Source code

Revision control

Copy as Markdown

Other Tools

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at
import logging
import os
import re
import taskcluster_urls
from taskgraph.util.taskcluster import get_root_url, get_task_definition
from gecko_taskgraph.actions.registry import register_callback_action
from gecko_taskgraph.actions.util import create_tasks, fetch_graph_and_labels
logger = logging.getLogger(__name__)
EMAIL_SUBJECT = "Your Interactive Task for {label}"
As you requested, Firefox CI has created an interactive task to run {label}
on revision {revision} in {repo}. Click the button below to connect to the
task. You may need to wait for it to begin running.
# Security Concerns
# An "interactive task" is, quite literally, shell access to a worker. That
# is limited by being in a Docker container, but we assume that Docker has
# bugs so we do not want to rely on container isolation exclusively.
# Interactive tasks should never be allowed on hosts that build binaries
# leading to a release -- level 3 builders.
# Users must not be allowed to create interactive tasks for tasks above
# their own level.
# Interactive tasks must not have any routes that might make them appear
# in the index to be used by other production tasks.
# Interactive tasks should not be able to write to any docker-worker caches.
# these are not actually secrets, and just about everything needs them
# public downloads are OK
# internal downloads are OK
# private toolchain artifacts from tasks
# level-appropriate secrets are generally necessary to run a task; these
# also are "not that secret" - most of them are built into the resulting
# binary and could be extracted by someone with `strings`.
# ptracing is generally useful for interactive tasks, too!
# docker-worker capabilities include loopback devices
def context(params):
# available for any docker-worker tasks at levels 1, 2; and for
# test tasks on level 3 (level-3 builders are firewalled off)
if int(params["level"]) < 3:
return [{"worker-implementation": "docker-worker"}]
return [{"worker-implementation": "docker-worker", "kind": "test"}]
# Windows is not supported by one-click loaners yet. See
# for instructions for using them.
title="Create Interactive Task",
description=("Create a a copy of the task that you can interact with"),
"type": "object",
"properties": {
"notify": {
"type": "string",
"format": "email",
"title": "Who to notify of the pending interactive task",
"description": (
"Enter your email here to get an email containing a link "
"to interact with the task"
# include a default for ease of users' editing
"default": "",
"additionalProperties": False,
def create_interactive_action(parameters, graph_config, input, task_group_id, task_id):
# fetch the original task definition from the taskgraph, to avoid
# creating interactive copies of unexpected tasks. Note that this only applies
# to docker-worker tasks, so we can assume the docker-worker payload format.
decision_task_id, full_task_graph, label_to_taskid, _ = fetch_graph_and_labels(
parameters, graph_config
task = get_task_definition(task_id)
label = task["metadata"]["name"]
def edit(task):
if task.label != label:
return task
task_def = task.task
# drop task routes (don't index this!)
task_def["routes"] = []
# only try this once
task_def["retries"] = 0
# short expirations, at least 3 hour maxRunTime
task_def["deadline"] = {"relative-datestamp": "12 hours"}
task_def["created"] = {"relative-datestamp": "0 hours"}
task_def["expires"] = {"relative-datestamp": "1 day"}
# filter scopes with the SCOPE_WHITELIST
task.task["scopes"] = [
for s in task.task.get("scopes", [])
if any(p.match(s) for p in SCOPE_WHITELIST)
payload = task_def["payload"]
# make sure the task runs for long enough..
payload["maxRunTime"] = max(3600 * 3, payload.get("maxRunTime", 0))
# no caches or artifacts
payload["cache"] = {}
payload["artifacts"] = {}
# enable interactive mode
payload.setdefault("features", {})["interactive"] = True
payload.setdefault("env", {})["TASKCLUSTER_INTERACTIVE"] = "true"
for key in task_def["payload"]["env"].keys():
payload["env"][key] = task_def["payload"]["env"].get(key, "")
# add notification
email = input.get("notify")
# no point sending to a noreply address!
if email and email != "":
info = {
"url": taskcluster_urls.ui(
get_root_url(False), "tasks/${status.taskId}/connect"
"label": label,
"revision": parameters["head_rev"],
"repo": parameters["head_repository"],
task_def.setdefault("extra", {}).setdefault("notify", {})["email"] = {
"subject": EMAIL_SUBJECT.format(**info),
"content": EMAIL_CONTENT.format(**info),
"link": {"text": "Connect", "href": info["url"]},
return task
# Create the task and any of its dependencies. This uses a new taskGroupId to avoid
# polluting the existing taskGroup with interactive tasks.
action_task_id = os.environ.get("TASK_ID")
label_to_taskid = create_tasks(
taskId = label_to_taskid[label]"Created interactive task {taskId}")