Do not put Treeherder route when on untrusted repo (#2921)

.taskcluster.yml

@@ -77,8 +77,12 @@ tasks:
           requires: all-completed   # Must be explicit because of Chain of Trust
           retries: 5
           routes:
-            - statuses  # Automatically added by taskcluster-github. It must be explicit because of Chain of Trust
+            $flatten:
-            - tc-treeherder.v2.fenix.${head_rev}
+              - statuses  # Automatically added by taskcluster-github. It must be explicit because of Chain of Trust
+              - $if: 'trust_level == 3'
+                then:
+                  - tc-treeherder.v2.fenix.${head_rev}
+                else: []
           payload:
             maxRunTime: 600   # Decision should remain fast enough to schedule a handful of tasks
             image: mozillamobile/fenix:1.4

automation/taskcluster/lib/tasks.py

@@ -362,6 +362,9 @@ class TaskBuilder(object):
         deadline = taskcluster.fromNow('1 day')
         expires = taskcluster.fromNow(DEFAULT_EXPIRES_IN)
 
+        if self.trust_level == 3:
+            routes.append('tc-treeherder.v2.fenix.{}'.format(self.commit))
+
         return {
             "provisionerId": provisioner_id,
             "workerType": worker_type,
@@ -375,9 +378,7 @@ class TaskBuilder(object):
             "priority": self.tasks_priority,
             "dependencies": [self.task_id] + dependencies,
             "requires": "all-completed",
-            "routes": routes + [
+            "routes": routes,
-                "tc-treeherder.v2.fenix.{}".format(self.commit)
-            ],
             "scopes": scopes,
             "payload": payload,
             "extra": {