all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fec2:d004
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: df3be9c2-c715-4c29-9737-dadcac94f722
        host_id: 82101243836454d7401d5893feae9e2c5df7cc291646d8a99b33b53b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fec2:d004
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.161
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.12
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fec2:d004
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-black explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#54>'
      - '<Job python-black explicit: None implied: None source: osism/container-image-osism-ansible/.zuul.yaml@main#106>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 0e9d9653bfd24a168958d3b20393fdc3
      build_refs:
      - branch: main
        change: '765'
        change_message: "hardening: create privsep dir before validate\n\nThe hardening
          role validates its `sshd_config` edits with\n`validate: /usr/sbin/sshd -T
          -f %s`. `sshd -T` does not only parse the candidate\nfile: it also checks
          that the privilege separation directory exists, exiting 255\nwith `Missing
          privilege separation directory` when it does not. That directory is\n`ssh.service`'s
          systemd `RuntimeDirectory`, so it is absent whenever the service\nis stopped
          \u2014 which couples validating a config *file* to live service state.\n\nOn
          Ubuntu 24.04 that coupling bites, because `ssh.socket` is enabled and\n`ssh.service`
          disabled. The service is then legitimately stopped much of the time,\nincluding
          right after an `openssh-server` upgrade, whose postinst stops it and\nleaves
          reachability to the socket. The host is fine \u2014 it keeps listening on
          `:22`,\nand the next inbound connection starts the daemon again and recreates
          the\ndirectory \u2014 but until that happens both `sshd_config` tasks in
          this role fail for a\nreason that has nothing to do with the configuration
          they are validating. Ansible\nreusing a multiplexed connection widens the
          window, because no new connection\narrives to trigger socket activation.\n\nMeasured
          on a live Ubuntu 24.04 host:\n\n| step | `ssh.service` | `/run/sshd` | `sshd
          -T` |\n|---|---|---|---|\n| baseline | active | present | rc 0 |\n| after
          `apt-get install --reinstall openssh-server` | inactive | gone | **rc 255**
          |\n| after `mkdir -p /run/sshd` | inactive | present | rc 0 |\n| after one
          TCP connect to `:22` | active | present | rc 0 |\n\n`:22` kept listening
          throughout, so the host never became unreachable. `sshd -t`,\n`sshd -T`
          and `sshd -t -q` all exit 255, so no flag avoids the check \u2014 creating
          the\ndirectory is the only fix available to the role.\n\n### The patch\n\nCreates
          the directory ahead of the two validating tasks, so validation depends on\nthe
          file alone. It carries the same tag set as the tasks it protects, so no\n`--tags`
          selection can run a validation without the prerequisite, and\n`security_sshd_privsep_dir`
          can be overridden where a platform uses a different\npath (`/var/empty/sshd`
          on RedHat).\n\n### Two constraints worth knowing during review\n\nIt is
          written against the role revision the release pins\n(`ansible_roles.hardening`,
          `e77c311`), not upstream `master`; an earlier draft\nwritten against `master`
          applied only with fuzz.\n\nThe filename sorts **after** `do-not-copy-login-warning-banner.patch`\ndeliberately.
          Both patches edit `tasks/rhel7stig/sshd.yml`, and inserting these\ntasks
          earlier in the file destroys the context that patch depends on. `patch`
          then\nreports `Reversed (or previously applied) patch detected!`, the\n`patch
          --dry-run \u2026 || exit 1` gate fails the image build, and the misleading\nmessage
          invites deleting a patch that is still required \u2014 dropping it would
          start\noverwriting `/etc/motd` with the STIG banner.\n\n### Verification\n\n-
          Image builds with `VERSION=v0.20260615.0`; all four `patches/hardening/*.patch`\n
          \ apply in glob order.\n- `osism apply hardening` on a live Ubuntu 24.04
          node: `ok=76 changed=17 failed=0`,\n  idempotent on re-run, and the `restart
          ssh` handler fired without stranding the\n  host.\n\n- osism/issues#1345\n"
        change_url: https://github.com/osism/container-image-osism-ansible/pull/765
        commit_id: e080d46ea9ee81c604a39b71223bca1cbef65681
        patchset: e080d46ea9ee81c604a39b71223bca1cbef65681
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-osism-ansible
          name: osism/container-image-osism-ansible
          short_name: container-image-osism-ansible
        src_dir: src/github.com/osism/container-image-osism-ansible
        topic: null
      buildset: 873c4df2c25a48f88f3929d2c9a71ee8
      buildset_refs:
      - branch: main
        change: '765'
        change_message: "hardening: create privsep dir before validate\n\nThe hardening
          role validates its `sshd_config` edits with\n`validate: /usr/sbin/sshd -T
          -f %s`. `sshd -T` does not only parse the candidate\nfile: it also checks
          that the privilege separation directory exists, exiting 255\nwith `Missing
          privilege separation directory` when it does not. That directory is\n`ssh.service`'s
          systemd `RuntimeDirectory`, so it is absent whenever the service\nis stopped
          \u2014 which couples validating a config *file* to live service state.\n\nOn
          Ubuntu 24.04 that coupling bites, because `ssh.socket` is enabled and\n`ssh.service`
          disabled. The service is then legitimately stopped much of the time,\nincluding
          right after an `openssh-server` upgrade, whose postinst stops it and\nleaves
          reachability to the socket. The host is fine \u2014 it keeps listening on
          `:22`,\nand the next inbound connection starts the daemon again and recreates
          the\ndirectory \u2014 but until that happens both `sshd_config` tasks in
          this role fail for a\nreason that has nothing to do with the configuration
          they are validating. Ansible\nreusing a multiplexed connection widens the
          window, because no new connection\narrives to trigger socket activation.\n\nMeasured
          on a live Ubuntu 24.04 host:\n\n| step | `ssh.service` | `/run/sshd` | `sshd
          -T` |\n|---|---|---|---|\n| baseline | active | present | rc 0 |\n| after
          `apt-get install --reinstall openssh-server` | inactive | gone | **rc 255**
          |\n| after `mkdir -p /run/sshd` | inactive | present | rc 0 |\n| after one
          TCP connect to `:22` | active | present | rc 0 |\n\n`:22` kept listening
          throughout, so the host never became unreachable. `sshd -t`,\n`sshd -T`
          and `sshd -t -q` all exit 255, so no flag avoids the check \u2014 creating
          the\ndirectory is the only fix available to the role.\n\n### The patch\n\nCreates
          the directory ahead of the two validating tasks, so validation depends on\nthe
          file alone. It carries the same tag set as the tasks it protects, so no\n`--tags`
          selection can run a validation without the prerequisite, and\n`security_sshd_privsep_dir`
          can be overridden where a platform uses a different\npath (`/var/empty/sshd`
          on RedHat).\n\n### Two constraints worth knowing during review\n\nIt is
          written against the role revision the release pins\n(`ansible_roles.hardening`,
          `e77c311`), not upstream `master`; an earlier draft\nwritten against `master`
          applied only with fuzz.\n\nThe filename sorts **after** `do-not-copy-login-warning-banner.patch`\ndeliberately.
          Both patches edit `tasks/rhel7stig/sshd.yml`, and inserting these\ntasks
          earlier in the file destroys the context that patch depends on. `patch`
          then\nreports `Reversed (or previously applied) patch detected!`, the\n`patch
          --dry-run \u2026 || exit 1` gate fails the image build, and the misleading\nmessage
          invites deleting a patch that is still required \u2014 dropping it would
          start\noverwriting `/etc/motd` with the STIG banner.\n\n### Verification\n\n-
          Image builds with `VERSION=v0.20260615.0`; all four `patches/hardening/*.patch`\n
          \ apply in glob order.\n- `osism apply hardening` on a live Ubuntu 24.04
          node: `ok=76 changed=17 failed=0`,\n  idempotent on re-run, and the `restart
          ssh` handler fired without stranding the\n  host.\n\n- osism/issues#1345\n"
        change_url: https://github.com/osism/container-image-osism-ansible/pull/765
        commit_id: e080d46ea9ee81c604a39b71223bca1cbef65681
        patchset: e080d46ea9ee81c604a39b71223bca1cbef65681
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-osism-ansible
          name: osism/container-image-osism-ansible
          short_name: container-image-osism-ansible
        src_dir: src/github.com/osism/container-image-osism-ansible
        topic: null
      change: '765'
      change_message: "hardening: create privsep dir before validate\n\nThe hardening
        role validates its `sshd_config` edits with\n`validate: /usr/sbin/sshd -T
        -f %s`. `sshd -T` does not only parse the candidate\nfile: it also checks
        that the privilege separation directory exists, exiting 255\nwith `Missing
        privilege separation directory` when it does not. That directory is\n`ssh.service`'s
        systemd `RuntimeDirectory`, so it is absent whenever the service\nis stopped
        \u2014 which couples validating a config *file* to live service state.\n\nOn
        Ubuntu 24.04 that coupling bites, because `ssh.socket` is enabled and\n`ssh.service`
        disabled. The service is then legitimately stopped much of the time,\nincluding
        right after an `openssh-server` upgrade, whose postinst stops it and\nleaves
        reachability to the socket. The host is fine \u2014 it keeps listening on
        `:22`,\nand the next inbound connection starts the daemon again and recreates
        the\ndirectory \u2014 but until that happens both `sshd_config` tasks in this
        role fail for a\nreason that has nothing to do with the configuration they
        are validating. Ansible\nreusing a multiplexed connection widens the window,
        because no new connection\narrives to trigger socket activation.\n\nMeasured
        on a live Ubuntu 24.04 host:\n\n| step | `ssh.service` | `/run/sshd` | `sshd
        -T` |\n|---|---|---|---|\n| baseline | active | present | rc 0 |\n| after
        `apt-get install --reinstall openssh-server` | inactive | gone | **rc 255**
        |\n| after `mkdir -p /run/sshd` | inactive | present | rc 0 |\n| after one
        TCP connect to `:22` | active | present | rc 0 |\n\n`:22` kept listening throughout,
        so the host never became unreachable. `sshd -t`,\n`sshd -T` and `sshd -t -q`
        all exit 255, so no flag avoids the check \u2014 creating the\ndirectory is
        the only fix available to the role.\n\n### The patch\n\nCreates the directory
        ahead of the two validating tasks, so validation depends on\nthe file alone.
        It carries the same tag set as the tasks it protects, so no\n`--tags` selection
        can run a validation without the prerequisite, and\n`security_sshd_privsep_dir`
        can be overridden where a platform uses a different\npath (`/var/empty/sshd`
        on RedHat).\n\n### Two constraints worth knowing during review\n\nIt is written
        against the role revision the release pins\n(`ansible_roles.hardening`, `e77c311`),
        not upstream `master`; an earlier draft\nwritten against `master` applied
        only with fuzz.\n\nThe filename sorts **after** `do-not-copy-login-warning-banner.patch`\ndeliberately.
        Both patches edit `tasks/rhel7stig/sshd.yml`, and inserting these\ntasks earlier
        in the file destroys the context that patch depends on. `patch` then\nreports
        `Reversed (or previously applied) patch detected!`, the\n`patch --dry-run
        \u2026 || exit 1` gate fails the image build, and the misleading\nmessage
        invites deleting a patch that is still required \u2014 dropping it would start\noverwriting
        `/etc/motd` with the STIG banner.\n\n### Verification\n\n- Image builds with
        `VERSION=v0.20260615.0`; all four `patches/hardening/*.patch`\n  apply in
        glob order.\n- `osism apply hardening` on a live Ubuntu 24.04 node: `ok=76
        changed=17 failed=0`,\n  idempotent on re-run, and the `restart ssh` handler
        fired without stranding the\n  host.\n\n- osism/issues#1345\n"
      change_url: https://github.com/osism/container-image-osism-ansible/pull/765
      child_jobs: []
      commit_id: e080d46ea9ee81c604a39b71223bca1cbef65681
      event_id: 5c5718b0-8b37-11f1-91ef-f01bd9214c41
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/0e9d9653bfd24a168958d3b20393fdc3/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/0e9d9653bfd24a168958d3b20393fdc3/work/logs
        result_data_file: /var/lib/zuul/builds/0e9d9653bfd24a168958d3b20393fdc3/work/results.json
        src_root: /var/lib/zuul/builds/0e9d9653bfd24a168958d3b20393fdc3/work/src
        work_root: /var/lib/zuul/builds/0e9d9653bfd24a168958d3b20393fdc3/work
      include_vars: []
      items:
      - branch: main
        change: '765'
        change_message: "hardening: create privsep dir before validate\n\nThe hardening
          role validates its `sshd_config` edits with\n`validate: /usr/sbin/sshd -T
          -f %s`. `sshd -T` does not only parse the candidate\nfile: it also checks
          that the privilege separation directory exists, exiting 255\nwith `Missing
          privilege separation directory` when it does not. That directory is\n`ssh.service`'s
          systemd `RuntimeDirectory`, so it is absent whenever the service\nis stopped
          \u2014 which couples validating a config *file* to live service state.\n\nOn
          Ubuntu 24.04 that coupling bites, because `ssh.socket` is enabled and\n`ssh.service`
          disabled. The service is then legitimately stopped much of the time,\nincluding
          right after an `openssh-server` upgrade, whose postinst stops it and\nleaves
          reachability to the socket. The host is fine \u2014 it keeps listening on
          `:22`,\nand the next inbound connection starts the daemon again and recreates
          the\ndirectory \u2014 but until that happens both `sshd_config` tasks in
          this role fail for a\nreason that has nothing to do with the configuration
          they are validating. Ansible\nreusing a multiplexed connection widens the
          window, because no new connection\narrives to trigger socket activation.\n\nMeasured
          on a live Ubuntu 24.04 host:\n\n| step | `ssh.service` | `/run/sshd` | `sshd
          -T` |\n|---|---|---|---|\n| baseline | active | present | rc 0 |\n| after
          `apt-get install --reinstall openssh-server` | inactive | gone | **rc 255**
          |\n| after `mkdir -p /run/sshd` | inactive | present | rc 0 |\n| after one
          TCP connect to `:22` | active | present | rc 0 |\n\n`:22` kept listening
          throughout, so the host never became unreachable. `sshd -t`,\n`sshd -T`
          and `sshd -t -q` all exit 255, so no flag avoids the check \u2014 creating
          the\ndirectory is the only fix available to the role.\n\n### The patch\n\nCreates
          the directory ahead of the two validating tasks, so validation depends on\nthe
          file alone. It carries the same tag set as the tasks it protects, so no\n`--tags`
          selection can run a validation without the prerequisite, and\n`security_sshd_privsep_dir`
          can be overridden where a platform uses a different\npath (`/var/empty/sshd`
          on RedHat).\n\n### Two constraints worth knowing during review\n\nIt is
          written against the role revision the release pins\n(`ansible_roles.hardening`,
          `e77c311`), not upstream `master`; an earlier draft\nwritten against `master`
          applied only with fuzz.\n\nThe filename sorts **after** `do-not-copy-login-warning-banner.patch`\ndeliberately.
          Both patches edit `tasks/rhel7stig/sshd.yml`, and inserting these\ntasks
          earlier in the file destroys the context that patch depends on. `patch`
          then\nreports `Reversed (or previously applied) patch detected!`, the\n`patch
          --dry-run \u2026 || exit 1` gate fails the image build, and the misleading\nmessage
          invites deleting a patch that is still required \u2014 dropping it would
          start\noverwriting `/etc/motd` with the STIG banner.\n\n### Verification\n\n-
          Image builds with `VERSION=v0.20260615.0`; all four `patches/hardening/*.patch`\n
          \ apply in glob order.\n- `osism apply hardening` on a live Ubuntu 24.04
          node: `ok=76 changed=17 failed=0`,\n  idempotent on re-run, and the `restart
          ssh` handler fired without stranding the\n  host.\n\n- osism/issues#1345\n"
        change_url: https://github.com/osism/container-image-osism-ansible/pull/765
        commit_id: e080d46ea9ee81c604a39b71223bca1cbef65681
        patchset: e080d46ea9ee81c604a39b71223bca1cbef65681
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-osism-ansible
          name: osism/container-image-osism-ansible
          short_name: container-image-osism-ansible
          src_dir: src/github.com/osism/container-image-osism-ansible
        topic: null
      job: python-black
      jobtags: []
      max_attempts: 3
      message: aGFyZGVuaW5nOiBjcmVhdGUgcHJpdnNlcCBkaXIgYmVmb3JlIHZhbGlkYXRlCgpUaGUgaGFyZGVuaW5nIHJvbGUgdmFsaWRhdGVzIGl0cyBgc3NoZF9jb25maWdgIGVkaXRzIHdpdGgKYHZhbGlkYXRlOiAvdXNyL3NiaW4vc3NoZCAtVCAtZiAlc2AuIGBzc2hkIC1UYCBkb2VzIG5vdCBvbmx5IHBhcnNlIHRoZSBjYW5kaWRhdGUKZmlsZTogaXQgYWxzbyBjaGVja3MgdGhhdCB0aGUgcHJpdmlsZWdlIHNlcGFyYXRpb24gZGlyZWN0b3J5IGV4aXN0cywgZXhpdGluZyAyNTUKd2l0aCBgTWlzc2luZyBwcml2aWxlZ2Ugc2VwYXJhdGlvbiBkaXJlY3RvcnlgIHdoZW4gaXQgZG9lcyBub3QuIFRoYXQgZGlyZWN0b3J5IGlzCmBzc2guc2VydmljZWAncyBzeXN0ZW1kIGBSdW50aW1lRGlyZWN0b3J5YCwgc28gaXQgaXMgYWJzZW50IHdoZW5ldmVyIHRoZSBzZXJ2aWNlCmlzIHN0b3BwZWQg4oCUIHdoaWNoIGNvdXBsZXMgdmFsaWRhdGluZyBhIGNvbmZpZyAqZmlsZSogdG8gbGl2ZSBzZXJ2aWNlIHN0YXRlLgoKT24gVWJ1bnR1IDI0LjA0IHRoYXQgY291cGxpbmcgYml0ZXMsIGJlY2F1c2UgYHNzaC5zb2NrZXRgIGlzIGVuYWJsZWQgYW5kCmBzc2guc2VydmljZWAgZGlzYWJsZWQuIFRoZSBzZXJ2aWNlIGlzIHRoZW4gbGVnaXRpbWF0ZWx5IHN0b3BwZWQgbXVjaCBvZiB0aGUgdGltZSwKaW5jbHVkaW5nIHJpZ2h0IGFmdGVyIGFuIGBvcGVuc3NoLXNlcnZlcmAgdXBncmFkZSwgd2hvc2UgcG9zdGluc3Qgc3RvcHMgaXQgYW5kCmxlYXZlcyByZWFjaGFiaWxpdHkgdG8gdGhlIHNvY2tldC4gVGhlIGhvc3QgaXMgZmluZSDigJQgaXQga2VlcHMgbGlzdGVuaW5nIG9uIGA6MjJgLAphbmQgdGhlIG5leHQgaW5ib3VuZCBjb25uZWN0aW9uIHN0YXJ0cyB0aGUgZGFlbW9uIGFnYWluIGFuZCByZWNyZWF0ZXMgdGhlCmRpcmVjdG9yeSDigJQgYnV0IHVudGlsIHRoYXQgaGFwcGVucyBib3RoIGBzc2hkX2NvbmZpZ2AgdGFza3MgaW4gdGhpcyByb2xlIGZhaWwgZm9yIGEKcmVhc29uIHRoYXQgaGFzIG5vdGhpbmcgdG8gZG8gd2l0aCB0aGUgY29uZmlndXJhdGlvbiB0aGV5IGFyZSB2YWxpZGF0aW5nLiBBbnNpYmxlCnJldXNpbmcgYSBtdWx0aXBsZXhlZCBjb25uZWN0aW9uIHdpZGVucyB0aGUgd2luZG93LCBiZWNhdXNlIG5vIG5ldyBjb25uZWN0aW9uCmFycml2ZXMgdG8gdHJpZ2dlciBzb2NrZXQgYWN0aXZhdGlvbi4KCk1lYXN1cmVkIG9uIGEgbGl2ZSBVYnVudHUgMjQuMDQgaG9zdDoKCnwgc3RlcCB8IGBzc2guc2VydmljZWAgfCBgL3J1bi9zc2hkYCB8IGBzc2hkIC1UYCB8CnwtLS18LS0tfC0tLXwtLS18CnwgYmFzZWxpbmUgfCBhY3RpdmUgfCBwcmVzZW50IHwgcmMgMCB8CnwgYWZ0ZXIgYGFwdC1nZXQgaW5zdGFsbCAtLXJlaW5zdGFsbCBvcGVuc3NoLXNlcnZlcmAgfCBpbmFjdGl2ZSB8IGdvbmUgfCAqKnJjIDI1NSoqIHwKfCBhZnRlciBgbWtkaXIgLXAgL3J1bi9zc2hkYCB8IGluYWN0aXZlIHwgcHJlc2VudCB8IHJjIDAgfAp8IGFmdGVyIG9uZSBUQ1AgY29ubmVjdCB0byBgOjIyYCB8IGFjdGl2ZSB8IHByZXNlbnQgfCByYyAwIHwKCmA6MjJgIGtlcHQgbGlzdGVuaW5nIHRocm91Z2hvdXQsIHNvIHRoZSBob3N0IG5ldmVyIGJlY2FtZSB1bnJlYWNoYWJsZS4gYHNzaGQgLXRgLApgc3NoZCAtVGAgYW5kIGBzc2hkIC10IC1xYCBhbGwgZXhpdCAyNTUsIHNvIG5vIGZsYWcgYXZvaWRzIHRoZSBjaGVjayDigJQgY3JlYXRpbmcgdGhlCmRpcmVjdG9yeSBpcyB0aGUgb25seSBmaXggYXZhaWxhYmxlIHRvIHRoZSByb2xlLgoKIyMjIFRoZSBwYXRjaAoKQ3JlYXRlcyB0aGUgZGlyZWN0b3J5IGFoZWFkIG9mIHRoZSB0d28gdmFsaWRhdGluZyB0YXNrcywgc28gdmFsaWRhdGlvbiBkZXBlbmRzIG9uCnRoZSBmaWxlIGFsb25lLiBJdCBjYXJyaWVzIHRoZSBzYW1lIHRhZyBzZXQgYXMgdGhlIHRhc2tzIGl0IHByb3RlY3RzLCBzbyBubwpgLS10YWdzYCBzZWxlY3Rpb24gY2FuIHJ1biBhIHZhbGlkYXRpb24gd2l0aG91dCB0aGUgcHJlcmVxdWlzaXRlLCBhbmQKYHNlY3VyaXR5X3NzaGRfcHJpdnNlcF9kaXJgIGNhbiBiZSBvdmVycmlkZGVuIHdoZXJlIGEgcGxhdGZvcm0gdXNlcyBhIGRpZmZlcmVudApwYXRoIChgL3Zhci9lbXB0eS9zc2hkYCBvbiBSZWRIYXQpLgoKIyMjIFR3byBjb25zdHJhaW50cyB3b3J0aCBrbm93aW5nIGR1cmluZyByZXZpZXcKCkl0IGlzIHdyaXR0ZW4gYWdhaW5zdCB0aGUgcm9sZSByZXZpc2lvbiB0aGUgcmVsZWFzZSBwaW5zCihgYW5zaWJsZV9yb2xlcy5oYXJkZW5pbmdgLCBgZTc3YzMxMWApLCBub3QgdXBzdHJlYW0gYG1hc3RlcmA7IGFuIGVhcmxpZXIgZHJhZnQKd3JpdHRlbiBhZ2FpbnN0IGBtYXN0ZXJgIGFwcGxpZWQgb25seSB3aXRoIGZ1enouCgpUaGUgZmlsZW5hbWUgc29ydHMgKiphZnRlcioqIGBkby1ub3QtY29weS1sb2dpbi13YXJuaW5nLWJhbm5lci5wYXRjaGAKZGVsaWJlcmF0ZWx5LiBCb3RoIHBhdGNoZXMgZWRpdCBgdGFza3MvcmhlbDdzdGlnL3NzaGQueW1sYCwgYW5kIGluc2VydGluZyB0aGVzZQp0YXNrcyBlYXJsaWVyIGluIHRoZSBmaWxlIGRlc3Ryb3lzIHRoZSBjb250ZXh0IHRoYXQgcGF0Y2ggZGVwZW5kcyBvbi4gYHBhdGNoYCB0aGVuCnJlcG9ydHMgYFJldmVyc2VkIChvciBwcmV2aW91c2x5IGFwcGxpZWQpIHBhdGNoIGRldGVjdGVkIWAsIHRoZQpgcGF0Y2ggLS1kcnktcnVuIOKApiB8fCBleGl0IDFgIGdhdGUgZmFpbHMgdGhlIGltYWdlIGJ1aWxkLCBhbmQgdGhlIG1pc2xlYWRpbmcKbWVzc2FnZSBpbnZpdGVzIGRlbGV0aW5nIGEgcGF0Y2ggdGhhdCBpcyBzdGlsbCByZXF1aXJlZCDigJQgZHJvcHBpbmcgaXQgd291bGQgc3RhcnQKb3ZlcndyaXRpbmcgYC9ldGMvbW90ZGAgd2l0aCB0aGUgU1RJRyBiYW5uZXIuCgojIyMgVmVyaWZpY2F0aW9uCgotIEltYWdlIGJ1aWxkcyB3aXRoIGBWRVJTSU9OPXYwLjIwMjYwNjE1LjBgOyBhbGwgZm91ciBgcGF0Y2hlcy9oYXJkZW5pbmcvKi5wYXRjaGAKICBhcHBseSBpbiBnbG9iIG9yZGVyLgotIGBvc2lzbSBhcHBseSBoYXJkZW5pbmdgIG9uIGEgbGl2ZSBVYnVudHUgMjQuMDQgbm9kZTogYG9rPTc2IGNoYW5nZWQ9MTcgZmFpbGVkPTBgLAogIGlkZW1wb3RlbnQgb24gcmUtcnVuLCBhbmQgdGhlIGByZXN0YXJ0IHNzaGAgaGFuZGxlciBmaXJlZCB3aXRob3V0IHN0cmFuZGluZyB0aGUKICBob3N0LgoKLSBvc2lzbS9pc3N1ZXMjMTM0NQo=
      patchset: e080d46ea9ee81c604a39b71223bca1cbef65681
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/python-black/run.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-image-osism-ansible
        name: osism/container-image-osism-ansible
        short_name: container-image-osism-ansible
        src_dir: src/github.com/osism/container-image-osism-ansible
      projects:
        github.com/osism/container-image-osism-ansible:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-osism-ansible
          checkout: main
          checkout_description: zuul branch
          commit: fff534ea8e21ac8f2f3d65d9c778594b6f845974
          name: osism/container-image-osism-ansible
          required: false
          short_name: container-image-osism-ansible
          src_dir: src/github.com/osism/container-image-osism-ansible
      ref: refs/pull/765/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
