all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:febe:68fd
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b8aebd2a-a5ae-4524-a33a-b8663abb513e
        host_id: 5afd8fc909abddfe2ce3a956a91bbe56629648b7209fd0acfa541862
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:febe:68fd
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.41
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.144
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:febe:68fd
        region: null
        slot: null
      tox_environment:
        NOSE_HTML_OUT_FILE: nose_results.html
        NOSE_WITH_HTML_OUTPUT: 1
        NOSE_WITH_XUNIT: 1
      tox_envlist: drift-test
  vars:
    tox_environment:
      NOSE_HTML_OUT_FILE: nose_results.html
      NOSE_WITH_HTML_OUTPUT: 1
      NOSE_WITH_XUNIT: 1
    tox_envlist: drift-test
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job unittests explicit: None implied: {MatchAny:{ImpliedBranchMatcher:master}}
        source: osism/openinfra-zuul-jobs/zuul.d/general-jobs.yaml@master#9>'
      - '<Job tox explicit: None implied: {MatchAny:{ImpliedBranchMatcher:master}}
        source: osism/openinfra-zuul-jobs/zuul.d/python-jobs.yaml@master#1>'
      - '<Job release-tox-drift-test explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/release/.zuul.yaml@main#2>'
      - '<Job release-tox-drift-test explicit: None implied: None source: osism/release/.zuul.yaml@main#14>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 2e1bc23d62824a17ad102bc52e415870
      build_refs:
      - branch: main
        change: '2573'
        change_message: "role_scan: credit container-template stream pins\n\n## Problem\n\n`role_unpinned`
          reports `cephclient` (`reef`) and `openstackclient`\n(`2024.2`) as actionable
          drift \u2014 role-default `<alias>_tag` pins with no\ncanonical release
          pin. These are **false positives**.\n\nBoth tags are stream-wired in the
          authoritative *container* render\ntemplate (`container-image-osism-ansible/.../images.yml.j2`):\n\n```\ncephclient_tag:
          \    \"{{ cephclient_version|default(ceph_version) }}\"\nopenstackclient_tag:
          \"{{ openstackclient_version|default(openstack_version) }}\"\n```\n\ni.e.
          the release train governs the deployed tag (concrete pins live in\nthe train
          files `ceph-*.yml` / `openstack-*.yml`), and the role default\nis only a
          fallback. But `iter_role_pins()` decided stream-resolution by\nreading **only**
          the generics manager template\n(`generics/environments/manager/images.yml`),
          which omits these two\naliases \u2014 so their role defaults were treated
          as canonical role pins.\n\n## Fix\n\nUnion the stream-resolved set from
          the container template on top of the\ngenerics one in `iter_role_pins()`.
          From the real container template\nthis adds exactly `cephclient` and `openstackclient`
          (nothing else\nmatches the `<name>_version|default` shape). `role_shadows`
          shares\n`iter_role_pins()` and benefits identically.\n\nAlso declare the
          container template in `role_unpinned`'s `INPUT_FILES`:\nthe driver resolves
          source repos from each selected plugin's\n`INPUT_FILES`, so without it,
          running `role_unpinned` alone in remote\nmode would read an unresolved repo.
          `role_shadows` already declared it.\n\n## Verification\n\nAgainst the local
          checkouts: `role_unpinned` drops from **11 to 9**\nactionable findings (`cephclient`
          and `openstackclient` removed);\n`role_shadows` unchanged. Two new tests
          (a role stream-wired only in the\ncontainer template must not surface as
          unpinned; `role_unpinned` must\ndeclare the container template as an input).
          Full suite 333 passed;\nblack + flake8 clean."
        change_url: https://github.com/osism/release/pull/2573
        commit_id: 633ac6e624816681e51a7d42048c274a393362a2
        patchset: 633ac6e624816681e51a7d42048c274a393362a2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: c9edfbb676be4254b18f01b054b59fba
      buildset_refs:
      - branch: main
        change: '2573'
        change_message: "role_scan: credit container-template stream pins\n\n## Problem\n\n`role_unpinned`
          reports `cephclient` (`reef`) and `openstackclient`\n(`2024.2`) as actionable
          drift \u2014 role-default `<alias>_tag` pins with no\ncanonical release
          pin. These are **false positives**.\n\nBoth tags are stream-wired in the
          authoritative *container* render\ntemplate (`container-image-osism-ansible/.../images.yml.j2`):\n\n```\ncephclient_tag:
          \    \"{{ cephclient_version|default(ceph_version) }}\"\nopenstackclient_tag:
          \"{{ openstackclient_version|default(openstack_version) }}\"\n```\n\ni.e.
          the release train governs the deployed tag (concrete pins live in\nthe train
          files `ceph-*.yml` / `openstack-*.yml`), and the role default\nis only a
          fallback. But `iter_role_pins()` decided stream-resolution by\nreading **only**
          the generics manager template\n(`generics/environments/manager/images.yml`),
          which omits these two\naliases \u2014 so their role defaults were treated
          as canonical role pins.\n\n## Fix\n\nUnion the stream-resolved set from
          the container template on top of the\ngenerics one in `iter_role_pins()`.
          From the real container template\nthis adds exactly `cephclient` and `openstackclient`
          (nothing else\nmatches the `<name>_version|default` shape). `role_shadows`
          shares\n`iter_role_pins()` and benefits identically.\n\nAlso declare the
          container template in `role_unpinned`'s `INPUT_FILES`:\nthe driver resolves
          source repos from each selected plugin's\n`INPUT_FILES`, so without it,
          running `role_unpinned` alone in remote\nmode would read an unresolved repo.
          `role_shadows` already declared it.\n\n## Verification\n\nAgainst the local
          checkouts: `role_unpinned` drops from **11 to 9**\nactionable findings (`cephclient`
          and `openstackclient` removed);\n`role_shadows` unchanged. Two new tests
          (a role stream-wired only in the\ncontainer template must not surface as
          unpinned; `role_unpinned` must\ndeclare the container template as an input).
          Full suite 333 passed;\nblack + flake8 clean."
        change_url: https://github.com/osism/release/pull/2573
        commit_id: 633ac6e624816681e51a7d42048c274a393362a2
        patchset: 633ac6e624816681e51a7d42048c274a393362a2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2573'
      change_message: "role_scan: credit container-template stream pins\n\n## Problem\n\n`role_unpinned`
        reports `cephclient` (`reef`) and `openstackclient`\n(`2024.2`) as actionable
        drift \u2014 role-default `<alias>_tag` pins with no\ncanonical release pin.
        These are **false positives**.\n\nBoth tags are stream-wired in the authoritative
        *container* render\ntemplate (`container-image-osism-ansible/.../images.yml.j2`):\n\n```\ncephclient_tag:
        \    \"{{ cephclient_version|default(ceph_version) }}\"\nopenstackclient_tag:
        \"{{ openstackclient_version|default(openstack_version) }}\"\n```\n\ni.e.
        the release train governs the deployed tag (concrete pins live in\nthe train
        files `ceph-*.yml` / `openstack-*.yml`), and the role default\nis only a fallback.
        But `iter_role_pins()` decided stream-resolution by\nreading **only** the
        generics manager template\n(`generics/environments/manager/images.yml`), which
        omits these two\naliases \u2014 so their role defaults were treated as canonical
        role pins.\n\n## Fix\n\nUnion the stream-resolved set from the container template
        on top of the\ngenerics one in `iter_role_pins()`. From the real container
        template\nthis adds exactly `cephclient` and `openstackclient` (nothing else\nmatches
        the `<name>_version|default` shape). `role_shadows` shares\n`iter_role_pins()`
        and benefits identically.\n\nAlso declare the container template in `role_unpinned`'s
        `INPUT_FILES`:\nthe driver resolves source repos from each selected plugin's\n`INPUT_FILES`,
        so without it, running `role_unpinned` alone in remote\nmode would read an
        unresolved repo. `role_shadows` already declared it.\n\n## Verification\n\nAgainst
        the local checkouts: `role_unpinned` drops from **11 to 9**\nactionable findings
        (`cephclient` and `openstackclient` removed);\n`role_shadows` unchanged. Two
        new tests (a role stream-wired only in the\ncontainer template must not surface
        as unpinned; `role_unpinned` must\ndeclare the container template as an input).
        Full suite 333 passed;\nblack + flake8 clean."
      change_url: https://github.com/osism/release/pull/2573
      child_jobs: []
      commit_id: 633ac6e624816681e51a7d42048c274a393362a2
      event_id: 77844250-7bcb-11f1-821f-968aca904fe4
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/2e1bc23d62824a17ad102bc52e415870/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/2e1bc23d62824a17ad102bc52e415870/work/logs
        result_data_file: /var/lib/zuul/builds/2e1bc23d62824a17ad102bc52e415870/work/results.json
        src_root: /var/lib/zuul/builds/2e1bc23d62824a17ad102bc52e415870/work/src
        work_root: /var/lib/zuul/builds/2e1bc23d62824a17ad102bc52e415870/work
      include_vars: []
      items:
      - branch: main
        change: '2573'
        change_message: "role_scan: credit container-template stream pins\n\n## Problem\n\n`role_unpinned`
          reports `cephclient` (`reef`) and `openstackclient`\n(`2024.2`) as actionable
          drift \u2014 role-default `<alias>_tag` pins with no\ncanonical release
          pin. These are **false positives**.\n\nBoth tags are stream-wired in the
          authoritative *container* render\ntemplate (`container-image-osism-ansible/.../images.yml.j2`):\n\n```\ncephclient_tag:
          \    \"{{ cephclient_version|default(ceph_version) }}\"\nopenstackclient_tag:
          \"{{ openstackclient_version|default(openstack_version) }}\"\n```\n\ni.e.
          the release train governs the deployed tag (concrete pins live in\nthe train
          files `ceph-*.yml` / `openstack-*.yml`), and the role default\nis only a
          fallback. But `iter_role_pins()` decided stream-resolution by\nreading **only**
          the generics manager template\n(`generics/environments/manager/images.yml`),
          which omits these two\naliases \u2014 so their role defaults were treated
          as canonical role pins.\n\n## Fix\n\nUnion the stream-resolved set from
          the container template on top of the\ngenerics one in `iter_role_pins()`.
          From the real container template\nthis adds exactly `cephclient` and `openstackclient`
          (nothing else\nmatches the `<name>_version|default` shape). `role_shadows`
          shares\n`iter_role_pins()` and benefits identically.\n\nAlso declare the
          container template in `role_unpinned`'s `INPUT_FILES`:\nthe driver resolves
          source repos from each selected plugin's\n`INPUT_FILES`, so without it,
          running `role_unpinned` alone in remote\nmode would read an unresolved repo.
          `role_shadows` already declared it.\n\n## Verification\n\nAgainst the local
          checkouts: `role_unpinned` drops from **11 to 9**\nactionable findings (`cephclient`
          and `openstackclient` removed);\n`role_shadows` unchanged. Two new tests
          (a role stream-wired only in the\ncontainer template must not surface as
          unpinned; `role_unpinned` must\ndeclare the container template as an input).
          Full suite 333 passed;\nblack + flake8 clean."
        change_url: https://github.com/osism/release/pull/2573
        commit_id: 633ac6e624816681e51a7d42048c274a393362a2
        patchset: 633ac6e624816681e51a7d42048c274a393362a2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: release-tox-drift-test
      jobtags: []
      max_attempts: 3
      message: cm9sZV9zY2FuOiBjcmVkaXQgY29udGFpbmVyLXRlbXBsYXRlIHN0cmVhbSBwaW5zCgojIyBQcm9ibGVtCgpgcm9sZV91bnBpbm5lZGAgcmVwb3J0cyBgY2VwaGNsaWVudGAgKGByZWVmYCkgYW5kIGBvcGVuc3RhY2tjbGllbnRgCihgMjAyNC4yYCkgYXMgYWN0aW9uYWJsZSBkcmlmdCDigJQgcm9sZS1kZWZhdWx0IGA8YWxpYXM+X3RhZ2AgcGlucyB3aXRoIG5vCmNhbm9uaWNhbCByZWxlYXNlIHBpbi4gVGhlc2UgYXJlICoqZmFsc2UgcG9zaXRpdmVzKiouCgpCb3RoIHRhZ3MgYXJlIHN0cmVhbS13aXJlZCBpbiB0aGUgYXV0aG9yaXRhdGl2ZSAqY29udGFpbmVyKiByZW5kZXIKdGVtcGxhdGUgKGBjb250YWluZXItaW1hZ2Utb3Npc20tYW5zaWJsZS8uLi4vaW1hZ2VzLnltbC5qMmApOgoKYGBgCmNlcGhjbGllbnRfdGFnOiAgICAgInt7IGNlcGhjbGllbnRfdmVyc2lvbnxkZWZhdWx0KGNlcGhfdmVyc2lvbikgfX0iCm9wZW5zdGFja2NsaWVudF90YWc6ICJ7eyBvcGVuc3RhY2tjbGllbnRfdmVyc2lvbnxkZWZhdWx0KG9wZW5zdGFja192ZXJzaW9uKSB9fSIKYGBgCgppLmUuIHRoZSByZWxlYXNlIHRyYWluIGdvdmVybnMgdGhlIGRlcGxveWVkIHRhZyAoY29uY3JldGUgcGlucyBsaXZlIGluCnRoZSB0cmFpbiBmaWxlcyBgY2VwaC0qLnltbGAgLyBgb3BlbnN0YWNrLSoueW1sYCksIGFuZCB0aGUgcm9sZSBkZWZhdWx0CmlzIG9ubHkgYSBmYWxsYmFjay4gQnV0IGBpdGVyX3JvbGVfcGlucygpYCBkZWNpZGVkIHN0cmVhbS1yZXNvbHV0aW9uIGJ5CnJlYWRpbmcgKipvbmx5KiogdGhlIGdlbmVyaWNzIG1hbmFnZXIgdGVtcGxhdGUKKGBnZW5lcmljcy9lbnZpcm9ubWVudHMvbWFuYWdlci9pbWFnZXMueW1sYCksIHdoaWNoIG9taXRzIHRoZXNlIHR3bwphbGlhc2VzIOKAlCBzbyB0aGVpciByb2xlIGRlZmF1bHRzIHdlcmUgdHJlYXRlZCBhcyBjYW5vbmljYWwgcm9sZSBwaW5zLgoKIyMgRml4CgpVbmlvbiB0aGUgc3RyZWFtLXJlc29sdmVkIHNldCBmcm9tIHRoZSBjb250YWluZXIgdGVtcGxhdGUgb24gdG9wIG9mIHRoZQpnZW5lcmljcyBvbmUgaW4gYGl0ZXJfcm9sZV9waW5zKClgLiBGcm9tIHRoZSByZWFsIGNvbnRhaW5lciB0ZW1wbGF0ZQp0aGlzIGFkZHMgZXhhY3RseSBgY2VwaGNsaWVudGAgYW5kIGBvcGVuc3RhY2tjbGllbnRgIChub3RoaW5nIGVsc2UKbWF0Y2hlcyB0aGUgYDxuYW1lPl92ZXJzaW9ufGRlZmF1bHRgIHNoYXBlKS4gYHJvbGVfc2hhZG93c2Agc2hhcmVzCmBpdGVyX3JvbGVfcGlucygpYCBhbmQgYmVuZWZpdHMgaWRlbnRpY2FsbHkuCgpBbHNvIGRlY2xhcmUgdGhlIGNvbnRhaW5lciB0ZW1wbGF0ZSBpbiBgcm9sZV91bnBpbm5lZGAncyBgSU5QVVRfRklMRVNgOgp0aGUgZHJpdmVyIHJlc29sdmVzIHNvdXJjZSByZXBvcyBmcm9tIGVhY2ggc2VsZWN0ZWQgcGx1Z2luJ3MKYElOUFVUX0ZJTEVTYCwgc28gd2l0aG91dCBpdCwgcnVubmluZyBgcm9sZV91bnBpbm5lZGAgYWxvbmUgaW4gcmVtb3RlCm1vZGUgd291bGQgcmVhZCBhbiB1bnJlc29sdmVkIHJlcG8uIGByb2xlX3NoYWRvd3NgIGFscmVhZHkgZGVjbGFyZWQgaXQuCgojIyBWZXJpZmljYXRpb24KCkFnYWluc3QgdGhlIGxvY2FsIGNoZWNrb3V0czogYHJvbGVfdW5waW5uZWRgIGRyb3BzIGZyb20gKioxMSB0byA5KioKYWN0aW9uYWJsZSBmaW5kaW5ncyAoYGNlcGhjbGllbnRgIGFuZCBgb3BlbnN0YWNrY2xpZW50YCByZW1vdmVkKTsKYHJvbGVfc2hhZG93c2AgdW5jaGFuZ2VkLiBUd28gbmV3IHRlc3RzIChhIHJvbGUgc3RyZWFtLXdpcmVkIG9ubHkgaW4gdGhlCmNvbnRhaW5lciB0ZW1wbGF0ZSBtdXN0IG5vdCBzdXJmYWNlIGFzIHVucGlubmVkOyBgcm9sZV91bnBpbm5lZGAgbXVzdApkZWNsYXJlIHRoZSBjb250YWluZXIgdGVtcGxhdGUgYXMgYW4gaW5wdXQpLiBGdWxsIHN1aXRlIDMzMyBwYXNzZWQ7CmJsYWNrICsgZmxha2U4IGNsZWFuLg==
      patchset: 633ac6e624816681e51a7d42048c274a393362a2
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
        playbooks:
        - path: untrusted/project_0/github.com/osism/openinfra-zuul-jobs/playbooks/tox/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_0/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_2/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: cc49f2925150eaa2f8635184631630a5ab1bad14
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2573/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
