all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe05:48e5
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: c22b3727-5c97-49be-b5a8-4314528fb82b
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe05:48e5
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.107
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.241
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe05:48e5
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/ansible-playbooks-manager/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 086b57fc142249aea71b9a9a26052a30
      build_refs:
      - branch: main
        change: '52'
        change_message: "keypair: fail on empty operator private key\n\n## What\n\nAdd
          an `assert` to `playbooks/keypair.yml` that fails when\n`operator_private_key`
          is empty/whitespace or does not contain a\n`PRIVATE KEY` marker, before
          writing `id_rsa.operator`.\n\n## Why\n\n`keypair.yml` writes `operator_private_key`
          verbatim to\n`id_rsa.operator`. When it resolves to an empty string \u2014
          e.g. a\nhost-path `lookup('file', ...)` that does not exist in the execution\ncontext,
          such as inside the `osism/seed` container \u2014 the play silently\nwrote
          a zero-byte key. The failure then surfaced far downstream during\nthe manager
          apply as an opaque SSH error:\n\n```\nLoad key \".../id_rsa.operator\":
          error in libcrypto: unsupported\n... Permission denied (publickey).\n```\n\nThat
          is OpenSSH's generic \"not a parseable private key\" message and\ngives
          no hint that the real fault is an empty key written one play\nearlier. This
          guard fails loudly at the point of the actual fault.\n\nThe `'PRIVATE KEY'`
          substring matches both PEM (`BEGIN RSA PRIVATE KEY`,\n`BEGIN PRIVATE KEY`)
          and OpenSSH (`BEGIN OPENSSH PRIVATE KEY`) keys, so\na real key passes while
          empty/whitespace/placeholder values fail. The\nassert reports only the condition
          expressions, not the key value, so\nthe key is not leaked to logs.\n\n##
          Testing\n\nRan the play in the `osism/seed` container against a vars file
          (as\n`run.sh` does, `-e @secrets.yml`):\n\n- `operator_private_key: \"\"`
          \u2192 assert fails, no file written\n- `operator_private_key: PLACEHOLDER`
          \u2192 assert fails, no file written\n- real RSA key \u2192 passes, `id_rsa.operator`
          written `0600`, loads via\n  `ssh-keygen -y`\n\nPasses `ansible-playbook
          --syntax-check` and `yamllint -c .yamllint.yml`.\n\n## Scope\n\nDefense-in-depth
          only. It does not address why the key may be empty in\na given configuration,
          and does not cover a stale zero-byte\n`id_rsa.operator` already present
          (callers skip this play when the file\nexists).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-playbooks-manager/pull/52
        commit_id: 1e9eddd5669b9b132fec532619e9d158dacff48c
        patchset: 1e9eddd5669b9b132fec532619e9d158dacff48c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-playbooks-manager
          name: osism/ansible-playbooks-manager
          short_name: ansible-playbooks-manager
        src_dir: src/github.com/osism/ansible-playbooks-manager
        topic: null
      buildset: de9e1cb0f2474353934ac70b8ee70634
      buildset_refs:
      - branch: main
        change: '52'
        change_message: "keypair: fail on empty operator private key\n\n## What\n\nAdd
          an `assert` to `playbooks/keypair.yml` that fails when\n`operator_private_key`
          is empty/whitespace or does not contain a\n`PRIVATE KEY` marker, before
          writing `id_rsa.operator`.\n\n## Why\n\n`keypair.yml` writes `operator_private_key`
          verbatim to\n`id_rsa.operator`. When it resolves to an empty string \u2014
          e.g. a\nhost-path `lookup('file', ...)` that does not exist in the execution\ncontext,
          such as inside the `osism/seed` container \u2014 the play silently\nwrote
          a zero-byte key. The failure then surfaced far downstream during\nthe manager
          apply as an opaque SSH error:\n\n```\nLoad key \".../id_rsa.operator\":
          error in libcrypto: unsupported\n... Permission denied (publickey).\n```\n\nThat
          is OpenSSH's generic \"not a parseable private key\" message and\ngives
          no hint that the real fault is an empty key written one play\nearlier. This
          guard fails loudly at the point of the actual fault.\n\nThe `'PRIVATE KEY'`
          substring matches both PEM (`BEGIN RSA PRIVATE KEY`,\n`BEGIN PRIVATE KEY`)
          and OpenSSH (`BEGIN OPENSSH PRIVATE KEY`) keys, so\na real key passes while
          empty/whitespace/placeholder values fail. The\nassert reports only the condition
          expressions, not the key value, so\nthe key is not leaked to logs.\n\n##
          Testing\n\nRan the play in the `osism/seed` container against a vars file
          (as\n`run.sh` does, `-e @secrets.yml`):\n\n- `operator_private_key: \"\"`
          \u2192 assert fails, no file written\n- `operator_private_key: PLACEHOLDER`
          \u2192 assert fails, no file written\n- real RSA key \u2192 passes, `id_rsa.operator`
          written `0600`, loads via\n  `ssh-keygen -y`\n\nPasses `ansible-playbook
          --syntax-check` and `yamllint -c .yamllint.yml`.\n\n## Scope\n\nDefense-in-depth
          only. It does not address why the key may be empty in\na given configuration,
          and does not cover a stale zero-byte\n`id_rsa.operator` already present
          (callers skip this play when the file\nexists).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-playbooks-manager/pull/52
        commit_id: 1e9eddd5669b9b132fec532619e9d158dacff48c
        patchset: 1e9eddd5669b9b132fec532619e9d158dacff48c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-playbooks-manager
          name: osism/ansible-playbooks-manager
          short_name: ansible-playbooks-manager
        src_dir: src/github.com/osism/ansible-playbooks-manager
        topic: null
      change: '52'
      change_message: "keypair: fail on empty operator private key\n\n## What\n\nAdd
        an `assert` to `playbooks/keypair.yml` that fails when\n`operator_private_key`
        is empty/whitespace or does not contain a\n`PRIVATE KEY` marker, before writing
        `id_rsa.operator`.\n\n## Why\n\n`keypair.yml` writes `operator_private_key`
        verbatim to\n`id_rsa.operator`. When it resolves to an empty string \u2014
        e.g. a\nhost-path `lookup('file', ...)` that does not exist in the execution\ncontext,
        such as inside the `osism/seed` container \u2014 the play silently\nwrote
        a zero-byte key. The failure then surfaced far downstream during\nthe manager
        apply as an opaque SSH error:\n\n```\nLoad key \".../id_rsa.operator\": error
        in libcrypto: unsupported\n... Permission denied (publickey).\n```\n\nThat
        is OpenSSH's generic \"not a parseable private key\" message and\ngives no
        hint that the real fault is an empty key written one play\nearlier. This guard
        fails loudly at the point of the actual fault.\n\nThe `'PRIVATE KEY'` substring
        matches both PEM (`BEGIN RSA PRIVATE KEY`,\n`BEGIN PRIVATE KEY`) and OpenSSH
        (`BEGIN OPENSSH PRIVATE KEY`) keys, so\na real key passes while empty/whitespace/placeholder
        values fail. The\nassert reports only the condition expressions, not the key
        value, so\nthe key is not leaked to logs.\n\n## Testing\n\nRan the play in
        the `osism/seed` container against a vars file (as\n`run.sh` does, `-e @secrets.yml`):\n\n-
        `operator_private_key: \"\"` \u2192 assert fails, no file written\n- `operator_private_key:
        PLACEHOLDER` \u2192 assert fails, no file written\n- real RSA key \u2192 passes,
        `id_rsa.operator` written `0600`, loads via\n  `ssh-keygen -y`\n\nPasses `ansible-playbook
        --syntax-check` and `yamllint -c .yamllint.yml`.\n\n## Scope\n\nDefense-in-depth
        only. It does not address why the key may be empty in\na given configuration,
        and does not cover a stale zero-byte\n`id_rsa.operator` already present (callers
        skip this play when the file\nexists).\n\n\U0001F916 Generated with [Claude
        Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-playbooks-manager/pull/52
      child_jobs: []
      commit_id: 1e9eddd5669b9b132fec532619e9d158dacff48c
      event_id: 0cd53eb0-7391-11f1-9035-4424bd59f3fd
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/086b57fc142249aea71b9a9a26052a30/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/086b57fc142249aea71b9a9a26052a30/work/logs
        result_data_file: /var/lib/zuul/builds/086b57fc142249aea71b9a9a26052a30/work/results.json
        src_root: /var/lib/zuul/builds/086b57fc142249aea71b9a9a26052a30/work/src
        work_root: /var/lib/zuul/builds/086b57fc142249aea71b9a9a26052a30/work
      include_vars: []
      items:
      - branch: main
        change: '52'
        change_message: "keypair: fail on empty operator private key\n\n## What\n\nAdd
          an `assert` to `playbooks/keypair.yml` that fails when\n`operator_private_key`
          is empty/whitespace or does not contain a\n`PRIVATE KEY` marker, before
          writing `id_rsa.operator`.\n\n## Why\n\n`keypair.yml` writes `operator_private_key`
          verbatim to\n`id_rsa.operator`. When it resolves to an empty string \u2014
          e.g. a\nhost-path `lookup('file', ...)` that does not exist in the execution\ncontext,
          such as inside the `osism/seed` container \u2014 the play silently\nwrote
          a zero-byte key. The failure then surfaced far downstream during\nthe manager
          apply as an opaque SSH error:\n\n```\nLoad key \".../id_rsa.operator\":
          error in libcrypto: unsupported\n... Permission denied (publickey).\n```\n\nThat
          is OpenSSH's generic \"not a parseable private key\" message and\ngives
          no hint that the real fault is an empty key written one play\nearlier. This
          guard fails loudly at the point of the actual fault.\n\nThe `'PRIVATE KEY'`
          substring matches both PEM (`BEGIN RSA PRIVATE KEY`,\n`BEGIN PRIVATE KEY`)
          and OpenSSH (`BEGIN OPENSSH PRIVATE KEY`) keys, so\na real key passes while
          empty/whitespace/placeholder values fail. The\nassert reports only the condition
          expressions, not the key value, so\nthe key is not leaked to logs.\n\n##
          Testing\n\nRan the play in the `osism/seed` container against a vars file
          (as\n`run.sh` does, `-e @secrets.yml`):\n\n- `operator_private_key: \"\"`
          \u2192 assert fails, no file written\n- `operator_private_key: PLACEHOLDER`
          \u2192 assert fails, no file written\n- real RSA key \u2192 passes, `id_rsa.operator`
          written `0600`, loads via\n  `ssh-keygen -y`\n\nPasses `ansible-playbook
          --syntax-check` and `yamllint -c .yamllint.yml`.\n\n## Scope\n\nDefense-in-depth
          only. It does not address why the key may be empty in\na given configuration,
          and does not cover a stale zero-byte\n`id_rsa.operator` already present
          (callers skip this play when the file\nexists).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-playbooks-manager/pull/52
        commit_id: 1e9eddd5669b9b132fec532619e9d158dacff48c
        patchset: 1e9eddd5669b9b132fec532619e9d158dacff48c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-playbooks-manager
          name: osism/ansible-playbooks-manager
          short_name: ansible-playbooks-manager
          src_dir: src/github.com/osism/ansible-playbooks-manager
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: a2V5cGFpcjogZmFpbCBvbiBlbXB0eSBvcGVyYXRvciBwcml2YXRlIGtleQoKIyMgV2hhdAoKQWRkIGFuIGBhc3NlcnRgIHRvIGBwbGF5Ym9va3Mva2V5cGFpci55bWxgIHRoYXQgZmFpbHMgd2hlbgpgb3BlcmF0b3JfcHJpdmF0ZV9rZXlgIGlzIGVtcHR5L3doaXRlc3BhY2Ugb3IgZG9lcyBub3QgY29udGFpbiBhCmBQUklWQVRFIEtFWWAgbWFya2VyLCBiZWZvcmUgd3JpdGluZyBgaWRfcnNhLm9wZXJhdG9yYC4KCiMjIFdoeQoKYGtleXBhaXIueW1sYCB3cml0ZXMgYG9wZXJhdG9yX3ByaXZhdGVfa2V5YCB2ZXJiYXRpbSB0bwpgaWRfcnNhLm9wZXJhdG9yYC4gV2hlbiBpdCByZXNvbHZlcyB0byBhbiBlbXB0eSBzdHJpbmcg4oCUIGUuZy4gYQpob3N0LXBhdGggYGxvb2t1cCgnZmlsZScsIC4uLilgIHRoYXQgZG9lcyBub3QgZXhpc3QgaW4gdGhlIGV4ZWN1dGlvbgpjb250ZXh0LCBzdWNoIGFzIGluc2lkZSB0aGUgYG9zaXNtL3NlZWRgIGNvbnRhaW5lciDigJQgdGhlIHBsYXkgc2lsZW50bHkKd3JvdGUgYSB6ZXJvLWJ5dGUga2V5LiBUaGUgZmFpbHVyZSB0aGVuIHN1cmZhY2VkIGZhciBkb3duc3RyZWFtIGR1cmluZwp0aGUgbWFuYWdlciBhcHBseSBhcyBhbiBvcGFxdWUgU1NIIGVycm9yOgoKYGBgCkxvYWQga2V5ICIuLi4vaWRfcnNhLm9wZXJhdG9yIjogZXJyb3IgaW4gbGliY3J5cHRvOiB1bnN1cHBvcnRlZAouLi4gUGVybWlzc2lvbiBkZW5pZWQgKHB1YmxpY2tleSkuCmBgYAoKVGhhdCBpcyBPcGVuU1NIJ3MgZ2VuZXJpYyAibm90IGEgcGFyc2VhYmxlIHByaXZhdGUga2V5IiBtZXNzYWdlIGFuZApnaXZlcyBubyBoaW50IHRoYXQgdGhlIHJlYWwgZmF1bHQgaXMgYW4gZW1wdHkga2V5IHdyaXR0ZW4gb25lIHBsYXkKZWFybGllci4gVGhpcyBndWFyZCBmYWlscyBsb3VkbHkgYXQgdGhlIHBvaW50IG9mIHRoZSBhY3R1YWwgZmF1bHQuCgpUaGUgYCdQUklWQVRFIEtFWSdgIHN1YnN0cmluZyBtYXRjaGVzIGJvdGggUEVNIChgQkVHSU4gUlNBIFBSSVZBVEUgS0VZYCwKYEJFR0lOIFBSSVZBVEUgS0VZYCkgYW5kIE9wZW5TU0ggKGBCRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZYCkga2V5cywgc28KYSByZWFsIGtleSBwYXNzZXMgd2hpbGUgZW1wdHkvd2hpdGVzcGFjZS9wbGFjZWhvbGRlciB2YWx1ZXMgZmFpbC4gVGhlCmFzc2VydCByZXBvcnRzIG9ubHkgdGhlIGNvbmRpdGlvbiBleHByZXNzaW9ucywgbm90IHRoZSBrZXkgdmFsdWUsIHNvCnRoZSBrZXkgaXMgbm90IGxlYWtlZCB0byBsb2dzLgoKIyMgVGVzdGluZwoKUmFuIHRoZSBwbGF5IGluIHRoZSBgb3Npc20vc2VlZGAgY29udGFpbmVyIGFnYWluc3QgYSB2YXJzIGZpbGUgKGFzCmBydW4uc2hgIGRvZXMsIGAtZSBAc2VjcmV0cy55bWxgKToKCi0gYG9wZXJhdG9yX3ByaXZhdGVfa2V5OiAiImAg4oaSIGFzc2VydCBmYWlscywgbm8gZmlsZSB3cml0dGVuCi0gYG9wZXJhdG9yX3ByaXZhdGVfa2V5OiBQTEFDRUhPTERFUmAg4oaSIGFzc2VydCBmYWlscywgbm8gZmlsZSB3cml0dGVuCi0gcmVhbCBSU0Ega2V5IOKGkiBwYXNzZXMsIGBpZF9yc2Eub3BlcmF0b3JgIHdyaXR0ZW4gYDA2MDBgLCBsb2FkcyB2aWEKICBgc3NoLWtleWdlbiAteWAKClBhc3NlcyBgYW5zaWJsZS1wbGF5Ym9vayAtLXN5bnRheC1jaGVja2AgYW5kIGB5YW1sbGludCAtYyAueWFtbGxpbnQueW1sYC4KCiMjIFNjb3BlCgpEZWZlbnNlLWluLWRlcHRoIG9ubHkuIEl0IGRvZXMgbm90IGFkZHJlc3Mgd2h5IHRoZSBrZXkgbWF5IGJlIGVtcHR5IGluCmEgZ2l2ZW4gY29uZmlndXJhdGlvbiwgYW5kIGRvZXMgbm90IGNvdmVyIGEgc3RhbGUgemVyby1ieXRlCmBpZF9yc2Eub3BlcmF0b3JgIGFscmVhZHkgcHJlc2VudCAoY2FsbGVycyBza2lwIHRoaXMgcGxheSB3aGVuIHRoZSBmaWxlCmV4aXN0cykuCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQ==
      patchset: 1e9eddd5669b9b132fec532619e9d158dacff48c
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-playbooks-manager
        name: osism/ansible-playbooks-manager
        short_name: ansible-playbooks-manager
        src_dir: src/github.com/osism/ansible-playbooks-manager
      projects:
        github.com/osism/ansible-playbooks-manager:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-playbooks-manager
          checkout: main
          checkout_description: zuul branch
          commit: 629974938668c4ec247fc133b4c570d7fa2f9587
          name: osism/ansible-playbooks-manager
          required: false
          short_name: ansible-playbooks-manager
          src_dir: src/github.com/osism/ansible-playbooks-manager
      ref: refs/pull/52/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
