--- a/.taskcluster.yml
+++ b/.taskcluster.yml
@@ -1,137 +1,213 @@
 ---
 # This file is rendered via JSON-e by
 # - mozilla-taskcluster - https://docs.taskcluster.net/reference/integrations/mozilla-taskcluster/docs/taskcluster-yml
+# - action tasks - taskcluster/taskgraph/actions/registry.py
 
 version: 1
 
 tasks:
-  $let:
-    # sometimes the push user is just `ffxbld` or the like, but we want an email-like field..
-    ownerEmail: {$if: '"@" in push.owner', then: '${push.owner}', else: '${push.owner}@noreply.mozilla.org'}
-    # ensure there's no trailing `/` on the repo URL
-    repoUrl: {$if: 'repository.url[-1] == "/"', then: {$eval: 'repository.url[:-1]'}, else: {$eval: 'repository.url'}}
-  in:
-  - taskId: '${as_slugid("decision")}'
-    taskGroupId: '${as_slugid("decision")}' # same as taskId; this is how automation identifies a decision tsak
-    schedulerId: 'gecko-level-${repository.level}'
+  - $let:
+      # sometimes the push user is just `ffxbld` or the like, but we want an email-like field..
+      ownerEmail: {$if: '"@" in push.owner', then: '${push.owner}', else: '${push.owner}@noreply.mozilla.org'}
+      # ensure there's no trailing `/` on the repo URL
+      repoUrl: {$if: 'repository.url[-1] == "/"', then: {$eval: 'repository.url[:-1]'}, else: {$eval: 'repository.url'}}
+    in:
+      taskId: {$if: 'tasks_for != "action"', then: '${as_slugid("decision")}'}
+      taskGroupId:
+        $if: 'tasks_for == "action"'
+        then:
+          '${action.taskGroupId}'
+        else:
+          '${as_slugid("decision")}' # same as taskId; this is how automation identifies a decision tsak
+      schedulerId: 'gecko-level-${repository.level}'
+
+      created: {$fromNow: ''}
+      deadline: {$fromNow: '1 day'}
+      expires: {$fromNow: '1 year 1 second'} # 1 second so artifacts expire first, despite rounding errors
 
-    created: {$fromNow: ''}
-    deadline: {$fromNow: '1 day'}
-    expires: {$fromNow: '1 year 1 second'} # 1 second so artifacts expire first, despite rounding errors
+      metadata:
+        $merge:
+          - owner: "${ownerEmail}"
+            source: "${repoUrl}/raw-file/${push.revision}/.taskcluster.yml"
+          - $if: 'tasks_for == "hg-push"'
+            then:
+              name: "Thunderbird Decision Task"
+              description: 'The task that creates all of the other tasks in the task graph'
+            else:
+              $if: 'tasks_for == "action"'
+              then:
+                name: "Action: ${action.title}"
+                description: '${action.description}'
+              else:
+                name: "Decision Task for cron job ${cron.job_name}"
+                description: 'Created by a [cron task](https://tools.taskcluster.net/tasks/${cron.task_id})'
 
-    metadata:
-      $merge:
-        - owner: "${ownerEmail}"
-          source: "${repoUrl}/raw-file/${push.revision}/.taskcluster.yml"
+      provisionerId: "aws-provisioner-v1"
+      workerType: "gecko-${repository.level}-decision"
+
+      tags:
+        $if: 'tasks_for == "hg-push"'
+        then: {createdForUser: "${ownerEmail}"}
+        else:
+          $if: 'tasks_for == "action"'
+          then:
+            createdForUser: '${ownerEmail}'
+            kind: 'action-callback'
+
+      routes:
+        $flatten:
+        - "tc-treeherder.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
+        - "tc-treeherder-stage.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
         - $if: 'tasks_for == "hg-push"'
           then:
-            name: "Thunderbird Decision Task"
-            description: 'The task that creates all of the other tasks in the task graph'
+          - "index.comm.v2.${repository.project}.latest.thunderbird.decision"
+          - "index.comm.v2.${repository.project}.revision.${push.revision}.thunderbird.decision"
+          - "index.comm.v2.${repository.project}.pushlog-id.${push.pushlog_id}.decision"
+          - "notify.email.${ownerEmail}.on-failed"
+          - $if: '"mozilla@hocat.ca" in ownerEmail'
+            # Until taskcluster is ready for general consumption, don't report exceptions from taskcluster.
+            then: "notify.email.${ownerEmail}.on-exception"
           else:
-            name: "Decision Task for cron job ${cron.job_name}"
-            description: 'Created by a [cron task](https://tools.taskcluster.net/tasks/${cron.task_id})'
-
-    provisionerId: "aws-provisioner-v1"
-    workerType: "gecko-${repository.level}-decision"
+          - $if: 'tasks_for == "action"'
+            then: "index.comm.v2.${repository.project}.pushlog-id.${push.pushlog_id}.actions.$ownTaskId"
+            else: "index.comm.v2.${repository.project}.latest.thunderbird.decision-${cron.job_name}"
 
-    tags:
-      $if: 'tasks_for == "hg-push"'
-      then: {createdForUser: "${ownerEmail}"}
+      scopes:
+        $if: 'tasks_for == "hg-push"'
+        then:
+          - 'assume:repo:${repoUrl[8:]}:*'
+          - 'queue:route:notify.email.${ownerEmail}.*'
+        else:
+          $if: 'tasks_for == "action"'
+          then:
+            - '${action.repo_scope}'
+          else:
+            - 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'
 
-    routes:
-      - "tc-treeherder.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
-      - "tc-treeherder-stage.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
-      - "notify.email.${ownerEmail}.on-failed"
-      - $if: '"mozilla@hocat.ca" in ownerEmail'
-        # Until taskcluster is ready for general consumption, don't report exceptions from taskcluster.
-        then: "notify.email.${ownerEmail}.on-exception"
+      dependencies: []
+      requires: all-completed
 
-    scopes:
-      - 'assume:repo:${repoUrl[8:]}:*'
-      - 'queue:route:notify.email.${ownerEmail}.*'
+      priority: lowest
+      retries: 5
 
-    dependencies: []
-    requires: all-completed
-
-    priority: lowest
-    retries: 5
+      payload:
+        env:
+          $merge:
+          - # checkout-gecko uses these to check out the source; the inputs
+            # to `mach taskgraph decision` are all on the command line.
+            GECKO_BASE_REPOSITORY: 'https://hg.mozilla.org/mozilla-unified'
+            GECKO_HEAD_REPOSITORY: 'https://hg.mozilla.org/mozilla-central'
+            GECKO_HEAD_REF: 'default'
+            COMM_BASE_REPOSITORY: 'https://hg.mozilla.org/comm-central'
+            COMM_HEAD_REPOSITORY: '${repoUrl}'
+            COMM_HEAD_REF: '${push.revision}'
+            COMM_HEAD_REV: '${push.revision}'
+            HG_STORE_PATH: /buillds/worker/checkouts/hg-store
+            TASKCLUSTER_CACHES: /builds/worker/checkouts
+          - $if: 'tasks_for != "action"'
+            then: 
+              $if: '("--buildbot" in push.comment) && !("mozilla@hocat.ca" in ownerEmail)'
+              then:
+                # Until all buildbot platforms are supported in taskcluster, avoid
+                # passing try syntax to taskcluster.
+                COMM_COMMIT_MSG: 'try: ignored'
+              else:
+                COMM_COMMIT_MSG: '${push.comment}'
+          - $if: 'tasks_for == "action"'
+            then:
+              ACTION_TASK_GROUP_ID: '${action.taskGroupId}'
+              ACTION_TASK_ID: {$json: {$eval: 'taskId'}}
+              ACTION_TASK: {$json: {$eval: 'task'}}
+              ACTION_INPUT: {$json: {$eval: 'input'}}
+              ACTION_CALLBACK: '${action.cb_name}'
+              ACTION_PARAMETERS: {$json: {$eval: 'parameters'}}
 
-    payload:
-      env:
-        $merge:
-        - # checkout-gecko uses these to check out the source; the inputs
-          # to `mach taskgraph decision` are all on the command line.
-          GECKO_BASE_REPOSITORY: 'https://hg.mozilla.org/mozilla-unified'
-          GECKO_HEAD_REPOSITORY: 'https://hg.mozilla.org/mozilla-central'
-          GECKO_HEAD_REF: 'default'
-          COMM_BASE_REPOSITORY: 'https://hg.mozilla.org/comm-central'
-          COMM_HEAD_REPOSITORY: '${repoUrl}'
-          COMM_HEAD_REF: '${push.revision}'
-          COMM_HEAD_REV: '${push.revision}'
-          HG_STORE_PATH: /buillds/worker/checkouts/hg-store
-          TASKCLUSTER_CACHES: /builds/worker/checkouts
-        - $if: '("--buildbot" in push.comment) && !("mozilla@hocat.ca" in ownerEmail)'
-          then:
-            # Until all buildbot platforms are supported in taskcluster, avoid
-            # passing try syntax to taskcluster.
-            COMM_COMMIT_MSG: 'try: ignored'
-          else:
-            COMM_COMMIT_MSG: '${push.comment}'
+        cache:
+          level-${repository.level}-checkouts-sparse-v1: /builds/worker/checkouts
+
+        features:
+          taskclusterProxy: true
+          chainOfTrust: true
+
+        # Note: This task is built server side without the context or tooling that
+        # exist in tree so we must hard code the hash
+        # XXX Changing this will break Chain of Trust without an associated puppet and
+        # scriptworker patch!
+        image: 'taskcluster/decision:2.0.0@sha256:4039fd878e5700b326d4a636e28c595c053fbcb53909c1db84ad1f513cf644ef'
 
-      cache:
-        level-${repository.level}-checkouts-sparse-v1: /builds/worker/checkouts
-
-      features:
-        taskclusterProxy: true
-        chainOfTrust: true
-
-      # Note: This task is built server side without the context or tooling that
-      # exist in tree so we must hard code the hash
-      # XXX Changing this will break Chain of Trust without an associated puppet and
-      # scriptworker patch!
-      image: 'taskcluster/decision:2.0.0@sha256:4039fd878e5700b326d4a636e28c595c053fbcb53909c1db84ad1f513cf644ef'
-
-      maxRunTime: 1800
+        maxRunTime: 1800
 
-      # TODO use mozilla-unified for the base repository once the tc-vcs
-      # tar.gz archives are created or tc-vcs isn't being used.
-      command:
-        - /builds/worker/bin/run-task
-        - '--vcs-checkout=/builds/worker/checkouts/gecko'
-        - '--sparse-profile=build/sparse-profiles/taskgraph'
-        - '--comm-checkout=/builds/worker/checkouts/gecko/comm'
-        - '--'
-        - bash
-        - -cx
-        - >
-            cd /builds/worker/checkouts/gecko &&
-            ln -s /builds/worker/artifacts artifacts &&
-            ./mach --log-no-times taskgraph decision
-            --root comm/taskcluster/ci
-            --pushlog-id='${push.pushlog_id}'
-            --pushdate='${push.pushdate}'
-            --project='${repository.project}'
-            --message="$COMM_COMMIT_MSG"
-            --owner='${ownerEmail}'
-            --level='${repository.level}'
-            --base-repository='https://hg.mozilla.org/mozilla-central'
-            --head-repository="$GECKO_HEAD_REPOSITORY"
-            --head-ref="$GECKO_HEAD_REF"
-            --head-rev="$GECKO_HEAD_REV"
-            --comm-base-repository="$COMM_BASE_REPOSITORY"
-            --comm-head-repository="$COMM_HEAD_REPOSITORY"
-            --comm-head-ref="$COMM_HEAD_REF"
-            --comm-head-rev="$COMM_HEAD_REV"
-            --try-task-config-file=comm/try_task_config.json
+        # TODO use mozilla-unified for the base repository once the tc-vcs
+        # tar.gz archives are created or tc-vcs isn't being used.
+        command:
+          - /builds/worker/bin/run-task
+          - '--vcs-checkout=/builds/worker/checkouts/gecko'
+          - '--sparse-profile=build/sparse-profiles/taskgraph'
+          - '--comm-checkout=/builds/worker/checkouts/gecko/comm'
+          - '--'
+          - bash
+          - -cx
+          - $let:
+              extraArgs: {$if: 'tasks_for == "cron"', then: '${cron.quoted_args}', else: ''}
+            in:
+              $if: 'tasks_for == "action"'
+              then: >
+                cd /builds/worker/checkouts/gecko &&
+                ln -s /builds/worker/artifacts artifacts &&
+                ./mach --log-no-times taskgraph action-callback
+              else: >
+                cd /builds/worker/checkouts/gecko &&
+                ln -s /builds/worker/artifacts artifacts &&
+                ./mach --log-no-times taskgraph decision
+                --root comm/taskcluster/ci
+                --pushlog-id='${push.pushlog_id}'
+                --pushdate='${push.pushdate}'
+                --project='${repository.project}'
+                --message="$COMM_COMMIT_MSG"
+                --owner='${ownerEmail}'
+                --level='${repository.level}'
+                --base-repository='https://hg.mozilla.org/mozilla-central'
+                --head-repository="$GECKO_HEAD_REPOSITORY"
+                --head-ref="$GECKO_HEAD_REF"
+                --head-rev="$GECKO_HEAD_REV"
+                --comm-base-repository="$COMM_BASE_REPOSITORY"
+                --comm-head-repository="$COMM_HEAD_REPOSITORY"
+                --comm-head-ref="$COMM_HEAD_REF"
+                --comm-head-rev="$COMM_HEAD_REV"
+                --try-task-config-file=comm/try_task_config.json
+                ${extraArgs}
 
-      artifacts:
-        'public':
-          type: 'directory'
-          path: '/builds/worker/artifacts'
-          expires: {$fromNow: '1 year'}
+        artifacts:
+          'public':
+            type: 'directory'
+            path: '/builds/worker/artifacts'
+            expires: {$fromNow: '1 year'}
 
-    extra:
-      treeherder:
-        symbol: D
-        machine:
-          platform: gecko-decision
+      extra:
+        $merge:
+          - treeherder:
+              $merge:
+                - machine:
+                    platform: gecko-decision
+                - $if: 'tasks_for == "hg-push"'
+                  then:
+                    symbol: D
+                  else:
+                    $if: 'tasks_for == "action"'
+                    then:
+                      groupName: 'action-callback'
+                      groupSymbol: AC
+                      symbol: "${action.symbol}"
+                    else:
+                      groupSymbol: cron
+                      symbol: "${cron.job_symbol}"
+          - $if: 'tasks_for == "action"'
+            then:
+              parent: '${action.taskGroupId}'
+              action:
+                name: '${action.name}'
+                context:
+                  taskGroupId: '${action.taskGroupId}'
+                  taskId: {$eval: 'taskId'}
+                  input: {$eval: 'input'}
+                  parameters: {$eval: 'parameters'}