all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe44:4c94
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 4b176b71-3d4d-4966-b188-326306cd6e83
        host_id: 5afd8fc909abddfe2ce3a956a91bbe56629648b7209fd0acfa541862
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe44:4c94
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.174
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.18
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe44:4c94
        region: null
        slot: null
      tox_environment:
        NOSE_HTML_OUT_FILE: nose_results.html
        NOSE_WITH_HTML_OUTPUT: 1
        NOSE_WITH_XUNIT: 1
      tox_envlist: drift-test
  vars:
    tox_environment:
      NOSE_HTML_OUT_FILE: nose_results.html
      NOSE_WITH_HTML_OUTPUT: 1
      NOSE_WITH_XUNIT: 1
    tox_envlist: drift-test
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job unittests explicit: None implied: {MatchAny:{ImpliedBranchMatcher:master}}
        source: osism/openinfra-zuul-jobs/zuul.d/general-jobs.yaml@master#9>'
      - '<Job tox explicit: None implied: {MatchAny:{ImpliedBranchMatcher:master}}
        source: osism/openinfra-zuul-jobs/zuul.d/python-jobs.yaml@master#1>'
      - '<Job release-tox-drift-test explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/release/.zuul.yaml@main#2>'
      - '<Job release-tox-drift-test explicit: None implied: None source: osism/release/.zuul.yaml@main#14>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 10140d881a704605b286819e5a5261b4
      build_refs:
      - branch: main
        change: '2576'
        change_message: "archive: extract safe symlinks on old Python\n\n## Problem\n\nThe
          daily `release-tox-drift` job (periodic-daily pipeline) has been failing
          since the release repo was added as a fetched source. It crashes during
          source fetching, not on detected drift:\n\n```\nsource error: unsafe archive
          member (link/special): osism-release-a2e4875/1.0.0/ceph.yml\ndrift: exit
          2 ... evaluation failed :(\n```\n\n`_safe_extract` downloads each source
          repo as a GitHub tarball and extracts it. When `tarfile.data_filter` is
          available (Python 3.11.4+ / 3.12+) it extracts with `filter=\"data\"`, which
          permits relative symlinks that stay inside the extraction directory. The
          manual fallback for older Pythons rejected **every** symlink member outright
          \u2014 stricter than the `data` filter it was meant to emulate.\n\nThe Zuul
          node runs **Python 3.11.2**, which predates the `data_filter` backport,
          so it takes the fallback path. The release repo contains ~80 legitimate
          relative symlinks (per-version `ceph.yml` / `openstack.yml` aliases), so
          extraction aborted on the first one. Local runs and `release-tox-drift-test`
          never caught this because their interpreters have `data_filter`.\n\n## Fix\n\nMake
          the fallback emulate the `data` filter: permit symlinks/hardlinks whose
          target resolves inside the extraction root, keep rejecting links that escape
          (absolute or via `..`) and any other special member. The final `extractall`
          is made version-robust (`filter=\"fully_trusted\"` where supported, plain
          `extractall` otherwise) so it behaves identically on old and new interpreters.\n\n##
          Verification\n\n- New regression test reproduces the exact CI error, then
          passes with the fix; the existing absolute-symlink rejection test is retained.\n-
          Full suite: 332 passed. flake8 + black clean.\n- End-to-end: forcing the
          no-`data_filter` path and extracting an archive built from the real release
          tree now succeeds (6 symlinks resolved) where it previously raised.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2576
        commit_id: ab568b32863dce7e7d300f3ed0d2654baba088a0
        patchset: ab568b32863dce7e7d300f3ed0d2654baba088a0
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 9a5933db707c482cae17fb53474efa7f
      buildset_refs:
      - branch: main
        change: '2576'
        change_message: "archive: extract safe symlinks on old Python\n\n## Problem\n\nThe
          daily `release-tox-drift` job (periodic-daily pipeline) has been failing
          since the release repo was added as a fetched source. It crashes during
          source fetching, not on detected drift:\n\n```\nsource error: unsafe archive
          member (link/special): osism-release-a2e4875/1.0.0/ceph.yml\ndrift: exit
          2 ... evaluation failed :(\n```\n\n`_safe_extract` downloads each source
          repo as a GitHub tarball and extracts it. When `tarfile.data_filter` is
          available (Python 3.11.4+ / 3.12+) it extracts with `filter=\"data\"`, which
          permits relative symlinks that stay inside the extraction directory. The
          manual fallback for older Pythons rejected **every** symlink member outright
          \u2014 stricter than the `data` filter it was meant to emulate.\n\nThe Zuul
          node runs **Python 3.11.2**, which predates the `data_filter` backport,
          so it takes the fallback path. The release repo contains ~80 legitimate
          relative symlinks (per-version `ceph.yml` / `openstack.yml` aliases), so
          extraction aborted on the first one. Local runs and `release-tox-drift-test`
          never caught this because their interpreters have `data_filter`.\n\n## Fix\n\nMake
          the fallback emulate the `data` filter: permit symlinks/hardlinks whose
          target resolves inside the extraction root, keep rejecting links that escape
          (absolute or via `..`) and any other special member. The final `extractall`
          is made version-robust (`filter=\"fully_trusted\"` where supported, plain
          `extractall` otherwise) so it behaves identically on old and new interpreters.\n\n##
          Verification\n\n- New regression test reproduces the exact CI error, then
          passes with the fix; the existing absolute-symlink rejection test is retained.\n-
          Full suite: 332 passed. flake8 + black clean.\n- End-to-end: forcing the
          no-`data_filter` path and extracting an archive built from the real release
          tree now succeeds (6 symlinks resolved) where it previously raised.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2576
        commit_id: ab568b32863dce7e7d300f3ed0d2654baba088a0
        patchset: ab568b32863dce7e7d300f3ed0d2654baba088a0
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2576'
      change_message: "archive: extract safe symlinks on old Python\n\n## Problem\n\nThe
        daily `release-tox-drift` job (periodic-daily pipeline) has been failing since
        the release repo was added as a fetched source. It crashes during source fetching,
        not on detected drift:\n\n```\nsource error: unsafe archive member (link/special):
        osism-release-a2e4875/1.0.0/ceph.yml\ndrift: exit 2 ... evaluation failed
        :(\n```\n\n`_safe_extract` downloads each source repo as a GitHub tarball
        and extracts it. When `tarfile.data_filter` is available (Python 3.11.4+ /
        3.12+) it extracts with `filter=\"data\"`, which permits relative symlinks
        that stay inside the extraction directory. The manual fallback for older Pythons
        rejected **every** symlink member outright \u2014 stricter than the `data`
        filter it was meant to emulate.\n\nThe Zuul node runs **Python 3.11.2**, which
        predates the `data_filter` backport, so it takes the fallback path. The release
        repo contains ~80 legitimate relative symlinks (per-version `ceph.yml` / `openstack.yml`
        aliases), so extraction aborted on the first one. Local runs and `release-tox-drift-test`
        never caught this because their interpreters have `data_filter`.\n\n## Fix\n\nMake
        the fallback emulate the `data` filter: permit symlinks/hardlinks whose target
        resolves inside the extraction root, keep rejecting links that escape (absolute
        or via `..`) and any other special member. The final `extractall` is made
        version-robust (`filter=\"fully_trusted\"` where supported, plain `extractall`
        otherwise) so it behaves identically on old and new interpreters.\n\n## Verification\n\n-
        New regression test reproduces the exact CI error, then passes with the fix;
        the existing absolute-symlink rejection test is retained.\n- Full suite: 332
        passed. flake8 + black clean.\n- End-to-end: forcing the no-`data_filter`
        path and extracting an archive built from the real release tree now succeeds
        (6 symlinks resolved) where it previously raised.\n\n\U0001F916 Generated
        with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/release/pull/2576
      child_jobs: []
      commit_id: ab568b32863dce7e7d300f3ed0d2654baba088a0
      event_id: 98b71300-7c87-11f1-81ac-787bdce7a051
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/10140d881a704605b286819e5a5261b4/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/10140d881a704605b286819e5a5261b4/work/logs
        result_data_file: /var/lib/zuul/builds/10140d881a704605b286819e5a5261b4/work/results.json
        src_root: /var/lib/zuul/builds/10140d881a704605b286819e5a5261b4/work/src
        work_root: /var/lib/zuul/builds/10140d881a704605b286819e5a5261b4/work
      include_vars: []
      items:
      - branch: main
        change: '2576'
        change_message: "archive: extract safe symlinks on old Python\n\n## Problem\n\nThe
          daily `release-tox-drift` job (periodic-daily pipeline) has been failing
          since the release repo was added as a fetched source. It crashes during
          source fetching, not on detected drift:\n\n```\nsource error: unsafe archive
          member (link/special): osism-release-a2e4875/1.0.0/ceph.yml\ndrift: exit
          2 ... evaluation failed :(\n```\n\n`_safe_extract` downloads each source
          repo as a GitHub tarball and extracts it. When `tarfile.data_filter` is
          available (Python 3.11.4+ / 3.12+) it extracts with `filter=\"data\"`, which
          permits relative symlinks that stay inside the extraction directory. The
          manual fallback for older Pythons rejected **every** symlink member outright
          \u2014 stricter than the `data` filter it was meant to emulate.\n\nThe Zuul
          node runs **Python 3.11.2**, which predates the `data_filter` backport,
          so it takes the fallback path. The release repo contains ~80 legitimate
          relative symlinks (per-version `ceph.yml` / `openstack.yml` aliases), so
          extraction aborted on the first one. Local runs and `release-tox-drift-test`
          never caught this because their interpreters have `data_filter`.\n\n## Fix\n\nMake
          the fallback emulate the `data` filter: permit symlinks/hardlinks whose
          target resolves inside the extraction root, keep rejecting links that escape
          (absolute or via `..`) and any other special member. The final `extractall`
          is made version-robust (`filter=\"fully_trusted\"` where supported, plain
          `extractall` otherwise) so it behaves identically on old and new interpreters.\n\n##
          Verification\n\n- New regression test reproduces the exact CI error, then
          passes with the fix; the existing absolute-symlink rejection test is retained.\n-
          Full suite: 332 passed. flake8 + black clean.\n- End-to-end: forcing the
          no-`data_filter` path and extracting an archive built from the real release
          tree now succeeds (6 symlinks resolved) where it previously raised.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2576
        commit_id: ab568b32863dce7e7d300f3ed0d2654baba088a0
        patchset: ab568b32863dce7e7d300f3ed0d2654baba088a0
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: release-tox-drift-test
      jobtags: []
      max_attempts: 3
      message: YXJjaGl2ZTogZXh0cmFjdCBzYWZlIHN5bWxpbmtzIG9uIG9sZCBQeXRob24KCiMjIFByb2JsZW0KClRoZSBkYWlseSBgcmVsZWFzZS10b3gtZHJpZnRgIGpvYiAocGVyaW9kaWMtZGFpbHkgcGlwZWxpbmUpIGhhcyBiZWVuIGZhaWxpbmcgc2luY2UgdGhlIHJlbGVhc2UgcmVwbyB3YXMgYWRkZWQgYXMgYSBmZXRjaGVkIHNvdXJjZS4gSXQgY3Jhc2hlcyBkdXJpbmcgc291cmNlIGZldGNoaW5nLCBub3Qgb24gZGV0ZWN0ZWQgZHJpZnQ6CgpgYGAKc291cmNlIGVycm9yOiB1bnNhZmUgYXJjaGl2ZSBtZW1iZXIgKGxpbmsvc3BlY2lhbCk6IG9zaXNtLXJlbGVhc2UtYTJlNDg3NS8xLjAuMC9jZXBoLnltbApkcmlmdDogZXhpdCAyIC4uLiBldmFsdWF0aW9uIGZhaWxlZCA6KApgYGAKCmBfc2FmZV9leHRyYWN0YCBkb3dubG9hZHMgZWFjaCBzb3VyY2UgcmVwbyBhcyBhIEdpdEh1YiB0YXJiYWxsIGFuZCBleHRyYWN0cyBpdC4gV2hlbiBgdGFyZmlsZS5kYXRhX2ZpbHRlcmAgaXMgYXZhaWxhYmxlIChQeXRob24gMy4xMS40KyAvIDMuMTIrKSBpdCBleHRyYWN0cyB3aXRoIGBmaWx0ZXI9ImRhdGEiYCwgd2hpY2ggcGVybWl0cyByZWxhdGl2ZSBzeW1saW5rcyB0aGF0IHN0YXkgaW5zaWRlIHRoZSBleHRyYWN0aW9uIGRpcmVjdG9yeS4gVGhlIG1hbnVhbCBmYWxsYmFjayBmb3Igb2xkZXIgUHl0aG9ucyByZWplY3RlZCAqKmV2ZXJ5Kiogc3ltbGluayBtZW1iZXIgb3V0cmlnaHQg4oCUIHN0cmljdGVyIHRoYW4gdGhlIGBkYXRhYCBmaWx0ZXIgaXQgd2FzIG1lYW50IHRvIGVtdWxhdGUuCgpUaGUgWnV1bCBub2RlIHJ1bnMgKipQeXRob24gMy4xMS4yKiosIHdoaWNoIHByZWRhdGVzIHRoZSBgZGF0YV9maWx0ZXJgIGJhY2twb3J0LCBzbyBpdCB0YWtlcyB0aGUgZmFsbGJhY2sgcGF0aC4gVGhlIHJlbGVhc2UgcmVwbyBjb250YWlucyB+ODAgbGVnaXRpbWF0ZSByZWxhdGl2ZSBzeW1saW5rcyAocGVyLXZlcnNpb24gYGNlcGgueW1sYCAvIGBvcGVuc3RhY2sueW1sYCBhbGlhc2VzKSwgc28gZXh0cmFjdGlvbiBhYm9ydGVkIG9uIHRoZSBmaXJzdCBvbmUuIExvY2FsIHJ1bnMgYW5kIGByZWxlYXNlLXRveC1kcmlmdC10ZXN0YCBuZXZlciBjYXVnaHQgdGhpcyBiZWNhdXNlIHRoZWlyIGludGVycHJldGVycyBoYXZlIGBkYXRhX2ZpbHRlcmAuCgojIyBGaXgKCk1ha2UgdGhlIGZhbGxiYWNrIGVtdWxhdGUgdGhlIGBkYXRhYCBmaWx0ZXI6IHBlcm1pdCBzeW1saW5rcy9oYXJkbGlua3Mgd2hvc2UgdGFyZ2V0IHJlc29sdmVzIGluc2lkZSB0aGUgZXh0cmFjdGlvbiByb290LCBrZWVwIHJlamVjdGluZyBsaW5rcyB0aGF0IGVzY2FwZSAoYWJzb2x1dGUgb3IgdmlhIGAuLmApIGFuZCBhbnkgb3RoZXIgc3BlY2lhbCBtZW1iZXIuIFRoZSBmaW5hbCBgZXh0cmFjdGFsbGAgaXMgbWFkZSB2ZXJzaW9uLXJvYnVzdCAoYGZpbHRlcj0iZnVsbHlfdHJ1c3RlZCJgIHdoZXJlIHN1cHBvcnRlZCwgcGxhaW4gYGV4dHJhY3RhbGxgIG90aGVyd2lzZSkgc28gaXQgYmVoYXZlcyBpZGVudGljYWxseSBvbiBvbGQgYW5kIG5ldyBpbnRlcnByZXRlcnMuCgojIyBWZXJpZmljYXRpb24KCi0gTmV3IHJlZ3Jlc3Npb24gdGVzdCByZXByb2R1Y2VzIHRoZSBleGFjdCBDSSBlcnJvciwgdGhlbiBwYXNzZXMgd2l0aCB0aGUgZml4OyB0aGUgZXhpc3RpbmcgYWJzb2x1dGUtc3ltbGluayByZWplY3Rpb24gdGVzdCBpcyByZXRhaW5lZC4KLSBGdWxsIHN1aXRlOiAzMzIgcGFzc2VkLiBmbGFrZTggKyBibGFjayBjbGVhbi4KLSBFbmQtdG8tZW5kOiBmb3JjaW5nIHRoZSBuby1gZGF0YV9maWx0ZXJgIHBhdGggYW5kIGV4dHJhY3RpbmcgYW4gYXJjaGl2ZSBidWlsdCBmcm9tIHRoZSByZWFsIHJlbGVhc2UgdHJlZSBub3cgc3VjY2VlZHMgKDYgc3ltbGlua3MgcmVzb2x2ZWQpIHdoZXJlIGl0IHByZXZpb3VzbHkgcmFpc2VkLgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: ab568b32863dce7e7d300f3ed0d2654baba088a0
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
        playbooks:
        - path: untrusted/project_0/github.com/osism/openinfra-zuul-jobs/playbooks/tox/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_0/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_2/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 92dee83a2ce58e98383913bad6455d4a94a49a59
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2576/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
