all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe20:8115
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: a822900c-a0fe-45a3-a66b-d614e6fbb548
        host_id: 82101243836454d7401d5893feae9e2c5df7cc291646d8a99b33b53b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe20:8115
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.44
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.54
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe20:8115
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/zuul-config/zuul.d/projects.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 27e10e6710a64e01b9778d03db822ee0
      build_refs:
      - branch: main
        change: '64'
        change_message: "diagnose-network: fix teardown hang, harden egress probes\n\nThe
          `diagnose-network` role has now run on real builds since it merged.\nThis
          PR acts on what it told us \u2014 and fixes a way it could break a job.\n\n##
          What the current instrumentation told us\n\nOn builds where teardown completes,
          the role collects real signal:\n\n- Across two independent captures \u2014
          the 2026-06-04 live probe and a\n  2026-06-15 build \u2014 IPv6 \u2192 `tarballs.opendev.org`
          was healthy while\n  IPv4 \u2192 `tarballs` failed (~50% loss, 10s connect
          timeouts). The \"IPv6\n  egress is the build-breaker\" theory has **not**
          been reproduced by any\n  direct probe yet; the path that actually fails
          in every capture is IPv4.\n- Docker's bridge reports `EnableIPv6: false`
          (no IPv6 in `docker info`,\n  no `daemon.json`) \u2192 containers/BuildKit
          are IPv4-only and forced onto\n  exactly that failing IPv4 path.\n- The
          `ping -6` gateway 100% loss is a constant red herring (the\n  link-local
          gateway just drops ICMP echo; routing is otherwise fine).\n\nBut it also
          showed the instrumentation was degrading or losing data:\n\n- **It hung
          a job.** A build wedged in post-run for 7+ hours with no logs\n  uploaded
          \u2014 the teardown `docker run` exec probe never returned and\n  stalled
          everything before `fetch-output`. This is what prompted the PR.\n- `sysctl:
          command not found` (\xD73) \u2014 the `accept_ra`/`forwarding` capture\n
          \ that tests the RA-suppression hypothesis was silently empty on the\n  Docker
          nodes (sysctl isn't on PATH there).\n- `ip -4 route get` was fed an IPv6
          address (awk matched the dotted\n  hostname) \u2014 so the IPv4 route, needed
          to tell ENETUNREACH from\n  TCP-timeout, was never captured.\n- No host
          resolver config when `resolvectl` is absent, and the pre-run\n  sibling
          role can't cover a resolver state that changes mid-job.\n- A single curl
          per family is a coin flip against a ~50%-loss path.\n- It always ran `traceroute6`
          (the healthy path) and never traced the\n  family that actually failed.\n\n##
          Why this PR\n\n1. **Fix the hang so teardown can never stall a job again**
          \u2014 per-command\n   timeouts on the daemon calls, plus an `async`/`poll`
          backstop on each\n   teardown task. The caps (300/120/180s) sum to 600s,
          a third of the\n   1800s base job timeout, so they leave ample room for
          `fetch-output`\n   and fire only on a genuine hang.\n2. **Collect better,
          more reliable data** \u2014 close the silent-failure gaps\n   above so the
          next failing window is actually captured.\n\n## Changes (one logical change
          per commit)\n\n- `add timeouts to teardown probes` \u2014 bound the daemon-touching
          `docker`\n  calls; the outer `timeout 60 docker run` bounds the exec probe.\n-
          `fix IPv4 address extraction` \u2014 anchor per family so `ip -4 route get`\n
          \ targets the v4 address.\n- `read v6 sysctls from /proc` \u2014 replace
          the missing `sysctl` binary;\n  restores the RA-suppression test.\n- `capture
          host resolver config` \u2014 `/etc/resolv.conf` + systemd upstreams\n  at
          teardown.\n- `sample each family 3 times` \u2014 make each pre/post bracket
          a reliable\n  verdict, not a coin toss.\n- `trace the failing family` \u2014
          traceroute the family whose curl failed,\n  to its resolved address (relies
          on the IPv4-extraction fix).\n- `add async hang backstop` \u2014 per-task
          ceiling, robust to any future\n  unbounded command.\n\n## Notes for reviewers\n\n-
          `zuul-config` is a trusted config-project, so this PR's own check is\n  `noop`;
          the change only takes effect after merge.\n- `yamllint` clean; `ansible-lint`
          unchanged (only the role's pre-existing\n  `risky-shell-pipe` baseline on
          the three shell tasks).\n\n## Related\n\n- osism/zuul-config#62\n"
        change_url: https://github.com/osism/zuul-config/pull/64
        commit_id: dab78bc17fa077086d3edb768c348296ebdf22a1
        patchset: dab78bc17fa077086d3edb768c348296ebdf22a1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/zuul-config
          name: osism/zuul-config
          short_name: zuul-config
        src_dir: src/github.com/osism/zuul-config
        topic: null
      buildset: 20fcef32420c4199b192f38719a5bb27
      buildset_refs:
      - branch: main
        change: '64'
        change_message: "diagnose-network: fix teardown hang, harden egress probes\n\nThe
          `diagnose-network` role has now run on real builds since it merged.\nThis
          PR acts on what it told us \u2014 and fixes a way it could break a job.\n\n##
          What the current instrumentation told us\n\nOn builds where teardown completes,
          the role collects real signal:\n\n- Across two independent captures \u2014
          the 2026-06-04 live probe and a\n  2026-06-15 build \u2014 IPv6 \u2192 `tarballs.opendev.org`
          was healthy while\n  IPv4 \u2192 `tarballs` failed (~50% loss, 10s connect
          timeouts). The \"IPv6\n  egress is the build-breaker\" theory has **not**
          been reproduced by any\n  direct probe yet; the path that actually fails
          in every capture is IPv4.\n- Docker's bridge reports `EnableIPv6: false`
          (no IPv6 in `docker info`,\n  no `daemon.json`) \u2192 containers/BuildKit
          are IPv4-only and forced onto\n  exactly that failing IPv4 path.\n- The
          `ping -6` gateway 100% loss is a constant red herring (the\n  link-local
          gateway just drops ICMP echo; routing is otherwise fine).\n\nBut it also
          showed the instrumentation was degrading or losing data:\n\n- **It hung
          a job.** A build wedged in post-run for 7+ hours with no logs\n  uploaded
          \u2014 the teardown `docker run` exec probe never returned and\n  stalled
          everything before `fetch-output`. This is what prompted the PR.\n- `sysctl:
          command not found` (\xD73) \u2014 the `accept_ra`/`forwarding` capture\n
          \ that tests the RA-suppression hypothesis was silently empty on the\n  Docker
          nodes (sysctl isn't on PATH there).\n- `ip -4 route get` was fed an IPv6
          address (awk matched the dotted\n  hostname) \u2014 so the IPv4 route, needed
          to tell ENETUNREACH from\n  TCP-timeout, was never captured.\n- No host
          resolver config when `resolvectl` is absent, and the pre-run\n  sibling
          role can't cover a resolver state that changes mid-job.\n- A single curl
          per family is a coin flip against a ~50%-loss path.\n- It always ran `traceroute6`
          (the healthy path) and never traced the\n  family that actually failed.\n\n##
          Why this PR\n\n1. **Fix the hang so teardown can never stall a job again**
          \u2014 per-command\n   timeouts on the daemon calls, plus an `async`/`poll`
          backstop on each\n   teardown task. The caps (300/120/180s) sum to 600s,
          a third of the\n   1800s base job timeout, so they leave ample room for
          `fetch-output`\n   and fire only on a genuine hang.\n2. **Collect better,
          more reliable data** \u2014 close the silent-failure gaps\n   above so the
          next failing window is actually captured.\n\n## Changes (one logical change
          per commit)\n\n- `add timeouts to teardown probes` \u2014 bound the daemon-touching
          `docker`\n  calls; the outer `timeout 60 docker run` bounds the exec probe.\n-
          `fix IPv4 address extraction` \u2014 anchor per family so `ip -4 route get`\n
          \ targets the v4 address.\n- `read v6 sysctls from /proc` \u2014 replace
          the missing `sysctl` binary;\n  restores the RA-suppression test.\n- `capture
          host resolver config` \u2014 `/etc/resolv.conf` + systemd upstreams\n  at
          teardown.\n- `sample each family 3 times` \u2014 make each pre/post bracket
          a reliable\n  verdict, not a coin toss.\n- `trace the failing family` \u2014
          traceroute the family whose curl failed,\n  to its resolved address (relies
          on the IPv4-extraction fix).\n- `add async hang backstop` \u2014 per-task
          ceiling, robust to any future\n  unbounded command.\n\n## Notes for reviewers\n\n-
          `zuul-config` is a trusted config-project, so this PR's own check is\n  `noop`;
          the change only takes effect after merge.\n- `yamllint` clean; `ansible-lint`
          unchanged (only the role's pre-existing\n  `risky-shell-pipe` baseline on
          the three shell tasks).\n\n## Related\n\n- osism/zuul-config#62\n"
        change_url: https://github.com/osism/zuul-config/pull/64
        commit_id: dab78bc17fa077086d3edb768c348296ebdf22a1
        patchset: dab78bc17fa077086d3edb768c348296ebdf22a1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/zuul-config
          name: osism/zuul-config
          short_name: zuul-config
        src_dir: src/github.com/osism/zuul-config
        topic: null
      change: '64'
      change_message: "diagnose-network: fix teardown hang, harden egress probes\n\nThe
        `diagnose-network` role has now run on real builds since it merged.\nThis
        PR acts on what it told us \u2014 and fixes a way it could break a job.\n\n##
        What the current instrumentation told us\n\nOn builds where teardown completes,
        the role collects real signal:\n\n- Across two independent captures \u2014
        the 2026-06-04 live probe and a\n  2026-06-15 build \u2014 IPv6 \u2192 `tarballs.opendev.org`
        was healthy while\n  IPv4 \u2192 `tarballs` failed (~50% loss, 10s connect
        timeouts). The \"IPv6\n  egress is the build-breaker\" theory has **not**
        been reproduced by any\n  direct probe yet; the path that actually fails in
        every capture is IPv4.\n- Docker's bridge reports `EnableIPv6: false` (no
        IPv6 in `docker info`,\n  no `daemon.json`) \u2192 containers/BuildKit are
        IPv4-only and forced onto\n  exactly that failing IPv4 path.\n- The `ping
        -6` gateway 100% loss is a constant red herring (the\n  link-local gateway
        just drops ICMP echo; routing is otherwise fine).\n\nBut it also showed the
        instrumentation was degrading or losing data:\n\n- **It hung a job.** A build
        wedged in post-run for 7+ hours with no logs\n  uploaded \u2014 the teardown
        `docker run` exec probe never returned and\n  stalled everything before `fetch-output`.
        This is what prompted the PR.\n- `sysctl: command not found` (\xD73) \u2014
        the `accept_ra`/`forwarding` capture\n  that tests the RA-suppression hypothesis
        was silently empty on the\n  Docker nodes (sysctl isn't on PATH there).\n-
        `ip -4 route get` was fed an IPv6 address (awk matched the dotted\n  hostname)
        \u2014 so the IPv4 route, needed to tell ENETUNREACH from\n  TCP-timeout,
        was never captured.\n- No host resolver config when `resolvectl` is absent,
        and the pre-run\n  sibling role can't cover a resolver state that changes
        mid-job.\n- A single curl per family is a coin flip against a ~50%-loss path.\n-
        It always ran `traceroute6` (the healthy path) and never traced the\n  family
        that actually failed.\n\n## Why this PR\n\n1. **Fix the hang so teardown can
        never stall a job again** \u2014 per-command\n   timeouts on the daemon calls,
        plus an `async`/`poll` backstop on each\n   teardown task. The caps (300/120/180s)
        sum to 600s, a third of the\n   1800s base job timeout, so they leave ample
        room for `fetch-output`\n   and fire only on a genuine hang.\n2. **Collect
        better, more reliable data** \u2014 close the silent-failure gaps\n   above
        so the next failing window is actually captured.\n\n## Changes (one logical
        change per commit)\n\n- `add timeouts to teardown probes` \u2014 bound the
        daemon-touching `docker`\n  calls; the outer `timeout 60 docker run` bounds
        the exec probe.\n- `fix IPv4 address extraction` \u2014 anchor per family
        so `ip -4 route get`\n  targets the v4 address.\n- `read v6 sysctls from /proc`
        \u2014 replace the missing `sysctl` binary;\n  restores the RA-suppression
        test.\n- `capture host resolver config` \u2014 `/etc/resolv.conf` + systemd
        upstreams\n  at teardown.\n- `sample each family 3 times` \u2014 make each
        pre/post bracket a reliable\n  verdict, not a coin toss.\n- `trace the failing
        family` \u2014 traceroute the family whose curl failed,\n  to its resolved
        address (relies on the IPv4-extraction fix).\n- `add async hang backstop`
        \u2014 per-task ceiling, robust to any future\n  unbounded command.\n\n##
        Notes for reviewers\n\n- `zuul-config` is a trusted config-project, so this
        PR's own check is\n  `noop`; the change only takes effect after merge.\n-
        `yamllint` clean; `ansible-lint` unchanged (only the role's pre-existing\n
        \ `risky-shell-pipe` baseline on the three shell tasks).\n\n## Related\n\n-
        osism/zuul-config#62\n"
      change_url: https://github.com/osism/zuul-config/pull/64
      child_jobs: []
      commit_id: dab78bc17fa077086d3edb768c348296ebdf22a1
      event_id: 2514f4b0-68ac-11f1-95e5-23a3771a4cdf
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/27e10e6710a64e01b9778d03db822ee0/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/27e10e6710a64e01b9778d03db822ee0/work/logs
        result_data_file: /var/lib/zuul/builds/27e10e6710a64e01b9778d03db822ee0/work/results.json
        src_root: /var/lib/zuul/builds/27e10e6710a64e01b9778d03db822ee0/work/src
        work_root: /var/lib/zuul/builds/27e10e6710a64e01b9778d03db822ee0/work
      include_vars: []
      items:
      - branch: main
        change: '64'
        change_message: "diagnose-network: fix teardown hang, harden egress probes\n\nThe
          `diagnose-network` role has now run on real builds since it merged.\nThis
          PR acts on what it told us \u2014 and fixes a way it could break a job.\n\n##
          What the current instrumentation told us\n\nOn builds where teardown completes,
          the role collects real signal:\n\n- Across two independent captures \u2014
          the 2026-06-04 live probe and a\n  2026-06-15 build \u2014 IPv6 \u2192 `tarballs.opendev.org`
          was healthy while\n  IPv4 \u2192 `tarballs` failed (~50% loss, 10s connect
          timeouts). The \"IPv6\n  egress is the build-breaker\" theory has **not**
          been reproduced by any\n  direct probe yet; the path that actually fails
          in every capture is IPv4.\n- Docker's bridge reports `EnableIPv6: false`
          (no IPv6 in `docker info`,\n  no `daemon.json`) \u2192 containers/BuildKit
          are IPv4-only and forced onto\n  exactly that failing IPv4 path.\n- The
          `ping -6` gateway 100% loss is a constant red herring (the\n  link-local
          gateway just drops ICMP echo; routing is otherwise fine).\n\nBut it also
          showed the instrumentation was degrading or losing data:\n\n- **It hung
          a job.** A build wedged in post-run for 7+ hours with no logs\n  uploaded
          \u2014 the teardown `docker run` exec probe never returned and\n  stalled
          everything before `fetch-output`. This is what prompted the PR.\n- `sysctl:
          command not found` (\xD73) \u2014 the `accept_ra`/`forwarding` capture\n
          \ that tests the RA-suppression hypothesis was silently empty on the\n  Docker
          nodes (sysctl isn't on PATH there).\n- `ip -4 route get` was fed an IPv6
          address (awk matched the dotted\n  hostname) \u2014 so the IPv4 route, needed
          to tell ENETUNREACH from\n  TCP-timeout, was never captured.\n- No host
          resolver config when `resolvectl` is absent, and the pre-run\n  sibling
          role can't cover a resolver state that changes mid-job.\n- A single curl
          per family is a coin flip against a ~50%-loss path.\n- It always ran `traceroute6`
          (the healthy path) and never traced the\n  family that actually failed.\n\n##
          Why this PR\n\n1. **Fix the hang so teardown can never stall a job again**
          \u2014 per-command\n   timeouts on the daemon calls, plus an `async`/`poll`
          backstop on each\n   teardown task. The caps (300/120/180s) sum to 600s,
          a third of the\n   1800s base job timeout, so they leave ample room for
          `fetch-output`\n   and fire only on a genuine hang.\n2. **Collect better,
          more reliable data** \u2014 close the silent-failure gaps\n   above so the
          next failing window is actually captured.\n\n## Changes (one logical change
          per commit)\n\n- `add timeouts to teardown probes` \u2014 bound the daemon-touching
          `docker`\n  calls; the outer `timeout 60 docker run` bounds the exec probe.\n-
          `fix IPv4 address extraction` \u2014 anchor per family so `ip -4 route get`\n
          \ targets the v4 address.\n- `read v6 sysctls from /proc` \u2014 replace
          the missing `sysctl` binary;\n  restores the RA-suppression test.\n- `capture
          host resolver config` \u2014 `/etc/resolv.conf` + systemd upstreams\n  at
          teardown.\n- `sample each family 3 times` \u2014 make each pre/post bracket
          a reliable\n  verdict, not a coin toss.\n- `trace the failing family` \u2014
          traceroute the family whose curl failed,\n  to its resolved address (relies
          on the IPv4-extraction fix).\n- `add async hang backstop` \u2014 per-task
          ceiling, robust to any future\n  unbounded command.\n\n## Notes for reviewers\n\n-
          `zuul-config` is a trusted config-project, so this PR's own check is\n  `noop`;
          the change only takes effect after merge.\n- `yamllint` clean; `ansible-lint`
          unchanged (only the role's pre-existing\n  `risky-shell-pipe` baseline on
          the three shell tasks).\n\n## Related\n\n- osism/zuul-config#62\n"
        change_url: https://github.com/osism/zuul-config/pull/64
        commit_id: dab78bc17fa077086d3edb768c348296ebdf22a1
        patchset: dab78bc17fa077086d3edb768c348296ebdf22a1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/zuul-config
          name: osism/zuul-config
          short_name: zuul-config
          src_dir: src/github.com/osism/zuul-config
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: ZGlhZ25vc2UtbmV0d29yazogZml4IHRlYXJkb3duIGhhbmcsIGhhcmRlbiBlZ3Jlc3MgcHJvYmVzCgpUaGUgYGRpYWdub3NlLW5ldHdvcmtgIHJvbGUgaGFzIG5vdyBydW4gb24gcmVhbCBidWlsZHMgc2luY2UgaXQgbWVyZ2VkLgpUaGlzIFBSIGFjdHMgb24gd2hhdCBpdCB0b2xkIHVzIOKAlCBhbmQgZml4ZXMgYSB3YXkgaXQgY291bGQgYnJlYWsgYSBqb2IuCgojIyBXaGF0IHRoZSBjdXJyZW50IGluc3RydW1lbnRhdGlvbiB0b2xkIHVzCgpPbiBidWlsZHMgd2hlcmUgdGVhcmRvd24gY29tcGxldGVzLCB0aGUgcm9sZSBjb2xsZWN0cyByZWFsIHNpZ25hbDoKCi0gQWNyb3NzIHR3byBpbmRlcGVuZGVudCBjYXB0dXJlcyDigJQgdGhlIDIwMjYtMDYtMDQgbGl2ZSBwcm9iZSBhbmQgYQogIDIwMjYtMDYtMTUgYnVpbGQg4oCUIElQdjYg4oaSIGB0YXJiYWxscy5vcGVuZGV2Lm9yZ2Agd2FzIGhlYWx0aHkgd2hpbGUKICBJUHY0IOKGkiBgdGFyYmFsbHNgIGZhaWxlZCAofjUwJSBsb3NzLCAxMHMgY29ubmVjdCB0aW1lb3V0cykuIFRoZSAiSVB2NgogIGVncmVzcyBpcyB0aGUgYnVpbGQtYnJlYWtlciIgdGhlb3J5IGhhcyAqKm5vdCoqIGJlZW4gcmVwcm9kdWNlZCBieSBhbnkKICBkaXJlY3QgcHJvYmUgeWV0OyB0aGUgcGF0aCB0aGF0IGFjdHVhbGx5IGZhaWxzIGluIGV2ZXJ5IGNhcHR1cmUgaXMgSVB2NC4KLSBEb2NrZXIncyBicmlkZ2UgcmVwb3J0cyBgRW5hYmxlSVB2NjogZmFsc2VgIChubyBJUHY2IGluIGBkb2NrZXIgaW5mb2AsCiAgbm8gYGRhZW1vbi5qc29uYCkg4oaSIGNvbnRhaW5lcnMvQnVpbGRLaXQgYXJlIElQdjQtb25seSBhbmQgZm9yY2VkIG9udG8KICBleGFjdGx5IHRoYXQgZmFpbGluZyBJUHY0IHBhdGguCi0gVGhlIGBwaW5nIC02YCBnYXRld2F5IDEwMCUgbG9zcyBpcyBhIGNvbnN0YW50IHJlZCBoZXJyaW5nICh0aGUKICBsaW5rLWxvY2FsIGdhdGV3YXkganVzdCBkcm9wcyBJQ01QIGVjaG87IHJvdXRpbmcgaXMgb3RoZXJ3aXNlIGZpbmUpLgoKQnV0IGl0IGFsc28gc2hvd2VkIHRoZSBpbnN0cnVtZW50YXRpb24gd2FzIGRlZ3JhZGluZyBvciBsb3NpbmcgZGF0YToKCi0gKipJdCBodW5nIGEgam9iLioqIEEgYnVpbGQgd2VkZ2VkIGluIHBvc3QtcnVuIGZvciA3KyBob3VycyB3aXRoIG5vIGxvZ3MKICB1cGxvYWRlZCDigJQgdGhlIHRlYXJkb3duIGBkb2NrZXIgcnVuYCBleGVjIHByb2JlIG5ldmVyIHJldHVybmVkIGFuZAogIHN0YWxsZWQgZXZlcnl0aGluZyBiZWZvcmUgYGZldGNoLW91dHB1dGAuIFRoaXMgaXMgd2hhdCBwcm9tcHRlZCB0aGUgUFIuCi0gYHN5c2N0bDogY29tbWFuZCBub3QgZm91bmRgICjDlzMpIOKAlCB0aGUgYGFjY2VwdF9yYWAvYGZvcndhcmRpbmdgIGNhcHR1cmUKICB0aGF0IHRlc3RzIHRoZSBSQS1zdXBwcmVzc2lvbiBoeXBvdGhlc2lzIHdhcyBzaWxlbnRseSBlbXB0eSBvbiB0aGUKICBEb2NrZXIgbm9kZXMgKHN5c2N0bCBpc24ndCBvbiBQQVRIIHRoZXJlKS4KLSBgaXAgLTQgcm91dGUgZ2V0YCB3YXMgZmVkIGFuIElQdjYgYWRkcmVzcyAoYXdrIG1hdGNoZWQgdGhlIGRvdHRlZAogIGhvc3RuYW1lKSDigJQgc28gdGhlIElQdjQgcm91dGUsIG5lZWRlZCB0byB0ZWxsIEVORVRVTlJFQUNIIGZyb20KICBUQ1AtdGltZW91dCwgd2FzIG5ldmVyIGNhcHR1cmVkLgotIE5vIGhvc3QgcmVzb2x2ZXIgY29uZmlnIHdoZW4gYHJlc29sdmVjdGxgIGlzIGFic2VudCwgYW5kIHRoZSBwcmUtcnVuCiAgc2libGluZyByb2xlIGNhbid0IGNvdmVyIGEgcmVzb2x2ZXIgc3RhdGUgdGhhdCBjaGFuZ2VzIG1pZC1qb2IuCi0gQSBzaW5nbGUgY3VybCBwZXIgZmFtaWx5IGlzIGEgY29pbiBmbGlwIGFnYWluc3QgYSB+NTAlLWxvc3MgcGF0aC4KLSBJdCBhbHdheXMgcmFuIGB0cmFjZXJvdXRlNmAgKHRoZSBoZWFsdGh5IHBhdGgpIGFuZCBuZXZlciB0cmFjZWQgdGhlCiAgZmFtaWx5IHRoYXQgYWN0dWFsbHkgZmFpbGVkLgoKIyMgV2h5IHRoaXMgUFIKCjEuICoqRml4IHRoZSBoYW5nIHNvIHRlYXJkb3duIGNhbiBuZXZlciBzdGFsbCBhIGpvYiBhZ2FpbioqIOKAlCBwZXItY29tbWFuZAogICB0aW1lb3V0cyBvbiB0aGUgZGFlbW9uIGNhbGxzLCBwbHVzIGFuIGBhc3luY2AvYHBvbGxgIGJhY2tzdG9wIG9uIGVhY2gKICAgdGVhcmRvd24gdGFzay4gVGhlIGNhcHMgKDMwMC8xMjAvMTgwcykgc3VtIHRvIDYwMHMsIGEgdGhpcmQgb2YgdGhlCiAgIDE4MDBzIGJhc2Ugam9iIHRpbWVvdXQsIHNvIHRoZXkgbGVhdmUgYW1wbGUgcm9vbSBmb3IgYGZldGNoLW91dHB1dGAKICAgYW5kIGZpcmUgb25seSBvbiBhIGdlbnVpbmUgaGFuZy4KMi4gKipDb2xsZWN0IGJldHRlciwgbW9yZSByZWxpYWJsZSBkYXRhKiog4oCUIGNsb3NlIHRoZSBzaWxlbnQtZmFpbHVyZSBnYXBzCiAgIGFib3ZlIHNvIHRoZSBuZXh0IGZhaWxpbmcgd2luZG93IGlzIGFjdHVhbGx5IGNhcHR1cmVkLgoKIyMgQ2hhbmdlcyAob25lIGxvZ2ljYWwgY2hhbmdlIHBlciBjb21taXQpCgotIGBhZGQgdGltZW91dHMgdG8gdGVhcmRvd24gcHJvYmVzYCDigJQgYm91bmQgdGhlIGRhZW1vbi10b3VjaGluZyBgZG9ja2VyYAogIGNhbGxzOyB0aGUgb3V0ZXIgYHRpbWVvdXQgNjAgZG9ja2VyIHJ1bmAgYm91bmRzIHRoZSBleGVjIHByb2JlLgotIGBmaXggSVB2NCBhZGRyZXNzIGV4dHJhY3Rpb25gIOKAlCBhbmNob3IgcGVyIGZhbWlseSBzbyBgaXAgLTQgcm91dGUgZ2V0YAogIHRhcmdldHMgdGhlIHY0IGFkZHJlc3MuCi0gYHJlYWQgdjYgc3lzY3RscyBmcm9tIC9wcm9jYCDigJQgcmVwbGFjZSB0aGUgbWlzc2luZyBgc3lzY3RsYCBiaW5hcnk7CiAgcmVzdG9yZXMgdGhlIFJBLXN1cHByZXNzaW9uIHRlc3QuCi0gYGNhcHR1cmUgaG9zdCByZXNvbHZlciBjb25maWdgIOKAlCBgL2V0Yy9yZXNvbHYuY29uZmAgKyBzeXN0ZW1kIHVwc3RyZWFtcwogIGF0IHRlYXJkb3duLgotIGBzYW1wbGUgZWFjaCBmYW1pbHkgMyB0aW1lc2Ag4oCUIG1ha2UgZWFjaCBwcmUvcG9zdCBicmFja2V0IGEgcmVsaWFibGUKICB2ZXJkaWN0LCBub3QgYSBjb2luIHRvc3MuCi0gYHRyYWNlIHRoZSBmYWlsaW5nIGZhbWlseWAg4oCUIHRyYWNlcm91dGUgdGhlIGZhbWlseSB3aG9zZSBjdXJsIGZhaWxlZCwKICB0byBpdHMgcmVzb2x2ZWQgYWRkcmVzcyAocmVsaWVzIG9uIHRoZSBJUHY0LWV4dHJhY3Rpb24gZml4KS4KLSBgYWRkIGFzeW5jIGhhbmcgYmFja3N0b3BgIOKAlCBwZXItdGFzayBjZWlsaW5nLCByb2J1c3QgdG8gYW55IGZ1dHVyZQogIHVuYm91bmRlZCBjb21tYW5kLgoKIyMgTm90ZXMgZm9yIHJldmlld2VycwoKLSBgenV1bC1jb25maWdgIGlzIGEgdHJ1c3RlZCBjb25maWctcHJvamVjdCwgc28gdGhpcyBQUidzIG93biBjaGVjayBpcwogIGBub29wYDsgdGhlIGNoYW5nZSBvbmx5IHRha2VzIGVmZmVjdCBhZnRlciBtZXJnZS4KLSBgeWFtbGxpbnRgIGNsZWFuOyBgYW5zaWJsZS1saW50YCB1bmNoYW5nZWQgKG9ubHkgdGhlIHJvbGUncyBwcmUtZXhpc3RpbmcKICBgcmlza3ktc2hlbGwtcGlwZWAgYmFzZWxpbmUgb24gdGhlIHRocmVlIHNoZWxsIHRhc2tzKS4KCiMjIFJlbGF0ZWQKCi0gb3Npc20venV1bC1jb25maWcjNjIK
      patchset: dab78bc17fa077086d3edb768c348296ebdf22a1
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 8c0e6675393589a6cfd1129ae1abaf8184a18465
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/zuul-config
        name: osism/zuul-config
        short_name: zuul-config
        src_dir: src/github.com/osism/zuul-config
      projects:
        github.com/osism/zuul-config:
          canonical_hostname: github.com
          canonical_name: github.com/osism/zuul-config
          checkout: main
          checkout_description: zuul branch
          commit: 8c0e6675393589a6cfd1129ae1abaf8184a18465
          name: osism/zuul-config
          required: false
          short_name: zuul-config
          src_dir: src/github.com/osism/zuul-config
      ref: refs/pull/64/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
