all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe22:a3d8
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 18f57a23-510c-44bd-aebf-7618a61af5f2
        host_id: 7f2607eceb24f4583c6f9496c53c64b51afe50de5eacda4379b21c42
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe22:a3d8
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.167
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.42
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe22:a3d8
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-osism-integration-tests explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/python-osism/.zuul.yaml@main#138>'
      - '<Job python-osism-integration-tests explicit: None implied: None source:
        osism/python-osism/.zuul.yaml@main#143>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 1e90acf5d2144d2fabacdde989e0fc2d
      build_refs:
      - branch: main
        change: '2337'
        change_message: "sonic: Restrict SSH to the OOB management network\n\nCloses
          #2329\n\n## What this does\n\nGenerates, per switch, a SONiC control-plane
          ACL (handled by `caclmgrd`) that permits SSH only from the device's OOB
          management subnet. Once a `CTRLPLANE` table binds the `SSH` service, caclmgrd
          installs an implicit default-drop for it, so front-panel / in-band interfaces
          with IPs in the default VRF can no longer reach TCP/22.\n\n## Walkthrough
          (commit order)\n\n1. **`sonic: Take ownership of ACL_TABLE and ACL_RULE
          on regen`** \u2014 registers both tables in `ON_DEMAND_OWNED_TABLE_KEYS`
          (feeding `OWNED_TABLE_KEYS`), so base-config content is dropped up front
          and the tables are rebuilt from scratch on every regen. The on-demand registry
          was chosen over `TOP_LEVEL_SCAFFOLD_KEYS` so the tables are entirely **absent**
          when nothing emits them (no empty `{}` scaffold entries). Includes an orchestrator
          test pinning that stale ACL entries carried over from `config_db.json` do
          not survive a regen without an OOB IP. The existing exhaustive ownership
          test (`test_generate_sonic_config_every_owned_table_drops_stale_entries`)
          picks the new keys up automatically.\n\n2. **`sonic: Restrict SSH to the
          OOB management network`** \u2014 adds `_add_ssh_acl_configuration(config,
          device, oob_ip_result)`, called from `generate_sonic_config` in the management-interface
          block, only when an OOB IP exists. The permitted subnet is derived from
          the same `get_device_oob_ip` result used for `MGMT_INTERFACE`, normalised
          to the network address via `IPv4Network(..., strict=False)`. Emits exactly
          the shape from the issue:\n   - `ACL_TABLE[\"SSH_ONLY\"]` \u2014 `type:
          CTRLPLANE`, `services: [\"SSH\"]`\n   - `ACL_RULE[\"SSH_ONLY|RULE_1\"]`
          \u2014 `PRIORITY 9999`, `PACKET_ACTION ACCEPT`, `SRC_IP <oob_network>/<prefix>`,
          `IP_TYPE IP`\n\n   Tests: helper-level (table/rule shape, network normalisation
          incl. non-octet boundary, wholesale replacement of pre-existing entries)
          plus orchestrator glue (called with the full OOB result when present, not
          called and tables absent when not).\n\n## Notes for the reviewer\n\n- Only
          the device's own OOB subnet is permitted \u2014 no metalbox/gateway or central
          admin networks (per the issue, this iteration).\n- When no OOB IP is present,
          no ACL is emitted and SSH is not locked down (per the issue, to be revisited
          if needed).\n- `ACL_TABLE`/`ACL_RULE` are not in the generated pydantic
          schema set (`_generated/_schemas.py` only models `DASH_ACL_*`), so the validator
          reports them as warnings, not errors. Adding the `sonic-acl` YANG model
          is deferred (relates to #2258).\n- SNMP/GNMI control-plane ACLs are #2330;
          the helper and owned-table wiring added here are the shared mechanism it
          can build on.\n- No CHANGELOG edit \u2014 this repo batches changelog entries
          in release PRs.\n\nAI-assisted: Claude Code"
        change_url: https://github.com/osism/python-osism/pull/2337
        commit_id: 5239e9849d3ad8160edacf3db1537fa329a44856
        patchset: 5239e9849d3ad8160edacf3db1537fa329a44856
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      buildset: 6daec110075b4e4c95a869b15aa79670
      buildset_refs:
      - branch: main
        change: '2337'
        change_message: "sonic: Restrict SSH to the OOB management network\n\nCloses
          #2329\n\n## What this does\n\nGenerates, per switch, a SONiC control-plane
          ACL (handled by `caclmgrd`) that permits SSH only from the device's OOB
          management subnet. Once a `CTRLPLANE` table binds the `SSH` service, caclmgrd
          installs an implicit default-drop for it, so front-panel / in-band interfaces
          with IPs in the default VRF can no longer reach TCP/22.\n\n## Walkthrough
          (commit order)\n\n1. **`sonic: Take ownership of ACL_TABLE and ACL_RULE
          on regen`** \u2014 registers both tables in `ON_DEMAND_OWNED_TABLE_KEYS`
          (feeding `OWNED_TABLE_KEYS`), so base-config content is dropped up front
          and the tables are rebuilt from scratch on every regen. The on-demand registry
          was chosen over `TOP_LEVEL_SCAFFOLD_KEYS` so the tables are entirely **absent**
          when nothing emits them (no empty `{}` scaffold entries). Includes an orchestrator
          test pinning that stale ACL entries carried over from `config_db.json` do
          not survive a regen without an OOB IP. The existing exhaustive ownership
          test (`test_generate_sonic_config_every_owned_table_drops_stale_entries`)
          picks the new keys up automatically.\n\n2. **`sonic: Restrict SSH to the
          OOB management network`** \u2014 adds `_add_ssh_acl_configuration(config,
          device, oob_ip_result)`, called from `generate_sonic_config` in the management-interface
          block, only when an OOB IP exists. The permitted subnet is derived from
          the same `get_device_oob_ip` result used for `MGMT_INTERFACE`, normalised
          to the network address via `IPv4Network(..., strict=False)`. Emits exactly
          the shape from the issue:\n   - `ACL_TABLE[\"SSH_ONLY\"]` \u2014 `type:
          CTRLPLANE`, `services: [\"SSH\"]`\n   - `ACL_RULE[\"SSH_ONLY|RULE_1\"]`
          \u2014 `PRIORITY 9999`, `PACKET_ACTION ACCEPT`, `SRC_IP <oob_network>/<prefix>`,
          `IP_TYPE IP`\n\n   Tests: helper-level (table/rule shape, network normalisation
          incl. non-octet boundary, wholesale replacement of pre-existing entries)
          plus orchestrator glue (called with the full OOB result when present, not
          called and tables absent when not).\n\n## Notes for the reviewer\n\n- Only
          the device's own OOB subnet is permitted \u2014 no metalbox/gateway or central
          admin networks (per the issue, this iteration).\n- When no OOB IP is present,
          no ACL is emitted and SSH is not locked down (per the issue, to be revisited
          if needed).\n- `ACL_TABLE`/`ACL_RULE` are not in the generated pydantic
          schema set (`_generated/_schemas.py` only models `DASH_ACL_*`), so the validator
          reports them as warnings, not errors. Adding the `sonic-acl` YANG model
          is deferred (relates to #2258).\n- SNMP/GNMI control-plane ACLs are #2330;
          the helper and owned-table wiring added here are the shared mechanism it
          can build on.\n- No CHANGELOG edit \u2014 this repo batches changelog entries
          in release PRs.\n\nAI-assisted: Claude Code"
        change_url: https://github.com/osism/python-osism/pull/2337
        commit_id: 5239e9849d3ad8160edacf3db1537fa329a44856
        patchset: 5239e9849d3ad8160edacf3db1537fa329a44856
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      change: '2337'
      change_message: "sonic: Restrict SSH to the OOB management network\n\nCloses
        #2329\n\n## What this does\n\nGenerates, per switch, a SONiC control-plane
        ACL (handled by `caclmgrd`) that permits SSH only from the device's OOB management
        subnet. Once a `CTRLPLANE` table binds the `SSH` service, caclmgrd installs
        an implicit default-drop for it, so front-panel / in-band interfaces with
        IPs in the default VRF can no longer reach TCP/22.\n\n## Walkthrough (commit
        order)\n\n1. **`sonic: Take ownership of ACL_TABLE and ACL_RULE on regen`**
        \u2014 registers both tables in `ON_DEMAND_OWNED_TABLE_KEYS` (feeding `OWNED_TABLE_KEYS`),
        so base-config content is dropped up front and the tables are rebuilt from
        scratch on every regen. The on-demand registry was chosen over `TOP_LEVEL_SCAFFOLD_KEYS`
        so the tables are entirely **absent** when nothing emits them (no empty `{}`
        scaffold entries). Includes an orchestrator test pinning that stale ACL entries
        carried over from `config_db.json` do not survive a regen without an OOB IP.
        The existing exhaustive ownership test (`test_generate_sonic_config_every_owned_table_drops_stale_entries`)
        picks the new keys up automatically.\n\n2. **`sonic: Restrict SSH to the OOB
        management network`** \u2014 adds `_add_ssh_acl_configuration(config, device,
        oob_ip_result)`, called from `generate_sonic_config` in the management-interface
        block, only when an OOB IP exists. The permitted subnet is derived from the
        same `get_device_oob_ip` result used for `MGMT_INTERFACE`, normalised to the
        network address via `IPv4Network(..., strict=False)`. Emits exactly the shape
        from the issue:\n   - `ACL_TABLE[\"SSH_ONLY\"]` \u2014 `type: CTRLPLANE`,
        `services: [\"SSH\"]`\n   - `ACL_RULE[\"SSH_ONLY|RULE_1\"]` \u2014 `PRIORITY
        9999`, `PACKET_ACTION ACCEPT`, `SRC_IP <oob_network>/<prefix>`, `IP_TYPE IP`\n\n
        \  Tests: helper-level (table/rule shape, network normalisation incl. non-octet
        boundary, wholesale replacement of pre-existing entries) plus orchestrator
        glue (called with the full OOB result when present, not called and tables
        absent when not).\n\n## Notes for the reviewer\n\n- Only the device's own
        OOB subnet is permitted \u2014 no metalbox/gateway or central admin networks
        (per the issue, this iteration).\n- When no OOB IP is present, no ACL is emitted
        and SSH is not locked down (per the issue, to be revisited if needed).\n-
        `ACL_TABLE`/`ACL_RULE` are not in the generated pydantic schema set (`_generated/_schemas.py`
        only models `DASH_ACL_*`), so the validator reports them as warnings, not
        errors. Adding the `sonic-acl` YANG model is deferred (relates to #2258).\n-
        SNMP/GNMI control-plane ACLs are #2330; the helper and owned-table wiring
        added here are the shared mechanism it can build on.\n- No CHANGELOG edit
        \u2014 this repo batches changelog entries in release PRs.\n\nAI-assisted:
        Claude Code"
      change_url: https://github.com/osism/python-osism/pull/2337
      child_jobs: []
      commit_id: 5239e9849d3ad8160edacf3db1537fa329a44856
      event_id: 327bef90-8117-11f1-966d-2888cae95394
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/1e90acf5d2144d2fabacdde989e0fc2d/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/1e90acf5d2144d2fabacdde989e0fc2d/work/logs
        result_data_file: /var/lib/zuul/builds/1e90acf5d2144d2fabacdde989e0fc2d/work/results.json
        src_root: /var/lib/zuul/builds/1e90acf5d2144d2fabacdde989e0fc2d/work/src
        work_root: /var/lib/zuul/builds/1e90acf5d2144d2fabacdde989e0fc2d/work
      include_vars: []
      items:
      - branch: main
        change: '2337'
        change_message: "sonic: Restrict SSH to the OOB management network\n\nCloses
          #2329\n\n## What this does\n\nGenerates, per switch, a SONiC control-plane
          ACL (handled by `caclmgrd`) that permits SSH only from the device's OOB
          management subnet. Once a `CTRLPLANE` table binds the `SSH` service, caclmgrd
          installs an implicit default-drop for it, so front-panel / in-band interfaces
          with IPs in the default VRF can no longer reach TCP/22.\n\n## Walkthrough
          (commit order)\n\n1. **`sonic: Take ownership of ACL_TABLE and ACL_RULE
          on regen`** \u2014 registers both tables in `ON_DEMAND_OWNED_TABLE_KEYS`
          (feeding `OWNED_TABLE_KEYS`), so base-config content is dropped up front
          and the tables are rebuilt from scratch on every regen. The on-demand registry
          was chosen over `TOP_LEVEL_SCAFFOLD_KEYS` so the tables are entirely **absent**
          when nothing emits them (no empty `{}` scaffold entries). Includes an orchestrator
          test pinning that stale ACL entries carried over from `config_db.json` do
          not survive a regen without an OOB IP. The existing exhaustive ownership
          test (`test_generate_sonic_config_every_owned_table_drops_stale_entries`)
          picks the new keys up automatically.\n\n2. **`sonic: Restrict SSH to the
          OOB management network`** \u2014 adds `_add_ssh_acl_configuration(config,
          device, oob_ip_result)`, called from `generate_sonic_config` in the management-interface
          block, only when an OOB IP exists. The permitted subnet is derived from
          the same `get_device_oob_ip` result used for `MGMT_INTERFACE`, normalised
          to the network address via `IPv4Network(..., strict=False)`. Emits exactly
          the shape from the issue:\n   - `ACL_TABLE[\"SSH_ONLY\"]` \u2014 `type:
          CTRLPLANE`, `services: [\"SSH\"]`\n   - `ACL_RULE[\"SSH_ONLY|RULE_1\"]`
          \u2014 `PRIORITY 9999`, `PACKET_ACTION ACCEPT`, `SRC_IP <oob_network>/<prefix>`,
          `IP_TYPE IP`\n\n   Tests: helper-level (table/rule shape, network normalisation
          incl. non-octet boundary, wholesale replacement of pre-existing entries)
          plus orchestrator glue (called with the full OOB result when present, not
          called and tables absent when not).\n\n## Notes for the reviewer\n\n- Only
          the device's own OOB subnet is permitted \u2014 no metalbox/gateway or central
          admin networks (per the issue, this iteration).\n- When no OOB IP is present,
          no ACL is emitted and SSH is not locked down (per the issue, to be revisited
          if needed).\n- `ACL_TABLE`/`ACL_RULE` are not in the generated pydantic
          schema set (`_generated/_schemas.py` only models `DASH_ACL_*`), so the validator
          reports them as warnings, not errors. Adding the `sonic-acl` YANG model
          is deferred (relates to #2258).\n- SNMP/GNMI control-plane ACLs are #2330;
          the helper and owned-table wiring added here are the shared mechanism it
          can build on.\n- No CHANGELOG edit \u2014 this repo batches changelog entries
          in release PRs.\n\nAI-assisted: Claude Code"
        change_url: https://github.com/osism/python-osism/pull/2337
        commit_id: 5239e9849d3ad8160edacf3db1537fa329a44856
        patchset: 5239e9849d3ad8160edacf3db1537fa329a44856
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
        topic: null
      job: python-osism-integration-tests
      jobtags: []
      max_attempts: 3
      message: c29uaWM6IFJlc3RyaWN0IFNTSCB0byB0aGUgT09CIG1hbmFnZW1lbnQgbmV0d29yawoKQ2xvc2VzICMyMzI5CgojIyBXaGF0IHRoaXMgZG9lcwoKR2VuZXJhdGVzLCBwZXIgc3dpdGNoLCBhIFNPTmlDIGNvbnRyb2wtcGxhbmUgQUNMIChoYW5kbGVkIGJ5IGBjYWNsbWdyZGApIHRoYXQgcGVybWl0cyBTU0ggb25seSBmcm9tIHRoZSBkZXZpY2UncyBPT0IgbWFuYWdlbWVudCBzdWJuZXQuIE9uY2UgYSBgQ1RSTFBMQU5FYCB0YWJsZSBiaW5kcyB0aGUgYFNTSGAgc2VydmljZSwgY2FjbG1ncmQgaW5zdGFsbHMgYW4gaW1wbGljaXQgZGVmYXVsdC1kcm9wIGZvciBpdCwgc28gZnJvbnQtcGFuZWwgLyBpbi1iYW5kIGludGVyZmFjZXMgd2l0aCBJUHMgaW4gdGhlIGRlZmF1bHQgVlJGIGNhbiBubyBsb25nZXIgcmVhY2ggVENQLzIyLgoKIyMgV2Fsa3Rocm91Z2ggKGNvbW1pdCBvcmRlcikKCjEuICoqYHNvbmljOiBUYWtlIG93bmVyc2hpcCBvZiBBQ0xfVEFCTEUgYW5kIEFDTF9SVUxFIG9uIHJlZ2VuYCoqIOKAlCByZWdpc3RlcnMgYm90aCB0YWJsZXMgaW4gYE9OX0RFTUFORF9PV05FRF9UQUJMRV9LRVlTYCAoZmVlZGluZyBgT1dORURfVEFCTEVfS0VZU2ApLCBzbyBiYXNlLWNvbmZpZyBjb250ZW50IGlzIGRyb3BwZWQgdXAgZnJvbnQgYW5kIHRoZSB0YWJsZXMgYXJlIHJlYnVpbHQgZnJvbSBzY3JhdGNoIG9uIGV2ZXJ5IHJlZ2VuLiBUaGUgb24tZGVtYW5kIHJlZ2lzdHJ5IHdhcyBjaG9zZW4gb3ZlciBgVE9QX0xFVkVMX1NDQUZGT0xEX0tFWVNgIHNvIHRoZSB0YWJsZXMgYXJlIGVudGlyZWx5ICoqYWJzZW50Kiogd2hlbiBub3RoaW5nIGVtaXRzIHRoZW0gKG5vIGVtcHR5IGB7fWAgc2NhZmZvbGQgZW50cmllcykuIEluY2x1ZGVzIGFuIG9yY2hlc3RyYXRvciB0ZXN0IHBpbm5pbmcgdGhhdCBzdGFsZSBBQ0wgZW50cmllcyBjYXJyaWVkIG92ZXIgZnJvbSBgY29uZmlnX2RiLmpzb25gIGRvIG5vdCBzdXJ2aXZlIGEgcmVnZW4gd2l0aG91dCBhbiBPT0IgSVAuIFRoZSBleGlzdGluZyBleGhhdXN0aXZlIG93bmVyc2hpcCB0ZXN0IChgdGVzdF9nZW5lcmF0ZV9zb25pY19jb25maWdfZXZlcnlfb3duZWRfdGFibGVfZHJvcHNfc3RhbGVfZW50cmllc2ApIHBpY2tzIHRoZSBuZXcga2V5cyB1cCBhdXRvbWF0aWNhbGx5LgoKMi4gKipgc29uaWM6IFJlc3RyaWN0IFNTSCB0byB0aGUgT09CIG1hbmFnZW1lbnQgbmV0d29ya2AqKiDigJQgYWRkcyBgX2FkZF9zc2hfYWNsX2NvbmZpZ3VyYXRpb24oY29uZmlnLCBkZXZpY2UsIG9vYl9pcF9yZXN1bHQpYCwgY2FsbGVkIGZyb20gYGdlbmVyYXRlX3NvbmljX2NvbmZpZ2AgaW4gdGhlIG1hbmFnZW1lbnQtaW50ZXJmYWNlIGJsb2NrLCBvbmx5IHdoZW4gYW4gT09CIElQIGV4aXN0cy4gVGhlIHBlcm1pdHRlZCBzdWJuZXQgaXMgZGVyaXZlZCBmcm9tIHRoZSBzYW1lIGBnZXRfZGV2aWNlX29vYl9pcGAgcmVzdWx0IHVzZWQgZm9yIGBNR01UX0lOVEVSRkFDRWAsIG5vcm1hbGlzZWQgdG8gdGhlIG5ldHdvcmsgYWRkcmVzcyB2aWEgYElQdjROZXR3b3JrKC4uLiwgc3RyaWN0PUZhbHNlKWAuIEVtaXRzIGV4YWN0bHkgdGhlIHNoYXBlIGZyb20gdGhlIGlzc3VlOgogICAtIGBBQ0xfVEFCTEVbIlNTSF9PTkxZIl1gIOKAlCBgdHlwZTogQ1RSTFBMQU5FYCwgYHNlcnZpY2VzOiBbIlNTSCJdYAogICAtIGBBQ0xfUlVMRVsiU1NIX09OTFl8UlVMRV8xIl1gIOKAlCBgUFJJT1JJVFkgOTk5OWAsIGBQQUNLRVRfQUNUSU9OIEFDQ0VQVGAsIGBTUkNfSVAgPG9vYl9uZXR3b3JrPi88cHJlZml4PmAsIGBJUF9UWVBFIElQYAoKICAgVGVzdHM6IGhlbHBlci1sZXZlbCAodGFibGUvcnVsZSBzaGFwZSwgbmV0d29yayBub3JtYWxpc2F0aW9uIGluY2wuIG5vbi1vY3RldCBib3VuZGFyeSwgd2hvbGVzYWxlIHJlcGxhY2VtZW50IG9mIHByZS1leGlzdGluZyBlbnRyaWVzKSBwbHVzIG9yY2hlc3RyYXRvciBnbHVlIChjYWxsZWQgd2l0aCB0aGUgZnVsbCBPT0IgcmVzdWx0IHdoZW4gcHJlc2VudCwgbm90IGNhbGxlZCBhbmQgdGFibGVzIGFic2VudCB3aGVuIG5vdCkuCgojIyBOb3RlcyBmb3IgdGhlIHJldmlld2VyCgotIE9ubHkgdGhlIGRldmljZSdzIG93biBPT0Igc3VibmV0IGlzIHBlcm1pdHRlZCDigJQgbm8gbWV0YWxib3gvZ2F0ZXdheSBvciBjZW50cmFsIGFkbWluIG5ldHdvcmtzIChwZXIgdGhlIGlzc3VlLCB0aGlzIGl0ZXJhdGlvbikuCi0gV2hlbiBubyBPT0IgSVAgaXMgcHJlc2VudCwgbm8gQUNMIGlzIGVtaXR0ZWQgYW5kIFNTSCBpcyBub3QgbG9ja2VkIGRvd24gKHBlciB0aGUgaXNzdWUsIHRvIGJlIHJldmlzaXRlZCBpZiBuZWVkZWQpLgotIGBBQ0xfVEFCTEVgL2BBQ0xfUlVMRWAgYXJlIG5vdCBpbiB0aGUgZ2VuZXJhdGVkIHB5ZGFudGljIHNjaGVtYSBzZXQgKGBfZ2VuZXJhdGVkL19zY2hlbWFzLnB5YCBvbmx5IG1vZGVscyBgREFTSF9BQ0xfKmApLCBzbyB0aGUgdmFsaWRhdG9yIHJlcG9ydHMgdGhlbSBhcyB3YXJuaW5ncywgbm90IGVycm9ycy4gQWRkaW5nIHRoZSBgc29uaWMtYWNsYCBZQU5HIG1vZGVsIGlzIGRlZmVycmVkIChyZWxhdGVzIHRvICMyMjU4KS4KLSBTTk1QL0dOTUkgY29udHJvbC1wbGFuZSBBQ0xzIGFyZSAjMjMzMDsgdGhlIGhlbHBlciBhbmQgb3duZWQtdGFibGUgd2lyaW5nIGFkZGVkIGhlcmUgYXJlIHRoZSBzaGFyZWQgbWVjaGFuaXNtIGl0IGNhbiBidWlsZCBvbi4KLSBObyBDSEFOR0VMT0cgZWRpdCDigJQgdGhpcyByZXBvIGJhdGNoZXMgY2hhbmdlbG9nIGVudHJpZXMgaW4gcmVsZWFzZSBQUnMuCgpBSS1hc3Npc3RlZDogQ2xhdWRlIENvZGU=
      patchset: 5239e9849d3ad8160edacf3db1537fa329a44856
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/python-osism:
            canonical_name: github.com/osism/python-osism
            checkout: main
            commit: 9ec6b8c6d663e2ff96b7aaa9fa541444cd7a74f5
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
        playbooks:
        - path: untrusted/project_0/github.com/osism/python-osism/playbooks/test-integration.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/python-osism
        name: osism/python-osism
        short_name: python-osism
        src_dir: src/github.com/osism/python-osism
      projects:
        github.com/osism/python-osism:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          checkout: main
          checkout_description: zuul branch
          commit: 9ec6b8c6d663e2ff96b7aaa9fa541444cd7a74f5
          name: osism/python-osism
          required: false
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
      ref: refs/pull/2337/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
