all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fed8:d8df
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 48ee0a35-7730-4d70-9730-04c123a32192
        host_id: 7f2607eceb24f4583c6f9496c53c64b51afe50de5eacda4379b21c42
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fed8:d8df
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.110
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.102
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fed8:d8df
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/container-image-kolla-ansible/.zuul.yaml@main#163>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 47de2951c69a45d0bc8a5e1ae6d43d4c
      build_refs:
      - branch: main
        change: '939'
        change_message: "nova: report the real error when the Libvirt checks cannot
          run\n\nkolla-ansible's `nova-cell` version check starts throwaway containers
          with\n`failed_when: false` and then consumes the registered result as if
          it had\nsucceeded. When the container start fails \u2014 image pull, container
          create,\noneshot start, or an exception inside `kolla_container` itself
          \u2014 the result\ncarries only `msg`, never `stdout`, and the real error
          is thrown away in favour\nof a misleading one.\n\nTwo sibling blocks in
          `ansible/roles/nova-cell/tasks/version-check.yml` have the\npattern, one
          patch each:\n\n| producer \u2192 consumer | consumer expression | what the
          operator sees today |\n|---|---|---|\n| `Get new Libvirt version` \u2192
          `Cache new Libvirt version` | `libvirt_version_new.stdout`, unguarded |
          play dies with `'dict object' has no attribute 'stdout'`, pointing at the
          **wrong task** |\n| `Look for kolla_nova_libvirt_start in the nova_libvirt
          image` \u2192 `Assert the nova_libvirt image is recent enough` | `nova_libvirt_script_check.stdout
          \\| default('')` | assert fails with *\"\u2026the container image has not
          been updated\"* \u2014 a **confidently wrong diagnosis** |\n\nThe second
          is the worse of the two: it does not crash, it sends the operator off\nto
          rebuild or re-pull an image that was never the problem.\n\nThis is reachable
          on every OSISM compute node. The block is gated on\n`enable_nova_libvirt_container`,
          which OSISM leaves at the kolla default with\n`nova_compute_virt_type: kvm`,
          and the version check is the *first* thing\n`nova-cell` does (`deploy.yml:5`)
          \u2014 so on an upgrade it is the first moment a\ncompute node ever asks
          the registry for the new `nova-libvirt` tag.\n\n## Root cause\n\n`stdout`
          is added to the module result only at the very end of\n`start_container()`,
          in the `not detach` branch\n(`ansible/module_utils/kolla_docker_worker.py:396-405`):\n\n```python\nif
          not self.check_image():\n    self.pull_image()          # registry/mirror
          problems land here\n\u2026\n    self.create_container()    # name conflicts,
          daemon errors\n\u2026\n    self.dc.start(\u2026)           # oneshot start\nif
          not self.params.get('detach'):\n    rc = self.dc.wait(\u2026)\n    self.result['stdout']
          = self.dc.logs(\u2026)   # first point stdout exists\n```\n\nEverything
          before that line fails `stdout`-less. `failed_when: false` rewrites\nthat
          failure into a green `changed` result, and the consumer then templates\n`.stdout`
          on a dict that holds only `msg`. A container exiting non-zero is *not*\naffected
          \u2014 that path reports `stdout` \u2014 which pins the masked window to
          strictly\nbefore `dc.wait()`.\n\nThe error is hidden, not lost: Ansible
          prints it at verbosity \u2265 1. Under OSISM\nthat needs `osism apply nova
          -- -vv`, because the `osism` CLI consumes a bare\n`-v` itself.\n\n## Evidence\n\nReproduced
          end to end on a live, supported OSISM cluster (tbng/regiocloud, OSISM\n`0.20260729.1`,
          OpenStack 2025.2, all Ubuntu 24.04) by pointing the image at an\nunreachable
          registry:\n\n```\nosism apply nova --tags nova-cell \\\n  -e nova_libvirt_image_full=127.0.0.1:1/kolla/nova-libvirt:no-such-tag\n```\n\n`Get
          new Libvirt version` reported `changed: [testbed-node-3]` \u2014 green,
          no\nwarning \u2014 and the next task produced the reported message character
          for\ncharacter. The ARA record of the swallowed result has content keys\n`['changed',
          'failed_when_result', 'invocation', 'msg']`, no `stdout`, with the\nreal
          traceback (`start_container()` \u2192 `pull_image()` \u2192 `docker.errors.APIError:\n500
          \u2026 connection refused`) in `msg`.\n\n## Verification\n\n- **Applies
          clean.** Replicated the Containerfile loop (`patch --forward\n  --batch
          -p1` over `LC_ALL=C sort`, dry-run then apply) against fresh\n  `stable/2025.1`
          and `stable/2025.2` trees with the complete patch set \u2014 28 and\n  25
          patches \u2014 all applying with no failures, and the resulting\n  `version-check.yml`
          matching the intended content. No other OSISM patch\n  touches this file.\n-
          **Three live `nova-cell` applies on the tbng 2025.2 cluster**, patched file\n
          \ `docker cp`'d into the `kolla-ansible` container, stock file restored
          and md5\n  confirmed afterwards:\n  1. Unreachable registry \u2192 fails
          in *Fail if the new Libvirt version could not\n     be determined* with
          the docker `APIError` from the pull, **at default\n     verbosity**, instead
          of `'dict object' has no attribute 'stdout'`.\n  2. Unreachable registry
          plus `--skip-tags nova-libvirt-version-check`, so the\n     script check
          is reached \u2192 fails in *Fail if the nova_libvirt image could\n     not
          be inspected*, and the stale-image assert does **not** fire (0\n     occurrences
          of \"does not contain\").\n  3. Unmodified run \u2192 `exit 0`, `failed=0`,
          both new tasks skipped, `nova-cell`\n     converges as before. Cluster re-converged
          clean.\n- **Ansible semantics.** The version-check condition tests the registered\n
          \ `stdout` with `is not search(...)` rather than the cached fact, so it
          does not\n  depend on how an unmatched `regex_search` renders (empty string
          on\n  ansible-core 2.18, `None` under native Jinja 2.19+). It also catches
          container\n  output the regex cannot parse, which would otherwise reach
          the version\n  comparison as an empty string and produce the next confusing
          error.\n\n## Scope\n\nOnly `patches/2025.1/` and `patches/2025.2/`: the
          version check landed in\nkolla-ansible `stable/2025.1` and does not exist
          in 2023.2, 2024.1 or 2024.2,\nand there is no `patches/2026.1/` here yet.
          The two files are byte-identical\nbetween the release directories \u2014
          upstream `version-check.yml` is identical on\nboth branches.\n\nBoth patches
          keep the Libvirt-downgrade guard itself intact; they only make the\nfailure
          path honest.\n\n## Upstream\n\nDeliberately trialled here first. Nothing
          is filed on Launchpad or Gerrit yet \u2014\nthe intent is to let these prove
          themselves downstream, then propose site 1 to\n`master` with backports and
          site 2 directly to the stable branches (`master` has\nno script-check block;
          it was added during the backports at a reviewer's\nrequest, <https://review.opendev.org/c/openstack/kolla-ansible/+/993458>).
          A\n`master` change will also need FQCN (`ansible.builtin.fail`), which the
          stable\nbranches do not.\n\nNothing in 12 patchsets of review on\n<https://review.opendev.org/c/openstack/kolla-ansible/+/942925>,
          in the original\ncommit, or in bug #2120290 ever mentions `failed_when:
          false` \u2014 so there is no\nintended behaviour being changed here.\n\nRelated:\n\n-
          osism/issues#1431\n\nDraft: opened for review while the reporting client's
          actual `msg` is still\noutstanding; the patches stand on their own, but
          a second opinion on the wording\nof the two new failure messages is welcome
          before marking ready.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-image-kolla-ansible/pull/939
        commit_id: d279fe8f339271325fcac811e9678a542a65df6f
        patchset: d279fe8f339271325fcac811e9678a542a65df6f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-kolla-ansible
          name: osism/container-image-kolla-ansible
          short_name: container-image-kolla-ansible
        src_dir: src/github.com/osism/container-image-kolla-ansible
        topic: null
      buildset: ed5cf7e91d214a78b50270d74bee3616
      buildset_refs:
      - branch: main
        change: '939'
        change_message: "nova: report the real error when the Libvirt checks cannot
          run\n\nkolla-ansible's `nova-cell` version check starts throwaway containers
          with\n`failed_when: false` and then consumes the registered result as if
          it had\nsucceeded. When the container start fails \u2014 image pull, container
          create,\noneshot start, or an exception inside `kolla_container` itself
          \u2014 the result\ncarries only `msg`, never `stdout`, and the real error
          is thrown away in favour\nof a misleading one.\n\nTwo sibling blocks in
          `ansible/roles/nova-cell/tasks/version-check.yml` have the\npattern, one
          patch each:\n\n| producer \u2192 consumer | consumer expression | what the
          operator sees today |\n|---|---|---|\n| `Get new Libvirt version` \u2192
          `Cache new Libvirt version` | `libvirt_version_new.stdout`, unguarded |
          play dies with `'dict object' has no attribute 'stdout'`, pointing at the
          **wrong task** |\n| `Look for kolla_nova_libvirt_start in the nova_libvirt
          image` \u2192 `Assert the nova_libvirt image is recent enough` | `nova_libvirt_script_check.stdout
          \\| default('')` | assert fails with *\"\u2026the container image has not
          been updated\"* \u2014 a **confidently wrong diagnosis** |\n\nThe second
          is the worse of the two: it does not crash, it sends the operator off\nto
          rebuild or re-pull an image that was never the problem.\n\nThis is reachable
          on every OSISM compute node. The block is gated on\n`enable_nova_libvirt_container`,
          which OSISM leaves at the kolla default with\n`nova_compute_virt_type: kvm`,
          and the version check is the *first* thing\n`nova-cell` does (`deploy.yml:5`)
          \u2014 so on an upgrade it is the first moment a\ncompute node ever asks
          the registry for the new `nova-libvirt` tag.\n\n## Root cause\n\n`stdout`
          is added to the module result only at the very end of\n`start_container()`,
          in the `not detach` branch\n(`ansible/module_utils/kolla_docker_worker.py:396-405`):\n\n```python\nif
          not self.check_image():\n    self.pull_image()          # registry/mirror
          problems land here\n\u2026\n    self.create_container()    # name conflicts,
          daemon errors\n\u2026\n    self.dc.start(\u2026)           # oneshot start\nif
          not self.params.get('detach'):\n    rc = self.dc.wait(\u2026)\n    self.result['stdout']
          = self.dc.logs(\u2026)   # first point stdout exists\n```\n\nEverything
          before that line fails `stdout`-less. `failed_when: false` rewrites\nthat
          failure into a green `changed` result, and the consumer then templates\n`.stdout`
          on a dict that holds only `msg`. A container exiting non-zero is *not*\naffected
          \u2014 that path reports `stdout` \u2014 which pins the masked window to
          strictly\nbefore `dc.wait()`.\n\nThe error is hidden, not lost: Ansible
          prints it at verbosity \u2265 1. Under OSISM\nthat needs `osism apply nova
          -- -vv`, because the `osism` CLI consumes a bare\n`-v` itself.\n\n## Evidence\n\nReproduced
          end to end on a live, supported OSISM cluster (tbng/regiocloud, OSISM\n`0.20260729.1`,
          OpenStack 2025.2, all Ubuntu 24.04) by pointing the image at an\nunreachable
          registry:\n\n```\nosism apply nova --tags nova-cell \\\n  -e nova_libvirt_image_full=127.0.0.1:1/kolla/nova-libvirt:no-such-tag\n```\n\n`Get
          new Libvirt version` reported `changed: [testbed-node-3]` \u2014 green,
          no\nwarning \u2014 and the next task produced the reported message character
          for\ncharacter. The ARA record of the swallowed result has content keys\n`['changed',
          'failed_when_result', 'invocation', 'msg']`, no `stdout`, with the\nreal
          traceback (`start_container()` \u2192 `pull_image()` \u2192 `docker.errors.APIError:\n500
          \u2026 connection refused`) in `msg`.\n\n## Verification\n\n- **Applies
          clean.** Replicated the Containerfile loop (`patch --forward\n  --batch
          -p1` over `LC_ALL=C sort`, dry-run then apply) against fresh\n  `stable/2025.1`
          and `stable/2025.2` trees with the complete patch set \u2014 28 and\n  25
          patches \u2014 all applying with no failures, and the resulting\n  `version-check.yml`
          matching the intended content. No other OSISM patch\n  touches this file.\n-
          **Three live `nova-cell` applies on the tbng 2025.2 cluster**, patched file\n
          \ `docker cp`'d into the `kolla-ansible` container, stock file restored
          and md5\n  confirmed afterwards:\n  1. Unreachable registry \u2192 fails
          in *Fail if the new Libvirt version could not\n     be determined* with
          the docker `APIError` from the pull, **at default\n     verbosity**, instead
          of `'dict object' has no attribute 'stdout'`.\n  2. Unreachable registry
          plus `--skip-tags nova-libvirt-version-check`, so the\n     script check
          is reached \u2192 fails in *Fail if the nova_libvirt image could\n     not
          be inspected*, and the stale-image assert does **not** fire (0\n     occurrences
          of \"does not contain\").\n  3. Unmodified run \u2192 `exit 0`, `failed=0`,
          both new tasks skipped, `nova-cell`\n     converges as before. Cluster re-converged
          clean.\n- **Ansible semantics.** The version-check condition tests the registered\n
          \ `stdout` with `is not search(...)` rather than the cached fact, so it
          does not\n  depend on how an unmatched `regex_search` renders (empty string
          on\n  ansible-core 2.18, `None` under native Jinja 2.19+). It also catches
          container\n  output the regex cannot parse, which would otherwise reach
          the version\n  comparison as an empty string and produce the next confusing
          error.\n\n## Scope\n\nOnly `patches/2025.1/` and `patches/2025.2/`: the
          version check landed in\nkolla-ansible `stable/2025.1` and does not exist
          in 2023.2, 2024.1 or 2024.2,\nand there is no `patches/2026.1/` here yet.
          The two files are byte-identical\nbetween the release directories \u2014
          upstream `version-check.yml` is identical on\nboth branches.\n\nBoth patches
          keep the Libvirt-downgrade guard itself intact; they only make the\nfailure
          path honest.\n\n## Upstream\n\nDeliberately trialled here first. Nothing
          is filed on Launchpad or Gerrit yet \u2014\nthe intent is to let these prove
          themselves downstream, then propose site 1 to\n`master` with backports and
          site 2 directly to the stable branches (`master` has\nno script-check block;
          it was added during the backports at a reviewer's\nrequest, <https://review.opendev.org/c/openstack/kolla-ansible/+/993458>).
          A\n`master` change will also need FQCN (`ansible.builtin.fail`), which the
          stable\nbranches do not.\n\nNothing in 12 patchsets of review on\n<https://review.opendev.org/c/openstack/kolla-ansible/+/942925>,
          in the original\ncommit, or in bug #2120290 ever mentions `failed_when:
          false` \u2014 so there is no\nintended behaviour being changed here.\n\nRelated:\n\n-
          osism/issues#1431\n\nDraft: opened for review while the reporting client's
          actual `msg` is still\noutstanding; the patches stand on their own, but
          a second opinion on the wording\nof the two new failure messages is welcome
          before marking ready.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-image-kolla-ansible/pull/939
        commit_id: d279fe8f339271325fcac811e9678a542a65df6f
        patchset: d279fe8f339271325fcac811e9678a542a65df6f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-kolla-ansible
          name: osism/container-image-kolla-ansible
          short_name: container-image-kolla-ansible
        src_dir: src/github.com/osism/container-image-kolla-ansible
        topic: null
      change: '939'
      change_message: "nova: report the real error when the Libvirt checks cannot
        run\n\nkolla-ansible's `nova-cell` version check starts throwaway containers
        with\n`failed_when: false` and then consumes the registered result as if it
        had\nsucceeded. When the container start fails \u2014 image pull, container
        create,\noneshot start, or an exception inside `kolla_container` itself \u2014
        the result\ncarries only `msg`, never `stdout`, and the real error is thrown
        away in favour\nof a misleading one.\n\nTwo sibling blocks in `ansible/roles/nova-cell/tasks/version-check.yml`
        have the\npattern, one patch each:\n\n| producer \u2192 consumer | consumer
        expression | what the operator sees today |\n|---|---|---|\n| `Get new Libvirt
        version` \u2192 `Cache new Libvirt version` | `libvirt_version_new.stdout`,
        unguarded | play dies with `'dict object' has no attribute 'stdout'`, pointing
        at the **wrong task** |\n| `Look for kolla_nova_libvirt_start in the nova_libvirt
        image` \u2192 `Assert the nova_libvirt image is recent enough` | `nova_libvirt_script_check.stdout
        \\| default('')` | assert fails with *\"\u2026the container image has not
        been updated\"* \u2014 a **confidently wrong diagnosis** |\n\nThe second is
        the worse of the two: it does not crash, it sends the operator off\nto rebuild
        or re-pull an image that was never the problem.\n\nThis is reachable on every
        OSISM compute node. The block is gated on\n`enable_nova_libvirt_container`,
        which OSISM leaves at the kolla default with\n`nova_compute_virt_type: kvm`,
        and the version check is the *first* thing\n`nova-cell` does (`deploy.yml:5`)
        \u2014 so on an upgrade it is the first moment a\ncompute node ever asks the
        registry for the new `nova-libvirt` tag.\n\n## Root cause\n\n`stdout` is added
        to the module result only at the very end of\n`start_container()`, in the
        `not detach` branch\n(`ansible/module_utils/kolla_docker_worker.py:396-405`):\n\n```python\nif
        not self.check_image():\n    self.pull_image()          # registry/mirror
        problems land here\n\u2026\n    self.create_container()    # name conflicts,
        daemon errors\n\u2026\n    self.dc.start(\u2026)           # oneshot start\nif
        not self.params.get('detach'):\n    rc = self.dc.wait(\u2026)\n    self.result['stdout']
        = self.dc.logs(\u2026)   # first point stdout exists\n```\n\nEverything before
        that line fails `stdout`-less. `failed_when: false` rewrites\nthat failure
        into a green `changed` result, and the consumer then templates\n`.stdout`
        on a dict that holds only `msg`. A container exiting non-zero is *not*\naffected
        \u2014 that path reports `stdout` \u2014 which pins the masked window to strictly\nbefore
        `dc.wait()`.\n\nThe error is hidden, not lost: Ansible prints it at verbosity
        \u2265 1. Under OSISM\nthat needs `osism apply nova -- -vv`, because the `osism`
        CLI consumes a bare\n`-v` itself.\n\n## Evidence\n\nReproduced end to end
        on a live, supported OSISM cluster (tbng/regiocloud, OSISM\n`0.20260729.1`,
        OpenStack 2025.2, all Ubuntu 24.04) by pointing the image at an\nunreachable
        registry:\n\n```\nosism apply nova --tags nova-cell \\\n  -e nova_libvirt_image_full=127.0.0.1:1/kolla/nova-libvirt:no-such-tag\n```\n\n`Get
        new Libvirt version` reported `changed: [testbed-node-3]` \u2014 green, no\nwarning
        \u2014 and the next task produced the reported message character for\ncharacter.
        The ARA record of the swallowed result has content keys\n`['changed', 'failed_when_result',
        'invocation', 'msg']`, no `stdout`, with the\nreal traceback (`start_container()`
        \u2192 `pull_image()` \u2192 `docker.errors.APIError:\n500 \u2026 connection
        refused`) in `msg`.\n\n## Verification\n\n- **Applies clean.** Replicated
        the Containerfile loop (`patch --forward\n  --batch -p1` over `LC_ALL=C sort`,
        dry-run then apply) against fresh\n  `stable/2025.1` and `stable/2025.2` trees
        with the complete patch set \u2014 28 and\n  25 patches \u2014 all applying
        with no failures, and the resulting\n  `version-check.yml` matching the intended
        content. No other OSISM patch\n  touches this file.\n- **Three live `nova-cell`
        applies on the tbng 2025.2 cluster**, patched file\n  `docker cp`'d into the
        `kolla-ansible` container, stock file restored and md5\n  confirmed afterwards:\n
        \ 1. Unreachable registry \u2192 fails in *Fail if the new Libvirt version
        could not\n     be determined* with the docker `APIError` from the pull, **at
        default\n     verbosity**, instead of `'dict object' has no attribute 'stdout'`.\n
        \ 2. Unreachable registry plus `--skip-tags nova-libvirt-version-check`, so
        the\n     script check is reached \u2192 fails in *Fail if the nova_libvirt
        image could\n     not be inspected*, and the stale-image assert does **not**
        fire (0\n     occurrences of \"does not contain\").\n  3. Unmodified run \u2192
        `exit 0`, `failed=0`, both new tasks skipped, `nova-cell`\n     converges
        as before. Cluster re-converged clean.\n- **Ansible semantics.** The version-check
        condition tests the registered\n  `stdout` with `is not search(...)` rather
        than the cached fact, so it does not\n  depend on how an unmatched `regex_search`
        renders (empty string on\n  ansible-core 2.18, `None` under native Jinja 2.19+).
        It also catches container\n  output the regex cannot parse, which would otherwise
        reach the version\n  comparison as an empty string and produce the next confusing
        error.\n\n## Scope\n\nOnly `patches/2025.1/` and `patches/2025.2/`: the version
        check landed in\nkolla-ansible `stable/2025.1` and does not exist in 2023.2,
        2024.1 or 2024.2,\nand there is no `patches/2026.1/` here yet. The two files
        are byte-identical\nbetween the release directories \u2014 upstream `version-check.yml`
        is identical on\nboth branches.\n\nBoth patches keep the Libvirt-downgrade
        guard itself intact; they only make the\nfailure path honest.\n\n## Upstream\n\nDeliberately
        trialled here first. Nothing is filed on Launchpad or Gerrit yet \u2014\nthe
        intent is to let these prove themselves downstream, then propose site 1 to\n`master`
        with backports and site 2 directly to the stable branches (`master` has\nno
        script-check block; it was added during the backports at a reviewer's\nrequest,
        <https://review.opendev.org/c/openstack/kolla-ansible/+/993458>). A\n`master`
        change will also need FQCN (`ansible.builtin.fail`), which the stable\nbranches
        do not.\n\nNothing in 12 patchsets of review on\n<https://review.opendev.org/c/openstack/kolla-ansible/+/942925>,
        in the original\ncommit, or in bug #2120290 ever mentions `failed_when: false`
        \u2014 so there is no\nintended behaviour being changed here.\n\nRelated:\n\n-
        osism/issues#1431\n\nDraft: opened for review while the reporting client's
        actual `msg` is still\noutstanding; the patches stand on their own, but a
        second opinion on the wording\nof the two new failure messages is welcome
        before marking ready.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/container-image-kolla-ansible/pull/939
      child_jobs: []
      commit_id: d279fe8f339271325fcac811e9678a542a65df6f
      event_id: 0dee9010-9260-11f1-8bac-2e11e67d0d52
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/47de2951c69a45d0bc8a5e1ae6d43d4c/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/47de2951c69a45d0bc8a5e1ae6d43d4c/work/logs
        result_data_file: /var/lib/zuul/builds/47de2951c69a45d0bc8a5e1ae6d43d4c/work/results.json
        src_root: /var/lib/zuul/builds/47de2951c69a45d0bc8a5e1ae6d43d4c/work/src
        work_root: /var/lib/zuul/builds/47de2951c69a45d0bc8a5e1ae6d43d4c/work
      include_vars: []
      items:
      - branch: main
        change: '939'
        change_message: "nova: report the real error when the Libvirt checks cannot
          run\n\nkolla-ansible's `nova-cell` version check starts throwaway containers
          with\n`failed_when: false` and then consumes the registered result as if
          it had\nsucceeded. When the container start fails \u2014 image pull, container
          create,\noneshot start, or an exception inside `kolla_container` itself
          \u2014 the result\ncarries only `msg`, never `stdout`, and the real error
          is thrown away in favour\nof a misleading one.\n\nTwo sibling blocks in
          `ansible/roles/nova-cell/tasks/version-check.yml` have the\npattern, one
          patch each:\n\n| producer \u2192 consumer | consumer expression | what the
          operator sees today |\n|---|---|---|\n| `Get new Libvirt version` \u2192
          `Cache new Libvirt version` | `libvirt_version_new.stdout`, unguarded |
          play dies with `'dict object' has no attribute 'stdout'`, pointing at the
          **wrong task** |\n| `Look for kolla_nova_libvirt_start in the nova_libvirt
          image` \u2192 `Assert the nova_libvirt image is recent enough` | `nova_libvirt_script_check.stdout
          \\| default('')` | assert fails with *\"\u2026the container image has not
          been updated\"* \u2014 a **confidently wrong diagnosis** |\n\nThe second
          is the worse of the two: it does not crash, it sends the operator off\nto
          rebuild or re-pull an image that was never the problem.\n\nThis is reachable
          on every OSISM compute node. The block is gated on\n`enable_nova_libvirt_container`,
          which OSISM leaves at the kolla default with\n`nova_compute_virt_type: kvm`,
          and the version check is the *first* thing\n`nova-cell` does (`deploy.yml:5`)
          \u2014 so on an upgrade it is the first moment a\ncompute node ever asks
          the registry for the new `nova-libvirt` tag.\n\n## Root cause\n\n`stdout`
          is added to the module result only at the very end of\n`start_container()`,
          in the `not detach` branch\n(`ansible/module_utils/kolla_docker_worker.py:396-405`):\n\n```python\nif
          not self.check_image():\n    self.pull_image()          # registry/mirror
          problems land here\n\u2026\n    self.create_container()    # name conflicts,
          daemon errors\n\u2026\n    self.dc.start(\u2026)           # oneshot start\nif
          not self.params.get('detach'):\n    rc = self.dc.wait(\u2026)\n    self.result['stdout']
          = self.dc.logs(\u2026)   # first point stdout exists\n```\n\nEverything
          before that line fails `stdout`-less. `failed_when: false` rewrites\nthat
          failure into a green `changed` result, and the consumer then templates\n`.stdout`
          on a dict that holds only `msg`. A container exiting non-zero is *not*\naffected
          \u2014 that path reports `stdout` \u2014 which pins the masked window to
          strictly\nbefore `dc.wait()`.\n\nThe error is hidden, not lost: Ansible
          prints it at verbosity \u2265 1. Under OSISM\nthat needs `osism apply nova
          -- -vv`, because the `osism` CLI consumes a bare\n`-v` itself.\n\n## Evidence\n\nReproduced
          end to end on a live, supported OSISM cluster (tbng/regiocloud, OSISM\n`0.20260729.1`,
          OpenStack 2025.2, all Ubuntu 24.04) by pointing the image at an\nunreachable
          registry:\n\n```\nosism apply nova --tags nova-cell \\\n  -e nova_libvirt_image_full=127.0.0.1:1/kolla/nova-libvirt:no-such-tag\n```\n\n`Get
          new Libvirt version` reported `changed: [testbed-node-3]` \u2014 green,
          no\nwarning \u2014 and the next task produced the reported message character
          for\ncharacter. The ARA record of the swallowed result has content keys\n`['changed',
          'failed_when_result', 'invocation', 'msg']`, no `stdout`, with the\nreal
          traceback (`start_container()` \u2192 `pull_image()` \u2192 `docker.errors.APIError:\n500
          \u2026 connection refused`) in `msg`.\n\n## Verification\n\n- **Applies
          clean.** Replicated the Containerfile loop (`patch --forward\n  --batch
          -p1` over `LC_ALL=C sort`, dry-run then apply) against fresh\n  `stable/2025.1`
          and `stable/2025.2` trees with the complete patch set \u2014 28 and\n  25
          patches \u2014 all applying with no failures, and the resulting\n  `version-check.yml`
          matching the intended content. No other OSISM patch\n  touches this file.\n-
          **Three live `nova-cell` applies on the tbng 2025.2 cluster**, patched file\n
          \ `docker cp`'d into the `kolla-ansible` container, stock file restored
          and md5\n  confirmed afterwards:\n  1. Unreachable registry \u2192 fails
          in *Fail if the new Libvirt version could not\n     be determined* with
          the docker `APIError` from the pull, **at default\n     verbosity**, instead
          of `'dict object' has no attribute 'stdout'`.\n  2. Unreachable registry
          plus `--skip-tags nova-libvirt-version-check`, so the\n     script check
          is reached \u2192 fails in *Fail if the nova_libvirt image could\n     not
          be inspected*, and the stale-image assert does **not** fire (0\n     occurrences
          of \"does not contain\").\n  3. Unmodified run \u2192 `exit 0`, `failed=0`,
          both new tasks skipped, `nova-cell`\n     converges as before. Cluster re-converged
          clean.\n- **Ansible semantics.** The version-check condition tests the registered\n
          \ `stdout` with `is not search(...)` rather than the cached fact, so it
          does not\n  depend on how an unmatched `regex_search` renders (empty string
          on\n  ansible-core 2.18, `None` under native Jinja 2.19+). It also catches
          container\n  output the regex cannot parse, which would otherwise reach
          the version\n  comparison as an empty string and produce the next confusing
          error.\n\n## Scope\n\nOnly `patches/2025.1/` and `patches/2025.2/`: the
          version check landed in\nkolla-ansible `stable/2025.1` and does not exist
          in 2023.2, 2024.1 or 2024.2,\nand there is no `patches/2026.1/` here yet.
          The two files are byte-identical\nbetween the release directories \u2014
          upstream `version-check.yml` is identical on\nboth branches.\n\nBoth patches
          keep the Libvirt-downgrade guard itself intact; they only make the\nfailure
          path honest.\n\n## Upstream\n\nDeliberately trialled here first. Nothing
          is filed on Launchpad or Gerrit yet \u2014\nthe intent is to let these prove
          themselves downstream, then propose site 1 to\n`master` with backports and
          site 2 directly to the stable branches (`master` has\nno script-check block;
          it was added during the backports at a reviewer's\nrequest, <https://review.opendev.org/c/openstack/kolla-ansible/+/993458>).
          A\n`master` change will also need FQCN (`ansible.builtin.fail`), which the
          stable\nbranches do not.\n\nNothing in 12 patchsets of review on\n<https://review.opendev.org/c/openstack/kolla-ansible/+/942925>,
          in the original\ncommit, or in bug #2120290 ever mentions `failed_when:
          false` \u2014 so there is no\nintended behaviour being changed here.\n\nRelated:\n\n-
          osism/issues#1431\n\nDraft: opened for review while the reporting client's
          actual `msg` is still\noutstanding; the patches stand on their own, but
          a second opinion on the wording\nof the two new failure messages is welcome
          before marking ready.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-image-kolla-ansible/pull/939
        commit_id: d279fe8f339271325fcac811e9678a542a65df6f
        patchset: d279fe8f339271325fcac811e9678a542a65df6f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-kolla-ansible
          name: osism/container-image-kolla-ansible
          short_name: container-image-kolla-ansible
          src_dir: src/github.com/osism/container-image-kolla-ansible
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: bm92YTogcmVwb3J0IHRoZSByZWFsIGVycm9yIHdoZW4gdGhlIExpYnZpcnQgY2hlY2tzIGNhbm5vdCBydW4KCmtvbGxhLWFuc2libGUncyBgbm92YS1jZWxsYCB2ZXJzaW9uIGNoZWNrIHN0YXJ0cyB0aHJvd2F3YXkgY29udGFpbmVycyB3aXRoCmBmYWlsZWRfd2hlbjogZmFsc2VgIGFuZCB0aGVuIGNvbnN1bWVzIHRoZSByZWdpc3RlcmVkIHJlc3VsdCBhcyBpZiBpdCBoYWQKc3VjY2VlZGVkLiBXaGVuIHRoZSBjb250YWluZXIgc3RhcnQgZmFpbHMg4oCUIGltYWdlIHB1bGwsIGNvbnRhaW5lciBjcmVhdGUsCm9uZXNob3Qgc3RhcnQsIG9yIGFuIGV4Y2VwdGlvbiBpbnNpZGUgYGtvbGxhX2NvbnRhaW5lcmAgaXRzZWxmIOKAlCB0aGUgcmVzdWx0CmNhcnJpZXMgb25seSBgbXNnYCwgbmV2ZXIgYHN0ZG91dGAsIGFuZCB0aGUgcmVhbCBlcnJvciBpcyB0aHJvd24gYXdheSBpbiBmYXZvdXIKb2YgYSBtaXNsZWFkaW5nIG9uZS4KClR3byBzaWJsaW5nIGJsb2NrcyBpbiBgYW5zaWJsZS9yb2xlcy9ub3ZhLWNlbGwvdGFza3MvdmVyc2lvbi1jaGVjay55bWxgIGhhdmUgdGhlCnBhdHRlcm4sIG9uZSBwYXRjaCBlYWNoOgoKfCBwcm9kdWNlciDihpIgY29uc3VtZXIgfCBjb25zdW1lciBleHByZXNzaW9uIHwgd2hhdCB0aGUgb3BlcmF0b3Igc2VlcyB0b2RheSB8CnwtLS18LS0tfC0tLXwKfCBgR2V0IG5ldyBMaWJ2aXJ0IHZlcnNpb25gIOKGkiBgQ2FjaGUgbmV3IExpYnZpcnQgdmVyc2lvbmAgfCBgbGlidmlydF92ZXJzaW9uX25ldy5zdGRvdXRgLCB1bmd1YXJkZWQgfCBwbGF5IGRpZXMgd2l0aCBgJ2RpY3Qgb2JqZWN0JyBoYXMgbm8gYXR0cmlidXRlICdzdGRvdXQnYCwgcG9pbnRpbmcgYXQgdGhlICoqd3JvbmcgdGFzayoqIHwKfCBgTG9vayBmb3Iga29sbGFfbm92YV9saWJ2aXJ0X3N0YXJ0IGluIHRoZSBub3ZhX2xpYnZpcnQgaW1hZ2VgIOKGkiBgQXNzZXJ0IHRoZSBub3ZhX2xpYnZpcnQgaW1hZ2UgaXMgcmVjZW50IGVub3VnaGAgfCBgbm92YV9saWJ2aXJ0X3NjcmlwdF9jaGVjay5zdGRvdXQgXHwgZGVmYXVsdCgnJylgIHwgYXNzZXJ0IGZhaWxzIHdpdGggKiLigKZ0aGUgY29udGFpbmVyIGltYWdlIGhhcyBub3QgYmVlbiB1cGRhdGVkIiog4oCUIGEgKipjb25maWRlbnRseSB3cm9uZyBkaWFnbm9zaXMqKiB8CgpUaGUgc2Vjb25kIGlzIHRoZSB3b3JzZSBvZiB0aGUgdHdvOiBpdCBkb2VzIG5vdCBjcmFzaCwgaXQgc2VuZHMgdGhlIG9wZXJhdG9yIG9mZgp0byByZWJ1aWxkIG9yIHJlLXB1bGwgYW4gaW1hZ2UgdGhhdCB3YXMgbmV2ZXIgdGhlIHByb2JsZW0uCgpUaGlzIGlzIHJlYWNoYWJsZSBvbiBldmVyeSBPU0lTTSBjb21wdXRlIG5vZGUuIFRoZSBibG9jayBpcyBnYXRlZCBvbgpgZW5hYmxlX25vdmFfbGlidmlydF9jb250YWluZXJgLCB3aGljaCBPU0lTTSBsZWF2ZXMgYXQgdGhlIGtvbGxhIGRlZmF1bHQgd2l0aApgbm92YV9jb21wdXRlX3ZpcnRfdHlwZToga3ZtYCwgYW5kIHRoZSB2ZXJzaW9uIGNoZWNrIGlzIHRoZSAqZmlyc3QqIHRoaW5nCmBub3ZhLWNlbGxgIGRvZXMgKGBkZXBsb3kueW1sOjVgKSDigJQgc28gb24gYW4gdXBncmFkZSBpdCBpcyB0aGUgZmlyc3QgbW9tZW50IGEKY29tcHV0ZSBub2RlIGV2ZXIgYXNrcyB0aGUgcmVnaXN0cnkgZm9yIHRoZSBuZXcgYG5vdmEtbGlidmlydGAgdGFnLgoKIyMgUm9vdCBjYXVzZQoKYHN0ZG91dGAgaXMgYWRkZWQgdG8gdGhlIG1vZHVsZSByZXN1bHQgb25seSBhdCB0aGUgdmVyeSBlbmQgb2YKYHN0YXJ0X2NvbnRhaW5lcigpYCwgaW4gdGhlIGBub3QgZGV0YWNoYCBicmFuY2gKKGBhbnNpYmxlL21vZHVsZV91dGlscy9rb2xsYV9kb2NrZXJfd29ya2VyLnB5OjM5Ni00MDVgKToKCmBgYHB5dGhvbgppZiBub3Qgc2VsZi5jaGVja19pbWFnZSgpOgogICAgc2VsZi5wdWxsX2ltYWdlKCkgICAgICAgICAgIyByZWdpc3RyeS9taXJyb3IgcHJvYmxlbXMgbGFuZCBoZXJlCuKApgogICAgc2VsZi5jcmVhdGVfY29udGFpbmVyKCkgICAgIyBuYW1lIGNvbmZsaWN0cywgZGFlbW9uIGVycm9ycwrigKYKICAgIHNlbGYuZGMuc3RhcnQo4oCmKSAgICAgICAgICAgIyBvbmVzaG90IHN0YXJ0CmlmIG5vdCBzZWxmLnBhcmFtcy5nZXQoJ2RldGFjaCcpOgogICAgcmMgPSBzZWxmLmRjLndhaXQo4oCmKQogICAgc2VsZi5yZXN1bHRbJ3N0ZG91dCddID0gc2VsZi5kYy5sb2dzKOKApikgICAjIGZpcnN0IHBvaW50IHN0ZG91dCBleGlzdHMKYGBgCgpFdmVyeXRoaW5nIGJlZm9yZSB0aGF0IGxpbmUgZmFpbHMgYHN0ZG91dGAtbGVzcy4gYGZhaWxlZF93aGVuOiBmYWxzZWAgcmV3cml0ZXMKdGhhdCBmYWlsdXJlIGludG8gYSBncmVlbiBgY2hhbmdlZGAgcmVzdWx0LCBhbmQgdGhlIGNvbnN1bWVyIHRoZW4gdGVtcGxhdGVzCmAuc3Rkb3V0YCBvbiBhIGRpY3QgdGhhdCBob2xkcyBvbmx5IGBtc2dgLiBBIGNvbnRhaW5lciBleGl0aW5nIG5vbi16ZXJvIGlzICpub3QqCmFmZmVjdGVkIOKAlCB0aGF0IHBhdGggcmVwb3J0cyBgc3Rkb3V0YCDigJQgd2hpY2ggcGlucyB0aGUgbWFza2VkIHdpbmRvdyB0byBzdHJpY3RseQpiZWZvcmUgYGRjLndhaXQoKWAuCgpUaGUgZXJyb3IgaXMgaGlkZGVuLCBub3QgbG9zdDogQW5zaWJsZSBwcmludHMgaXQgYXQgdmVyYm9zaXR5IOKJpSAxLiBVbmRlciBPU0lTTQp0aGF0IG5lZWRzIGBvc2lzbSBhcHBseSBub3ZhIC0tIC12dmAsIGJlY2F1c2UgdGhlIGBvc2lzbWAgQ0xJIGNvbnN1bWVzIGEgYmFyZQpgLXZgIGl0c2VsZi4KCiMjIEV2aWRlbmNlCgpSZXByb2R1Y2VkIGVuZCB0byBlbmQgb24gYSBsaXZlLCBzdXBwb3J0ZWQgT1NJU00gY2x1c3RlciAodGJuZy9yZWdpb2Nsb3VkLCBPU0lTTQpgMC4yMDI2MDcyOS4xYCwgT3BlblN0YWNrIDIwMjUuMiwgYWxsIFVidW50dSAyNC4wNCkgYnkgcG9pbnRpbmcgdGhlIGltYWdlIGF0IGFuCnVucmVhY2hhYmxlIHJlZ2lzdHJ5OgoKYGBgCm9zaXNtIGFwcGx5IG5vdmEgLS10YWdzIG5vdmEtY2VsbCBcCiAgLWUgbm92YV9saWJ2aXJ0X2ltYWdlX2Z1bGw9MTI3LjAuMC4xOjEva29sbGEvbm92YS1saWJ2aXJ0Om5vLXN1Y2gtdGFnCmBgYAoKYEdldCBuZXcgTGlidmlydCB2ZXJzaW9uYCByZXBvcnRlZCBgY2hhbmdlZDogW3Rlc3RiZWQtbm9kZS0zXWAg4oCUIGdyZWVuLCBubwp3YXJuaW5nIOKAlCBhbmQgdGhlIG5leHQgdGFzayBwcm9kdWNlZCB0aGUgcmVwb3J0ZWQgbWVzc2FnZSBjaGFyYWN0ZXIgZm9yCmNoYXJhY3Rlci4gVGhlIEFSQSByZWNvcmQgb2YgdGhlIHN3YWxsb3dlZCByZXN1bHQgaGFzIGNvbnRlbnQga2V5cwpgWydjaGFuZ2VkJywgJ2ZhaWxlZF93aGVuX3Jlc3VsdCcsICdpbnZvY2F0aW9uJywgJ21zZyddYCwgbm8gYHN0ZG91dGAsIHdpdGggdGhlCnJlYWwgdHJhY2ViYWNrIChgc3RhcnRfY29udGFpbmVyKClgIOKGkiBgcHVsbF9pbWFnZSgpYCDihpIgYGRvY2tlci5lcnJvcnMuQVBJRXJyb3I6CjUwMCDigKYgY29ubmVjdGlvbiByZWZ1c2VkYCkgaW4gYG1zZ2AuCgojIyBWZXJpZmljYXRpb24KCi0gKipBcHBsaWVzIGNsZWFuLioqIFJlcGxpY2F0ZWQgdGhlIENvbnRhaW5lcmZpbGUgbG9vcCAoYHBhdGNoIC0tZm9yd2FyZAogIC0tYmF0Y2ggLXAxYCBvdmVyIGBMQ19BTEw9QyBzb3J0YCwgZHJ5LXJ1biB0aGVuIGFwcGx5KSBhZ2FpbnN0IGZyZXNoCiAgYHN0YWJsZS8yMDI1LjFgIGFuZCBgc3RhYmxlLzIwMjUuMmAgdHJlZXMgd2l0aCB0aGUgY29tcGxldGUgcGF0Y2ggc2V0IOKAlCAyOCBhbmQKICAyNSBwYXRjaGVzIOKAlCBhbGwgYXBwbHlpbmcgd2l0aCBubyBmYWlsdXJlcywgYW5kIHRoZSByZXN1bHRpbmcKICBgdmVyc2lvbi1jaGVjay55bWxgIG1hdGNoaW5nIHRoZSBpbnRlbmRlZCBjb250ZW50LiBObyBvdGhlciBPU0lTTSBwYXRjaAogIHRvdWNoZXMgdGhpcyBmaWxlLgotICoqVGhyZWUgbGl2ZSBgbm92YS1jZWxsYCBhcHBsaWVzIG9uIHRoZSB0Ym5nIDIwMjUuMiBjbHVzdGVyKiosIHBhdGNoZWQgZmlsZQogIGBkb2NrZXIgY3BgJ2QgaW50byB0aGUgYGtvbGxhLWFuc2libGVgIGNvbnRhaW5lciwgc3RvY2sgZmlsZSByZXN0b3JlZCBhbmQgbWQ1CiAgY29uZmlybWVkIGFmdGVyd2FyZHM6CiAgMS4gVW5yZWFjaGFibGUgcmVnaXN0cnkg4oaSIGZhaWxzIGluICpGYWlsIGlmIHRoZSBuZXcgTGlidmlydCB2ZXJzaW9uIGNvdWxkIG5vdAogICAgIGJlIGRldGVybWluZWQqIHdpdGggdGhlIGRvY2tlciBgQVBJRXJyb3JgIGZyb20gdGhlIHB1bGwsICoqYXQgZGVmYXVsdAogICAgIHZlcmJvc2l0eSoqLCBpbnN0ZWFkIG9mIGAnZGljdCBvYmplY3QnIGhhcyBubyBhdHRyaWJ1dGUgJ3N0ZG91dCdgLgogIDIuIFVucmVhY2hhYmxlIHJlZ2lzdHJ5IHBsdXMgYC0tc2tpcC10YWdzIG5vdmEtbGlidmlydC12ZXJzaW9uLWNoZWNrYCwgc28gdGhlCiAgICAgc2NyaXB0IGNoZWNrIGlzIHJlYWNoZWQg4oaSIGZhaWxzIGluICpGYWlsIGlmIHRoZSBub3ZhX2xpYnZpcnQgaW1hZ2UgY291bGQKICAgICBub3QgYmUgaW5zcGVjdGVkKiwgYW5kIHRoZSBzdGFsZS1pbWFnZSBhc3NlcnQgZG9lcyAqKm5vdCoqIGZpcmUgKDAKICAgICBvY2N1cnJlbmNlcyBvZiAiZG9lcyBub3QgY29udGFpbiIpLgogIDMuIFVubW9kaWZpZWQgcnVuIOKGkiBgZXhpdCAwYCwgYGZhaWxlZD0wYCwgYm90aCBuZXcgdGFza3Mgc2tpcHBlZCwgYG5vdmEtY2VsbGAKICAgICBjb252ZXJnZXMgYXMgYmVmb3JlLiBDbHVzdGVyIHJlLWNvbnZlcmdlZCBjbGVhbi4KLSAqKkFuc2libGUgc2VtYW50aWNzLioqIFRoZSB2ZXJzaW9uLWNoZWNrIGNvbmRpdGlvbiB0ZXN0cyB0aGUgcmVnaXN0ZXJlZAogIGBzdGRvdXRgIHdpdGggYGlzIG5vdCBzZWFyY2goLi4uKWAgcmF0aGVyIHRoYW4gdGhlIGNhY2hlZCBmYWN0LCBzbyBpdCBkb2VzIG5vdAogIGRlcGVuZCBvbiBob3cgYW4gdW5tYXRjaGVkIGByZWdleF9zZWFyY2hgIHJlbmRlcnMgKGVtcHR5IHN0cmluZyBvbgogIGFuc2libGUtY29yZSAyLjE4LCBgTm9uZWAgdW5kZXIgbmF0aXZlIEppbmphIDIuMTkrKS4gSXQgYWxzbyBjYXRjaGVzIGNvbnRhaW5lcgogIG91dHB1dCB0aGUgcmVnZXggY2Fubm90IHBhcnNlLCB3aGljaCB3b3VsZCBvdGhlcndpc2UgcmVhY2ggdGhlIHZlcnNpb24KICBjb21wYXJpc29uIGFzIGFuIGVtcHR5IHN0cmluZyBhbmQgcHJvZHVjZSB0aGUgbmV4dCBjb25mdXNpbmcgZXJyb3IuCgojIyBTY29wZQoKT25seSBgcGF0Y2hlcy8yMDI1LjEvYCBhbmQgYHBhdGNoZXMvMjAyNS4yL2A6IHRoZSB2ZXJzaW9uIGNoZWNrIGxhbmRlZCBpbgprb2xsYS1hbnNpYmxlIGBzdGFibGUvMjAyNS4xYCBhbmQgZG9lcyBub3QgZXhpc3QgaW4gMjAyMy4yLCAyMDI0LjEgb3IgMjAyNC4yLAphbmQgdGhlcmUgaXMgbm8gYHBhdGNoZXMvMjAyNi4xL2AgaGVyZSB5ZXQuIFRoZSB0d28gZmlsZXMgYXJlIGJ5dGUtaWRlbnRpY2FsCmJldHdlZW4gdGhlIHJlbGVhc2UgZGlyZWN0b3JpZXMg4oCUIHVwc3RyZWFtIGB2ZXJzaW9uLWNoZWNrLnltbGAgaXMgaWRlbnRpY2FsIG9uCmJvdGggYnJhbmNoZXMuCgpCb3RoIHBhdGNoZXMga2VlcCB0aGUgTGlidmlydC1kb3duZ3JhZGUgZ3VhcmQgaXRzZWxmIGludGFjdDsgdGhleSBvbmx5IG1ha2UgdGhlCmZhaWx1cmUgcGF0aCBob25lc3QuCgojIyBVcHN0cmVhbQoKRGVsaWJlcmF0ZWx5IHRyaWFsbGVkIGhlcmUgZmlyc3QuIE5vdGhpbmcgaXMgZmlsZWQgb24gTGF1bmNocGFkIG9yIEdlcnJpdCB5ZXQg4oCUCnRoZSBpbnRlbnQgaXMgdG8gbGV0IHRoZXNlIHByb3ZlIHRoZW1zZWx2ZXMgZG93bnN0cmVhbSwgdGhlbiBwcm9wb3NlIHNpdGUgMSB0bwpgbWFzdGVyYCB3aXRoIGJhY2twb3J0cyBhbmQgc2l0ZSAyIGRpcmVjdGx5IHRvIHRoZSBzdGFibGUgYnJhbmNoZXMgKGBtYXN0ZXJgIGhhcwpubyBzY3JpcHQtY2hlY2sgYmxvY2s7IGl0IHdhcyBhZGRlZCBkdXJpbmcgdGhlIGJhY2twb3J0cyBhdCBhIHJldmlld2VyJ3MKcmVxdWVzdCwgPGh0dHBzOi8vcmV2aWV3Lm9wZW5kZXYub3JnL2Mvb3BlbnN0YWNrL2tvbGxhLWFuc2libGUvKy85OTM0NTg+KS4gQQpgbWFzdGVyYCBjaGFuZ2Ugd2lsbCBhbHNvIG5lZWQgRlFDTiAoYGFuc2libGUuYnVpbHRpbi5mYWlsYCksIHdoaWNoIHRoZSBzdGFibGUKYnJhbmNoZXMgZG8gbm90LgoKTm90aGluZyBpbiAxMiBwYXRjaHNldHMgb2YgcmV2aWV3IG9uCjxodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9jL29wZW5zdGFjay9rb2xsYS1hbnNpYmxlLysvOTQyOTI1PiwgaW4gdGhlIG9yaWdpbmFsCmNvbW1pdCwgb3IgaW4gYnVnICMyMTIwMjkwIGV2ZXIgbWVudGlvbnMgYGZhaWxlZF93aGVuOiBmYWxzZWAg4oCUIHNvIHRoZXJlIGlzIG5vCmludGVuZGVkIGJlaGF2aW91ciBiZWluZyBjaGFuZ2VkIGhlcmUuCgpSZWxhdGVkOgoKLSBvc2lzbS9pc3N1ZXMjMTQzMQoKRHJhZnQ6IG9wZW5lZCBmb3IgcmV2aWV3IHdoaWxlIHRoZSByZXBvcnRpbmcgY2xpZW50J3MgYWN0dWFsIGBtc2dgIGlzIHN0aWxsCm91dHN0YW5kaW5nOyB0aGUgcGF0Y2hlcyBzdGFuZCBvbiB0aGVpciBvd24sIGJ1dCBhIHNlY29uZCBvcGluaW9uIG9uIHRoZSB3b3JkaW5nCm9mIHRoZSB0d28gbmV3IGZhaWx1cmUgbWVzc2FnZXMgaXMgd2VsY29tZSBiZWZvcmUgbWFya2luZyByZWFkeS4KCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUpCg==
      patchset: d279fe8f339271325fcac811e9678a542a65df6f
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: b7c70f39598a39998dbbc6f833779355630f3a39
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: b7c70f39598a39998dbbc6f833779355630f3a39
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-image-kolla-ansible
        name: osism/container-image-kolla-ansible
        short_name: container-image-kolla-ansible
        src_dir: src/github.com/osism/container-image-kolla-ansible
      projects:
        github.com/osism/container-image-kolla-ansible:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-image-kolla-ansible
          checkout: main
          checkout_description: zuul branch
          commit: d2eca202853482b2fff2d56cb1cc3c0a0431cf3d
          name: osism/container-image-kolla-ansible
          required: false
          short_name: container-image-kolla-ansible
          src_dir: src/github.com/osism/container-image-kolla-ansible
      ref: refs/pull/939/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
