all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe9e:3c50
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 703e9b28-c02a-43ca-9929-1b25e1a55866
        host_id: 4ba4344415ca7057d9956ea5de826bbc0b830981e82c0e0f191fa07b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe9e:3c50
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.102
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.167
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe9e:3c50
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/k8s-capi-images/.zuul.yaml@main#243>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 0b51aab701754422a136764a594cc4c1
      build_refs:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. QEMU runs in pure software
          emulation (`-accel tcg`, no KVM) so it works regardless of whether the CI
          node exposes `/dev/kvm` \u2014 adding `-enable-kvm` later is a pure speed
          optimization.\n\n## Change set, in commit order\n\n1. **`6167045` Add QEMU
          boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`5a89427` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`e2863fb` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`e4d069f`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay/TCG boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: e4d069f5949271679d19c75727163d296b24a62a
        patchset: e4d069f5949271679d19c75727163d296b24a62a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      buildset: 798cc81d7c3b4e9ea63896ca0db840fb
      buildset_refs:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. QEMU runs in pure software
          emulation (`-accel tcg`, no KVM) so it works regardless of whether the CI
          node exposes `/dev/kvm` \u2014 adding `-enable-kvm` later is a pure speed
          optimization.\n\n## Change set, in commit order\n\n1. **`6167045` Add QEMU
          boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`5a89427` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`e2863fb` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`e4d069f`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay/TCG boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: e4d069f5949271679d19c75727163d296b24a62a
        patchset: e4d069f5949271679d19c75727163d296b24a62a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      change: '339'
      change_message: "Validate built CAPI images with goss (reuse upstream image-builder
        specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
        Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
        uses \u2014 by booting the image and running `goss validate` inside it, so
        an image that diverges from what upstream produces is caught before it can
        be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
        and live sysctl checks need a real init system, so an offline chroot can't
        cover them. The image is therefore booted under QEMU and goss runs inside
        the guest. To keep the published artifact bit-identical, the VM boots a disposable
        copy-on-write overlay whose backing file is the built qcow2 (all guest writes
        land in the throwaway overlay); the build's checksum is re-verified afterwards
        to prove the artifact was untouched. QEMU runs in pure software emulation
        (`-accel tcg`, no KVM) so it works regardless of whether the CI node exposes
        `/dev/kvm` \u2014 adding `-enable-kvm` later is a pure speed optimization.\n\n##
        Change set, in commit order\n\n1. **`6167045` Add QEMU boot and cloud-init
        seed tooling to the build host** \u2014 `playbooks/pre.yml` installs `qemu-system-x86`
        (boots the image) and `cloud-image-utils` (provides `cloud-localds` for the
        NoCloud seed ISO). `qemu-utils` already supplied `qemu-img` for the overlay.\n\n2.
        **`d8bb2b6` Add goss `--vars-inline` renderer from image-builder config**
        \u2014 `scripts/render-goss-vars.py` reproduces the `vars_inline` object that
        upstream's Packer goss provisioner feeds the spec, by merging `packer/config/*.json`
        in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
        and applying the per-build override last. Required keys are asserted so a
        stale config layout fails loudly instead of running a silently degraded validation.\n\n3.
        **`5a89427` Validate built CAPI images with goss in a QEMU overlay boot**
        \u2014 `playbooks/validate.yml`: boots the overlay, seeds it with cloud-init,
        re-clones the goss spec from image-builder at the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF`
        the build uses (not vendored, to avoid drift), runs the pinned-and-checksummed
        `goss` 0.3.23 inside the VM, and fails the build on any failed assertion.
        The JSON report and console log are saved under `zuul-output/logs/`; the overlay,
        seed, and clone are cleaned up on every exit path, and the `always:` teardown
        re-verifies the artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
        `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
        speculative `.zuul.yaml` changes.\n\n4. **`e2863fb` Wire goss validation into
        Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
        to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
        and the `-gardener` variants) validate after building, and the still-commented
        publish jobs inherit it. The arming comment is updated: because the upload
        tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
        arming publish must relocate them into a new `playbooks/publish.yml` appended
        *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`e4d069f`
        Document the goss image-validation step** \u2014 adds a \"Validating images\"
        section to `README.md` (overlay/TCG boot, bit-identical artifact + checksum
        re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
        cross-references it from `elements/k8s-capi/README.rst`, which notes the element
        deliberately drops image-builder's Packer-only goss plumbing.\n\n## Notes
        for the reviewer\n\n- Validation lives in the shared abstract job, so it is
        inherited by the publish jobs even though they remain commented out; publishing
        is not armed by this PR.\n- The goss spec is re-cloned (not vendored) to honor
        the existing supply-chain model; both the spec ref and the goss binary are
        pinned the same way the build already pins its inputs.\n- No divergence from
        the issue was observed in the commits: the work reuses the upstream image-builder
        goss specs as #338 asks, with the booted-VM overlay approach chosen specifically
        so service/sysctl checks pass while the published image stays untouched.\n\n---\n\n_Implemented
        by [planwerk-agent](https://github.com/planwerk/planwerk-agent) 84299e2 with
        Claude:claude-opus-4-8_\n"
      change_url: https://github.com/osism/k8s-capi-images/pull/339
      child_jobs: []
      commit_id: e4d069f5949271679d19c75727163d296b24a62a
      event_id: 8ddf7510-7400-11f1-8a9e-873fabf779bf
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/0b51aab701754422a136764a594cc4c1/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/0b51aab701754422a136764a594cc4c1/work/logs
        result_data_file: /var/lib/zuul/builds/0b51aab701754422a136764a594cc4c1/work/results.json
        src_root: /var/lib/zuul/builds/0b51aab701754422a136764a594cc4c1/work/src
        work_root: /var/lib/zuul/builds/0b51aab701754422a136764a594cc4c1/work
      include_vars: []
      items:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. QEMU runs in pure software
          emulation (`-accel tcg`, no KVM) so it works regardless of whether the CI
          node exposes `/dev/kvm` \u2014 adding `-enable-kvm` later is a pure speed
          optimization.\n\n## Change set, in commit order\n\n1. **`6167045` Add QEMU
          boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`5a89427` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`e2863fb` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`e4d069f`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay/TCG boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: e4d069f5949271679d19c75727163d296b24a62a
        patchset: e4d069f5949271679d19c75727163d296b24a62a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
          src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: VmFsaWRhdGUgYnVpbHQgQ0FQSSBpbWFnZXMgd2l0aCBnb3NzIChyZXVzZSB1cHN0cmVhbSBpbWFnZS1idWlsZGVyIHNwZWNzKQoKQ2xvc2VzICMzMzgKClZhbGlkYXRlIGV2ZXJ5IGJ1aWx0IENBUEkgaW1hZ2UgYWdhaW5zdCB0aGUgdXBzdHJlYW0gSW1hZ2UgQnVpbGRlciBnb3NzIHNwZWMg4oCUIHRoZSBzYW1lIHNwZWMgW2t1YmVybmV0ZXMtc2lncy9pbWFnZS1idWlsZGVyXShodHRwczovL2dpdGh1Yi5jb20va3ViZXJuZXRlcy1zaWdzL2ltYWdlLWJ1aWxkZXIvKSB1c2VzIOKAlCBieSBib290aW5nIHRoZSBpbWFnZSBhbmQgcnVubmluZyBgZ29zcyB2YWxpZGF0ZWAgaW5zaWRlIGl0LCBzbyBhbiBpbWFnZSB0aGF0IGRpdmVyZ2VzIGZyb20gd2hhdCB1cHN0cmVhbSBwcm9kdWNlcyBpcyBjYXVnaHQgYmVmb3JlIGl0IGNhbiBiZSBwdWJsaXNoZWQuCgojIyBXaHkgYSBib290ZWQgVk0gcmF0aGVyIHRoYW4gYSBjaHJvb3QKClNlcnZpY2UtcnVubmluZyBhbmQgbGl2ZSBzeXNjdGwgY2hlY2tzIG5lZWQgYSByZWFsIGluaXQgc3lzdGVtLCBzbyBhbiBvZmZsaW5lIGNocm9vdCBjYW4ndCBjb3ZlciB0aGVtLiBUaGUgaW1hZ2UgaXMgdGhlcmVmb3JlIGJvb3RlZCB1bmRlciBRRU1VIGFuZCBnb3NzIHJ1bnMgaW5zaWRlIHRoZSBndWVzdC4gVG8ga2VlcCB0aGUgcHVibGlzaGVkIGFydGlmYWN0IGJpdC1pZGVudGljYWwsIHRoZSBWTSBib290cyBhIGRpc3Bvc2FibGUgY29weS1vbi13cml0ZSBvdmVybGF5IHdob3NlIGJhY2tpbmcgZmlsZSBpcyB0aGUgYnVpbHQgcWNvdzIgKGFsbCBndWVzdCB3cml0ZXMgbGFuZCBpbiB0aGUgdGhyb3dhd2F5IG92ZXJsYXkpOyB0aGUgYnVpbGQncyBjaGVja3N1bSBpcyByZS12ZXJpZmllZCBhZnRlcndhcmRzIHRvIHByb3ZlIHRoZSBhcnRpZmFjdCB3YXMgdW50b3VjaGVkLiBRRU1VIHJ1bnMgaW4gcHVyZSBzb2Z0d2FyZSBlbXVsYXRpb24gKGAtYWNjZWwgdGNnYCwgbm8gS1ZNKSBzbyBpdCB3b3JrcyByZWdhcmRsZXNzIG9mIHdoZXRoZXIgdGhlIENJIG5vZGUgZXhwb3NlcyBgL2Rldi9rdm1gIOKAlCBhZGRpbmcgYC1lbmFibGUta3ZtYCBsYXRlciBpcyBhIHB1cmUgc3BlZWQgb3B0aW1pemF0aW9uLgoKIyMgQ2hhbmdlIHNldCwgaW4gY29tbWl0IG9yZGVyCgoxLiAqKmA2MTY3MDQ1YCBBZGQgUUVNVSBib290IGFuZCBjbG91ZC1pbml0IHNlZWQgdG9vbGluZyB0byB0aGUgYnVpbGQgaG9zdCoqIOKAlCBgcGxheWJvb2tzL3ByZS55bWxgIGluc3RhbGxzIGBxZW11LXN5c3RlbS14ODZgIChib290cyB0aGUgaW1hZ2UpIGFuZCBgY2xvdWQtaW1hZ2UtdXRpbHNgIChwcm92aWRlcyBgY2xvdWQtbG9jYWxkc2AgZm9yIHRoZSBOb0Nsb3VkIHNlZWQgSVNPKS4gYHFlbXUtdXRpbHNgIGFscmVhZHkgc3VwcGxpZWQgYHFlbXUtaW1nYCBmb3IgdGhlIG92ZXJsYXkuCgoyLiAqKmBkOGJiMmI2YCBBZGQgZ29zcyBgLS12YXJzLWlubGluZWAgcmVuZGVyZXIgZnJvbSBpbWFnZS1idWlsZGVyIGNvbmZpZyoqIOKAlCBgc2NyaXB0cy9yZW5kZXItZ29zcy12YXJzLnB5YCByZXByb2R1Y2VzIHRoZSBgdmFyc19pbmxpbmVgIG9iamVjdCB0aGF0IHVwc3RyZWFtJ3MgUGFja2VyIGdvc3MgcHJvdmlzaW9uZXIgZmVlZHMgdGhlIHNwZWMsIGJ5IG1lcmdpbmcgYHBhY2tlci9jb25maWcvKi5qc29uYCBpbiB0aGUgc2FtZSBmaXhlZCBvcmRlciBhcyBgZWxlbWVudHMvazhzLWNhcGkvaW5zdGFsbC5kLzYwLXJ1bi1pbWFnZS1idWlsZGVyYCBhbmQgYXBwbHlpbmcgdGhlIHBlci1idWlsZCBvdmVycmlkZSBsYXN0LiBSZXF1aXJlZCBrZXlzIGFyZSBhc3NlcnRlZCBzbyBhIHN0YWxlIGNvbmZpZyBsYXlvdXQgZmFpbHMgbG91ZGx5IGluc3RlYWQgb2YgcnVubmluZyBhIHNpbGVudGx5IGRlZ3JhZGVkIHZhbGlkYXRpb24uCgozLiAqKmA1YTg5NDI3YCBWYWxpZGF0ZSBidWlsdCBDQVBJIGltYWdlcyB3aXRoIGdvc3MgaW4gYSBRRU1VIG92ZXJsYXkgYm9vdCoqIOKAlCBgcGxheWJvb2tzL3ZhbGlkYXRlLnltbGA6IGJvb3RzIHRoZSBvdmVybGF5LCBzZWVkcyBpdCB3aXRoIGNsb3VkLWluaXQsIHJlLWNsb25lcyB0aGUgZ29zcyBzcGVjIGZyb20gaW1hZ2UtYnVpbGRlciBhdCB0aGUgc2FtZSBTSEEtcGlubmVkIGBESUJfSzhTX0lNQUdFX0JVSUxERVJfUkVGYCB0aGUgYnVpbGQgdXNlcyAobm90IHZlbmRvcmVkLCB0byBhdm9pZCBkcmlmdCksIHJ1bnMgdGhlIHBpbm5lZC1hbmQtY2hlY2tzdW1tZWQgYGdvc3NgIDAuMy4yMyBpbnNpZGUgdGhlIFZNLCBhbmQgZmFpbHMgdGhlIGJ1aWxkIG9uIGFueSBmYWlsZWQgYXNzZXJ0aW9uLiBUaGUgSlNPTiByZXBvcnQgYW5kIGNvbnNvbGUgbG9nIGFyZSBzYXZlZCB1bmRlciBgenV1bC1vdXRwdXQvbG9ncy9gOyB0aGUgb3ZlcmxheSwgc2VlZCwgYW5kIGNsb25lIGFyZSBjbGVhbmVkIHVwIG9uIGV2ZXJ5IGV4aXQgcGF0aCwgYW5kIHRoZSBgYWx3YXlzOmAgdGVhcmRvd24gcmUtdmVyaWZpZXMgdGhlIGFydGlmYWN0IGNoZWNrc3VtLiBKb2IgdmFycyB0aGF0IGZsb3cgaW50byBmaWxlIHBhdGhzIChga3ViZXJuZXRlc192ZXJzaW9uYCwgYHZhcmlhbnRgKSBhcmUgdmFsaWRhdGVkIGFnYWluc3QgYFtBLVphLXowLTkuXy1dYCB1cCBmcm9udCB0byBndWFyZCBhZ2FpbnN0IHNwZWN1bGF0aXZlIGAuenV1bC55YW1sYCBjaGFuZ2VzLgoKNC4gKipgZTI4NjNmYmAgV2lyZSBnb3NzIHZhbGlkYXRpb24gaW50byBadXVsIGJ1aWxkIGFuZCBwdWJsaXNoIGdhdGluZyoqIOKAlCBgLnp1dWwueWFtbGAgYXBwZW5kcyBgcGxheWJvb2tzL3ZhbGlkYXRlLnltbGAgdG8gdGhlIGFic3RyYWN0IGJ1aWxkIGpvYidzIGBydW5gIGxpc3QsIHNvIGFsbCBlaWdodCBjaGVjayBqb2JzICh2MS4zM+KAk3YxLjM2IGFuZCB0aGUgYC1nYXJkZW5lcmAgdmFyaWFudHMpIHZhbGlkYXRlIGFmdGVyIGJ1aWxkaW5nLCBhbmQgdGhlIHN0aWxsLWNvbW1lbnRlZCBwdWJsaXNoIGpvYnMgaW5oZXJpdCBpdC4gVGhlIGFybWluZyBjb21tZW50IGlzIHVwZGF0ZWQ6IGJlY2F1c2UgdGhlIHVwbG9hZCB0YXNrcyBjdXJyZW50bHkgc2l0IGF0IHRoZSB0YWlsIG9mIGBidWlsZC55bWxgICh3aGljaCBydW5zICpiZWZvcmUqIGB2YWxpZGF0ZS55bWxgKSwgYXJtaW5nIHB1Ymxpc2ggbXVzdCByZWxvY2F0ZSB0aGVtIGludG8gYSBuZXcgYHBsYXlib29rcy9wdWJsaXNoLnltbGAgYXBwZW5kZWQgKmFmdGVyKiBgdmFsaWRhdGUueW1sYCwgc28gYSBmYWlsZWQgdmFsaWRhdGlvbiBnYXRlcyB1cGxvYWQuCgo1LiAqKmBlNGQwNjlmYCBEb2N1bWVudCB0aGUgZ29zcyBpbWFnZS12YWxpZGF0aW9uIHN0ZXAqKiDigJQgYWRkcyBhICJWYWxpZGF0aW5nIGltYWdlcyIgc2VjdGlvbiB0byBgUkVBRE1FLm1kYCAob3ZlcmxheS9UQ0cgYm9vdCwgYml0LWlkZW50aWNhbCBhcnRpZmFjdCArIGNoZWNrc3VtIHJlLXZlcmlmaWNhdGlvbiwgU0hBLXBpbm5lZCBzcGVjIHJldXNlLCBmYWlsZWQtYXNzZXJ0aW9uLWZhaWxzLWJ1aWxkKSBhbmQgY3Jvc3MtcmVmZXJlbmNlcyBpdCBmcm9tIGBlbGVtZW50cy9rOHMtY2FwaS9SRUFETUUucnN0YCwgd2hpY2ggbm90ZXMgdGhlIGVsZW1lbnQgZGVsaWJlcmF0ZWx5IGRyb3BzIGltYWdlLWJ1aWxkZXIncyBQYWNrZXItb25seSBnb3NzIHBsdW1iaW5nLgoKIyMgTm90ZXMgZm9yIHRoZSByZXZpZXdlcgoKLSBWYWxpZGF0aW9uIGxpdmVzIGluIHRoZSBzaGFyZWQgYWJzdHJhY3Qgam9iLCBzbyBpdCBpcyBpbmhlcml0ZWQgYnkgdGhlIHB1Ymxpc2ggam9icyBldmVuIHRob3VnaCB0aGV5IHJlbWFpbiBjb21tZW50ZWQgb3V0OyBwdWJsaXNoaW5nIGlzIG5vdCBhcm1lZCBieSB0aGlzIFBSLgotIFRoZSBnb3NzIHNwZWMgaXMgcmUtY2xvbmVkIChub3QgdmVuZG9yZWQpIHRvIGhvbm9yIHRoZSBleGlzdGluZyBzdXBwbHktY2hhaW4gbW9kZWw7IGJvdGggdGhlIHNwZWMgcmVmIGFuZCB0aGUgZ29zcyBiaW5hcnkgYXJlIHBpbm5lZCB0aGUgc2FtZSB3YXkgdGhlIGJ1aWxkIGFscmVhZHkgcGlucyBpdHMgaW5wdXRzLgotIE5vIGRpdmVyZ2VuY2UgZnJvbSB0aGUgaXNzdWUgd2FzIG9ic2VydmVkIGluIHRoZSBjb21taXRzOiB0aGUgd29yayByZXVzZXMgdGhlIHVwc3RyZWFtIGltYWdlLWJ1aWxkZXIgZ29zcyBzcGVjcyBhcyAjMzM4IGFza3MsIHdpdGggdGhlIGJvb3RlZC1WTSBvdmVybGF5IGFwcHJvYWNoIGNob3NlbiBzcGVjaWZpY2FsbHkgc28gc2VydmljZS9zeXNjdGwgY2hlY2tzIHBhc3Mgd2hpbGUgdGhlIHB1Ymxpc2hlZCBpbWFnZSBzdGF5cyB1bnRvdWNoZWQuCgotLS0KCl9JbXBsZW1lbnRlZCBieSBbcGxhbndlcmstYWdlbnRdKGh0dHBzOi8vZ2l0aHViLmNvbS9wbGFud2Vyay9wbGFud2Vyay1hZ2VudCkgODQyOTllMiB3aXRoIENsYXVkZTpjbGF1ZGUtb3B1cy00LThfCg==
      patchset: e4d069f5949271679d19c75727163d296b24a62a
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/k8s-capi-images
        name: osism/k8s-capi-images
        short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
      projects:
        github.com/osism/k8s-capi-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          checkout: main
          checkout_description: zuul branch
          commit: bc7a29d4b8a07159928f137b25fd0131d802a520
          name: osism/k8s-capi-images
          required: false
          short_name: k8s-capi-images
          src_dir: src/github.com/osism/k8s-capi-images
      ref: refs/pull/339/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
