Bug 2037926 - landoscript: introduce file-specific version_bump scopes

[JohanLorenzo]

For now, the general scope continues to work; file-specific scopes are required only when the general scope is absent.

Merge order

1. fxci-config staging #1012 — ✅ merged
2. This PR — ✅ staged on dev-landoscript and verified (see below), awaiting merge to master
3. fxci-config production #1038 — staging verified ✅, ready to create
4. mozilla-taskgraph #215 — merge + publish
5. xpi-manifest — update mozilla-taskgraph pin
6. firefox gecko_taskgraph — Phabricator + uplift
7. fxci-config cleanup (separate PR) — remove old general version_bump grants
8. scriptworker-scripts cleanup (separate PR) — remove transition fallback from validate_scopes

Verification

Triggered a staging-xpi-manifest release promotion. The version_bump task ran with the legacy project:releng:lando:action:version_bump scope (backward compat), bumped browser/extensions/newtab/manifest.json from 153.1.0 → 153.6.0, and landed on staging-firefox-main:

landoscript.actions.version_bump - INFO - browser/extensions/newtab/manifest.json: successfully bumped!
-  "version": "153.1.0",
+  "version": "153.6.0",
landoscript.lando - INFO - success! got 200 response with 'LANDED' status

Bug 2037926

[jcristau]

Merge order

1. fxci-config staging #1012 — apply-staging + merge first

2. This PR — deploy to staging via dev-landoscript, merge to master

3. mozilla-taskgraph #215 — merge + publish

4. xpi-manifest — update mozilla-taskgraph pin, trigger staging e2e test

5. fxci-config production (separate PR) — after staging verification

6. firefox gecko_taskgraph — Phabricator + uplift

7. fxci-config cleanup (separate PR) — remove old general version_bump grants

8. scriptworker-scripts cleanup (separate PR) — remove transition fallback from validate_scopes

I'd probably do 5 before merging anything to mozilla-taskgraph, if that gets picked up anywhere in the mean time we'd break production.

[jcristau]

Not exactly sure how to change it but I'm not super happy with the way this makes scope validation functions more complex, this is critical code that would ideally remain as straightforward as possible.

[jcristau]

instead of this ugly (version_bump_files or []), consider having the caller pass an empty list, or adding and version_bump_files to the if?

[bhearsum]

I agree; this is a case where more verbose/simpler code would be beneficial now that the logic is less than trivial. I think it also has a bug in it as currently written? (I don't see any way that project:releng:lando:action:version_bump is ever in expected_scopes?)

How about something like this?

def validate_scopes(scopes, lando_repo, actions, version_bump_files=[]):
  expected_scopes = {f"project:releng:lando:repo:{lando_repo}"}
  for action in actions:
    if action == "version_bump":
      if "project:releng:lando:action:version_bump" in scopes:
        # It's superfluous to add this to the expected scopes, but a bit more clear/correct to do so? This block goes away when we stop supporting this legacy scope anyways.
        expected_scopes.add("project:releng:lando:action:version_bump")
      else:
        expected_scopes.update(f"project:releng:lando:action:version_bump:file:{f}" for f in version_bump_files)
    else:
      expected_scopes.add(f"project:releng:lando:action:{action}")

[jcristau]

with one nit, the default for version_bump_files shouldn't be [] (use () instead).

[JohanLorenzo]

Thanks guys! Changes made. I also expanded the unit test suite to make sure we cover all known cases.