Bug 1274350 - Rewrite decision task generation to handle multiple platforms better r=me

60 files changed, 675 insertions, 990 deletions

diff --git a/.taskcluster.yml b/.taskcluster.yml
index 1a6e8f1b8..371166e7f 100644
--- a/.taskcluster.yml
+++ b/.taskcluster.yml
@@ -71,15 +71,9 @@ tasks:
           TC_SOURCE: {{{source}}}
           TC_REVISION: '{{revision}}'
           TC_REVISION_HASH: '{{revision_hash}}'
-          TC_DOCKER_IMAGE: "ttaubert/nss-ci:0.0.16"
-          TC_PROVISIONER_ID: "aws-provisioner-v1"
-          TC_WORKER_TYPE: "hg-worker"
           NSS_HEAD_REPOSITORY: '{{{url}}}'
           NSS_HEAD_REVISION: '{{revision}}'
 
-        features:
-          taskclusterProxy: true
-
         maxRunTime: 1800
 
         command:
diff --git a/automation/taskcluster/graph/build.js b/automation/taskcluster/graph/build.js
index fe63a0263..d19e222d9 100644
--- a/automation/taskcluster/graph/build.js
+++ b/automation/taskcluster/graph/build.js
@@ -9,27 +9,17 @@ var yaml = require("js-yaml");
 var slugid = require("slugid");
 var flatmap = require("flatmap");
 
-var TC_WORKER_TYPE = process.env.TC_WORKER_TYPE || "hg-worker";
-var TC_PROVISIONER_ID = process.env.TC_PROVISIONER_ID || "aws-provisioner-v1";
-
 // Default values for debugging.
 var TC_REVISION = process.env.TC_REVISION || "{{tc_rev}}";
 var TC_REVISION_HASH = process.env.TC_REVISION_HASH || "{{tc_rev_hash}}";
-var TC_DOCKER_IMAGE = process.env.TC_DOCKER_IMAGE || "{{tc_docker_img}}";
 var TC_OWNER = process.env.TC_OWNER || "{{tc_owner}}";
 var TC_SOURCE = process.env.TC_SOURCE || "{{tc_source}}";
 var NSS_HEAD_REPOSITORY = process.env.NSS_HEAD_REPOSITORY || "{{nss_head_repo}}";
 var NSS_HEAD_REVISION = process.env.NSS_HEAD_REVISION || "{{nss_head_rev}}";
 
-// Point in time at $now + x hours.
-function from_now(hours) {
-  var d = new Date();
-  d.setHours(d.getHours() + (hours || 0));
-  return d.toJSON();
-}
-
 // Register custom YAML types.
 var YAML_SCHEMA = yaml.Schema.create([
+  // Point in time at $now + x hours.
   new yaml.Type('!from_now', {
     kind: "scalar",
 
@@ -38,149 +28,137 @@ var YAML_SCHEMA = yaml.Schema.create([
     },
 
     construct: function (data) {
-      return from_now(data|0);
+      var d = new Date();
+      d.setHours(d.getHours() + (data|0));
+      return d.toJSON();
     }
-  })
-]);
+  }),
 
-// Parse a directory containing YAML files.
-function parseDirectory(dir) {
-  var tasks = {};
+  // Environment variables.
+  new yaml.Type('!env', {
+    kind: "scalar",
+
+    resolve: function (data) {
+      return true;
+    },
 
-  fs.readdirSync(dir).forEach(function (file) {
-    if (file.endsWith(".yml")) {
-      var source = fs.readFileSync(path.join(dir, file), "utf-8");
-      tasks[file.slice(0, -4)] = yaml.load(source, {schema: YAML_SCHEMA});
+    construct: function (data) {
+      return process.env[data];
     }
-  });
+  })
+]);
 
-  return tasks;
+// Parse a given YAML file.
+function parseYamlFile(file, fallback) {
+  // Return fallback if the file doesn't exist.
+  if (!fs.existsSync(file) && fallback) {
+    return fallback;
+  }
+
+  // Otherwise, read the file or fail.
+  var source = fs.readFileSync(file, "utf-8");
+  return yaml.load(source, {schema: YAML_SCHEMA});
 }
 
-// Generates a task using a given definition.
-function generateTasks(definition) {
-  var task = {
-    taskId: slugid.v4(),
-    reruns: 2,
-
-    task: task = {
-      created: from_now(0),
-      deadline: from_now(24),
-      provisionerId: TC_PROVISIONER_ID,
-      workerType: TC_WORKER_TYPE,
-      schedulerId: "task-graph-scheduler",
-
-      scopes: [
-        "queue:route:tc-treeherder-stage.nss." + TC_REVISION_HASH,
-        "queue:route:tc-treeherder.nss." + TC_REVISION_HASH,
-        "scheduler:extend-task-graph:*"
-      ],
-
-      routes: [
-        "tc-treeherder-stage.nss." + TC_REVISION_HASH,
-        "tc-treeherder.nss." + TC_REVISION_HASH
-      ],
-
-      metadata: {
-        owner: TC_OWNER,
-        source: TC_SOURCE
-      },
-
-      payload: {
-        image: TC_DOCKER_IMAGE,
-        maxRunTime: 3600,
-
-        env: {
-          NSS_HEAD_REPOSITORY: NSS_HEAD_REPOSITORY,
-          NSS_HEAD_REVISION: NSS_HEAD_REVISION
-        }
-      },
+// Generate all tasks for a given build.
+function generateBuildTasks(platform, file) {
+  var dir = path.join(__dirname, "./" + platform);
 
-      extra: {
-        treeherder: {
-          revision: TC_REVISION,
-          revision_hash: TC_REVISION_HASH
-        }
-      }
-    }
-  };
+  // Parse base definitions.
+  var buildBase = parseYamlFile(path.join(dir, "_build_base.yml"), {});
+  var testBase = parseYamlFile(path.join(dir, "_test_base.yml"), {});
 
-  // Merge base task definition with the YAML one.
-  var tasks = [task = merge.recursive(true, task, definition)];
+  return flatmap(parseYamlFile(path.join(dir, file)), function (task) {
+    // Merge base build task definition with the current one.
+    var tasks = [task = merge.recursive(true, buildBase, task)];
 
-  // Generate dependent tasks.
-  if (task.dependents) {
-    // The base definition for all subtasks.
-    var base = {
-      requires: [task.taskId],
+    // Assign random task id.
+    task.taskId = slugid.v4();
 
-      task: {
-        payload: {
-          env: {
-            TC_PARENT_TASK_ID: task.taskId
+    // Generate test tasks.
+    if (task.tests) {
+      // The base definition for all tests of this platform.
+      var base = merge.recursive(true, {
+        requires: [task.taskId],
+
+        task: {
+          payload: {
+            env: {
+              TC_PARENT_TASK_ID: task.taskId
+            }
           }
         }
-      }
-    };
-
-    // We clone everything but the taskId, we need a new and unique one.
-    delete base.taskId;
-
-    // Iterate and generate all subtasks.
-    var subtasks = flatmap(task.dependents, function (name) {
-      if (!(name in TASKS)) {
-        throw new Error("Can't find task '" + name + "'");
-      }
-
-      return flatmap(TASKS[name], function (subtask) {
-        // Merge subtask with base definition.
-        var dependent = merge.recursive(true, subtask, base);
-
-        // We only want to carry over environment variables and
-        // TreeHerder configuration data.
-        dependent.task.payload.env =
-          merge.recursive(true, task.task.payload.env,
-                                dependent.task.payload.env);
-        dependent.task.extra.treeherder =
-          merge.recursive(true, task.task.extra.treeherder,
-                                dependent.task.extra.treeherder);
-
-        // Print all subtasks.
-        return generateTasks(dependent);
-      });
-    });
+      }, testBase);
 
-    // Append subtasks.
-    tasks = tasks.concat(subtasks);
+      // Generate and append test task definitions.
+      tasks = tasks.concat(flatmap(task.tests, function (name) {
+        return generateTestTasks(name, base, task);
+      }));
 
-    // The dependents field is not part of the schema.
-    delete task.dependents;
-  }
+      // |tests| is not part of the schema.
+      delete task.tests;
+    }
 
-  // Convert env variables to strings.
-  tasks.forEach(function (task) {
-    var env = task.task.payload.env || {};
-    Object.keys(env).forEach(function (name) {
-      if (typeof(env[name]) != "undefined") {
-        env[name] = env[name] + "";
-      }
-    });
+    return tasks;
   });
+}
+
+// Generate all tasks for a given test.
+function generateTestTasks(name, base, task) {
+  // Load test definitions.
+  var dir = path.join(__dirname, "./tests");
+  var tests = parseYamlFile(path.join(dir, name + ".yml"));
+
+  return tests.map(function (test) {
+    // Merge test with base definition.
+    test = merge.recursive(true, base, test);
+
+    // Assign random task id.
+    test.taskId = slugid.v4();
+
+    // We only want to carry over environment variables...
+    test.task.payload.env =
+      merge.recursive(true, task.task.payload.env,
+                            test.task.payload.env);
 
-  return tasks;
+    // ...and TreeHerder configuration data.
+    test.task.extra.treeherder =
+      merge.recursive(true, task.task.extra.treeherder,
+                            test.task.extra.treeherder);
+
+    return test;
+  });
 }
 
-// Parse YAML task definitions.
-var BUILDS = parseDirectory(path.join(__dirname, "./builds/"));
-var TASKS = parseDirectory(path.join(__dirname, "./tasks/"));
+// Generate all tasks for a given platform.
+function generatePlatformTasks(platform) {
+  var dir = path.join(__dirname, "./" + platform);
+  var buildBase = parseYamlFile(path.join(dir, "_build_base.yml"), {});
+  var testBase = parseYamlFile(path.join(dir, "_test_base.yml"), {});
+
+  // Parse all build tasks.
+  return flatmap(fs.readdirSync(dir), function (file) {
+    if (!file.startsWith("_") && file.endsWith(".yml")) {
+      var tasks = generateBuildTasks(platform, file);
+
+      // Convert env variables to strings.
+      tasks.forEach(function (task) {
+        var env = task.task.payload.env || {};
+        Object.keys(env).forEach(function (name) {
+          if (typeof(env[name]) != "undefined") {
+            env[name] = env[name] + "";
+          }
+        });
+      });
 
+      return tasks;
+    }
+  });
+}
+
+// Construct the task graph.
 var graph = {
-  // Use files in the "builds" directory as roots.
-  tasks: flatmap(Object.keys(BUILDS), function (name) {
-    return flatmap(BUILDS[name], function (build) {
-      return generateTasks(build);
-    });
-  })
+  tasks: flatmap(["linux", "windows", "tools"], generatePlatformTasks)
 };
 
 // Output the final graph.
diff --git a/automation/taskcluster/graph/builds/clang-format.yml b/automation/taskcluster/graph/builds/clang-format.yml
deleted file mode 100644
index 21ef36264..000000000
--- a/automation/taskcluster/graph/builds/clang-format.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- task:
-    metadata:
-      name: "clang-format-3.8"
-      description: "clang-format-3.8"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_clang_format.sh nss/lib/ssl"
-
-    extra:
-      treeherder:
-        build:
-          platform: nss-tools
-        symbol: clang-format-3.8
-  reruns: 0
diff --git a/automation/taskcluster/graph/builds/linux64-memleak.yml b/automation/taskcluster/graph/builds/linux64-memleak.yml
deleted file mode 100644
index ff0eade07..000000000
--- a/automation/taskcluster/graph/builds/linux64-memleak.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- task:
-    metadata:
-      name: "Linux 64 (MemLeak, debug)"
-      description: "Linux 64 (MemLeak, debug)"
-
-    payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
-        NSS_TESTS: "memleak"
-        USE_64: 1
-
-    extra:
-      treeherder:
-        build:
-          platform: linux64
-        collection:
-          memleak: true
-        symbol: B
-
-  dependents:
-    - memleak
diff --git a/automation/taskcluster/graph/builds/win2012x64-debug.yml b/automation/taskcluster/graph/builds/win2012x64-debug.yml
deleted file mode 100644
index b1aa33f91..000000000
--- a/automation/taskcluster/graph/builds/win2012x64-debug.yml
+++ /dev/null
@@ -1,39 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "Windows 2012 64 (debug)"
-      description: "Windows 2012 64 (debug)"
-
-    payload:
-      artifacts:
-        - type: directory
-          path: "public\\build"
-          expires: !from_now 24
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/build.sh"
-      env:
-        PATH: "c:\\mozilla-build\\python;c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;c:\\Windows\\system32;c:\\mozilla-build\\upx391w;c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget"
-        NSS_ENABLE_TLS_1_3: 1
-        DOMSUF: localdomain
-        HOST: localhost
-        USE_64: 1
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        build:
-          platform: windows2012-64
-        collection:
-          debug: true
-        symbol: B
-
-  dependents:
-    - cipher-win
-    - ec-win
-    - gtests-win
-    - ocsp-win
-    - pkix-win
-    - sdr-win
diff --git a/automation/taskcluster/graph/builds/win2012x64-opt.yml b/automation/taskcluster/graph/builds/win2012x64-opt.yml
deleted file mode 100644
index 01e08ce56..000000000
--- a/automation/taskcluster/graph/builds/win2012x64-opt.yml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "Windows 2012 64 (opt)"
-      description: "Windows 2012 64 (opt)"
-
-    payload:
-      artifacts:
-        - type: directory
-          path: "public\\build"
-          expires: !from_now 24
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/build.sh"
-      env:
-        PATH: "c:\\mozilla-build\\python;c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;c:\\Windows\\system32;c:\\mozilla-build\\upx391w;c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget"
-        NSS_ENABLE_TLS_1_3: 1
-        DOMSUF: localdomain
-        HOST: localhost
-        BUILD_OPT: 1
-        USE_64: 1
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        build:
-          platform: windows2012-64
-        collection:
-          opt: true
-        symbol: B
-
-  dependents:
-    - cipher-win
-    - ec-win
-    - gtests-win
-    - ocsp-win
-    - pkix-win
-    - sdr-win
diff --git a/automation/taskcluster/graph/linux/_build_base.yml b/automation/taskcluster/graph/linux/_build_base.yml
new file mode 100644
index 000000000..2af1b0ee7
--- /dev/null
+++ b/automation/taskcluster/graph/linux/_build_base.yml
@@ -0,0 +1,40 @@
+---
+reruns: 2
+
+task:
+  created: !from_now 0
+  deadline: !from_now 24
+  provisionerId: aws-provisioner-v1
+  workerType: hg-worker
+  schedulerId: task-graph-scheduler
+
+  metadata:
+    owner: !env TC_OWNER
+    source: !env TC_SOURCE
+
+  payload:
+    maxRunTime: 3600
+    image: ttaubert/nss-ci:0.0.16
+
+    artifacts:
+      public:
+        type: directory
+        path: /home/worker/artifacts
+        expires: !from_now 24
+
+    command:
+      - "/bin/bash"
+      - "-c"
+      - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
+
+    env:
+      NSS_HEAD_REPOSITORY: !env NSS_HEAD_REPOSITORY
+      NSS_HEAD_REVISION: !env NSS_HEAD_REVISION
+      GCC_VERSION: gcc-5
+      GXX_VERSION: g++-5
+
+  extra:
+    treeherder:
+      revision: !env TC_REVISION
+      revision_hash: !env TC_REVISION_HASH
+      symbol: B
diff --git a/automation/taskcluster/graph/linux/_test_base.yml b/automation/taskcluster/graph/linux/_test_base.yml
new file mode 100644
index 000000000..2d283fbed
--- /dev/null
+++ b/automation/taskcluster/graph/linux/_test_base.yml
@@ -0,0 +1,22 @@
+---
+reruns: 2
+
+task:
+  created: !from_now 0
+  deadline: !from_now 24
+  provisionerId: aws-provisioner-v1
+  workerType: hg-worker
+  schedulerId: task-graph-scheduler
+
+  metadata:
+    owner: !env TC_OWNER
+    source: !env TC_SOURCE
+
+  payload:
+    maxRunTime: 3600
+    image: !env TC_DOCKER_IMAGE
+
+    command:
+      - "/bin/bash"
+      - "-c"
+      - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
diff --git a/automation/taskcluster/graph/builds/linux32-debug.yml b/automation/taskcluster/graph/linux/build32-debug.yml
index f19b49587..39c83bec2 100644
--- a/automation/taskcluster/graph/builds/linux32-debug.yml
+++ b/automation/taskcluster/graph/linux/build32-debug.yml
@@ -5,19 +5,8 @@
       description: "Linux 32 (debug)"
 
     payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
 
     extra:
       treeherder:
@@ -25,9 +14,8 @@
           platform: linux32
         collection:
           debug: true
-        symbol: B
 
-  dependents:
+  tests:
     - cert
     - chains
     - cipher
@@ -43,19 +31,36 @@
     - pkix
     - sdr
     - smime
-    - ssl
     - tools
 
 - task:
     metadata:
+      name: "Linux 32 (debug, no TLS 1.3)"
+      description: "Linux 32 (debug, no TLS 1.3)"
+
+    payload:
+      env:
+        NSS_TESTS: ssl
+
+    extra:
+      treeherder:
+        build:
+          platform: linux32
+        collection:
+          debug: true
+        groupSymbol: Builds
+        groupName: Various builds
+        symbol: noTLSv1.3
+
+  tests:
+    - ssl
+
+- task:
+    metadata:
       name: "Linux 32 (debug, clang-3.8)"
       description: "Linux 32 (debug, clang-3.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: clang-3.8
@@ -77,10 +82,6 @@
       description: "Linux 32 (debug, gcc-4.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-4.8
@@ -102,10 +103,6 @@
       description: "Linux 32 (debug, gcc-6.1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-6
@@ -127,15 +124,9 @@
       description: "Linux 32 (debug, NO_PKCS11_BYPASS=1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         NO_PKCS11_BYPASS: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
 
     extra:
       treeherder:
@@ -146,27 +137,3 @@
         groupSymbol: Builds
         groupName: Various builds
         symbol: noPkcs11Bypass
-
-- task:
-    metadata:
-      name: "Linux 32 (debug, no TLS 1.3)"
-      description: "Linux 32 (debug, no TLS 1.3)"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
-
-    extra:
-      treeherder:
-        build:
-          platform: linux32
-        collection:
-          debug: true
-        groupSymbol: Builds
-        groupName: Various builds
-        symbol: noTLSv1.3
diff --git a/automation/taskcluster/graph/builds/linux32-opt.yml b/automation/taskcluster/graph/linux/build32-opt.yml
index d1479bfc2..95afdeff3 100644
--- a/automation/taskcluster/graph/builds/linux32-opt.yml
+++ b/automation/taskcluster/graph/linux/build32-opt.yml
@@ -5,19 +5,8 @@
       description: "Linux 32 (opt)"
 
     payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         BUILD_OPT: 1
 
     extra:
@@ -26,9 +15,8 @@
           platform: linux32
         collection:
           opt: true
-        symbol: B
 
-  dependents:
+  tests:
     - cert
     - chains
     - cipher
@@ -44,19 +32,37 @@
     - pkix
     - sdr
     - smime
-    - ssl
     - tools
 
 - task:
     metadata:
+      name: "Linux 32 (opt, no TLS 1.3)"
+      description: "Linux 32 (opt, no TLS 1.3)"
+
+    payload:
+      env:
+        NSS_TESTS: ssl
+        BUILD_OPT: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: linux32
+        collection:
+          opt: true
+        groupSymbol: Builds
+        groupName: Various builds
+        symbol: noTLSv1.3
+
+  tests:
+    - ssl
+
+- task:
+    metadata:
       name: "Linux 32 (opt, clang-3.8)"
       description: "Linux 32 (opt, clang-3.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: clang-3.8
@@ -79,10 +85,6 @@
       description: "Linux 32 (opt, gcc-4.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-4.8
@@ -105,10 +107,6 @@
       description: "Linux 32 (opt, gcc-6.1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-6
@@ -131,15 +129,9 @@
       description: "Linux 32 (opt, NO_PKCS11_BYPASS=1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         NO_PKCS11_BYPASS: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         BUILD_OPT: 1
 
     extra:
@@ -151,28 +143,3 @@
         groupSymbol: Builds
         groupName: Various builds
         symbol: noPkcs11Bypass
-
-- task:
-    metadata:
-      name: "Linux 32 (opt, no TLS 1.3)"
-      description: "Linux 32 (opt, no TLS 1.3)"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
-        BUILD_OPT: 1
-
-    extra:
-      treeherder:
-        build:
-          platform: linux32
-        collection:
-          opt: true
-        groupSymbol: Builds
-        groupName: Various builds
-        symbol: noTLSv1.3
diff --git a/automation/taskcluster/graph/builds/linux64-asan.yml b/automation/taskcluster/graph/linux/build64-asan.yml
index 08f8325ea..3cf0a986c 100644
--- a/automation/taskcluster/graph/builds/linux64-asan.yml
+++ b/automation/taskcluster/graph/linux/build64-asan.yml
@@ -5,15 +5,6 @@
       description: "Linux 64 (ASan, debug)"
 
     payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: clang-3.8
@@ -27,9 +18,8 @@
           platform: linux64
         collection:
           asan: true
-        symbol: B
 
-  dependents:
+  tests:
     - cert
     - chains
     - cipher
@@ -45,5 +35,29 @@
     - pkix
     - sdr
     - smime
-    - ssl
     - tools
+
+- task:
+    metadata:
+      name: "Linux 64 (ASan, debug, no TLS 1.3)"
+      description: "Linux 64 (ASan, debug, no TLS 1.3)"
+
+    payload:
+      env:
+        GCC_VERSION: clang-3.8
+        GXX_VERSION: clang++-3.8
+        NSS_TESTS: ssl
+        USE_ASAN: 1
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: linux64
+        collection:
+          asan: true
+        groupSymbol: SSL
+        groupName: SSL tests
+
+  tests:
+    - ssl
diff --git a/automation/taskcluster/graph/builds/linux64-debug.yml b/automation/taskcluster/graph/linux/build64-debug.yml
index 97114eb1b..7d1b914c3 100644
--- a/automation/taskcluster/graph/builds/linux64-debug.yml
+++ b/automation/taskcluster/graph/linux/build64-debug.yml
@@ -5,19 +5,8 @@
       description: "Linux 64 (debug)"
 
     payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         USE_64: 1
 
     extra:
@@ -26,9 +15,8 @@
           platform: linux64
         collection:
           debug: true
-        symbol: B
 
-  dependents:
+  tests:
     - cert
     - chains
     - cipher
@@ -44,19 +32,37 @@
     - pkix
     - sdr
     - smime
-    - ssl
     - tools
 
 - task:
     metadata:
+      name: "Linux 64 (debug, no TLS 1.3)"
+      description: "Linux 64 (debug, no TLS 1.3)"
+
+    payload:
+      env:
+        NSS_TESTS: ssl
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: linux64
+        collection:
+          debug: true
+        groupSymbol: Builds
+        groupName: Various builds
+        symbol: noTLSv1.3
+
+  tests:
+    - ssl
+
+- task:
+    metadata:
       name: "Linux 64 (debug, clang-3.8)"
       description: "Linux 64 (debug, clang-3.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: clang-3.8
@@ -79,10 +85,6 @@
       description: "Linux 64 (debug, gcc-4.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-4.8
@@ -105,10 +107,6 @@
       description: "Linux 64 (debug, gcc-6.1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-6
@@ -131,15 +129,9 @@
       description: "Linux 64 (debug, NO_PKCS11_BYPASS=1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         NO_PKCS11_BYPASS: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         USE_64: 1
 
     extra:
@@ -151,28 +143,3 @@
         groupSymbol: Builds
         groupName: Various builds
         symbol: noPkcs11Bypass
-
-- task:
-    metadata:
-      name: "Linux 64 (debug, no TLS 1.3)"
-      description: "Linux 64 (debug, no TLS 1.3)"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
-        USE_64: 1
-
-    extra:
-      treeherder:
-        build:
-          platform: linux64
-        collection:
-          debug: true
-        groupSymbol: Builds
-        groupName: Various builds
-        symbol: noTLSv1.3
diff --git a/automation/taskcluster/graph/linux/build64-memleak.yml b/automation/taskcluster/graph/linux/build64-memleak.yml
new file mode 100644
index 000000000..baf666839
--- /dev/null
+++ b/automation/taskcluster/graph/linux/build64-memleak.yml
@@ -0,0 +1,20 @@
+---
+- task:
+    metadata:
+      name: "Linux 64 (MemLeak, debug)"
+      description: "Linux 64 (MemLeak, debug)"
+
+    payload:
+      env:
+        NSS_TESTS: memleak
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: linux64
+        collection:
+          memleak: true
+
+  tests:
+    - memleak
diff --git a/automation/taskcluster/graph/builds/linux64-opt.yml b/automation/taskcluster/graph/linux/build64-opt.yml
index 1f192cacd..011b0ebd0 100644
--- a/automation/taskcluster/graph/builds/linux64-opt.yml
+++ b/automation/taskcluster/graph/linux/build64-opt.yml
@@ -5,19 +5,8 @@
       description: "Linux 64 (opt)"
 
     payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         BUILD_OPT: 1
         USE_64: 1
 
@@ -27,9 +16,8 @@
           platform: linux64
         collection:
           opt: true
-        symbol: B
 
-  dependents:
+  tests:
     - cert
     - chains
     - cipher
@@ -45,19 +33,38 @@
     - pkix
     - sdr
     - smime
-    - ssl
     - tools
 
 - task:
     metadata:
+      name: "Linux 64 (opt, no TLS 1.3)"
+      description: "Linux 64 (opt, no TLS 1.3)"
+
+    payload:
+      env:
+        NSS_TESTS: ssl
+        BUILD_OPT: 1
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: linux64
+        collection:
+          opt: true
+        groupSymbol: Builds
+        groupName: Various builds
+        symbol: noTLSv1.3
+
+  tests:
+    - ssl
+
+- task:
+    metadata:
       name: "Linux 64 (opt, clang-3.8)"
       description: "Linux 64 (opt, clang-3.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: clang-3.8
@@ -81,10 +88,6 @@
       description: "Linux 64 (opt, gcc-4.8)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-4.8
@@ -108,10 +111,6 @@
       description: "Linux 64 (opt, gcc-6.1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         GCC_VERSION: gcc-6
@@ -135,15 +134,9 @@
       description: "Linux 64 (opt, NO_PKCS11_BYPASS=1)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
       env:
         NSS_ENABLE_TLS_1_3: 1
         NO_PKCS11_BYPASS: 1
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
         BUILD_OPT: 1
         USE_64: 1
 
@@ -156,29 +149,3 @@
         groupSymbol: Builds
         groupName: Various builds
         symbol: noPkcs11Bypass
-
-- task:
-    metadata:
-      name: "Linux 64 (opt, no TLS 1.3)"
-      description: "Linux 64 (opt, no TLS 1.3)"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        GCC_VERSION: gcc-5
-        GXX_VERSION: g++-5
-        BUILD_OPT: 1
-        USE_64: 1
-
-    extra:
-      treeherder:
-        build:
-          platform: linux64
-        collection:
-          opt: true
-        groupSymbol: Builds
-        groupName: Various builds
-        symbol: noTLSv1.3
diff --git a/automation/taskcluster/graph/tasks/cert.yml b/automation/taskcluster/graph/tasks/cert.yml
deleted file mode 100644
index e3f01c5ae..000000000
--- a/automation/taskcluster/graph/tasks/cert.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Cert tests"
-      description: "Cert tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "cert"
-
-    extra:
-      treeherder:
-        symbol: Cert
diff --git a/automation/taskcluster/graph/tasks/chains.yml b/automation/taskcluster/graph/tasks/chains.yml
deleted file mode 100644
index 7a6e94104..000000000
--- a/automation/taskcluster/graph/tasks/chains.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Chains tests"
-      description: "Chains tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "chains"
-
-    extra:
-      treeherder:
-        symbol: Chains
diff --git a/automation/taskcluster/graph/tasks/cipher-win.yml b/automation/taskcluster/graph/tasks/cipher-win.yml
deleted file mode 100644
index ecd175042..000000000
--- a/automation/taskcluster/graph/tasks/cipher-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "Cipher tests"
-      description: "Cipher tests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "cipher"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: Cipher
diff --git a/automation/taskcluster/graph/tasks/cipher.yml b/automation/taskcluster/graph/tasks/cipher.yml
deleted file mode 100644
index d7479ddba..000000000
--- a/automation/taskcluster/graph/tasks/cipher.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Cipher tests"
-      description: "Cipher tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "cipher"
-
-    extra:
-      treeherder:
-        symbol: Cipher
diff --git a/automation/taskcluster/graph/tasks/crmf.yml b/automation/taskcluster/graph/tasks/crmf.yml
deleted file mode 100644
index ff113da18..000000000
--- a/automation/taskcluster/graph/tasks/crmf.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "CRMF tests"
-      description: "CRMF tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "crmf"
-
-    extra:
-      treeherder:
-        symbol: CRMF
diff --git a/automation/taskcluster/graph/tasks/db.yml b/automation/taskcluster/graph/tasks/db.yml
deleted file mode 100644
index c8e626c57..000000000
--- a/automation/taskcluster/graph/tasks/db.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "DB tests"
-      description: "DB tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "dbtests"
-
-    extra:
-      treeherder:
-        symbol: DB
diff --git a/automation/taskcluster/graph/tasks/ec-win.yml b/automation/taskcluster/graph/tasks/ec-win.yml
deleted file mode 100644
index 942b1756a..000000000
--- a/automation/taskcluster/graph/tasks/ec-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "EC tests"
-      description: "EC tests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "ec"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: EC
diff --git a/automation/taskcluster/graph/tasks/ec.yml b/automation/taskcluster/graph/tasks/ec.yml
deleted file mode 100644
index 99118799b..000000000
--- a/automation/taskcluster/graph/tasks/ec.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "EC tests"
-      description: "EC tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "ec"
-
-    extra:
-      treeherder:
-        symbol: EC
diff --git a/automation/taskcluster/graph/tasks/fips.yml b/automation/taskcluster/graph/tasks/fips.yml
deleted file mode 100644
index 0d34deabd..000000000
--- a/automation/taskcluster/graph/tasks/fips.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "FIPS tests"
-      description: "FIPS tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "fips"
-
-    extra:
-      treeherder:
-        symbol: FIPS
diff --git a/automation/taskcluster/graph/tasks/gtests-win.yml b/automation/taskcluster/graph/tasks/gtests-win.yml
deleted file mode 100644
index f30033411..000000000
--- a/automation/taskcluster/graph/tasks/gtests-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "GTests"
-      description: "GTests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "ssl_gtests gtests"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: GTest
diff --git a/automation/taskcluster/graph/tasks/gtests.yml b/automation/taskcluster/graph/tasks/gtests.yml
deleted file mode 100644
index dd41f736b..000000000
--- a/automation/taskcluster/graph/tasks/gtests.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "GTests"
-      description: "GTests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "ssl_gtests gtests"
-
-    extra:
-      treeherder:
-        symbol: GTest
diff --git a/automation/taskcluster/graph/tasks/lowhash.yml b/automation/taskcluster/graph/tasks/lowhash.yml
deleted file mode 100644
index b9ea783ea..000000000
--- a/automation/taskcluster/graph/tasks/lowhash.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Lowhash tests"
-      description: "Lowhash tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "lowhash"
-
-    extra:
-      treeherder:
-        symbol: Lowhash
diff --git a/automation/taskcluster/graph/tasks/merge.yml b/automation/taskcluster/graph/tasks/merge.yml
deleted file mode 100644
index ba8f09c81..000000000
--- a/automation/taskcluster/graph/tasks/merge.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Merge tests"
-      description: "Merge tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "merge"
-
-    extra:
-      treeherder:
-        symbol: Merge
diff --git a/automation/taskcluster/graph/tasks/ocsp-win.yml b/automation/taskcluster/graph/tasks/ocsp-win.yml
deleted file mode 100644
index b739ca4a7..000000000
--- a/automation/taskcluster/graph/tasks/ocsp-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "OCSP tests"
-      description: "OCSP tests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "ocsp"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: OCSP
diff --git a/automation/taskcluster/graph/tasks/ocsp.yml b/automation/taskcluster/graph/tasks/ocsp.yml
deleted file mode 100644
index ee1f63db2..000000000
--- a/automation/taskcluster/graph/tasks/ocsp.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "OCSP tests"
-      description: "OCSP tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "ocsp"
-
-    extra:
-      treeherder:
-        symbol: OCSP
diff --git a/automation/taskcluster/graph/tasks/pkits.yml b/automation/taskcluster/graph/tasks/pkits.yml
deleted file mode 100644
index a765d24ad..000000000
--- a/automation/taskcluster/graph/tasks/pkits.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "NIST PKITS tests"
-      description: "NIST PKITS tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "pkits"
-
-    extra:
-      treeherder:
-        symbol: PKITS
diff --git a/automation/taskcluster/graph/tasks/pkix-win.yml b/automation/taskcluster/graph/tasks/pkix-win.yml
deleted file mode 100644
index c812a140f..000000000
--- a/automation/taskcluster/graph/tasks/pkix-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "libpkix tests"
-      description: "libpkix tests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "libpkix"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: PKIX
diff --git a/automation/taskcluster/graph/tasks/pkix.yml b/automation/taskcluster/graph/tasks/pkix.yml
deleted file mode 100644
index af5327098..000000000
--- a/automation/taskcluster/graph/tasks/pkix.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "libpkix tests"
-      description: "libpkix tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "libpkix"
-
-    extra:
-      treeherder:
-        symbol: PKIX
diff --git a/automation/taskcluster/graph/tasks/sdr-win.yml b/automation/taskcluster/graph/tasks/sdr-win.yml
deleted file mode 100644
index 6b9764030..000000000
--- a/automation/taskcluster/graph/tasks/sdr-win.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- task:
-    workerType: ttaubert-win2012r2
-
-    metadata:
-      name: "SDR tests"
-      description: "SDR tests"
-
-    payload:
-      command:
-        - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
-        - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
-      env:
-        NSS_TESTS: "sdr"
-      image: !!js/undefined
-
-    extra:
-      treeherder:
-        symbol: SDR
diff --git a/automation/taskcluster/graph/tasks/sdr.yml b/automation/taskcluster/graph/tasks/sdr.yml
deleted file mode 100644
index 2c47b31a2..000000000
--- a/automation/taskcluster/graph/tasks/sdr.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "SDR tests"
-      description: "SDR tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "sdr"
-
-    extra:
-      treeherder:
-        symbol: SDR
diff --git a/automation/taskcluster/graph/tasks/smime.yml b/automation/taskcluster/graph/tasks/smime.yml
deleted file mode 100644
index 9abd84402..000000000
--- a/automation/taskcluster/graph/tasks/smime.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "S/MIME tests"
-      description: "S/MIME tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "smime"
-
-    extra:
-      treeherder:
-        symbol: SMIME
diff --git a/automation/taskcluster/graph/tasks/ssl.yml b/automation/taskcluster/graph/tasks/ssl.yml
deleted file mode 100644
index 5a9c15bae..000000000
--- a/automation/taskcluster/graph/tasks/ssl.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- task:
-    metadata:
-      name: "SSL tests"
-      description: "SSL tests"
-
-    payload:
-      artifacts:
-        public:
-          type: directory
-          path: /home/worker/artifacts
-          expires: !from_now 24
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
-      env:
-        NSS_ENABLE_TLS_1_3: !!js/undefined # override
-        NSS_TESTS: "ssl"
-
-    extra:
-      treeherder:
-        groupSymbol: SSL
-        groupName: SSL tests
-        symbol: B
-
-  dependents:
-    - ssl_cycles
diff --git a/automation/taskcluster/graph/tasks/tools.yml b/automation/taskcluster/graph/tasks/tools.yml
deleted file mode 100644
index 056c799bd..000000000
--- a/automation/taskcluster/graph/tasks/tools.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- task:
-    metadata:
-      name: "Tools tests"
-      description: "Tools tests"
-
-    payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-      env:
-        NSS_TESTS: "tools"
-
-    extra:
-      treeherder:
-        symbol: Tools
diff --git a/automation/taskcluster/graph/tests/cert.yml b/automation/taskcluster/graph/tests/cert.yml
new file mode 100644
index 000000000..f8750efdd
--- /dev/null
+++ b/automation/taskcluster/graph/tests/cert.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Cert tests
+      description: Cert tests
+
+    payload:
+      env:
+        NSS_TESTS: cert
+
+    extra:
+      treeherder:
+        symbol: Cert
diff --git a/automation/taskcluster/graph/tests/chains.yml b/automation/taskcluster/graph/tests/chains.yml
new file mode 100644
index 000000000..aa528e424
--- /dev/null
+++ b/automation/taskcluster/graph/tests/chains.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Chains tests
+      description: Chains tests
+
+    payload:
+      env:
+        NSS_TESTS: chains
+
+    extra:
+      treeherder:
+        symbol: Chains
diff --git a/automation/taskcluster/graph/tests/cipher.yml b/automation/taskcluster/graph/tests/cipher.yml
new file mode 100644
index 000000000..e1d0f9faa
--- /dev/null
+++ b/automation/taskcluster/graph/tests/cipher.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Cipher tests
+      description: Cipher tests
+
+    payload:
+      env:
+        NSS_TESTS: cipher
+
+    extra:
+      treeherder:
+        symbol: Cipher
diff --git a/automation/taskcluster/graph/tests/crmf.yml b/automation/taskcluster/graph/tests/crmf.yml
new file mode 100644
index 000000000..eff4a611b
--- /dev/null
+++ b/automation/taskcluster/graph/tests/crmf.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: CRMF tests
+      description: CRMF tests
+
+    payload:
+      env:
+        NSS_TESTS: crmf
+
+    extra:
+      treeherder:
+        symbol: CRMF
diff --git a/automation/taskcluster/graph/tests/db.yml b/automation/taskcluster/graph/tests/db.yml
new file mode 100644
index 000000000..b5ee77653
--- /dev/null
+++ b/automation/taskcluster/graph/tests/db.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: DB tests
+      description: DB tests
+
+    payload:
+      env:
+        NSS_TESTS: dbtests
+
+    extra:
+      treeherder:
+        symbol: DB
diff --git a/automation/taskcluster/graph/tests/ec.yml b/automation/taskcluster/graph/tests/ec.yml
new file mode 100644
index 000000000..c6e21917e
--- /dev/null
+++ b/automation/taskcluster/graph/tests/ec.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: EC tests
+      description: EC tests
+
+    payload:
+      env:
+        NSS_TESTS: ec
+
+    extra:
+      treeherder:
+        symbol: EC
diff --git a/automation/taskcluster/graph/tests/fips.yml b/automation/taskcluster/graph/tests/fips.yml
new file mode 100644
index 000000000..d25a3ea54
--- /dev/null
+++ b/automation/taskcluster/graph/tests/fips.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: FIPS tests
+      description: FIPS tests
+
+    payload:
+      env:
+        NSS_TESTS: fips
+
+    extra:
+      treeherder:
+        symbol: FIPS
diff --git a/automation/taskcluster/graph/tests/gtests.yml b/automation/taskcluster/graph/tests/gtests.yml
new file mode 100644
index 000000000..d4a355a24
--- /dev/null
+++ b/automation/taskcluster/graph/tests/gtests.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: GTests
+      description: GTests
+
+    payload:
+      env:
+        NSS_TESTS: ssl_gtests gtests
+
+    extra:
+      treeherder:
+        symbol: GTest
diff --git a/automation/taskcluster/graph/tests/lowhash.yml b/automation/taskcluster/graph/tests/lowhash.yml
new file mode 100644
index 000000000..097a92377
--- /dev/null
+++ b/automation/taskcluster/graph/tests/lowhash.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Lowhash tests
+      description: Lowhash tests
+
+    payload:
+      env:
+        NSS_TESTS: lowhash
+
+    extra:
+      treeherder:
+        symbol: Lowhash
diff --git a/automation/taskcluster/graph/tasks/memleak.yml b/automation/taskcluster/graph/tests/memleak.yml
index 5f5403fde..d3b0170a1 100644
--- a/automation/taskcluster/graph/tasks/memleak.yml
+++ b/automation/taskcluster/graph/tests/memleak.yml
@@ -5,12 +5,8 @@
       description: "MemLeak tests (ocsp)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
-        NSS_MEMLEAK_TESTS: "ocsp"
+        NSS_MEMLEAK_TESTS: ocsp
 
     extra:
       treeherder:
@@ -22,10 +18,6 @@
       description: "MemLeak tests (ssl_server, standard)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_server"
         NSS_CYCLES: "standard"
@@ -42,10 +34,6 @@
       description: "MemLeak tests (ssl_server, pkix)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_server"
         NSS_CYCLES: "pkix"
@@ -62,10 +50,6 @@
       description: "MemLeak tests (ssl_server, sharedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_server"
         NSS_CYCLES: "sharedb"
@@ -82,10 +66,6 @@
       description: "MemLeak tests (ssl_server, upgradedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_server"
         NSS_CYCLES: "upgradedb"
@@ -102,10 +82,6 @@
       description: "MemLeak tests (ssl_client, standard)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_client"
         NSS_CYCLES: "standard"
@@ -122,10 +98,6 @@
       description: "MemLeak tests (ssl_client, pkix)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_client"
         NSS_CYCLES: "pkix"
@@ -142,10 +114,6 @@
       description: "MemLeak tests (ssl_client, sharedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_client"
         NSS_CYCLES: "sharedb"
@@ -162,10 +130,6 @@
       description: "MemLeak tests (ssl_client, upgradedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "ssl_client"
         NSS_CYCLES: "upgradedb"
@@ -182,10 +146,6 @@
       description: "MemLeak tests (chains, standard)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "chains"
         NSS_CYCLES: "standard"
@@ -202,10 +162,6 @@
       description: "MemLeak tests (chains, pkix)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "chains"
         NSS_CYCLES: "pkix"
@@ -222,10 +178,6 @@
       description: "MemLeak tests (chains, sharedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "chains"
         NSS_CYCLES: "sharedb"
@@ -242,10 +194,6 @@
       description: "MemLeak tests (chains, upgradedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_MEMLEAK_TESTS: "chains"
         NSS_CYCLES: "upgradedb"
diff --git a/automation/taskcluster/graph/tests/merge.yml b/automation/taskcluster/graph/tests/merge.yml
new file mode 100644
index 000000000..7db008a1d
--- /dev/null
+++ b/automation/taskcluster/graph/tests/merge.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Merge tests
+      description: Merge tests
+
+    payload:
+      env:
+        NSS_TESTS: merge
+
+    extra:
+      treeherder:
+        symbol: Merge
diff --git a/automation/taskcluster/graph/tests/ocsp.yml b/automation/taskcluster/graph/tests/ocsp.yml
new file mode 100644
index 000000000..b10d06e8e
--- /dev/null
+++ b/automation/taskcluster/graph/tests/ocsp.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: OCSP tests
+      description: OCSP tests
+
+    payload:
+      env:
+        NSS_TESTS: ocsp
+
+    extra:
+      treeherder:
+        symbol: OCSP
diff --git a/automation/taskcluster/graph/tests/pkits.yml b/automation/taskcluster/graph/tests/pkits.yml
new file mode 100644
index 000000000..1f4b2575d
--- /dev/null
+++ b/automation/taskcluster/graph/tests/pkits.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: NIST PKITS tests
+      description: NIST PKITS tests
+
+    payload:
+      env:
+        NSS_TESTS: pkits
+
+    extra:
+      treeherder:
+        symbol: PKITS
diff --git a/automation/taskcluster/graph/tests/pkix.yml b/automation/taskcluster/graph/tests/pkix.yml
new file mode 100644
index 000000000..02d207080
--- /dev/null
+++ b/automation/taskcluster/graph/tests/pkix.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: libpkix tests
+      description: libpkix tests
+
+    payload:
+      env:
+        NSS_TESTS: libpkix
+
+    extra:
+      treeherder:
+        symbol: PKIX
diff --git a/automation/taskcluster/graph/tests/sdr.yml b/automation/taskcluster/graph/tests/sdr.yml
new file mode 100644
index 000000000..12d881eda
--- /dev/null
+++ b/automation/taskcluster/graph/tests/sdr.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: SDR tests
+      description: SDR tests
+
+    payload:
+      env:
+        NSS_TESTS: sdr
+
+    extra:
+      treeherder:
+        symbol: SDR
diff --git a/automation/taskcluster/graph/tests/smime.yml b/automation/taskcluster/graph/tests/smime.yml
new file mode 100644
index 000000000..f5c3ab8fb
--- /dev/null
+++ b/automation/taskcluster/graph/tests/smime.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: S/MIME tests
+      description: S/MIME tests
+
+    payload:
+      env:
+        NSS_TESTS: smime
+
+    extra:
+      treeherder:
+        symbol: SMIME
diff --git a/automation/taskcluster/graph/tasks/ssl_cycles.yml b/automation/taskcluster/graph/tests/ssl.yml
index 9caae80c2..e58db2028 100644
--- a/automation/taskcluster/graph/tasks/ssl_cycles.yml
+++ b/automation/taskcluster/graph/tests/ssl.yml
@@ -6,16 +6,14 @@
 
     payload:
       maxRunTime: 7200
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_CYCLES: "standard"
 
     extra:
       treeherder:
         symbol: standard
+        groupSymbol: SSL
+        groupName: SSL tests
 
 - task:
     metadata:
@@ -23,16 +21,14 @@
       description: "SSL tests (pkix)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_CYCLES: "pkix"
 
     extra:
       treeherder:
         symbol: pkix
+        groupSymbol: SSL
+        groupName: SSL tests
 
 - task:
     metadata:
@@ -40,16 +36,14 @@
       description: "SSL tests (sharedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_CYCLES: "sharedb"
 
     extra:
       treeherder:
         symbol: sharedb
+        groupSymbol: SSL
+        groupName: SSL tests
 
 - task:
     metadata:
@@ -57,13 +51,11 @@
       description: "SSL tests (upgradedb)"
 
     payload:
-      command:
-        - "/bin/bash"
-        - "-c"
-        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
       env:
         NSS_CYCLES: "upgradedb"
 
     extra:
       treeherder:
         symbol: upgradedb
+        groupSymbol: SSL
+        groupName: SSL tests
diff --git a/automation/taskcluster/graph/tests/tools.yml b/automation/taskcluster/graph/tests/tools.yml
new file mode 100644
index 000000000..2edcce01a
--- /dev/null
+++ b/automation/taskcluster/graph/tests/tools.yml
@@ -0,0 +1,13 @@
+---
+- task:
+    metadata:
+      name: Tools tests
+      description: Tools tests
+
+    payload:
+      env:
+        NSS_TESTS: tools
+
+    extra:
+      treeherder:
+        symbol: Tools
diff --git a/automation/taskcluster/graph/tools/clang-format.yml b/automation/taskcluster/graph/tools/clang-format.yml
new file mode 100644
index 000000000..75f190edd
--- /dev/null
+++ b/automation/taskcluster/graph/tools/clang-format.yml
@@ -0,0 +1,35 @@
+---
+- reruns: 0
+  task:
+    created: !from_now 0
+    deadline: !from_now 24
+    provisionerId: aws-provisioner-v1
+    workerType: hg-worker
+    schedulerId: task-graph-scheduler
+
+    metadata:
+      owner: !env TC_OWNER
+      source: !env TC_SOURCE
+      name: clang-format-3.8
+      description: clang-format-3.8
+
+    payload:
+      maxRunTime: 3600
+      image: ttaubert/nss-ci:0.0.16
+
+      command:
+        - "/bin/bash"
+        - "-c"
+        - "bin/checkout.sh && nss/automation/taskcluster/scripts/run_clang_format.sh nss/lib/ssl"
+
+      env:
+        NSS_HEAD_REPOSITORY: !env NSS_HEAD_REPOSITORY
+        NSS_HEAD_REVISION: !env NSS_HEAD_REVISION
+
+    extra:
+      treeherder:
+        build:
+          platform: nss-tools
+        symbol: clang-format-3.8
+        revision: !env TC_REVISION
+        revision_hash: !env TC_REVISION_HASH
diff --git a/automation/taskcluster/graph/windows/_build_base.yml b/automation/taskcluster/graph/windows/_build_base.yml
new file mode 100644
index 000000000..80e55a60a
--- /dev/null
+++ b/automation/taskcluster/graph/windows/_build_base.yml
@@ -0,0 +1,38 @@
+---
+reruns: 2
+
+task:
+  created: !from_now 0
+  deadline: !from_now 24
+  provisionerId: aws-provisioner-v1
+  workerType: ttaubert-win2012r2
+  schedulerId: task-graph-scheduler
+
+  metadata:
+    owner: !env TC_OWNER
+    source: !env TC_SOURCE
+
+  payload:
+    maxRunTime: 3600
+
+    artifacts:
+      - type: directory
+        path: "public\\build"
+        expires: !from_now 24
+
+    command:
+      - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
+      - "time /t && bash -c nss/automation/taskcluster/windows/build.sh"
+
+    env:
+      PATH: "c:\\mozilla-build\\python;c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;c:\\Windows\\system32;c:\\mozilla-build\\upx391w;c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget"
+      NSS_HEAD_REPOSITORY: !env NSS_HEAD_REPOSITORY
+      NSS_HEAD_REVISION: !env NSS_HEAD_REVISION
+      DOMSUF: localdomain
+      HOST: localhost
+
+  extra:
+    treeherder:
+      revision: !env TC_REVISION
+      revision_hash: !env TC_REVISION_HASH
+      symbol: B
diff --git a/automation/taskcluster/graph/windows/_test_base.yml b/automation/taskcluster/graph/windows/_test_base.yml
new file mode 100644
index 000000000..73f4c1e9d
--- /dev/null
+++ b/automation/taskcluster/graph/windows/_test_base.yml
@@ -0,0 +1,20 @@
+---
+reruns: 2
+
+task:
+  created: !from_now 0
+  deadline: !from_now 24
+  provisionerId: aws-provisioner-v1
+  workerType: ttaubert-win2012r2
+  schedulerId: task-graph-scheduler
+
+  metadata:
+    owner: !env TC_OWNER
+    source: !env TC_SOURCE
+
+  payload:
+    maxRunTime: 3600
+
+    command:
+      - "time /t && hg clone -r %NSS_HEAD_REVISION% %NSS_HEAD_REPOSITORY% nss"
+      - "time /t && bash -c nss/automation/taskcluster/windows/run_tests.sh"
diff --git a/automation/taskcluster/graph/windows/build64-debug.yml b/automation/taskcluster/graph/windows/build64-debug.yml
new file mode 100644
index 000000000..1de71bcc4
--- /dev/null
+++ b/automation/taskcluster/graph/windows/build64-debug.yml
@@ -0,0 +1,25 @@
+---
+- task:
+    metadata:
+      name: "Windows 2012 64 (debug)"
+      description: "Windows 2012 64 (debug)"
+
+    payload:
+      env:
+        NSS_ENABLE_TLS_1_3: 1
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: windows2012-64
+        collection:
+          debug: true
+
+  tests:
+    - cipher
+    - ec
+    - gtests
+    - ocsp
+    - pkix
+    - sdr
diff --git a/automation/taskcluster/graph/windows/build64-opt.yml b/automation/taskcluster/graph/windows/build64-opt.yml
new file mode 100644
index 000000000..c726edc02
--- /dev/null
+++ b/automation/taskcluster/graph/windows/build64-opt.yml
@@ -0,0 +1,26 @@
+---
+- task:
+    metadata:
+      name: "Windows 2012 64 (opt)"
+      description: "Windows 2012 64 (opt)"
+
+    payload:
+      env:
+        NSS_ENABLE_TLS_1_3: 1
+        BUILD_OPT: 1
+        USE_64: 1
+
+    extra:
+      treeherder:
+        build:
+          platform: windows2012-64
+        collection:
+          opt: true
+
+  tests:
+    - cipher
+    - ec
+    - gtests
+    - ocsp
+    - pkix
+    - sdr