taskcluster

[MAJOR] The worker-manager service's google provider type now requires that worker pool definitions contain an array of possible variations of workers for the pool, in the launchConfig property. See google provider type for more detail. Note that this is a breaking change that will cause all google-based worker pools to stop provisioning until they have been updated to the new format. To update, change the config field by moving all fields except minCapacity and maxCapacity into an array in launchConfigs:

some/worker:
  config:
    minCapacity: 25
    maxCapacity: 50
-   region: us-central1
-   zone: us-central1-a
-   capacityPerInstance: 1
-   minCpuPlatform: "Intel Skylake"
-   ...
+   launchConfigs:
+     - region: us-central1
+       zone: us-central1-a
+       capacityPerInstance: 1
+       minCpuPlatform: "Intel Skylake"
+       ...

(bug 1585102) The GitHub service now posts a more useful comment to pull requests and commits when an InsufficientScopes error occurs. The message now includes the scopes used to make the API call, including the assume:repo:.. role.

[MAJOR] (bug 1584321) Scopes for the Taskcluster services themselves are now handled internally to the platform, although access tokens must still be managed as part of the deployment process. When deploying this version, remove all scopes and description properties from static/taskcluster/.. clients in the array in the Auth service's STATIC_CLIENTS configuration. See the new docs on static clients for more background on this setting.

[minor] (bug 1586102) The github service now adds scopes for check/status scopes and its scheduler-id, where previously it had relied on specific configuration of the repo:github.com/* role. There is no longer a need to add such scopes scopes to the role repo:github.com/*.

[minor] (#1486) The Worker-Manager google provider implementation now supports terminating instances in response to workerManager.removeWorker(..) API calls.

(#1495) In the previous version, indirect go dependency github.com/streadway/amqp had an invalid pseudo-version. This has been fixed, and the tool that generated the incorrect dependency (renovate) has been disabled.

(bug 1585135) The fix in 18.0.2 is updated to replace all escaped newlines in the GITHUB_PRIVATE_PEM config, not just the first.

(bug 1585135) The github.private_pem configuration in GITHUB_PRIVATE_PEM can now be specified with "regular" newlines or with encoded newlines (\ \n). This works around a bug in the generation of multiline secrets present in the Mozilla deployment pipeline.

No changes

[minor] (bug 1561320) Taskcluster deployments now support sentry error reporting. You can configure this option by setting an errorConfig at the top-level of your config:

rootUrl: ...
errorConfig:
  reporter: SentryReporter
  dsn: <your sentry dsn>

Errors will be reported to this project and tagged with service/process names in addition to taskcluster release version.

(bug 1574656) Worker-pool configurations for google-based providers now accept a workerConfig property, which is passed to new workers. The existing userData property is deprecated.

[minor] (bug 1572775) * All lib-loader setup functions now get passed their own name to allow logging more usefully.

• There is now a document in dev-docs explaining recommended monitoring practices.

[minor] (bug 1553953) The workerType identifier now has a more restrictive pattern:

• consisting of lower-case alphanumeric plus dash (-)
• from 1 to 38 characters long
• beginning with a lower-case alphabetic character
• ending with a lower-case alphanumeric character (not a dash) Any worker types not matching this pattern will no longer function as of this version.

This is considered a minor change because no known workerTypes (aside from some internal testing workerTypes) violate this pattern.

[minor] (bug 1572764) The go client doesn't log the full request in case of an error anymore. It logs only the method, hostname, port and response body. It logs the full request when the environment variable TASKCLUSTER_DEBUG is defined.

[minor] (#1190) Updates a number of config variables including:

• Setting pulse-namespace per service is no longer supported
• Services that no longer use aws directly no longer take credentials
• Setting table names for secrets, notify, and hooks services is no longer supported

The name of the hooks last fires table has changed so you must update your static client scopes in your deployment from including auth:azure-table:read-write:${azureAccountId}/LastFire to auth:azure-table:read-write:${azureAccountId}/LastFire3.

[MAJOR] (bug 1552970) The auth.gcpCredentials method no longer modifies the granting service account. Instead, that service account must be configured with the "Service Account Token Creator" role prior to deployment of Taskcluster. The format of configuration for these credentials has changed as well, now taking GCP_CREDENTIALS_ALLOWED_PROJECTS. See the deployment documentation for more information.

[MAJOR] (bug 1570723) The deployment configuration value ui.ui_login_strategy_names is now required. It should be a space-separated list of the names of the strategies in web_server.ui_login_strategies.

[minor] (#1140) Add Chain of Trust documentation for taskcluster worker implementations and maintenance.

[minor] (#1062) The taskcluster cli rerun action now takes a --force option. It will refuse to rerun non-exception, non-failed tasks without --force.

(#1108) The development process has been improved to use kubectl directly instead of helm. Helm is still used to render templates because we need to support it.

[MAJOR] The web-server application no longer generates a JWT when logging in. It uses sessions to keep track of users. The JWT_KEY configuration variable in web-server should be replaced with SESSION_SECRET which is used to compute the session hash.

[MAJOR] (#1005) There is now a checked-in helm chart in infrastructure/k8s. Using this anyone should be able to deploy taskcluster by just setting up the configuration.

To facilitate this, some environment variables for configuring services have changed:

• All services now take AZURE_ACCOUNT_ID instead of AZURE_ACCOUNT or AZURE_ACCOUNT_NAME
• Hooks takes AZURE_CRYPTO_KEY and AZURE_SIGNING_KEY instead of TABLE_CRYPTO_KEY and TABLE_SIGNING_KEY

[minor] (#1084) The Dockerfile for the Taskcluster services is now checked-in rather than generated at build time. It has been reordered so that changes to things other than package.json won't re-install packages.

Include generated APIs in python package.

[minor] Pulse messages now include a task's tags for better classification of the messages that are received.

[minor] (bug 1563545) The apiMethod log structure has been updated so that it now splits out query params into their own field and only logs the useful part of paths for resources.

[minor] (bug 1558345) The experimental workerManager.credentialsGoogle API method has been removed and replaced with a similar but more provider-agnostic workerManager.registerWorker method.

[minor] (bug 1523807) The taskcluster command-line interface (taskcluster-cli) has been incorporated into the main repository and will be relased with the same version numbers as the Taskcluster services.

[minor] The web-server application now uses CORS headers to limit access to the /graphql and /subscription endpoints to requests from the root URL origin. An additional, optional configuration value, ADDITIONAL_ALLOWED_CORS_ORIGIN, provides a way to allow additional origins. If it begins and ends with /, it is treated as a regular expression, allowing matching e.g., pull-request draft deployments.

[minor] What was previously the /worker-pools-errors/:workerPoolId API route is now spelled /worker-pool-errors/:workerPoolId. This endpoint is still experimental so while this might someday be a breaking change, it is currently considered minor.

[minor] (bug 1563341) Worker-manager now allows getting workers by worker group and singly by worker ID, and creating and removing workers (for some providers). The static provider uses this capability to manage static workers, each authoritatively identified by a shared secret.

(bug 1547077) Emails now use the modern Taskcluster logo

The GRAPHQL_SUBSCRIPTION_ENDPOINT config for taskcluster-ui can now have scheme http or https instead of ws/wss. This allows easier generation of this configuration as ${TASKCLUSTER_ROOT_URL}/subscription. The existing schemas are still accepted so no configuration change is required.

With the proper scopes, github repositories can now override the default scheduler. Adding custom schedulerId to the task definition while using github's Statuses API might break the status reporting functionality of tc-github in the case of successful build. Therefore, this only works with experimental checks status reporting.