all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe9b:8c1e
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: fd3581a6-e8b3-4a92-abfb-54eb3e8fed80
        host_id: ec4f54fa666de9bc553bc59c41683f12345b665d0b1af00d715e7318
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe9b:8c1e
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.204
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.201
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe9b:8c1e
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job hadolint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#37>'
      - '<Job hadolint explicit: None implied: None source: osism/container-images/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 55450659afa341719ad527d59abd5dc8
      build_refs:
      - branch: main
        change: '942'
        change_message: "ara-server: revision-suffix the version tag\n\n## Problem\n\n`osism/ara-server`'s
          version tag is derived from the upstream `ara --version` and\npushed with
          a skip-if-exists guard, which makes it effectively **write-once**: once\n`osism/ara-server:1.7.5`
          exists, no rebuild ever re-pushes it. But the image bundles\nOSISM-specific
          content \u2014 a patched `0018` migration and `run.sh` \u2014 that changes\n**without**
          an upstream ARA version bump.\n\nThe result: a fix merged here (the history-preserving
          `0018` migration, `7c62552`)\nnever reaches a version-pinned deployment.
          The nightly build only refreshes\n`:latest`, while `:1.7.5` stays frozen
          at its first build (2026-02-26). OSISM 9\u219210\nupgrades with existing
          ARA history then fail the manager-upgrade health gate on the\ndata-lossy
          stock `0018`.\n\n## Change\n\nTag ara-server as `<ara version>-r<osism revision>`
          (Bitnami-style), e.g.\n`1.7.5-r1`, with the revision read from a new `ara-server/osism-revision`
          file.\nBump `osism-revision` in the same change that touches the ara-server
          image layer; a\nnew immutable tag is then minted instead of going stale.
          Existing tags are never\nmutated and `:latest` keeps tracking `main`.\n\nA
          `-rN` suffix is used, not a 4th dotted segment (`1.7.5.1`), because a dotted\nsegment
          is itself a legal upstream version and would collide the day upstream ships\none.
          `-rN` keeps the OSISM revision in a namespace upstream cannot reach (as
          Debian\ndoes with an upstream-revision). A `+` build-metadata separator
          is unavailable \u2014\nOCI tags forbid `+`.\n\n## Depends on osism/renovate-config#8\n\nFor
          Renovate to **adopt** the new `-rN` tag and re-pin deployments (rather than\ntreat
          it as an opaque variant suffix like `-alpine` and ignore it), the regex\nversioning
          rule must be in place. Merge the companion first or together with this\nPR
          \u2014 pushing a `-rN` tag without it is not harmful, the fix just won't
          auto-propagate\nuntil it lands.\n\n- osism/renovate-config#8\n\n## Draft\n\nDraft
          pending review.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/942
        commit_id: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        patchset: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      buildset: 2e5110b6340e444da5ca250340a35f69
      buildset_refs:
      - branch: main
        change: '942'
        change_message: "ara-server: revision-suffix the version tag\n\n## Problem\n\n`osism/ara-server`'s
          version tag is derived from the upstream `ara --version` and\npushed with
          a skip-if-exists guard, which makes it effectively **write-once**: once\n`osism/ara-server:1.7.5`
          exists, no rebuild ever re-pushes it. But the image bundles\nOSISM-specific
          content \u2014 a patched `0018` migration and `run.sh` \u2014 that changes\n**without**
          an upstream ARA version bump.\n\nThe result: a fix merged here (the history-preserving
          `0018` migration, `7c62552`)\nnever reaches a version-pinned deployment.
          The nightly build only refreshes\n`:latest`, while `:1.7.5` stays frozen
          at its first build (2026-02-26). OSISM 9\u219210\nupgrades with existing
          ARA history then fail the manager-upgrade health gate on the\ndata-lossy
          stock `0018`.\n\n## Change\n\nTag ara-server as `<ara version>-r<osism revision>`
          (Bitnami-style), e.g.\n`1.7.5-r1`, with the revision read from a new `ara-server/osism-revision`
          file.\nBump `osism-revision` in the same change that touches the ara-server
          image layer; a\nnew immutable tag is then minted instead of going stale.
          Existing tags are never\nmutated and `:latest` keeps tracking `main`.\n\nA
          `-rN` suffix is used, not a 4th dotted segment (`1.7.5.1`), because a dotted\nsegment
          is itself a legal upstream version and would collide the day upstream ships\none.
          `-rN` keeps the OSISM revision in a namespace upstream cannot reach (as
          Debian\ndoes with an upstream-revision). A `+` build-metadata separator
          is unavailable \u2014\nOCI tags forbid `+`.\n\n## Depends on osism/renovate-config#8\n\nFor
          Renovate to **adopt** the new `-rN` tag and re-pin deployments (rather than\ntreat
          it as an opaque variant suffix like `-alpine` and ignore it), the regex\nversioning
          rule must be in place. Merge the companion first or together with this\nPR
          \u2014 pushing a `-rN` tag without it is not harmful, the fix just won't
          auto-propagate\nuntil it lands.\n\n- osism/renovate-config#8\n\n## Draft\n\nDraft
          pending review.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/942
        commit_id: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        patchset: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      change: '942'
      change_message: "ara-server: revision-suffix the version tag\n\n## Problem\n\n`osism/ara-server`'s
        version tag is derived from the upstream `ara --version` and\npushed with
        a skip-if-exists guard, which makes it effectively **write-once**: once\n`osism/ara-server:1.7.5`
        exists, no rebuild ever re-pushes it. But the image bundles\nOSISM-specific
        content \u2014 a patched `0018` migration and `run.sh` \u2014 that changes\n**without**
        an upstream ARA version bump.\n\nThe result: a fix merged here (the history-preserving
        `0018` migration, `7c62552`)\nnever reaches a version-pinned deployment. The
        nightly build only refreshes\n`:latest`, while `:1.7.5` stays frozen at its
        first build (2026-02-26). OSISM 9\u219210\nupgrades with existing ARA history
        then fail the manager-upgrade health gate on the\ndata-lossy stock `0018`.\n\n##
        Change\n\nTag ara-server as `<ara version>-r<osism revision>` (Bitnami-style),
        e.g.\n`1.7.5-r1`, with the revision read from a new `ara-server/osism-revision`
        file.\nBump `osism-revision` in the same change that touches the ara-server
        image layer; a\nnew immutable tag is then minted instead of going stale. Existing
        tags are never\nmutated and `:latest` keeps tracking `main`.\n\nA `-rN` suffix
        is used, not a 4th dotted segment (`1.7.5.1`), because a dotted\nsegment is
        itself a legal upstream version and would collide the day upstream ships\none.
        `-rN` keeps the OSISM revision in a namespace upstream cannot reach (as Debian\ndoes
        with an upstream-revision). A `+` build-metadata separator is unavailable
        \u2014\nOCI tags forbid `+`.\n\n## Depends on osism/renovate-config#8\n\nFor
        Renovate to **adopt** the new `-rN` tag and re-pin deployments (rather than\ntreat
        it as an opaque variant suffix like `-alpine` and ignore it), the regex\nversioning
        rule must be in place. Merge the companion first or together with this\nPR
        \u2014 pushing a `-rN` tag without it is not harmful, the fix just won't auto-propagate\nuntil
        it lands.\n\n- osism/renovate-config#8\n\n## Draft\n\nDraft pending review.\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/container-images/pull/942
      child_jobs: []
      commit_id: 30af8d90eab7687031b52b08d48ea091f6a48b5e
      event_id: e489a0a0-7470-11f1-8ffa-158f37f6181a
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/55450659afa341719ad527d59abd5dc8/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/55450659afa341719ad527d59abd5dc8/work/logs
        result_data_file: /var/lib/zuul/builds/55450659afa341719ad527d59abd5dc8/work/results.json
        src_root: /var/lib/zuul/builds/55450659afa341719ad527d59abd5dc8/work/src
        work_root: /var/lib/zuul/builds/55450659afa341719ad527d59abd5dc8/work
      include_vars: []
      items:
      - branch: main
        change: '942'
        change_message: "ara-server: revision-suffix the version tag\n\n## Problem\n\n`osism/ara-server`'s
          version tag is derived from the upstream `ara --version` and\npushed with
          a skip-if-exists guard, which makes it effectively **write-once**: once\n`osism/ara-server:1.7.5`
          exists, no rebuild ever re-pushes it. But the image bundles\nOSISM-specific
          content \u2014 a patched `0018` migration and `run.sh` \u2014 that changes\n**without**
          an upstream ARA version bump.\n\nThe result: a fix merged here (the history-preserving
          `0018` migration, `7c62552`)\nnever reaches a version-pinned deployment.
          The nightly build only refreshes\n`:latest`, while `:1.7.5` stays frozen
          at its first build (2026-02-26). OSISM 9\u219210\nupgrades with existing
          ARA history then fail the manager-upgrade health gate on the\ndata-lossy
          stock `0018`.\n\n## Change\n\nTag ara-server as `<ara version>-r<osism revision>`
          (Bitnami-style), e.g.\n`1.7.5-r1`, with the revision read from a new `ara-server/osism-revision`
          file.\nBump `osism-revision` in the same change that touches the ara-server
          image layer; a\nnew immutable tag is then minted instead of going stale.
          Existing tags are never\nmutated and `:latest` keeps tracking `main`.\n\nA
          `-rN` suffix is used, not a 4th dotted segment (`1.7.5.1`), because a dotted\nsegment
          is itself a legal upstream version and would collide the day upstream ships\none.
          `-rN` keeps the OSISM revision in a namespace upstream cannot reach (as
          Debian\ndoes with an upstream-revision). A `+` build-metadata separator
          is unavailable \u2014\nOCI tags forbid `+`.\n\n## Depends on osism/renovate-config#8\n\nFor
          Renovate to **adopt** the new `-rN` tag and re-pin deployments (rather than\ntreat
          it as an opaque variant suffix like `-alpine` and ignore it), the regex\nversioning
          rule must be in place. Merge the companion first or together with this\nPR
          \u2014 pushing a `-rN` tag without it is not harmful, the fix just won't
          auto-propagate\nuntil it lands.\n\n- osism/renovate-config#8\n\n## Draft\n\nDraft
          pending review.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/942
        commit_id: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        patchset: 30af8d90eab7687031b52b08d48ea091f6a48b5e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
          src_dir: src/github.com/osism/container-images
        topic: null
      job: hadolint
      jobtags: []
      max_attempts: 3
      message: YXJhLXNlcnZlcjogcmV2aXNpb24tc3VmZml4IHRoZSB2ZXJzaW9uIHRhZwoKIyMgUHJvYmxlbQoKYG9zaXNtL2FyYS1zZXJ2ZXJgJ3MgdmVyc2lvbiB0YWcgaXMgZGVyaXZlZCBmcm9tIHRoZSB1cHN0cmVhbSBgYXJhIC0tdmVyc2lvbmAgYW5kCnB1c2hlZCB3aXRoIGEgc2tpcC1pZi1leGlzdHMgZ3VhcmQsIHdoaWNoIG1ha2VzIGl0IGVmZmVjdGl2ZWx5ICoqd3JpdGUtb25jZSoqOiBvbmNlCmBvc2lzbS9hcmEtc2VydmVyOjEuNy41YCBleGlzdHMsIG5vIHJlYnVpbGQgZXZlciByZS1wdXNoZXMgaXQuIEJ1dCB0aGUgaW1hZ2UgYnVuZGxlcwpPU0lTTS1zcGVjaWZpYyBjb250ZW50IOKAlCBhIHBhdGNoZWQgYDAwMThgIG1pZ3JhdGlvbiBhbmQgYHJ1bi5zaGAg4oCUIHRoYXQgY2hhbmdlcwoqKndpdGhvdXQqKiBhbiB1cHN0cmVhbSBBUkEgdmVyc2lvbiBidW1wLgoKVGhlIHJlc3VsdDogYSBmaXggbWVyZ2VkIGhlcmUgKHRoZSBoaXN0b3J5LXByZXNlcnZpbmcgYDAwMThgIG1pZ3JhdGlvbiwgYDdjNjI1NTJgKQpuZXZlciByZWFjaGVzIGEgdmVyc2lvbi1waW5uZWQgZGVwbG95bWVudC4gVGhlIG5pZ2h0bHkgYnVpbGQgb25seSByZWZyZXNoZXMKYDpsYXRlc3RgLCB3aGlsZSBgOjEuNy41YCBzdGF5cyBmcm96ZW4gYXQgaXRzIGZpcnN0IGJ1aWxkICgyMDI2LTAyLTI2KS4gT1NJU00gOeKGkjEwCnVwZ3JhZGVzIHdpdGggZXhpc3RpbmcgQVJBIGhpc3RvcnkgdGhlbiBmYWlsIHRoZSBtYW5hZ2VyLXVwZ3JhZGUgaGVhbHRoIGdhdGUgb24gdGhlCmRhdGEtbG9zc3kgc3RvY2sgYDAwMThgLgoKIyMgQ2hhbmdlCgpUYWcgYXJhLXNlcnZlciBhcyBgPGFyYSB2ZXJzaW9uPi1yPG9zaXNtIHJldmlzaW9uPmAgKEJpdG5hbWktc3R5bGUpLCBlLmcuCmAxLjcuNS1yMWAsIHdpdGggdGhlIHJldmlzaW9uIHJlYWQgZnJvbSBhIG5ldyBgYXJhLXNlcnZlci9vc2lzbS1yZXZpc2lvbmAgZmlsZS4KQnVtcCBgb3Npc20tcmV2aXNpb25gIGluIHRoZSBzYW1lIGNoYW5nZSB0aGF0IHRvdWNoZXMgdGhlIGFyYS1zZXJ2ZXIgaW1hZ2UgbGF5ZXI7IGEKbmV3IGltbXV0YWJsZSB0YWcgaXMgdGhlbiBtaW50ZWQgaW5zdGVhZCBvZiBnb2luZyBzdGFsZS4gRXhpc3RpbmcgdGFncyBhcmUgbmV2ZXIKbXV0YXRlZCBhbmQgYDpsYXRlc3RgIGtlZXBzIHRyYWNraW5nIGBtYWluYC4KCkEgYC1yTmAgc3VmZml4IGlzIHVzZWQsIG5vdCBhIDR0aCBkb3R0ZWQgc2VnbWVudCAoYDEuNy41LjFgKSwgYmVjYXVzZSBhIGRvdHRlZApzZWdtZW50IGlzIGl0c2VsZiBhIGxlZ2FsIHVwc3RyZWFtIHZlcnNpb24gYW5kIHdvdWxkIGNvbGxpZGUgdGhlIGRheSB1cHN0cmVhbSBzaGlwcwpvbmUuIGAtck5gIGtlZXBzIHRoZSBPU0lTTSByZXZpc2lvbiBpbiBhIG5hbWVzcGFjZSB1cHN0cmVhbSBjYW5ub3QgcmVhY2ggKGFzIERlYmlhbgpkb2VzIHdpdGggYW4gdXBzdHJlYW0tcmV2aXNpb24pLiBBIGArYCBidWlsZC1tZXRhZGF0YSBzZXBhcmF0b3IgaXMgdW5hdmFpbGFibGUg4oCUCk9DSSB0YWdzIGZvcmJpZCBgK2AuCgojIyBEZXBlbmRzIG9uIG9zaXNtL3Jlbm92YXRlLWNvbmZpZyM4CgpGb3IgUmVub3ZhdGUgdG8gKiphZG9wdCoqIHRoZSBuZXcgYC1yTmAgdGFnIGFuZCByZS1waW4gZGVwbG95bWVudHMgKHJhdGhlciB0aGFuCnRyZWF0IGl0IGFzIGFuIG9wYXF1ZSB2YXJpYW50IHN1ZmZpeCBsaWtlIGAtYWxwaW5lYCBhbmQgaWdub3JlIGl0KSwgdGhlIHJlZ2V4CnZlcnNpb25pbmcgcnVsZSBtdXN0IGJlIGluIHBsYWNlLiBNZXJnZSB0aGUgY29tcGFuaW9uIGZpcnN0IG9yIHRvZ2V0aGVyIHdpdGggdGhpcwpQUiDigJQgcHVzaGluZyBhIGAtck5gIHRhZyB3aXRob3V0IGl0IGlzIG5vdCBoYXJtZnVsLCB0aGUgZml4IGp1c3Qgd29uJ3QgYXV0by1wcm9wYWdhdGUKdW50aWwgaXQgbGFuZHMuCgotIG9zaXNtL3Jlbm92YXRlLWNvbmZpZyM4CgojIyBEcmFmdAoKRHJhZnQgcGVuZGluZyByZXZpZXcuCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQo=
      patchset: 30af8d90eab7687031b52b08d48ea091f6a48b5e
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/hadolint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images
        name: osism/container-images
        short_name: container-images
        src_dir: src/github.com/osism/container-images
      projects:
        github.com/osism/container-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          checkout: main
          checkout_description: zuul branch
          commit: 939fcb31169bb18522e228cbc49153fef09b904b
          name: osism/container-images
          required: false
          short_name: container-images
          src_dir: src/github.com/osism/container-images
      ref: refs/pull/942/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
