date:   Mon,  3 Nov 2025 14:38:30 +0000

Bug 1997922 - move expiration-policy check to graph verifications. r=taskgraph-reviewers,ahal

Instead of checking taskcluster/config.yml's expiration policies for try
as part of transforms on try pushes, move the check to a verification so
it can be skipped or moved outside of the decision task, and so it can
run outside of actual try pushes.

Differential Revision: https://phabricator.services.mozilla.com/D271072

Diffstat:
M
taskcluster/gecko_taskgraph/transforms/task.py
 | 
12
------------
M
taskcluster/gecko_taskgraph/util/verify.py
 | 
22
++++++++++++++++++++++

2 files changed, 22 insertions(+), 12 deletions(-)
diff --git a/taskcluster/gecko_taskgraph/transforms/task.py b/taskcluster/gecko_taskgraph/transforms/task.py
@@ -2141,18 +2141,6 @@ def set_task_and_artifact_expiry(config, jobs):
         else None
     )
     cap_from_now = fromNow(cap, now) if cap else None
-    if cap:
-        expiration_policy = evaluate_keyed_by(
-            config.graph_config["expiration-policy"],
-            "task expiration",
-            {"project": config.params["project"], "level": config.params["level"]},
-        )
-        for policy, expires in expiration_policy.items():
-            if fromNow(expires, now) > cap_from_now:
-                raise Exception(
-                    f'expiration-policy "{policy}" is larger than {cap} '
-                    f'for {config.params["project"]}'
-                )
     for job in jobs:
         expires = get_expiration(config, job.get("expiration-policy", "default"))
         job_expiry = job.setdefault("expires-after", expires)
diff --git a/taskcluster/gecko_taskgraph/util/verify.py b/taskcluster/gecko_taskgraph/util/verify.py
@@ -3,6 +3,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 
+import datetime
 import logging
 import os
 import re
@@ -10,6 +11,8 @@ import sys
 import warnings
 
 import attr
+from taskcluster.utils import fromNow
+from taskgraph.util.keyed_by import evaluate_keyed_by
 from taskgraph.util.treeherder import join_symbol
 from taskgraph.util.verify import VerificationSequence
 
@@ -445,3 +448,22 @@ def verify_run_known_projects(task, taskgraph, scratch_pad, graph_config, parame
                 f"Task '{task.label}' has an invalid run-on-projects value: "
                 f"{invalid_projects}"
             )
+
+
+@verifications.add("graph_config")
+def verify_try_expiration_policies(graph_config):
+    """We don't want any configuration leading to anything with an expiry longer
+    than 28 days on try."""
+    now = datetime.datetime.utcnow()
+    cap = "28 days"
+    cap_from_now = fromNow(cap, now)
+    expiration_policy = evaluate_keyed_by(
+        graph_config["expiration-policy"],
+        "task expiration",
+        {"project": "try", "level": "1"},
+    )
+    for policy, expires in expiration_policy.items():
+        if fromNow(expires, now) > cap_from_now:
+            raise Exception(
+                f'expiration-policy "{policy}" ({expires}) is larger than {cap} for try'
+            )