Bug 2037926 - landoscript: introduce file-specific version_bump scopes

[JohanLorenzo]

Merge order

1. fxci-config staging #1012 — apply-staging + merge first
2. This PR — deploy to staging via dev-landoscript, merge to master
3. mozilla-taskgraph #215 — merge + publish
4. xpi-manifest — update mozilla-taskgraph pin, trigger staging e2e test
5. fxci-config production (separate PR) — after staging verification
6. firefox gecko_taskgraph — Phabricator + uplift
7. fxci-config cleanup (separate PR) — remove old general version_bump grants
8. scriptworker-scripts cleanup (separate PR) — remove transition fallback from validate_scopes

Bug 2037926

[jcristau]

Merge order

1. fxci-config staging #1012 — apply-staging + merge first

2. This PR — deploy to staging via dev-landoscript, merge to master

3. mozilla-taskgraph #215 — merge + publish

4. xpi-manifest — update mozilla-taskgraph pin, trigger staging e2e test

5. fxci-config production (separate PR) — after staging verification

6. firefox gecko_taskgraph — Phabricator + uplift

7. fxci-config cleanup (separate PR) — remove old general version_bump grants

8. scriptworker-scripts cleanup (separate PR) — remove transition fallback from validate_scopes

I'd probably do 5 before merging anything to mozilla-taskgraph, if that gets picked up anywhere in the mean time we'd break production.

[jcristau]

Not exactly sure how to change it but I'm not super happy with the way this makes scope validation functions more complex, this is critical code that would ideally remain as straightforward as possible.

[jcristau]

instead of this ugly (version_bump_files or []), consider having the caller pass an empty list, or adding and version_bump_files to the if?

[bhearsum]

I agree; this is a case where more verbose/simpler code would be beneficial now that the logic is less than trivial. I think it also has a bug in it as currently written? (I don't see any way that project:releng:lando:action:version_bump is ever in expected_scopes?)

How about something like this?

def validate_scopes(scopes, lando_repo, actions, version_bump_files=[]):
  expected_scopes = {f"project:releng:lando:repo:{lando_repo}"}
  for action in actions:
    if action == "version_bump":
      if "project:releng:lando:action:version_bump" in scopes:
        # It's superfluous to add this to the expected scopes, but a bit more clear/correct to do so? This block goes away when we stop supporting this legacy scope anyways.
        expected_scopes.add("project:releng:lando:action:version_bump")
      else:
        expected_scopes.update(f"project:releng:lando:action:version_bump:file:{f}" for f in version_bump_files)
    else:
      expected_scopes.add(f"project:releng:lando:action:{action}")