all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:feb6:ee2
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: c78e9701-327a-4de6-a61e-c2126bae5c56
        host_id: 7f2607eceb24f4583c6f9496c53c64b51afe50de5eacda4379b21c42
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:feb6:ee2
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.9
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.20
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:feb6:ee2
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job yamllint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#59>'
      - '<Job yamllint explicit: None implied: None source: osism/metalbox/.zuul.yaml@main#231>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 46615e487c9548629fd2bb425696e5d2
      build_refs:
      - branch: main
        change: '371'
        change_message: "mirror: upload artifacts before their checksums\n\nThe three
          publish playbooks uploaded the .CHECKSUM file before the\nartifact it describes.
          Both objects have fixed names in the S3 bucket\nand no history, and the
          two uploads are separate PUTs with nothing\ntying them together, so the
          published pair is inconsistent for the\nduration of whichever upload runs
          second.\n\nPutting the checksum first makes that window the entire large
          transfer,\non every run: for ubuntu-noble.tar.bz2 on 2026-08-02 the checksum\nlanded
          at 01:10:25 and the 5.53 GB tarball at 01:16:20, so for six\nminutes the
          published checksum described an object that was not there\nyet. Worse, if
          the artifact upload fails the mismatch is permanent\nuntil the next successful
          run: the previous artifact is still intact\nand still good, but the checksum
          no longer describes it, so a consumer\nthat verifies must reject it. A failed
          publish took the fallback down\nwith it, which defeats the point of leaving
          the previous artifact in\nplace.\n\nUpload the artifact first and the checksum
          last. The routine\ninconsistency window shrinks from the large transfer
          to one small\nobject, and a failed artifact upload now leaves the previous
          artifact\nand its matching checksum both in place.\n\nmirror-container-images.yml
          had no `set -e` in its upload block, so the\nsecond rclone ran even when
          the first had failed. The ordering only\nmeans anything if a failed artifact
          upload aborts before the checksum\nis published, so add it there.\n\nThis
          does not make publishing atomic -- two objects cannot be updated\ntogether,
          and a consumer can still observe a mismatch, so verifying the\nchecksum
          before use remains necessary. Giving the S3 objects\ndate-stamped names
          plus a small pointer file, matching the history the\nquay.io/osism-mirror
          tags already have, would be the durable fix.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by:
          Roger Luethi <luethi@osism.tech>\n\n---\n\n<sub>Stack created with <a href=\"https://github.com/github/gh-stack\">GitHub
          Stacks CLI</a> \u2022 <a href=\"https://gh.io/stacks-feedback\">Give Feedback
          \U0001F4AC</a></sub>"
        change_url: https://github.com/osism/metalbox/pull/371
        commit_id: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        patchset: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
        src_dir: src/github.com/osism/metalbox
        topic: null
      buildset: 5e1e7a5c6e55493b899b1f4f315b8c82
      buildset_refs:
      - branch: main
        change: '371'
        change_message: "mirror: upload artifacts before their checksums\n\nThe three
          publish playbooks uploaded the .CHECKSUM file before the\nartifact it describes.
          Both objects have fixed names in the S3 bucket\nand no history, and the
          two uploads are separate PUTs with nothing\ntying them together, so the
          published pair is inconsistent for the\nduration of whichever upload runs
          second.\n\nPutting the checksum first makes that window the entire large
          transfer,\non every run: for ubuntu-noble.tar.bz2 on 2026-08-02 the checksum\nlanded
          at 01:10:25 and the 5.53 GB tarball at 01:16:20, so for six\nminutes the
          published checksum described an object that was not there\nyet. Worse, if
          the artifact upload fails the mismatch is permanent\nuntil the next successful
          run: the previous artifact is still intact\nand still good, but the checksum
          no longer describes it, so a consumer\nthat verifies must reject it. A failed
          publish took the fallback down\nwith it, which defeats the point of leaving
          the previous artifact in\nplace.\n\nUpload the artifact first and the checksum
          last. The routine\ninconsistency window shrinks from the large transfer
          to one small\nobject, and a failed artifact upload now leaves the previous
          artifact\nand its matching checksum both in place.\n\nmirror-container-images.yml
          had no `set -e` in its upload block, so the\nsecond rclone ran even when
          the first had failed. The ordering only\nmeans anything if a failed artifact
          upload aborts before the checksum\nis published, so add it there.\n\nThis
          does not make publishing atomic -- two objects cannot be updated\ntogether,
          and a consumer can still observe a mismatch, so verifying the\nchecksum
          before use remains necessary. Giving the S3 objects\ndate-stamped names
          plus a small pointer file, matching the history the\nquay.io/osism-mirror
          tags already have, would be the durable fix.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by:
          Roger Luethi <luethi@osism.tech>\n\n---\n\n<sub>Stack created with <a href=\"https://github.com/github/gh-stack\">GitHub
          Stacks CLI</a> \u2022 <a href=\"https://gh.io/stacks-feedback\">Give Feedback
          \U0001F4AC</a></sub>"
        change_url: https://github.com/osism/metalbox/pull/371
        commit_id: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        patchset: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
        src_dir: src/github.com/osism/metalbox
        topic: null
      change: '371'
      change_message: "mirror: upload artifacts before their checksums\n\nThe three
        publish playbooks uploaded the .CHECKSUM file before the\nartifact it describes.
        Both objects have fixed names in the S3 bucket\nand no history, and the two
        uploads are separate PUTs with nothing\ntying them together, so the published
        pair is inconsistent for the\nduration of whichever upload runs second.\n\nPutting
        the checksum first makes that window the entire large transfer,\non every
        run: for ubuntu-noble.tar.bz2 on 2026-08-02 the checksum\nlanded at 01:10:25
        and the 5.53 GB tarball at 01:16:20, so for six\nminutes the published checksum
        described an object that was not there\nyet. Worse, if the artifact upload
        fails the mismatch is permanent\nuntil the next successful run: the previous
        artifact is still intact\nand still good, but the checksum no longer describes
        it, so a consumer\nthat verifies must reject it. A failed publish took the
        fallback down\nwith it, which defeats the point of leaving the previous artifact
        in\nplace.\n\nUpload the artifact first and the checksum last. The routine\ninconsistency
        window shrinks from the large transfer to one small\nobject, and a failed
        artifact upload now leaves the previous artifact\nand its matching checksum
        both in place.\n\nmirror-container-images.yml had no `set -e` in its upload
        block, so the\nsecond rclone ran even when the first had failed. The ordering
        only\nmeans anything if a failed artifact upload aborts before the checksum\nis
        published, so add it there.\n\nThis does not make publishing atomic -- two
        objects cannot be updated\ntogether, and a consumer can still observe a mismatch,
        so verifying the\nchecksum before use remains necessary. Giving the S3 objects\ndate-stamped
        names plus a small pointer file, matching the history the\nquay.io/osism-mirror
        tags already have, would be the durable fix.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by:
        Roger Luethi <luethi@osism.tech>\n\n---\n\n<sub>Stack created with <a href=\"https://github.com/github/gh-stack\">GitHub
        Stacks CLI</a> \u2022 <a href=\"https://gh.io/stacks-feedback\">Give Feedback
        \U0001F4AC</a></sub>"
      change_url: https://github.com/osism/metalbox/pull/371
      child_jobs: []
      commit_id: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
      event_id: 95943170-90ba-11f1-961e-e572dda0f0da
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/46615e487c9548629fd2bb425696e5d2/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/46615e487c9548629fd2bb425696e5d2/work/logs
        result_data_file: /var/lib/zuul/builds/46615e487c9548629fd2bb425696e5d2/work/results.json
        src_root: /var/lib/zuul/builds/46615e487c9548629fd2bb425696e5d2/work/src
        work_root: /var/lib/zuul/builds/46615e487c9548629fd2bb425696e5d2/work
      include_vars: []
      items:
      - branch: main
        change: '371'
        change_message: "mirror: upload artifacts before their checksums\n\nThe three
          publish playbooks uploaded the .CHECKSUM file before the\nartifact it describes.
          Both objects have fixed names in the S3 bucket\nand no history, and the
          two uploads are separate PUTs with nothing\ntying them together, so the
          published pair is inconsistent for the\nduration of whichever upload runs
          second.\n\nPutting the checksum first makes that window the entire large
          transfer,\non every run: for ubuntu-noble.tar.bz2 on 2026-08-02 the checksum\nlanded
          at 01:10:25 and the 5.53 GB tarball at 01:16:20, so for six\nminutes the
          published checksum described an object that was not there\nyet. Worse, if
          the artifact upload fails the mismatch is permanent\nuntil the next successful
          run: the previous artifact is still intact\nand still good, but the checksum
          no longer describes it, so a consumer\nthat verifies must reject it. A failed
          publish took the fallback down\nwith it, which defeats the point of leaving
          the previous artifact in\nplace.\n\nUpload the artifact first and the checksum
          last. The routine\ninconsistency window shrinks from the large transfer
          to one small\nobject, and a failed artifact upload now leaves the previous
          artifact\nand its matching checksum both in place.\n\nmirror-container-images.yml
          had no `set -e` in its upload block, so the\nsecond rclone ran even when
          the first had failed. The ordering only\nmeans anything if a failed artifact
          upload aborts before the checksum\nis published, so add it there.\n\nThis
          does not make publishing atomic -- two objects cannot be updated\ntogether,
          and a consumer can still observe a mismatch, so verifying the\nchecksum
          before use remains necessary. Giving the S3 objects\ndate-stamped names
          plus a small pointer file, matching the history the\nquay.io/osism-mirror
          tags already have, would be the durable fix.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by:
          Roger Luethi <luethi@osism.tech>\n\n---\n\n<sub>Stack created with <a href=\"https://github.com/github/gh-stack\">GitHub
          Stacks CLI</a> \u2022 <a href=\"https://gh.io/stacks-feedback\">Give Feedback
          \U0001F4AC</a></sub>"
        change_url: https://github.com/osism/metalbox/pull/371
        commit_id: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        patchset: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
          src_dir: src/github.com/osism/metalbox
        topic: null
      job: yamllint
      jobtags: []
      max_attempts: 3
      message: bWlycm9yOiB1cGxvYWQgYXJ0aWZhY3RzIGJlZm9yZSB0aGVpciBjaGVja3N1bXMKClRoZSB0aHJlZSBwdWJsaXNoIHBsYXlib29rcyB1cGxvYWRlZCB0aGUgLkNIRUNLU1VNIGZpbGUgYmVmb3JlIHRoZQphcnRpZmFjdCBpdCBkZXNjcmliZXMuIEJvdGggb2JqZWN0cyBoYXZlIGZpeGVkIG5hbWVzIGluIHRoZSBTMyBidWNrZXQKYW5kIG5vIGhpc3RvcnksIGFuZCB0aGUgdHdvIHVwbG9hZHMgYXJlIHNlcGFyYXRlIFBVVHMgd2l0aCBub3RoaW5nCnR5aW5nIHRoZW0gdG9nZXRoZXIsIHNvIHRoZSBwdWJsaXNoZWQgcGFpciBpcyBpbmNvbnNpc3RlbnQgZm9yIHRoZQpkdXJhdGlvbiBvZiB3aGljaGV2ZXIgdXBsb2FkIHJ1bnMgc2Vjb25kLgoKUHV0dGluZyB0aGUgY2hlY2tzdW0gZmlyc3QgbWFrZXMgdGhhdCB3aW5kb3cgdGhlIGVudGlyZSBsYXJnZSB0cmFuc2ZlciwKb24gZXZlcnkgcnVuOiBmb3IgdWJ1bnR1LW5vYmxlLnRhci5iejIgb24gMjAyNi0wOC0wMiB0aGUgY2hlY2tzdW0KbGFuZGVkIGF0IDAxOjEwOjI1IGFuZCB0aGUgNS41MyBHQiB0YXJiYWxsIGF0IDAxOjE2OjIwLCBzbyBmb3Igc2l4Cm1pbnV0ZXMgdGhlIHB1Ymxpc2hlZCBjaGVja3N1bSBkZXNjcmliZWQgYW4gb2JqZWN0IHRoYXQgd2FzIG5vdCB0aGVyZQp5ZXQuIFdvcnNlLCBpZiB0aGUgYXJ0aWZhY3QgdXBsb2FkIGZhaWxzIHRoZSBtaXNtYXRjaCBpcyBwZXJtYW5lbnQKdW50aWwgdGhlIG5leHQgc3VjY2Vzc2Z1bCBydW46IHRoZSBwcmV2aW91cyBhcnRpZmFjdCBpcyBzdGlsbCBpbnRhY3QKYW5kIHN0aWxsIGdvb2QsIGJ1dCB0aGUgY2hlY2tzdW0gbm8gbG9uZ2VyIGRlc2NyaWJlcyBpdCwgc28gYSBjb25zdW1lcgp0aGF0IHZlcmlmaWVzIG11c3QgcmVqZWN0IGl0LiBBIGZhaWxlZCBwdWJsaXNoIHRvb2sgdGhlIGZhbGxiYWNrIGRvd24Kd2l0aCBpdCwgd2hpY2ggZGVmZWF0cyB0aGUgcG9pbnQgb2YgbGVhdmluZyB0aGUgcHJldmlvdXMgYXJ0aWZhY3QgaW4KcGxhY2UuCgpVcGxvYWQgdGhlIGFydGlmYWN0IGZpcnN0IGFuZCB0aGUgY2hlY2tzdW0gbGFzdC4gVGhlIHJvdXRpbmUKaW5jb25zaXN0ZW5jeSB3aW5kb3cgc2hyaW5rcyBmcm9tIHRoZSBsYXJnZSB0cmFuc2ZlciB0byBvbmUgc21hbGwKb2JqZWN0LCBhbmQgYSBmYWlsZWQgYXJ0aWZhY3QgdXBsb2FkIG5vdyBsZWF2ZXMgdGhlIHByZXZpb3VzIGFydGlmYWN0CmFuZCBpdHMgbWF0Y2hpbmcgY2hlY2tzdW0gYm90aCBpbiBwbGFjZS4KCm1pcnJvci1jb250YWluZXItaW1hZ2VzLnltbCBoYWQgbm8gYHNldCAtZWAgaW4gaXRzIHVwbG9hZCBibG9jaywgc28gdGhlCnNlY29uZCByY2xvbmUgcmFuIGV2ZW4gd2hlbiB0aGUgZmlyc3QgaGFkIGZhaWxlZC4gVGhlIG9yZGVyaW5nIG9ubHkKbWVhbnMgYW55dGhpbmcgaWYgYSBmYWlsZWQgYXJ0aWZhY3QgdXBsb2FkIGFib3J0cyBiZWZvcmUgdGhlIGNoZWNrc3VtCmlzIHB1Ymxpc2hlZCwgc28gYWRkIGl0IHRoZXJlLgoKVGhpcyBkb2VzIG5vdCBtYWtlIHB1Ymxpc2hpbmcgYXRvbWljIC0tIHR3byBvYmplY3RzIGNhbm5vdCBiZSB1cGRhdGVkCnRvZ2V0aGVyLCBhbmQgYSBjb25zdW1lciBjYW4gc3RpbGwgb2JzZXJ2ZSBhIG1pc21hdGNoLCBzbyB2ZXJpZnlpbmcgdGhlCmNoZWNrc3VtIGJlZm9yZSB1c2UgcmVtYWlucyBuZWNlc3NhcnkuIEdpdmluZyB0aGUgUzMgb2JqZWN0cwpkYXRlLXN0YW1wZWQgbmFtZXMgcGx1cyBhIHNtYWxsIHBvaW50ZXIgZmlsZSwgbWF0Y2hpbmcgdGhlIGhpc3RvcnkgdGhlCnF1YXkuaW8vb3Npc20tbWlycm9yIHRhZ3MgYWxyZWFkeSBoYXZlLCB3b3VsZCBiZSB0aGUgZHVyYWJsZSBmaXguCgpBc3Npc3RlZC1ieTogQ2xhdWRlOmNsYXVkZS1vcHVzLTUKU2lnbmVkLW9mZi1ieTogUm9nZXIgTHVldGhpIDxsdWV0aGlAb3Npc20udGVjaD4KCi0tLQoKPHN1Yj5TdGFjayBjcmVhdGVkIHdpdGggPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL2dpdGh1Yi9naC1zdGFjayI+R2l0SHViIFN0YWNrcyBDTEk8L2E+IOKAoiA8YSBocmVmPSJodHRwczovL2doLmlvL3N0YWNrcy1mZWVkYmFjayI+R2l2ZSBGZWVkYmFjayDwn5KsPC9hPjwvc3ViPg==
      patchset: 102b7bae547efb144ea843f9fd23cbbc9b9c3c0e
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/yamllint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/metalbox
        name: osism/metalbox
        short_name: metalbox
        src_dir: src/github.com/osism/metalbox
      projects:
        github.com/osism/metalbox:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          checkout: main
          checkout_description: zuul branch
          commit: ab01d8b435f87d78ef4d0eca350980785481d545
          name: osism/metalbox
          required: false
          short_name: metalbox
          src_dir: src/github.com/osism/metalbox
      ref: refs/pull/371/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
