Allow extra refs to be marked as optional in run-task

Also mark the notes/decision-parameters one as optional in this repo.

This prevents failures if a fork doesn't have any notes at
`refs/notes/decision-parameters`. I chose to pay for the `ls-remote`
time if an optional ref failed to fetch to avoid having to parse the
stderr from git fetch which felt very fragile. It adds a potential ~1.5s
to fetches per optional remote that is missing which isn't ideal, but I
don't have anything better at this point in time. The new log message is
slightly misleading since technically ls-remote might find one ref but
not another and it'd be reported that both are missing but I don't want
to have to ls-remote for each ref, adding 1.5s each time, to fix this.

Author: Eijebong

.taskcluster.yml

@@ -226,7 +226,7 @@ tasks:
                               - $if: 'isPullRequest'
                                 then:
                                     TASKGRAPH_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
-                                    TASKGRAPH_EXTRA_REFS: {$json: ["refs/notes/decision-parameters"]}
+                                    TASKGRAPH_EXTRA_REFS: {$json: ["?refs/notes/decision-parameters"]}
                               - $if: 'tasks_for == "action" || tasks_for == "pr-action"'
                                 then:
                                     ACTION_TASK_GROUP_ID: '${action.taskGroupId}'  # taskGroupId of the target task

src/taskgraph/run-task/run-task

@@ -574,6 +574,7 @@ def git_fetch(
     tags: bool = False,
     shallow: bool = False,
     env: Optional[Dict[str, str]] = None,
+    optional: bool = False,
 ):
     args = ["git", "fetch"]
     if tags:
@@ -584,6 +585,30 @@ def git_fetch(
         args.append("--depth=1")
 
     args.extend([remote, *set(targets)])
+    if not optional:
+        retry_required_command(b"vcs", args, cwd=destination_path, extra_env=env)
+        return
+
+    try:
+        retry_required_command(
+            b"vcs", args, cwd=destination_path, extra_env=env, retries=0
+        )
+        return
+    except SystemExit:
+        # Ignore the first failure to check if the ref even exists
+        pass
+
+    ref_names = [t.split(":", 1)[0] for t in targets]
+    ls = subprocess.run(
+        ["git", "ls-remote", "--exit-code", remote, *ref_names],
+        cwd=destination_path,
+        capture_output=True,
+    )
+
+    if ls.returncode == 2:
+        print_line(b"vcs", b"optional refs %r not present on remote, skipping\n" % ref_names)
+        return
+
     retry_required_command(b"vcs", args, cwd=destination_path, extra_env=env)
 
 
@@ -735,11 +760,15 @@ def git_checkout(
         env=env,
     )
 
-    if extra_refs:
+    for ref in extra_refs or []:
+        optional = ref.startswith("?")
+        if optional:
+            ref = ref[1:]
         git_fetch(
             destination_path,
-            *[f"{ref}:{ref}" for ref in extra_refs],
+            f"{ref}:{ref}",
             remote=head_repo,
+            optional=optional,
             env=env,
         )