all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fedd:868a
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b60f3eba-03e6-4a6e-a037-5e1a88775eb8
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fedd:868a
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.233
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.13
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fedd:868a
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job yamllint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#59>'
      - '<Job yamllint explicit: None implied: None source: osism/release/.zuul.yaml@main#14>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: a388a44f854447da93b489caa63cce3f
      build_refs:
      - branch: main
        change: '2642'
        change_message: "Add drift check for stale OpenStack source refs\n\nDetects
          the silent failure that left OSISM's 2024.1 images on October 2025\nsources
          for nine months.\n\nUpstream renames `stable/<release>` to `unmaintained/<release>`
          when a release\nenters the unmaintained phase, and deletes the branch at
          EOL.\n`tarballs.opendev.org` keeps serving the artifact for a retired branch
          name but\nstops regenerating it, so a build that still asks for\n`<project>-stable-<release>.tar.gz`
          keeps succeeding while its sources sit\nfrozen at the moment of the rename.
          Nothing fails, so nothing prompts a fix \u2014\nwhich is exactly what happened
          to 2024.1, and only surfaced when a fix for\nCVE-2026-55707 failed to appear
          in a freshly rebuilt image.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n\nThat instance is fixed
          (osism/release#2640, osism/container-images-kolla#762).\nThis adds the check
          that would have caught it on day one, and will catch 2025.1\nwhen it transitions.\n\n##
          The check\n\n`kolla_source_ref_phase` compares each `openstack_projects`
          ref in\n`latest/openstack-<release>.yml` against the latest lifecycle phase
          opendev\nactually publishes a tarball for, and reports drift when a later
          phase exists.\n\n**Artifact-driven, not branch-driven.** The question is
          which tarball the build\nconsumes, so probing the published set answers
          it directly. This also avoids a\nblocker: `release_to_ref` would need an
          upstream owner configured per project,\nand `sources` maps only `kolla`
          and `kolla_ansible` (default owner is `osism`),\nso a branch probe would
          404 on all 21 projects. And it self-limits at EOL \u2014\n2024.2 has no
          `unmaintained` or `eol` tarball, so the frozen `stable` one is the\nonly
          option and nothing is flagged.\n\n**Only phases after the configured one
          are probed.** An earlier phase's tarball\nkeeps being served after a rename,
          so its presence says nothing about freshness;\nthe latest published phase
          is the target.\n\n**One HEAD per candidate, not the index listing.** My
          first version read the\nper-project index \u2014 fewer requests, one per
          project covers all releases \u2014 but\nthose listings are large (nova's
          is ~1.4 MB with 10k entries) and timed out\nintermittently in live runs,
          first on keystone at 30s then nova at 90s. For a\nnightly check that is
          noise. A HEAD is a few hundred bytes. Full run over four\nreleases: ~2 minutes.\n\n**Only
          a 404 means absent.** Any other unsuccessful status raises, because\nreading
          an outage or a throttled response as \"no later phase published\" would\nreport
          no drift and silently reintroduce the blind spot this check exists to\nclose.
          `http.head` therefore takes the same `ok=` whitelist contract as `_get`.\n\n##
          Verification\n\nReplayed against the pre-fix manifest with live probes:\n\n```\nflagged
          21 of 22; skipped: ['gnocchi']\n  aodh      stable-2024.1  ->  unmaintained-2024.1\n
          \ barbican  stable-2024.1  ->  unmaintained-2024.1\n  ...\n```\n\n`gnocchi`
          is correctly skipped \u2014 `stable/4.6` does not follow the release\nlifecycle.
          Against the current (fixed) tree the plugin reports nothing, and\n2024.2
          and 2025.x stay silent.\n\n361 tests pass; flake8, black and yamllint clean.\n\n##
          Supporting changes\n\n- `enablement.parse_source_refs` returns `openstack_projects`
          as\n  `{project: ref}` with names verbatim, since they index tarball URLs
          where the\n  real name (e.g. `neutron-dynamic-routing`) resolves. `parse_build_set`\n
          \ canonicalises and so cannot be reused.\n- `http.head` probes existence
          under the same contract as `_get`.\n- The plugin sorts first in `KOLLA_PLUGINS`:
          source selection is the\n  upstream-most input, so a finding here means
          every downstream result is about\n  stale sources. Happy to move it if you
          would rather group it elsewhere.\n\n## Not covered\n\nThe requirements ref
          in `container-images-kolla` `scripts/002-generate.sh` is\nhardcoded rather
          than read from the manifest, so this plugin cannot see it.\nDetecting that
          would mean parsing shell in another repo. The retirement guide's\nchecklist
          is the control there (osism/osism.github.io#1048).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2642
        commit_id: 70a06395786a7f3cd290465864917cc58ebca975
        patchset: 70a06395786a7f3cd290465864917cc58ebca975
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 7060edc5a8cf45d799e634cc10c89c19
      buildset_refs:
      - branch: main
        change: '2642'
        change_message: "Add drift check for stale OpenStack source refs\n\nDetects
          the silent failure that left OSISM's 2024.1 images on October 2025\nsources
          for nine months.\n\nUpstream renames `stable/<release>` to `unmaintained/<release>`
          when a release\nenters the unmaintained phase, and deletes the branch at
          EOL.\n`tarballs.opendev.org` keeps serving the artifact for a retired branch
          name but\nstops regenerating it, so a build that still asks for\n`<project>-stable-<release>.tar.gz`
          keeps succeeding while its sources sit\nfrozen at the moment of the rename.
          Nothing fails, so nothing prompts a fix \u2014\nwhich is exactly what happened
          to 2024.1, and only surfaced when a fix for\nCVE-2026-55707 failed to appear
          in a freshly rebuilt image.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n\nThat instance is fixed
          (osism/release#2640, osism/container-images-kolla#762).\nThis adds the check
          that would have caught it on day one, and will catch 2025.1\nwhen it transitions.\n\n##
          The check\n\n`kolla_source_ref_phase` compares each `openstack_projects`
          ref in\n`latest/openstack-<release>.yml` against the latest lifecycle phase
          opendev\nactually publishes a tarball for, and reports drift when a later
          phase exists.\n\n**Artifact-driven, not branch-driven.** The question is
          which tarball the build\nconsumes, so probing the published set answers
          it directly. This also avoids a\nblocker: `release_to_ref` would need an
          upstream owner configured per project,\nand `sources` maps only `kolla`
          and `kolla_ansible` (default owner is `osism`),\nso a branch probe would
          404 on all 21 projects. And it self-limits at EOL \u2014\n2024.2 has no
          `unmaintained` or `eol` tarball, so the frozen `stable` one is the\nonly
          option and nothing is flagged.\n\n**Only phases after the configured one
          are probed.** An earlier phase's tarball\nkeeps being served after a rename,
          so its presence says nothing about freshness;\nthe latest published phase
          is the target.\n\n**One HEAD per candidate, not the index listing.** My
          first version read the\nper-project index \u2014 fewer requests, one per
          project covers all releases \u2014 but\nthose listings are large (nova's
          is ~1.4 MB with 10k entries) and timed out\nintermittently in live runs,
          first on keystone at 30s then nova at 90s. For a\nnightly check that is
          noise. A HEAD is a few hundred bytes. Full run over four\nreleases: ~2 minutes.\n\n**Only
          a 404 means absent.** Any other unsuccessful status raises, because\nreading
          an outage or a throttled response as \"no later phase published\" would\nreport
          no drift and silently reintroduce the blind spot this check exists to\nclose.
          `http.head` therefore takes the same `ok=` whitelist contract as `_get`.\n\n##
          Verification\n\nReplayed against the pre-fix manifest with live probes:\n\n```\nflagged
          21 of 22; skipped: ['gnocchi']\n  aodh      stable-2024.1  ->  unmaintained-2024.1\n
          \ barbican  stable-2024.1  ->  unmaintained-2024.1\n  ...\n```\n\n`gnocchi`
          is correctly skipped \u2014 `stable/4.6` does not follow the release\nlifecycle.
          Against the current (fixed) tree the plugin reports nothing, and\n2024.2
          and 2025.x stay silent.\n\n361 tests pass; flake8, black and yamllint clean.\n\n##
          Supporting changes\n\n- `enablement.parse_source_refs` returns `openstack_projects`
          as\n  `{project: ref}` with names verbatim, since they index tarball URLs
          where the\n  real name (e.g. `neutron-dynamic-routing`) resolves. `parse_build_set`\n
          \ canonicalises and so cannot be reused.\n- `http.head` probes existence
          under the same contract as `_get`.\n- The plugin sorts first in `KOLLA_PLUGINS`:
          source selection is the\n  upstream-most input, so a finding here means
          every downstream result is about\n  stale sources. Happy to move it if you
          would rather group it elsewhere.\n\n## Not covered\n\nThe requirements ref
          in `container-images-kolla` `scripts/002-generate.sh` is\nhardcoded rather
          than read from the manifest, so this plugin cannot see it.\nDetecting that
          would mean parsing shell in another repo. The retirement guide's\nchecklist
          is the control there (osism/osism.github.io#1048).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2642
        commit_id: 70a06395786a7f3cd290465864917cc58ebca975
        patchset: 70a06395786a7f3cd290465864917cc58ebca975
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2642'
      change_message: "Add drift check for stale OpenStack source refs\n\nDetects
        the silent failure that left OSISM's 2024.1 images on October 2025\nsources
        for nine months.\n\nUpstream renames `stable/<release>` to `unmaintained/<release>`
        when a release\nenters the unmaintained phase, and deletes the branch at EOL.\n`tarballs.opendev.org`
        keeps serving the artifact for a retired branch name but\nstops regenerating
        it, so a build that still asks for\n`<project>-stable-<release>.tar.gz` keeps
        succeeding while its sources sit\nfrozen at the moment of the rename. Nothing
        fails, so nothing prompts a fix \u2014\nwhich is exactly what happened to
        2024.1, and only surfaced when a fix for\nCVE-2026-55707 failed to appear
        in a freshly rebuilt image.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
        https://bugs.launchpad.net/neutron/+bug/2152113\n\nThat instance is fixed
        (osism/release#2640, osism/container-images-kolla#762).\nThis adds the check
        that would have caught it on day one, and will catch 2025.1\nwhen it transitions.\n\n##
        The check\n\n`kolla_source_ref_phase` compares each `openstack_projects` ref
        in\n`latest/openstack-<release>.yml` against the latest lifecycle phase opendev\nactually
        publishes a tarball for, and reports drift when a later phase exists.\n\n**Artifact-driven,
        not branch-driven.** The question is which tarball the build\nconsumes, so
        probing the published set answers it directly. This also avoids a\nblocker:
        `release_to_ref` would need an upstream owner configured per project,\nand
        `sources` maps only `kolla` and `kolla_ansible` (default owner is `osism`),\nso
        a branch probe would 404 on all 21 projects. And it self-limits at EOL \u2014\n2024.2
        has no `unmaintained` or `eol` tarball, so the frozen `stable` one is the\nonly
        option and nothing is flagged.\n\n**Only phases after the configured one are
        probed.** An earlier phase's tarball\nkeeps being served after a rename, so
        its presence says nothing about freshness;\nthe latest published phase is
        the target.\n\n**One HEAD per candidate, not the index listing.** My first
        version read the\nper-project index \u2014 fewer requests, one per project
        covers all releases \u2014 but\nthose listings are large (nova's is ~1.4 MB
        with 10k entries) and timed out\nintermittently in live runs, first on keystone
        at 30s then nova at 90s. For a\nnightly check that is noise. A HEAD is a few
        hundred bytes. Full run over four\nreleases: ~2 minutes.\n\n**Only a 404 means
        absent.** Any other unsuccessful status raises, because\nreading an outage
        or a throttled response as \"no later phase published\" would\nreport no drift
        and silently reintroduce the blind spot this check exists to\nclose. `http.head`
        therefore takes the same `ok=` whitelist contract as `_get`.\n\n## Verification\n\nReplayed
        against the pre-fix manifest with live probes:\n\n```\nflagged 21 of 22; skipped:
        ['gnocchi']\n  aodh      stable-2024.1  ->  unmaintained-2024.1\n  barbican
        \ stable-2024.1  ->  unmaintained-2024.1\n  ...\n```\n\n`gnocchi` is correctly
        skipped \u2014 `stable/4.6` does not follow the release\nlifecycle. Against
        the current (fixed) tree the plugin reports nothing, and\n2024.2 and 2025.x
        stay silent.\n\n361 tests pass; flake8, black and yamllint clean.\n\n## Supporting
        changes\n\n- `enablement.parse_source_refs` returns `openstack_projects` as\n
        \ `{project: ref}` with names verbatim, since they index tarball URLs where
        the\n  real name (e.g. `neutron-dynamic-routing`) resolves. `parse_build_set`\n
        \ canonicalises and so cannot be reused.\n- `http.head` probes existence under
        the same contract as `_get`.\n- The plugin sorts first in `KOLLA_PLUGINS`:
        source selection is the\n  upstream-most input, so a finding here means every
        downstream result is about\n  stale sources. Happy to move it if you would
        rather group it elsewhere.\n\n## Not covered\n\nThe requirements ref in `container-images-kolla`
        `scripts/002-generate.sh` is\nhardcoded rather than read from the manifest,
        so this plugin cannot see it.\nDetecting that would mean parsing shell in
        another repo. The retirement guide's\nchecklist is the control there (osism/osism.github.io#1048).\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/release/pull/2642
      child_jobs: []
      commit_id: 70a06395786a7f3cd290465864917cc58ebca975
      event_id: 7a1b0d70-8d1c-11f1-81b3-30f755cd6846
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/a388a44f854447da93b489caa63cce3f/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/a388a44f854447da93b489caa63cce3f/work/logs
        result_data_file: /var/lib/zuul/builds/a388a44f854447da93b489caa63cce3f/work/results.json
        src_root: /var/lib/zuul/builds/a388a44f854447da93b489caa63cce3f/work/src
        work_root: /var/lib/zuul/builds/a388a44f854447da93b489caa63cce3f/work
      include_vars: []
      items:
      - branch: main
        change: '2642'
        change_message: "Add drift check for stale OpenStack source refs\n\nDetects
          the silent failure that left OSISM's 2024.1 images on October 2025\nsources
          for nine months.\n\nUpstream renames `stable/<release>` to `unmaintained/<release>`
          when a release\nenters the unmaintained phase, and deletes the branch at
          EOL.\n`tarballs.opendev.org` keeps serving the artifact for a retired branch
          name but\nstops regenerating it, so a build that still asks for\n`<project>-stable-<release>.tar.gz`
          keeps succeeding while its sources sit\nfrozen at the moment of the rename.
          Nothing fails, so nothing prompts a fix \u2014\nwhich is exactly what happened
          to 2024.1, and only surfaced when a fix for\nCVE-2026-55707 failed to appear
          in a freshly rebuilt image.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n\nThat instance is fixed
          (osism/release#2640, osism/container-images-kolla#762).\nThis adds the check
          that would have caught it on day one, and will catch 2025.1\nwhen it transitions.\n\n##
          The check\n\n`kolla_source_ref_phase` compares each `openstack_projects`
          ref in\n`latest/openstack-<release>.yml` against the latest lifecycle phase
          opendev\nactually publishes a tarball for, and reports drift when a later
          phase exists.\n\n**Artifact-driven, not branch-driven.** The question is
          which tarball the build\nconsumes, so probing the published set answers
          it directly. This also avoids a\nblocker: `release_to_ref` would need an
          upstream owner configured per project,\nand `sources` maps only `kolla`
          and `kolla_ansible` (default owner is `osism`),\nso a branch probe would
          404 on all 21 projects. And it self-limits at EOL \u2014\n2024.2 has no
          `unmaintained` or `eol` tarball, so the frozen `stable` one is the\nonly
          option and nothing is flagged.\n\n**Only phases after the configured one
          are probed.** An earlier phase's tarball\nkeeps being served after a rename,
          so its presence says nothing about freshness;\nthe latest published phase
          is the target.\n\n**One HEAD per candidate, not the index listing.** My
          first version read the\nper-project index \u2014 fewer requests, one per
          project covers all releases \u2014 but\nthose listings are large (nova's
          is ~1.4 MB with 10k entries) and timed out\nintermittently in live runs,
          first on keystone at 30s then nova at 90s. For a\nnightly check that is
          noise. A HEAD is a few hundred bytes. Full run over four\nreleases: ~2 minutes.\n\n**Only
          a 404 means absent.** Any other unsuccessful status raises, because\nreading
          an outage or a throttled response as \"no later phase published\" would\nreport
          no drift and silently reintroduce the blind spot this check exists to\nclose.
          `http.head` therefore takes the same `ok=` whitelist contract as `_get`.\n\n##
          Verification\n\nReplayed against the pre-fix manifest with live probes:\n\n```\nflagged
          21 of 22; skipped: ['gnocchi']\n  aodh      stable-2024.1  ->  unmaintained-2024.1\n
          \ barbican  stable-2024.1  ->  unmaintained-2024.1\n  ...\n```\n\n`gnocchi`
          is correctly skipped \u2014 `stable/4.6` does not follow the release\nlifecycle.
          Against the current (fixed) tree the plugin reports nothing, and\n2024.2
          and 2025.x stay silent.\n\n361 tests pass; flake8, black and yamllint clean.\n\n##
          Supporting changes\n\n- `enablement.parse_source_refs` returns `openstack_projects`
          as\n  `{project: ref}` with names verbatim, since they index tarball URLs
          where the\n  real name (e.g. `neutron-dynamic-routing`) resolves. `parse_build_set`\n
          \ canonicalises and so cannot be reused.\n- `http.head` probes existence
          under the same contract as `_get`.\n- The plugin sorts first in `KOLLA_PLUGINS`:
          source selection is the\n  upstream-most input, so a finding here means
          every downstream result is about\n  stale sources. Happy to move it if you
          would rather group it elsewhere.\n\n## Not covered\n\nThe requirements ref
          in `container-images-kolla` `scripts/002-generate.sh` is\nhardcoded rather
          than read from the manifest, so this plugin cannot see it.\nDetecting that
          would mean parsing shell in another repo. The retirement guide's\nchecklist
          is the control there (osism/osism.github.io#1048).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/release/pull/2642
        commit_id: 70a06395786a7f3cd290465864917cc58ebca975
        patchset: 70a06395786a7f3cd290465864917cc58ebca975
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: yamllint
      jobtags: []
      max_attempts: 3
      message: QWRkIGRyaWZ0IGNoZWNrIGZvciBzdGFsZSBPcGVuU3RhY2sgc291cmNlIHJlZnMKCkRldGVjdHMgdGhlIHNpbGVudCBmYWlsdXJlIHRoYXQgbGVmdCBPU0lTTSdzIDIwMjQuMSBpbWFnZXMgb24gT2N0b2JlciAyMDI1CnNvdXJjZXMgZm9yIG5pbmUgbW9udGhzLgoKVXBzdHJlYW0gcmVuYW1lcyBgc3RhYmxlLzxyZWxlYXNlPmAgdG8gYHVubWFpbnRhaW5lZC88cmVsZWFzZT5gIHdoZW4gYSByZWxlYXNlCmVudGVycyB0aGUgdW5tYWludGFpbmVkIHBoYXNlLCBhbmQgZGVsZXRlcyB0aGUgYnJhbmNoIGF0IEVPTC4KYHRhcmJhbGxzLm9wZW5kZXYub3JnYCBrZWVwcyBzZXJ2aW5nIHRoZSBhcnRpZmFjdCBmb3IgYSByZXRpcmVkIGJyYW5jaCBuYW1lIGJ1dApzdG9wcyByZWdlbmVyYXRpbmcgaXQsIHNvIGEgYnVpbGQgdGhhdCBzdGlsbCBhc2tzIGZvcgpgPHByb2plY3Q+LXN0YWJsZS08cmVsZWFzZT4udGFyLmd6YCBrZWVwcyBzdWNjZWVkaW5nIHdoaWxlIGl0cyBzb3VyY2VzIHNpdApmcm96ZW4gYXQgdGhlIG1vbWVudCBvZiB0aGUgcmVuYW1lLiBOb3RoaW5nIGZhaWxzLCBzbyBub3RoaW5nIHByb21wdHMgYSBmaXgg4oCUCndoaWNoIGlzIGV4YWN0bHkgd2hhdCBoYXBwZW5lZCB0byAyMDI0LjEsIGFuZCBvbmx5IHN1cmZhY2VkIHdoZW4gYSBmaXggZm9yCkNWRS0yMDI2LTU1NzA3IGZhaWxlZCB0byBhcHBlYXIgaW4gYSBmcmVzaGx5IHJlYnVpbHQgaW1hZ2UuCgotIGh0dHBzOi8vb3Npc20udGVjaC9kb2NzL2FwcGVuZGl4L3NlY3VyaXR5L29zc2EtMjAyNi0wMzIvCi0gaHR0cHM6Ly9idWdzLmxhdW5jaHBhZC5uZXQvbmV1dHJvbi8rYnVnLzIxNTIxMTMKClRoYXQgaW5zdGFuY2UgaXMgZml4ZWQgKG9zaXNtL3JlbGVhc2UjMjY0MCwgb3Npc20vY29udGFpbmVyLWltYWdlcy1rb2xsYSM3NjIpLgpUaGlzIGFkZHMgdGhlIGNoZWNrIHRoYXQgd291bGQgaGF2ZSBjYXVnaHQgaXQgb24gZGF5IG9uZSwgYW5kIHdpbGwgY2F0Y2ggMjAyNS4xCndoZW4gaXQgdHJhbnNpdGlvbnMuCgojIyBUaGUgY2hlY2sKCmBrb2xsYV9zb3VyY2VfcmVmX3BoYXNlYCBjb21wYXJlcyBlYWNoIGBvcGVuc3RhY2tfcHJvamVjdHNgIHJlZiBpbgpgbGF0ZXN0L29wZW5zdGFjay08cmVsZWFzZT4ueW1sYCBhZ2FpbnN0IHRoZSBsYXRlc3QgbGlmZWN5Y2xlIHBoYXNlIG9wZW5kZXYKYWN0dWFsbHkgcHVibGlzaGVzIGEgdGFyYmFsbCBmb3IsIGFuZCByZXBvcnRzIGRyaWZ0IHdoZW4gYSBsYXRlciBwaGFzZSBleGlzdHMuCgoqKkFydGlmYWN0LWRyaXZlbiwgbm90IGJyYW5jaC1kcml2ZW4uKiogVGhlIHF1ZXN0aW9uIGlzIHdoaWNoIHRhcmJhbGwgdGhlIGJ1aWxkCmNvbnN1bWVzLCBzbyBwcm9iaW5nIHRoZSBwdWJsaXNoZWQgc2V0IGFuc3dlcnMgaXQgZGlyZWN0bHkuIFRoaXMgYWxzbyBhdm9pZHMgYQpibG9ja2VyOiBgcmVsZWFzZV90b19yZWZgIHdvdWxkIG5lZWQgYW4gdXBzdHJlYW0gb3duZXIgY29uZmlndXJlZCBwZXIgcHJvamVjdCwKYW5kIGBzb3VyY2VzYCBtYXBzIG9ubHkgYGtvbGxhYCBhbmQgYGtvbGxhX2Fuc2libGVgIChkZWZhdWx0IG93bmVyIGlzIGBvc2lzbWApLApzbyBhIGJyYW5jaCBwcm9iZSB3b3VsZCA0MDQgb24gYWxsIDIxIHByb2plY3RzLiBBbmQgaXQgc2VsZi1saW1pdHMgYXQgRU9MIOKAlAoyMDI0LjIgaGFzIG5vIGB1bm1haW50YWluZWRgIG9yIGBlb2xgIHRhcmJhbGwsIHNvIHRoZSBmcm96ZW4gYHN0YWJsZWAgb25lIGlzIHRoZQpvbmx5IG9wdGlvbiBhbmQgbm90aGluZyBpcyBmbGFnZ2VkLgoKKipPbmx5IHBoYXNlcyBhZnRlciB0aGUgY29uZmlndXJlZCBvbmUgYXJlIHByb2JlZC4qKiBBbiBlYXJsaWVyIHBoYXNlJ3MgdGFyYmFsbAprZWVwcyBiZWluZyBzZXJ2ZWQgYWZ0ZXIgYSByZW5hbWUsIHNvIGl0cyBwcmVzZW5jZSBzYXlzIG5vdGhpbmcgYWJvdXQgZnJlc2huZXNzOwp0aGUgbGF0ZXN0IHB1Ymxpc2hlZCBwaGFzZSBpcyB0aGUgdGFyZ2V0LgoKKipPbmUgSEVBRCBwZXIgY2FuZGlkYXRlLCBub3QgdGhlIGluZGV4IGxpc3RpbmcuKiogTXkgZmlyc3QgdmVyc2lvbiByZWFkIHRoZQpwZXItcHJvamVjdCBpbmRleCDigJQgZmV3ZXIgcmVxdWVzdHMsIG9uZSBwZXIgcHJvamVjdCBjb3ZlcnMgYWxsIHJlbGVhc2VzIOKAlCBidXQKdGhvc2UgbGlzdGluZ3MgYXJlIGxhcmdlIChub3ZhJ3MgaXMgfjEuNCBNQiB3aXRoIDEwayBlbnRyaWVzKSBhbmQgdGltZWQgb3V0CmludGVybWl0dGVudGx5IGluIGxpdmUgcnVucywgZmlyc3Qgb24ga2V5c3RvbmUgYXQgMzBzIHRoZW4gbm92YSBhdCA5MHMuIEZvciBhCm5pZ2h0bHkgY2hlY2sgdGhhdCBpcyBub2lzZS4gQSBIRUFEIGlzIGEgZmV3IGh1bmRyZWQgYnl0ZXMuIEZ1bGwgcnVuIG92ZXIgZm91cgpyZWxlYXNlczogfjIgbWludXRlcy4KCioqT25seSBhIDQwNCBtZWFucyBhYnNlbnQuKiogQW55IG90aGVyIHVuc3VjY2Vzc2Z1bCBzdGF0dXMgcmFpc2VzLCBiZWNhdXNlCnJlYWRpbmcgYW4gb3V0YWdlIG9yIGEgdGhyb3R0bGVkIHJlc3BvbnNlIGFzICJubyBsYXRlciBwaGFzZSBwdWJsaXNoZWQiIHdvdWxkCnJlcG9ydCBubyBkcmlmdCBhbmQgc2lsZW50bHkgcmVpbnRyb2R1Y2UgdGhlIGJsaW5kIHNwb3QgdGhpcyBjaGVjayBleGlzdHMgdG8KY2xvc2UuIGBodHRwLmhlYWRgIHRoZXJlZm9yZSB0YWtlcyB0aGUgc2FtZSBgb2s9YCB3aGl0ZWxpc3QgY29udHJhY3QgYXMgYF9nZXRgLgoKIyMgVmVyaWZpY2F0aW9uCgpSZXBsYXllZCBhZ2FpbnN0IHRoZSBwcmUtZml4IG1hbmlmZXN0IHdpdGggbGl2ZSBwcm9iZXM6CgpgYGAKZmxhZ2dlZCAyMSBvZiAyMjsgc2tpcHBlZDogWydnbm9jY2hpJ10KICBhb2RoICAgICAgc3RhYmxlLTIwMjQuMSAgLT4gIHVubWFpbnRhaW5lZC0yMDI0LjEKICBiYXJiaWNhbiAgc3RhYmxlLTIwMjQuMSAgLT4gIHVubWFpbnRhaW5lZC0yMDI0LjEKICAuLi4KYGBgCgpgZ25vY2NoaWAgaXMgY29ycmVjdGx5IHNraXBwZWQg4oCUIGBzdGFibGUvNC42YCBkb2VzIG5vdCBmb2xsb3cgdGhlIHJlbGVhc2UKbGlmZWN5Y2xlLiBBZ2FpbnN0IHRoZSBjdXJyZW50IChmaXhlZCkgdHJlZSB0aGUgcGx1Z2luIHJlcG9ydHMgbm90aGluZywgYW5kCjIwMjQuMiBhbmQgMjAyNS54IHN0YXkgc2lsZW50LgoKMzYxIHRlc3RzIHBhc3M7IGZsYWtlOCwgYmxhY2sgYW5kIHlhbWxsaW50IGNsZWFuLgoKIyMgU3VwcG9ydGluZyBjaGFuZ2VzCgotIGBlbmFibGVtZW50LnBhcnNlX3NvdXJjZV9yZWZzYCByZXR1cm5zIGBvcGVuc3RhY2tfcHJvamVjdHNgIGFzCiAgYHtwcm9qZWN0OiByZWZ9YCB3aXRoIG5hbWVzIHZlcmJhdGltLCBzaW5jZSB0aGV5IGluZGV4IHRhcmJhbGwgVVJMcyB3aGVyZSB0aGUKICByZWFsIG5hbWUgKGUuZy4gYG5ldXRyb24tZHluYW1pYy1yb3V0aW5nYCkgcmVzb2x2ZXMuIGBwYXJzZV9idWlsZF9zZXRgCiAgY2Fub25pY2FsaXNlcyBhbmQgc28gY2Fubm90IGJlIHJldXNlZC4KLSBgaHR0cC5oZWFkYCBwcm9iZXMgZXhpc3RlbmNlIHVuZGVyIHRoZSBzYW1lIGNvbnRyYWN0IGFzIGBfZ2V0YC4KLSBUaGUgcGx1Z2luIHNvcnRzIGZpcnN0IGluIGBLT0xMQV9QTFVHSU5TYDogc291cmNlIHNlbGVjdGlvbiBpcyB0aGUKICB1cHN0cmVhbS1tb3N0IGlucHV0LCBzbyBhIGZpbmRpbmcgaGVyZSBtZWFucyBldmVyeSBkb3duc3RyZWFtIHJlc3VsdCBpcyBhYm91dAogIHN0YWxlIHNvdXJjZXMuIEhhcHB5IHRvIG1vdmUgaXQgaWYgeW91IHdvdWxkIHJhdGhlciBncm91cCBpdCBlbHNld2hlcmUuCgojIyBOb3QgY292ZXJlZAoKVGhlIHJlcXVpcmVtZW50cyByZWYgaW4gYGNvbnRhaW5lci1pbWFnZXMta29sbGFgIGBzY3JpcHRzLzAwMi1nZW5lcmF0ZS5zaGAgaXMKaGFyZGNvZGVkIHJhdGhlciB0aGFuIHJlYWQgZnJvbSB0aGUgbWFuaWZlc3QsIHNvIHRoaXMgcGx1Z2luIGNhbm5vdCBzZWUgaXQuCkRldGVjdGluZyB0aGF0IHdvdWxkIG1lYW4gcGFyc2luZyBzaGVsbCBpbiBhbm90aGVyIHJlcG8uIFRoZSByZXRpcmVtZW50IGd1aWRlJ3MKY2hlY2tsaXN0IGlzIHRoZSBjb250cm9sIHRoZXJlIChvc2lzbS9vc2lzbS5naXRodWIuaW8jMTA0OCkuCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQ==
      patchset: 70a06395786a7f3cd290465864917cc58ebca975
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/yamllint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: dc34e84ad0a1a2d5a3ee9b011715c0fa605ec9f3
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2642/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
