Bug 1405408 - Part 2: Add taskcluster-proxy and scopes to tasks consu…

…ming non-public/ toolchains. r=dustin

MozReview-Commit-ID: BIGjLXmTSli

--HG--
extra : rebase_source : 8628be21bacacbd782dffc47933d000c57dc2fb2

taskcluster/taskgraph/transforms/use_toolchains.py

@@ -68,6 +68,7 @@ def get_alias(key):
             return aliases.get(key, key)
 
     for job in jobs:
+        scopes = job.setdefault('scopes', [])
         env = job.setdefault('worker', {}).setdefault('env', {})
 
         toolchains = [get_alias(t)
@@ -83,7 +84,7 @@ def get_alias(key):
                 raise Exception('Missing toolchain job for %s-%s: %s'
                                 % (config.kind, job['name'], t))
 
-            f = os.path.basename(artifacts[t])
+            dirname, f = os.path.split(artifacts[t])
             if f in filenames:
                 # Build jobs don't support toolchain artifacts with the same
                 # name: they would overwrite one with the other.
@@ -93,6 +94,15 @@ def get_alias(key):
                                    t, f))
             filenames[f] = t
 
+            if not artifacts[t].startswith('public/'):
+                # Use taskcluster-proxy and request appropriate scope.
+                # For example, add 'scopes: [queue:get-artifact:path/to/*]'
+                # for 'path/to/artifact.tar.xz'.
+                job['worker']['taskcluster-proxy'] = True
+                scope = 'queue:get-artifact:{}/*'.format(dirname)
+                if scope not in scopes:
+                    scopes.append(scope)
+
             if t.endswith('-sccache'):
                 job['needs-sccache'] = True