diff --git a/.taskcluster.yml b/.taskcluster.yml
index 022d2f3b7..34d440f44 100644
--- a/.taskcluster.yml
+++ b/.taskcluster.yml
@@ -63,8 +63,11 @@ tasks:
                           $if: 'tasks_for == "github-release"'
                           then: '${event.release.target_commitish}'
                           else:
-                              $if: 'tasks_for in ["cron", "action"]'
+                              $if: 'tasks_for == "cron"'
                               then: '${push.branch}'
+                              else:
+                                $if: 'tasks_for == "action"'
+                                then: ${parameters.head_ref}
               head_sha:
                   $if: 'tasks_for == "github-push"'
                   then: '${event.after}'
@@ -75,18 +78,21 @@ tasks:
                           $if: 'tasks_for == "github-release"'
                           then: '${event.release.tag_name}'
                           else:
-                              $if: 'tasks_for in ["cron", "action"]'
+                              $if: 'tasks_for == "cron"'
                               then: '${push.revision}'
+                              else:
+                                $if: 'tasks_for == "action"'
+                                then: ${parameters.head_rev}
+
               head_tag:
                   $if: 'tasks_for == "github-release"'
                   then: '${event.release.tag_name}'
                   else: ''
-
               ownTaskId:
                   $if: '"github" in tasks_for'
                   then: {$eval: as_slugid("decision_task")}
                   else:
-                      $if: 'tasks_for == "cron"'
+                      $if: 'tasks_for in ["cron", "action"]'
                       then: '${ownTaskId}'
               releaseAction:
                   $if: 'tasks_for == "github-release"'
@@ -102,198 +108,213 @@ tasks:
                           $if: 'tasks_for in ["github-push", "github-release", "action", "cron"] && repoUrl == "https://github.com/mozilla-mobile/fenix"'
                           then: '3'
                           else: '1'
+
+                      short_head_branch:
+                          $if: 'head_branch[:11] == "refs/heads/"'
+                          then: {$eval: 'head_branch[11:]'}
                   in:
-                      taskId: '${ownTaskId}'
-                      taskGroupId:
-                          $if: 'tasks_for == "action"'
+                    $mergeDeep:
+                        - $if: 'tasks_for != "action"'
                           then:
-                              '${action.taskGroupId}'
-                          else:
-                              '${ownTaskId}'  # same as taskId; this is how automation identifies a decision task
-                      schedulerId: '${trustDomain}-level-${level}'
-                      created: {$fromNow: ''}
-                      deadline: {$fromNow: '1 day'}
-                      expires: {$fromNow: '1 year 1 second'}  # 1 second so artifacts expire first, despite rounding errors
-                      metadata:
-                          $merge:
-                              - owner: "${ownerEmail}"
-                                source: '${repoUrl}/raw/${head_sha}/.taskcluster.yml'
-                              - $if: 'tasks_for in ["github-push", "github-pull-request", "github-release"]'
-                                then:
-                                    name: "Decision Task"
-                                    description: 'The task that creates all of the other tasks in the task graph'
-                                else:
-                                    $if: 'tasks_for == "action"'
-                                    then:
-                                        name: "Action: ${action.title}"
-                                        description: '${action.description}'
-                                    else:
-                                        name: "Decision Task for cron job ${cron.job_name}"
-                                        description: 'Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id})'
-                      provisionerId: "mobile-${level}"
-                      workerType: "decision"
-                      tags:
-                          $if: 'tasks_for in ["github-push", "github-pull-request"]'
-                          then:
-                              kind: decision-task
-                          else:
+                              taskId: '${ownTaskId}'
+                        - taskGroupId:
                               $if: 'tasks_for == "action"'
                               then:
-                                  kind: 'action-callback'
+                                  '${action.taskGroupId}'
                               else:
-                                  $if: 'tasks_for == "cron"'
-                                  then:
-                                      kind: cron-task
-                      routes:
-                          $flatten:
-                              - checks
-                              - $if: 'level == "3"'
-                                then:
-                                    - "tc-treeherder.v2.${project}.${head_sha}"
-                                else: []
-                      scopes:
-                          # `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.
-                          $if: 'tasks_for == "github-push"'
-                          then:
-                              $let:
-                                  short_head_branch:
-                                      $if: 'head_branch[:11] == "refs/heads/"'
-                                      then: {$eval: 'head_branch[11:]'}
-                                      else: ${head_branch}
-                              in:
-                                  - 'assume:repo:${repoUrl[8:]}:branch:${short_head_branch}'
-                          else:
-                              $if: 'tasks_for == "github-pull-request"'
-                              then:
-                                  - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
-                              else:
-                                  $if: 'tasks_for == "github-release"'
-                                  then:
-                                      - 'assume:repo:${repoUrl[8:]}:release'
-                                  else:
-                                      $if: 'tasks_for == "action"'
-                                      then:
-                                          # when all actions are hooks, we can calculate this directly rather than using a variable
-                                          - '${action.repo_scope}'
-                                      else:
-                                          - 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'
-
-                      requires: all-completed
-                      priority: lowest
-                      retries: 5
-
-                      payload:
-                          env:
-                              # run-task uses these to check out the source; the inputs
-                              # to `mach taskgraph decision` are all on the command line.
+                                  '${ownTaskId}'  # same as taskId; this is how automation identifies a decision task
+                          schedulerId: '${trustDomain}-level-${level}'
+                          created: {$fromNow: ''}
+                          deadline: {$fromNow: '1 day'}
+                          expires: {$fromNow: '1 year 1 second'}  # 1 second so artifacts expire first, despite rounding errors
+                          metadata:
                               $merge:
-                                  - MOBILE_BASE_REPOSITORY: '${baseRepoUrl}'
-                                    MOBILE_HEAD_REPOSITORY: '${repoUrl}'
-                                    MOBILE_HEAD_REF: '${head_branch}'
-                                    MOBILE_HEAD_REV: '${head_sha}'
-                                    MOBILE_HEAD_TAG: '${head_tag}'
-                                    MOBILE_REPOSITORY_TYPE: git
-                                    TASKGRAPH_BASE_REPOSITORY: https://hg.mozilla.org/ci/taskgraph
-                                    TASKGRAPH_HEAD_REPOSITORY: https://hg.mozilla.org/ci/${taskgraph.branch}
-                                    TASKGRAPH_HEAD_REV: ${taskgraph.revision}
-                                    TASKGRAPH_REPOSITORY_TYPE: hg
-                                    REPOSITORIES: {$json: {mobile: "Fenix", taskgraph: "Taskgraph"}}
-                                    HG_STORE_PATH: /builds/worker/checkouts/hg-store
-                                    ANDROID_SDK_ROOT: /builds/worker/android-sdk
-                                  - $if: 'tasks_for in ["github-pull-request"]'
+                                  - owner: "${ownerEmail}"
+                                    source: '${repoUrl}/raw/${head_sha}/.taskcluster.yml'
+                                  - $if: 'tasks_for in ["github-push", "github-pull-request", "github-release"]'
                                     then:
-                                        MOBILE_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
+                                        name: "Decision Task"
+                                        description: 'The task that creates all of the other tasks in the task graph'
+                                    else:
+                                        $if: 'tasks_for == "action"'
+                                        then:
+                                            name: "Action: ${action.title}"
+                                            description: '${action.description}'
+                                        else:
+                                            name: "Decision Task for cron job ${cron.job_name}"
+                                            description: 'Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id})'
+                          provisionerId: "mobile-${level}"
+                          workerType: "decision"
+                          tags:
+                              $if: 'tasks_for in ["github-push", "github-pull-request"]'
+                              then:
+                                  kind: decision-task
+                              else:
+                                  $if: 'tasks_for == "action"'
+                                  then:
+                                      kind: 'action-callback'
+                                  else:
+                                      $if: 'tasks_for == "cron"'
+                                      then:
+                                          kind: cron-task
+                          routes:
+                              $flattenDeep:
+                                  - checks
+                                  - $if: 'level == "3"'
+                                    then:
+                                        - tc-treeherder.v2.${project}.${head_sha}
+                                        # TODO Bug 1601928: Make this scope fork-friendly once ${project} is better defined. This will enable
+                                        # staging release promotion on forks.
+                                        - $if: 'tasks_for == "github-push"'
+                                          then:
+                                              - index.project.mobile.${project}.v2.branch.${short_head_branch}.latest.taskgraph.decision
+                                              - index.project.mobile.${project}.v2.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision
+                                        - $if: 'tasks_for == "cron"'
+                                          then:
+                                              - index.project.mobile.${project}.v2.branch.${short_head_branch}.latest.taskgraph.decision-${cron.job_name}
+                                              - index.project.mobile.${project}.v2.branch.${short_head_branch}.revision.${head_sha}.taskgraph.decision-${cron.job_name}
+                                              - index.project.mobile.${project}.v2.branch.${short_head_branch}.revision.${head_sha}.taskgraph.cron.${ownTaskId}
+                          scopes:
+                              $if: 'tasks_for == "github-push"'
+                              then:
+                                  # `https://` is 8 characters so, ${repoUrl[8:]} is the repository without the protocol.
+                                  - 'assume:repo:${repoUrl[8:]}:branch:${short_head_branch}'
+                              else:
+                                  $if: 'tasks_for == "github-pull-request"'
+                                  then:
+                                      - 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:pull-request'
+                                  else:
+                                      $if: 'tasks_for == "github-release"'
+                                      then:
+                                          - 'assume:repo:${repoUrl[8:]}:release'
+                                      else:
+                                          $if: 'tasks_for == "action"'
+                                          then:
+                                              # when all actions are hooks, we can calculate this directly rather than using a variable
+                                              - '${action.repo_scope}'
+                                          else:
+                                              - 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'
+
+                          requires: all-completed
+                          priority: lowest
+                          retries: 5
+
+                          payload:
+                              env:
+                                  # run-task uses these to check out the source; the inputs
+                                  # to `mach taskgraph decision` are all on the command line.
+                                  $merge:
+                                      - MOBILE_BASE_REPOSITORY: '${baseRepoUrl}'
+                                        MOBILE_HEAD_REPOSITORY: '${repoUrl}'
+                                        MOBILE_HEAD_REF: '${head_branch}'
+                                        MOBILE_HEAD_REV: '${head_sha}'
+                                        MOBILE_HEAD_TAG: '${head_tag}'
+                                        MOBILE_REPOSITORY_TYPE: git
+                                        TASKGRAPH_BASE_REPOSITORY: https://hg.mozilla.org/ci/taskgraph
+                                        TASKGRAPH_HEAD_REPOSITORY: https://hg.mozilla.org/ci/${taskgraph.branch}
+                                        TASKGRAPH_HEAD_REV: ${taskgraph.revision}
+                                        TASKGRAPH_REPOSITORY_TYPE: hg
+                                        REPOSITORIES: {$json: {mobile: "Fenix", taskgraph: "Taskgraph"}}
+                                        HG_STORE_PATH: /builds/worker/checkouts/hg-store
+                                        ANDROID_SDK_ROOT: /builds/worker/android-sdk
+                                      - $if: 'tasks_for in ["github-pull-request"]'
+                                        then:
+                                            MOBILE_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
+                                      - $if: 'tasks_for == "action"'
+                                        then:
+                                            ACTION_TASK_GROUP_ID: '${action.taskGroupId}'  # taskGroupId of the target task
+                                            ACTION_TASK_ID: {$json: {$eval: 'taskId'}}  # taskId of the target task (JSON-encoded)
+                                            ACTION_INPUT: {$json: {$eval: 'input'}}
+                                            ACTION_CALLBACK: '${action.cb_name}'
+                                      - $if: 'tasks_for == "github-release"'
+                                        then:
+                                            MOBILE_HEAD_TAG: '${event.release.tag_name}'
+                              features:
+                                  taskclusterProxy: true
+                                  chainOfTrust: true
+                              # Note: This task is built server side without the context or tooling that
+                              # exist in tree so we must hard code the hash
+                              image:
+                                  mozillareleases/taskgraph:decision-mobile-6020473b1a928d8df50e234a7ca2e81ade2220a4fb5fbe16b02477dd64a49728@sha256:98d226736b7d03907114bf37938002b90e8a37cbe3a297690e349f1ddddb1d7c
+
+                              maxRunTime: 1800
+
+                              command:
+                                  - /usr/local/bin/run-task
+                                  - '--mobile-checkout=/builds/worker/checkouts/src'
+                                  - '--taskgraph-checkout=/builds/worker/checkouts/taskgraph'
+                                  - '--task-cwd=/builds/worker/checkouts/src'
+                                  - '--'
+                                  - bash
+                                  - -cx
+                                  - $let:
+                                        extraArgs: {$if: 'tasks_for == "cron"', then: '${cron.quoted_args}', else: ''}
+                                    in:
+                                        $if: 'tasks_for == "action"'
+                                        then: >
+                                            PIP_IGNORE_INSTALLED=0 pip install --user /builds/worker/checkouts/taskgraph &&
+                                            taskcluster/scripts/install-sdk.sh &&
+                                            ln -s /builds/worker/artifacts artifacts &&
+                                            ~/.local/bin/taskgraph action-callback
+                                        else: >
+                                            PIP_IGNORE_INSTALLED=0 pip install --user /builds/worker/checkouts/taskgraph &&
+                                            PIP_IGNORE_INSTALLED=0 pip install --user arrow taskcluster pyyaml &&
+                                            taskcluster/scripts/install-sdk.sh &&
+                                            ln -s /builds/worker/artifacts artifacts &&
+                                            ~/.local/bin/taskgraph decision
+                                            --pushlog-id='0'
+                                            --pushdate='0'
+                                            --project='${project}'
+                                            --message=""
+                                            --owner='${ownerEmail}'
+                                            --level='${level}'
+                                            --base-repository="$MOBILE_BASE_REPOSITORY"
+                                            --head-repository="$MOBILE_HEAD_REPOSITORY"
+                                            --head-ref="$MOBILE_HEAD_REF"
+                                            --head-rev="$MOBILE_HEAD_REV"
+                                            --head-tag="$MOBILE_HEAD_TAG"
+                                            --repository-type="$MOBILE_REPOSITORY_TYPE"
+                                            --tasks-for='${tasks_for}'
+                                            ${extraArgs}
+
+                              artifacts:
+                                  'public':
+                                      type: 'directory'
+                                      path: '/builds/worker/artifacts'
+                                      expires: {$fromNow: '1 year'}
+
+                          extra:
+                              $merge:
+                                  - treeherder:
+                                        $merge:
+                                            - machine:
+                                                  platform: gecko-decision
+                                            - $if: 'tasks_for in ["github-push", "github-pull-request"]'
+                                              then:
+                                                  symbol: D
+                                              else:
+                                                  $if: 'tasks_for == "github-release"'
+                                                  then:
+                                                      symbol: 'ship_fenix'
+                                                  else:
+                                                      $if: 'tasks_for == "action"'
+                                                      then:
+                                                          groupName: 'action-callback'
+                                                          groupSymbol: AC
+                                                          symbol: "${action.symbol}"
+                                                      else:
+                                                          groupSymbol: cron
+                                                          symbol: "${cron.job_symbol}"
                                   - $if: 'tasks_for == "action"'
                                     then:
-                                        ACTION_TASK_GROUP_ID: '${action.taskGroupId}'  # taskGroupId of the target task
-                                        ACTION_TASK_ID: {$json: {$eval: 'taskId'}}  # taskId of the target task (JSON-encoded)
-                                        ACTION_INPUT: {$json: {$eval: 'input'}}
-                                        ACTION_CALLBACK: '${action.cb_name}'
-                          features:
-                              taskclusterProxy: true
-                              chainOfTrust: true
-                          # Note: This task is built server side without the context or tooling that
-                          # exist in tree so we must hard code the hash
-                          image:
-                              mozillareleases/taskgraph:decision-mobile-6020473b1a928d8df50e234a7ca2e81ade2220a4fb5fbe16b02477dd64a49728@sha256:98d226736b7d03907114bf37938002b90e8a37cbe3a297690e349f1ddddb1d7c
-
-                          maxRunTime: 1800
-
-                          command:
-                              - /usr/local/bin/run-task
-                              - '--mobile-checkout=/builds/worker/checkouts/src'
-                              - '--taskgraph-checkout=/builds/worker/checkouts/taskgraph'
-                              - '--task-cwd=/builds/worker/checkouts/src'
-                              - '--'
-                              - bash
-                              - -cx
-                              - $let:
-                                    extraArgs: {$if: 'tasks_for == "cron"', then: '${cron.quoted_args}', else: ''}
-                                in:
-                                    $if: 'tasks_for == "action"'
-                                    then: >
-                                        cd /builds/worker/checkouts/src &&
-                                        ln -s /builds/worker/artifacts artifacts &&
-                                        taskgraph action-callback
-                                    else: >
-                                        PIP_IGNORE_INSTALLED=0 pip install --user /builds/worker/checkouts/taskgraph &&
-                                        PIP_IGNORE_INSTALLED=0 pip install --user arrow taskcluster pyyaml &&
-                                        taskcluster/scripts/install-sdk.sh &&
-                                        ln -s /builds/worker/artifacts artifacts &&
-                                        ~/.local/bin/taskgraph decision
-                                        --pushlog-id='0'
-                                        --pushdate='0'
-                                        --project='${project}'
-                                        --message=""
-                                        --owner='${ownerEmail}'
-                                        --level='${level}'
-                                        --base-repository="$MOBILE_BASE_REPOSITORY"
-                                        --head-repository="$MOBILE_HEAD_REPOSITORY"
-                                        --head-ref="$MOBILE_HEAD_REF"
-                                        --head-rev="$MOBILE_HEAD_REV"
-                                        --head-tag="$MOBILE_HEAD_TAG"
-                                        --repository-type="$MOBILE_REPOSITORY_TYPE"
-                                        --tasks-for='${tasks_for}'
-                                        ${extraArgs}
-
-                          artifacts:
-                              'public':
-                                  type: 'directory'
-                                  path: '/builds/worker/artifacts'
-                                  expires: {$fromNow: '1 year'}
-
-                      extra:
-                          $merge:
-                              - treeherder:
-                                    $merge:
-                                        - machine:
-                                              platform: gecko-decision
-                                        - $if: 'tasks_for in ["github-push", "github-pull-request"]'
-                                          then:
-                                              symbol: D
-                                          else:
-                                              $if: 'tasks_for == "github-release"'
-                                              then:
-                                                  symbol: 'ship_fenix'
-                                              else:
-                                                  $if: 'tasks_for == "action"'
-                                                  then:
-                                                      groupName: 'action-callback'
-                                                      groupSymbol: AC
-                                                      symbol: "${action.symbol}"
-                                                  else:
-                                                      groupSymbol: cron
-                                                      symbol: "${cron.job_symbol}"
-                              - $if: 'tasks_for == "action"'
-                                then:
-                                    parent: '${action.taskGroupId}'
-                                    action:
-                                        name: '${action.name}'
-                                        context:
-                                            taskGroupId: '${action.taskGroupId}'
-                                            taskId: {$eval: 'taskId'}
-                                            input: {$eval: 'input'}
-                              - $if: 'tasks_for == "cron"'
-                                then:
-                                    cron: {$json: {$eval: 'cron'}}
-                              - tasks_for: '${tasks_for}'
+                                        parent: '${action.taskGroupId}'
+                                        action:
+                                            name: '${action.name}'
+                                            context:
+                                                taskGroupId: '${action.taskGroupId}'
+                                                taskId: {$eval: 'taskId'}
+                                                input: {$eval: 'input'}
+                                  - $if: 'tasks_for == "cron"'
+                                    then:
+                                        cron: {$json: {$eval: 'cron'}}
+                                  - tasks_for: '${tasks_for}'