all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:feda:5fb3
      ansible_molecule_ansible_version: 11.12.0
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_role: manager
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 259a72eb-67f3-4d9e-b0ee-37759845146f
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:feda:5fb3
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.163
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.114
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:feda:5fb3
        region: null
        slot: null
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe7b:3e90
      ansible_molecule_ansible_version: 11.12.0
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_role: manager
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 30b468b3-4ae6-47b7-8c06-0a62e46ea508
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe7b:3e90
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.73
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.187
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe7b:3e90
        region: null
        slot: null
  vars:
    ansible_molecule_ansible_version: 11.12.0
    ansible_role: manager
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-molecule explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#12>'
      - '<Job abstract-ansible-collection-services-molecule explicit: None implied:
        {MatchAny:{ImpliedBranchMatcher:main}} source: osism/ansible-collection-services/.zuul.yaml@main#79>'
      - '<Job ansible-collection-services-molecule-manager explicit: None implied:
        {MatchAny:{ImpliedBranchMatcher:main}} source: osism/ansible-collection-services/.zuul.yaml@main#267>'
      - '<Job ansible-collection-services-molecule-manager explicit: None implied:
        None source: osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: a86a912c36454512a5f24b5b50e4e805
      build_refs:
      - branch: main
        change: '2125'
        change_message: "manager: wire update-manager seed-container path\n\n## What\n\nWire
          the `osism-update-manager` wrapper's `CONTAINER` path to parity with the\n`SEED_CONTAINER`
          block of `run.sh` (`osism/generics`), so `osism update manager`\nworks on
          a manager deployed with the seed container (no local Ansible venv).\n\n##
          Why\n\n\"Update the manager\" always runs the same `osism.manager.manager`
          playbook over\nSSH; only the driver differs by deployment topology:\n\n|
          Topology | Manager state at update time | Driver | Before |\n|---|---|---|---|\n|
          Seedless / self-bootstrapped | has a local venv | `osism update manager`
          \u2192 venv path | works |\n| Persistent seed (separate VM/workstation)
          | seed holds config+vault+key | re-run `run.sh manager` from the seed |
          works |\n| **Seed container, seed discarded** | only `/opt/configuration`
          + `/opt/ansible/secrets/id_rsa.operator` | `osism update manager` \u2192
          **container path** | **broken** |\n\nThe seed container is now a documented
          (and default) deploy path, but the\nwrapper's `CONTAINER=true` path was
          a pre-seed-container fossil: a bare\n`docker run` that bind-mounted the
          config repo read-only, hardcoded `-it`,\nforwarded no vault password, and
          passed only the playbook name. On a\nseed-deployed manager it failed immediately
          with `Attempting to decrypt but no\nvault secrets found` \u2014 and could
          not even materialize the (vault-encrypted)\noperator key into the read-only
          mount.\n\n## How\n\nBring the container path to `run.sh` `SEED_CONTAINER`
          parity, confirmed against\nthe `osism/seed` image entrypoint (`container-images/seed`
          `files/run.sh`):\n\n- bind-mount the configuration repository **writable**
          (drop `:ro`) so the\n  in-container `osism.manager.keypair` step can write
          `id_rsa.operator`;\n- forward an explicit `ANSIBLE_VAULT_PASSWORD_FILE`,
          else auto-detect\n  `environments/.vault_pass`; also forward `ANSIBLE_ASK_VAULT_PASS`
          (the env\n  form of `--ask-vault-pass`, for a Redis-only manager with no
          `.vault_pass`);\n- request a TTY only when stdin is one (the hardcoded `-it`
          broke\n  non-interactive callers); pass `\"$@\"` through;\n- default `CONTAINER=auto`
          (was `false`): use the seed container when an engine\n  is present, else
          fall back to the venv path; `CONTAINER=false` forces venv,\n  `CONTAINER=true`
          requires the container; `CONTAINER_ENGINE` selects podman;\n- forward the
          connection/auth env allowlist `run.sh` forwards (`ANSIBLE_USER`,\n  `ANSIBLE_ASK_PASS`,
          `ANSIBLE_BECOME_ASK_PASS`, `ANSIBLE_SSH_ARGS`);\n- warn when `CONTAINER=auto`
          selects the container path but the caller set the\n  venv-only `ANSIBLE_INVENTORY`
          / `ANSIBLE_PRIVATE_KEY` overrides (the seed\n  entrypoint hardcodes `-i
          hosts --private-key id_rsa.operator`), so the\n  default flip is not silent.\n\nEach
          commit carries a molecule assertion pinning its behavior.\n\n`MANAGER_VERSION`,
          `ANSIBLE_INVENTORY`/`ANSIBLE_PRIVATE_KEY`, and the collection\nsource/version
          are intentionally **not** forwarded on the container path \u2014\nmatching
          `run.sh`: the release is selected from the mounted `configuration.yml`,\nand
          inventory/key are resolved inside the container.\n\n## Stacked on\n\n- osism/ansible-collection-services#2124\n\nThis
          PR is based on that branch (the exit-0 masking fix is its shared base);
          it\nwill retarget to `main` once #2124 merges. Review just the wiring commits
          here.\n\n## Validation\n\n- Rendered + `bash -n` clean; stubbed-engine smoke
          covers auto/true/false/invalid\n  selection and the vault/TTY/arg cases;
          molecule assertions added per commit.\n- **Live-validated GREEN** on a real
          seed-container-deployed manager (no\n  `python3-venv`): vault decrypt succeeds,
          the operator key is materialized into\n  the writable mount, SSH to `hosts:
          manager` works, conditional `-t` over\n  non-interactive SSH, and the exit
          code propagates \u2014 `Apply role manager\n  ok=44 changed=7 failed=0`,
          all container versions match, `rc 0`.\n\nDocImpact \u2014 the upgrade guide
          needs a matching seed-container update story\n(which install path \u2192
          which update path), drafted in:\n\n- osism/osism.github.io#1009\n\nIts gated
          commit documents this PR's `CONTAINER=auto` behaviour and should land\nwith/after
          this fix.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/ansible-collection-services/pull/2125
        commit_id: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        patchset: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: c346320cbe8d495784ff1919aadee042
      buildset_refs:
      - branch: main
        change: '2125'
        change_message: "manager: wire update-manager seed-container path\n\n## What\n\nWire
          the `osism-update-manager` wrapper's `CONTAINER` path to parity with the\n`SEED_CONTAINER`
          block of `run.sh` (`osism/generics`), so `osism update manager`\nworks on
          a manager deployed with the seed container (no local Ansible venv).\n\n##
          Why\n\n\"Update the manager\" always runs the same `osism.manager.manager`
          playbook over\nSSH; only the driver differs by deployment topology:\n\n|
          Topology | Manager state at update time | Driver | Before |\n|---|---|---|---|\n|
          Seedless / self-bootstrapped | has a local venv | `osism update manager`
          \u2192 venv path | works |\n| Persistent seed (separate VM/workstation)
          | seed holds config+vault+key | re-run `run.sh manager` from the seed |
          works |\n| **Seed container, seed discarded** | only `/opt/configuration`
          + `/opt/ansible/secrets/id_rsa.operator` | `osism update manager` \u2192
          **container path** | **broken** |\n\nThe seed container is now a documented
          (and default) deploy path, but the\nwrapper's `CONTAINER=true` path was
          a pre-seed-container fossil: a bare\n`docker run` that bind-mounted the
          config repo read-only, hardcoded `-it`,\nforwarded no vault password, and
          passed only the playbook name. On a\nseed-deployed manager it failed immediately
          with `Attempting to decrypt but no\nvault secrets found` \u2014 and could
          not even materialize the (vault-encrypted)\noperator key into the read-only
          mount.\n\n## How\n\nBring the container path to `run.sh` `SEED_CONTAINER`
          parity, confirmed against\nthe `osism/seed` image entrypoint (`container-images/seed`
          `files/run.sh`):\n\n- bind-mount the configuration repository **writable**
          (drop `:ro`) so the\n  in-container `osism.manager.keypair` step can write
          `id_rsa.operator`;\n- forward an explicit `ANSIBLE_VAULT_PASSWORD_FILE`,
          else auto-detect\n  `environments/.vault_pass`; also forward `ANSIBLE_ASK_VAULT_PASS`
          (the env\n  form of `--ask-vault-pass`, for a Redis-only manager with no
          `.vault_pass`);\n- request a TTY only when stdin is one (the hardcoded `-it`
          broke\n  non-interactive callers); pass `\"$@\"` through;\n- default `CONTAINER=auto`
          (was `false`): use the seed container when an engine\n  is present, else
          fall back to the venv path; `CONTAINER=false` forces venv,\n  `CONTAINER=true`
          requires the container; `CONTAINER_ENGINE` selects podman;\n- forward the
          connection/auth env allowlist `run.sh` forwards (`ANSIBLE_USER`,\n  `ANSIBLE_ASK_PASS`,
          `ANSIBLE_BECOME_ASK_PASS`, `ANSIBLE_SSH_ARGS`);\n- warn when `CONTAINER=auto`
          selects the container path but the caller set the\n  venv-only `ANSIBLE_INVENTORY`
          / `ANSIBLE_PRIVATE_KEY` overrides (the seed\n  entrypoint hardcodes `-i
          hosts --private-key id_rsa.operator`), so the\n  default flip is not silent.\n\nEach
          commit carries a molecule assertion pinning its behavior.\n\n`MANAGER_VERSION`,
          `ANSIBLE_INVENTORY`/`ANSIBLE_PRIVATE_KEY`, and the collection\nsource/version
          are intentionally **not** forwarded on the container path \u2014\nmatching
          `run.sh`: the release is selected from the mounted `configuration.yml`,\nand
          inventory/key are resolved inside the container.\n\n## Stacked on\n\n- osism/ansible-collection-services#2124\n\nThis
          PR is based on that branch (the exit-0 masking fix is its shared base);
          it\nwill retarget to `main` once #2124 merges. Review just the wiring commits
          here.\n\n## Validation\n\n- Rendered + `bash -n` clean; stubbed-engine smoke
          covers auto/true/false/invalid\n  selection and the vault/TTY/arg cases;
          molecule assertions added per commit.\n- **Live-validated GREEN** on a real
          seed-container-deployed manager (no\n  `python3-venv`): vault decrypt succeeds,
          the operator key is materialized into\n  the writable mount, SSH to `hosts:
          manager` works, conditional `-t` over\n  non-interactive SSH, and the exit
          code propagates \u2014 `Apply role manager\n  ok=44 changed=7 failed=0`,
          all container versions match, `rc 0`.\n\nDocImpact \u2014 the upgrade guide
          needs a matching seed-container update story\n(which install path \u2192
          which update path), drafted in:\n\n- osism/osism.github.io#1009\n\nIts gated
          commit documents this PR's `CONTAINER=auto` behaviour and should land\nwith/after
          this fix.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/ansible-collection-services/pull/2125
        commit_id: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        patchset: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2125'
      change_message: "manager: wire update-manager seed-container path\n\n## What\n\nWire
        the `osism-update-manager` wrapper's `CONTAINER` path to parity with the\n`SEED_CONTAINER`
        block of `run.sh` (`osism/generics`), so `osism update manager`\nworks on
        a manager deployed with the seed container (no local Ansible venv).\n\n##
        Why\n\n\"Update the manager\" always runs the same `osism.manager.manager`
        playbook over\nSSH; only the driver differs by deployment topology:\n\n| Topology
        | Manager state at update time | Driver | Before |\n|---|---|---|---|\n| Seedless
        / self-bootstrapped | has a local venv | `osism update manager` \u2192 venv
        path | works |\n| Persistent seed (separate VM/workstation) | seed holds config+vault+key
        | re-run `run.sh manager` from the seed | works |\n| **Seed container, seed
        discarded** | only `/opt/configuration` + `/opt/ansible/secrets/id_rsa.operator`
        | `osism update manager` \u2192 **container path** | **broken** |\n\nThe seed
        container is now a documented (and default) deploy path, but the\nwrapper's
        `CONTAINER=true` path was a pre-seed-container fossil: a bare\n`docker run`
        that bind-mounted the config repo read-only, hardcoded `-it`,\nforwarded no
        vault password, and passed only the playbook name. On a\nseed-deployed manager
        it failed immediately with `Attempting to decrypt but no\nvault secrets found`
        \u2014 and could not even materialize the (vault-encrypted)\noperator key
        into the read-only mount.\n\n## How\n\nBring the container path to `run.sh`
        `SEED_CONTAINER` parity, confirmed against\nthe `osism/seed` image entrypoint
        (`container-images/seed` `files/run.sh`):\n\n- bind-mount the configuration
        repository **writable** (drop `:ro`) so the\n  in-container `osism.manager.keypair`
        step can write `id_rsa.operator`;\n- forward an explicit `ANSIBLE_VAULT_PASSWORD_FILE`,
        else auto-detect\n  `environments/.vault_pass`; also forward `ANSIBLE_ASK_VAULT_PASS`
        (the env\n  form of `--ask-vault-pass`, for a Redis-only manager with no `.vault_pass`);\n-
        request a TTY only when stdin is one (the hardcoded `-it` broke\n  non-interactive
        callers); pass `\"$@\"` through;\n- default `CONTAINER=auto` (was `false`):
        use the seed container when an engine\n  is present, else fall back to the
        venv path; `CONTAINER=false` forces venv,\n  `CONTAINER=true` requires the
        container; `CONTAINER_ENGINE` selects podman;\n- forward the connection/auth
        env allowlist `run.sh` forwards (`ANSIBLE_USER`,\n  `ANSIBLE_ASK_PASS`, `ANSIBLE_BECOME_ASK_PASS`,
        `ANSIBLE_SSH_ARGS`);\n- warn when `CONTAINER=auto` selects the container path
        but the caller set the\n  venv-only `ANSIBLE_INVENTORY` / `ANSIBLE_PRIVATE_KEY`
        overrides (the seed\n  entrypoint hardcodes `-i hosts --private-key id_rsa.operator`),
        so the\n  default flip is not silent.\n\nEach commit carries a molecule assertion
        pinning its behavior.\n\n`MANAGER_VERSION`, `ANSIBLE_INVENTORY`/`ANSIBLE_PRIVATE_KEY`,
        and the collection\nsource/version are intentionally **not** forwarded on
        the container path \u2014\nmatching `run.sh`: the release is selected from
        the mounted `configuration.yml`,\nand inventory/key are resolved inside the
        container.\n\n## Stacked on\n\n- osism/ansible-collection-services#2124\n\nThis
        PR is based on that branch (the exit-0 masking fix is its shared base); it\nwill
        retarget to `main` once #2124 merges. Review just the wiring commits here.\n\n##
        Validation\n\n- Rendered + `bash -n` clean; stubbed-engine smoke covers auto/true/false/invalid\n
        \ selection and the vault/TTY/arg cases; molecule assertions added per commit.\n-
        **Live-validated GREEN** on a real seed-container-deployed manager (no\n  `python3-venv`):
        vault decrypt succeeds, the operator key is materialized into\n  the writable
        mount, SSH to `hosts: manager` works, conditional `-t` over\n  non-interactive
        SSH, and the exit code propagates \u2014 `Apply role manager\n  ok=44 changed=7
        failed=0`, all container versions match, `rc 0`.\n\nDocImpact \u2014 the upgrade
        guide needs a matching seed-container update story\n(which install path \u2192
        which update path), drafted in:\n\n- osism/osism.github.io#1009\n\nIts gated
        commit documents this PR's `CONTAINER=auto` behaviour and should land\nwith/after
        this fix.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/ansible-collection-services/pull/2125
      child_jobs: []
      commit_id: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
      event_id: f96a2b00-716b-11f1-9073-91ca2a96acca
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/a86a912c36454512a5f24b5b50e4e805/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/a86a912c36454512a5f24b5b50e4e805/work/logs
        result_data_file: /var/lib/zuul/builds/a86a912c36454512a5f24b5b50e4e805/work/results.json
        src_root: /var/lib/zuul/builds/a86a912c36454512a5f24b5b50e4e805/work/src
        work_root: /var/lib/zuul/builds/a86a912c36454512a5f24b5b50e4e805/work
      include_vars: []
      items:
      - branch: main
        change: '2125'
        change_message: "manager: wire update-manager seed-container path\n\n## What\n\nWire
          the `osism-update-manager` wrapper's `CONTAINER` path to parity with the\n`SEED_CONTAINER`
          block of `run.sh` (`osism/generics`), so `osism update manager`\nworks on
          a manager deployed with the seed container (no local Ansible venv).\n\n##
          Why\n\n\"Update the manager\" always runs the same `osism.manager.manager`
          playbook over\nSSH; only the driver differs by deployment topology:\n\n|
          Topology | Manager state at update time | Driver | Before |\n|---|---|---|---|\n|
          Seedless / self-bootstrapped | has a local venv | `osism update manager`
          \u2192 venv path | works |\n| Persistent seed (separate VM/workstation)
          | seed holds config+vault+key | re-run `run.sh manager` from the seed |
          works |\n| **Seed container, seed discarded** | only `/opt/configuration`
          + `/opt/ansible/secrets/id_rsa.operator` | `osism update manager` \u2192
          **container path** | **broken** |\n\nThe seed container is now a documented
          (and default) deploy path, but the\nwrapper's `CONTAINER=true` path was
          a pre-seed-container fossil: a bare\n`docker run` that bind-mounted the
          config repo read-only, hardcoded `-it`,\nforwarded no vault password, and
          passed only the playbook name. On a\nseed-deployed manager it failed immediately
          with `Attempting to decrypt but no\nvault secrets found` \u2014 and could
          not even materialize the (vault-encrypted)\noperator key into the read-only
          mount.\n\n## How\n\nBring the container path to `run.sh` `SEED_CONTAINER`
          parity, confirmed against\nthe `osism/seed` image entrypoint (`container-images/seed`
          `files/run.sh`):\n\n- bind-mount the configuration repository **writable**
          (drop `:ro`) so the\n  in-container `osism.manager.keypair` step can write
          `id_rsa.operator`;\n- forward an explicit `ANSIBLE_VAULT_PASSWORD_FILE`,
          else auto-detect\n  `environments/.vault_pass`; also forward `ANSIBLE_ASK_VAULT_PASS`
          (the env\n  form of `--ask-vault-pass`, for a Redis-only manager with no
          `.vault_pass`);\n- request a TTY only when stdin is one (the hardcoded `-it`
          broke\n  non-interactive callers); pass `\"$@\"` through;\n- default `CONTAINER=auto`
          (was `false`): use the seed container when an engine\n  is present, else
          fall back to the venv path; `CONTAINER=false` forces venv,\n  `CONTAINER=true`
          requires the container; `CONTAINER_ENGINE` selects podman;\n- forward the
          connection/auth env allowlist `run.sh` forwards (`ANSIBLE_USER`,\n  `ANSIBLE_ASK_PASS`,
          `ANSIBLE_BECOME_ASK_PASS`, `ANSIBLE_SSH_ARGS`);\n- warn when `CONTAINER=auto`
          selects the container path but the caller set the\n  venv-only `ANSIBLE_INVENTORY`
          / `ANSIBLE_PRIVATE_KEY` overrides (the seed\n  entrypoint hardcodes `-i
          hosts --private-key id_rsa.operator`), so the\n  default flip is not silent.\n\nEach
          commit carries a molecule assertion pinning its behavior.\n\n`MANAGER_VERSION`,
          `ANSIBLE_INVENTORY`/`ANSIBLE_PRIVATE_KEY`, and the collection\nsource/version
          are intentionally **not** forwarded on the container path \u2014\nmatching
          `run.sh`: the release is selected from the mounted `configuration.yml`,\nand
          inventory/key are resolved inside the container.\n\n## Stacked on\n\n- osism/ansible-collection-services#2124\n\nThis
          PR is based on that branch (the exit-0 masking fix is its shared base);
          it\nwill retarget to `main` once #2124 merges. Review just the wiring commits
          here.\n\n## Validation\n\n- Rendered + `bash -n` clean; stubbed-engine smoke
          covers auto/true/false/invalid\n  selection and the vault/TTY/arg cases;
          molecule assertions added per commit.\n- **Live-validated GREEN** on a real
          seed-container-deployed manager (no\n  `python3-venv`): vault decrypt succeeds,
          the operator key is materialized into\n  the writable mount, SSH to `hosts:
          manager` works, conditional `-t` over\n  non-interactive SSH, and the exit
          code propagates \u2014 `Apply role manager\n  ok=44 changed=7 failed=0`,
          all container versions match, `rc 0`.\n\nDocImpact \u2014 the upgrade guide
          needs a matching seed-container update story\n(which install path \u2192
          which update path), drafted in:\n\n- osism/osism.github.io#1009\n\nIts gated
          commit documents this PR's `CONTAINER=auto` behaviour and should land\nwith/after
          this fix.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/ansible-collection-services/pull/2125
        commit_id: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        patchset: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: ansible-collection-services-molecule-manager
      jobtags: []
      max_attempts: 3
      message: bWFuYWdlcjogd2lyZSB1cGRhdGUtbWFuYWdlciBzZWVkLWNvbnRhaW5lciBwYXRoCgojIyBXaGF0CgpXaXJlIHRoZSBgb3Npc20tdXBkYXRlLW1hbmFnZXJgIHdyYXBwZXIncyBgQ09OVEFJTkVSYCBwYXRoIHRvIHBhcml0eSB3aXRoIHRoZQpgU0VFRF9DT05UQUlORVJgIGJsb2NrIG9mIGBydW4uc2hgIChgb3Npc20vZ2VuZXJpY3NgKSwgc28gYG9zaXNtIHVwZGF0ZSBtYW5hZ2VyYAp3b3JrcyBvbiBhIG1hbmFnZXIgZGVwbG95ZWQgd2l0aCB0aGUgc2VlZCBjb250YWluZXIgKG5vIGxvY2FsIEFuc2libGUgdmVudikuCgojIyBXaHkKCiJVcGRhdGUgdGhlIG1hbmFnZXIiIGFsd2F5cyBydW5zIHRoZSBzYW1lIGBvc2lzbS5tYW5hZ2VyLm1hbmFnZXJgIHBsYXlib29rIG92ZXIKU1NIOyBvbmx5IHRoZSBkcml2ZXIgZGlmZmVycyBieSBkZXBsb3ltZW50IHRvcG9sb2d5OgoKfCBUb3BvbG9neSB8IE1hbmFnZXIgc3RhdGUgYXQgdXBkYXRlIHRpbWUgfCBEcml2ZXIgfCBCZWZvcmUgfAp8LS0tfC0tLXwtLS18LS0tfAp8IFNlZWRsZXNzIC8gc2VsZi1ib290c3RyYXBwZWQgfCBoYXMgYSBsb2NhbCB2ZW52IHwgYG9zaXNtIHVwZGF0ZSBtYW5hZ2VyYCDihpIgdmVudiBwYXRoIHwgd29ya3MgfAp8IFBlcnNpc3RlbnQgc2VlZCAoc2VwYXJhdGUgVk0vd29ya3N0YXRpb24pIHwgc2VlZCBob2xkcyBjb25maWcrdmF1bHQra2V5IHwgcmUtcnVuIGBydW4uc2ggbWFuYWdlcmAgZnJvbSB0aGUgc2VlZCB8IHdvcmtzIHwKfCAqKlNlZWQgY29udGFpbmVyLCBzZWVkIGRpc2NhcmRlZCoqIHwgb25seSBgL29wdC9jb25maWd1cmF0aW9uYCArIGAvb3B0L2Fuc2libGUvc2VjcmV0cy9pZF9yc2Eub3BlcmF0b3JgIHwgYG9zaXNtIHVwZGF0ZSBtYW5hZ2VyYCDihpIgKipjb250YWluZXIgcGF0aCoqIHwgKipicm9rZW4qKiB8CgpUaGUgc2VlZCBjb250YWluZXIgaXMgbm93IGEgZG9jdW1lbnRlZCAoYW5kIGRlZmF1bHQpIGRlcGxveSBwYXRoLCBidXQgdGhlCndyYXBwZXIncyBgQ09OVEFJTkVSPXRydWVgIHBhdGggd2FzIGEgcHJlLXNlZWQtY29udGFpbmVyIGZvc3NpbDogYSBiYXJlCmBkb2NrZXIgcnVuYCB0aGF0IGJpbmQtbW91bnRlZCB0aGUgY29uZmlnIHJlcG8gcmVhZC1vbmx5LCBoYXJkY29kZWQgYC1pdGAsCmZvcndhcmRlZCBubyB2YXVsdCBwYXNzd29yZCwgYW5kIHBhc3NlZCBvbmx5IHRoZSBwbGF5Ym9vayBuYW1lLiBPbiBhCnNlZWQtZGVwbG95ZWQgbWFuYWdlciBpdCBmYWlsZWQgaW1tZWRpYXRlbHkgd2l0aCBgQXR0ZW1wdGluZyB0byBkZWNyeXB0IGJ1dCBubwp2YXVsdCBzZWNyZXRzIGZvdW5kYCDigJQgYW5kIGNvdWxkIG5vdCBldmVuIG1hdGVyaWFsaXplIHRoZSAodmF1bHQtZW5jcnlwdGVkKQpvcGVyYXRvciBrZXkgaW50byB0aGUgcmVhZC1vbmx5IG1vdW50LgoKIyMgSG93CgpCcmluZyB0aGUgY29udGFpbmVyIHBhdGggdG8gYHJ1bi5zaGAgYFNFRURfQ09OVEFJTkVSYCBwYXJpdHksIGNvbmZpcm1lZCBhZ2FpbnN0CnRoZSBgb3Npc20vc2VlZGAgaW1hZ2UgZW50cnlwb2ludCAoYGNvbnRhaW5lci1pbWFnZXMvc2VlZGAgYGZpbGVzL3J1bi5zaGApOgoKLSBiaW5kLW1vdW50IHRoZSBjb25maWd1cmF0aW9uIHJlcG9zaXRvcnkgKip3cml0YWJsZSoqIChkcm9wIGA6cm9gKSBzbyB0aGUKICBpbi1jb250YWluZXIgYG9zaXNtLm1hbmFnZXIua2V5cGFpcmAgc3RlcCBjYW4gd3JpdGUgYGlkX3JzYS5vcGVyYXRvcmA7Ci0gZm9yd2FyZCBhbiBleHBsaWNpdCBgQU5TSUJMRV9WQVVMVF9QQVNTV09SRF9GSUxFYCwgZWxzZSBhdXRvLWRldGVjdAogIGBlbnZpcm9ubWVudHMvLnZhdWx0X3Bhc3NgOyBhbHNvIGZvcndhcmQgYEFOU0lCTEVfQVNLX1ZBVUxUX1BBU1NgICh0aGUgZW52CiAgZm9ybSBvZiBgLS1hc2stdmF1bHQtcGFzc2AsIGZvciBhIFJlZGlzLW9ubHkgbWFuYWdlciB3aXRoIG5vIGAudmF1bHRfcGFzc2ApOwotIHJlcXVlc3QgYSBUVFkgb25seSB3aGVuIHN0ZGluIGlzIG9uZSAodGhlIGhhcmRjb2RlZCBgLWl0YCBicm9rZQogIG5vbi1pbnRlcmFjdGl2ZSBjYWxsZXJzKTsgcGFzcyBgIiRAImAgdGhyb3VnaDsKLSBkZWZhdWx0IGBDT05UQUlORVI9YXV0b2AgKHdhcyBgZmFsc2VgKTogdXNlIHRoZSBzZWVkIGNvbnRhaW5lciB3aGVuIGFuIGVuZ2luZQogIGlzIHByZXNlbnQsIGVsc2UgZmFsbCBiYWNrIHRvIHRoZSB2ZW52IHBhdGg7IGBDT05UQUlORVI9ZmFsc2VgIGZvcmNlcyB2ZW52LAogIGBDT05UQUlORVI9dHJ1ZWAgcmVxdWlyZXMgdGhlIGNvbnRhaW5lcjsgYENPTlRBSU5FUl9FTkdJTkVgIHNlbGVjdHMgcG9kbWFuOwotIGZvcndhcmQgdGhlIGNvbm5lY3Rpb24vYXV0aCBlbnYgYWxsb3dsaXN0IGBydW4uc2hgIGZvcndhcmRzIChgQU5TSUJMRV9VU0VSYCwKICBgQU5TSUJMRV9BU0tfUEFTU2AsIGBBTlNJQkxFX0JFQ09NRV9BU0tfUEFTU2AsIGBBTlNJQkxFX1NTSF9BUkdTYCk7Ci0gd2FybiB3aGVuIGBDT05UQUlORVI9YXV0b2Agc2VsZWN0cyB0aGUgY29udGFpbmVyIHBhdGggYnV0IHRoZSBjYWxsZXIgc2V0IHRoZQogIHZlbnYtb25seSBgQU5TSUJMRV9JTlZFTlRPUllgIC8gYEFOU0lCTEVfUFJJVkFURV9LRVlgIG92ZXJyaWRlcyAodGhlIHNlZWQKICBlbnRyeXBvaW50IGhhcmRjb2RlcyBgLWkgaG9zdHMgLS1wcml2YXRlLWtleSBpZF9yc2Eub3BlcmF0b3JgKSwgc28gdGhlCiAgZGVmYXVsdCBmbGlwIGlzIG5vdCBzaWxlbnQuCgpFYWNoIGNvbW1pdCBjYXJyaWVzIGEgbW9sZWN1bGUgYXNzZXJ0aW9uIHBpbm5pbmcgaXRzIGJlaGF2aW9yLgoKYE1BTkFHRVJfVkVSU0lPTmAsIGBBTlNJQkxFX0lOVkVOVE9SWWAvYEFOU0lCTEVfUFJJVkFURV9LRVlgLCBhbmQgdGhlIGNvbGxlY3Rpb24Kc291cmNlL3ZlcnNpb24gYXJlIGludGVudGlvbmFsbHkgKipub3QqKiBmb3J3YXJkZWQgb24gdGhlIGNvbnRhaW5lciBwYXRoIOKAlAptYXRjaGluZyBgcnVuLnNoYDogdGhlIHJlbGVhc2UgaXMgc2VsZWN0ZWQgZnJvbSB0aGUgbW91bnRlZCBgY29uZmlndXJhdGlvbi55bWxgLAphbmQgaW52ZW50b3J5L2tleSBhcmUgcmVzb2x2ZWQgaW5zaWRlIHRoZSBjb250YWluZXIuCgojIyBTdGFja2VkIG9uCgotIG9zaXNtL2Fuc2libGUtY29sbGVjdGlvbi1zZXJ2aWNlcyMyMTI0CgpUaGlzIFBSIGlzIGJhc2VkIG9uIHRoYXQgYnJhbmNoICh0aGUgZXhpdC0wIG1hc2tpbmcgZml4IGlzIGl0cyBzaGFyZWQgYmFzZSk7IGl0CndpbGwgcmV0YXJnZXQgdG8gYG1haW5gIG9uY2UgIzIxMjQgbWVyZ2VzLiBSZXZpZXcganVzdCB0aGUgd2lyaW5nIGNvbW1pdHMgaGVyZS4KCiMjIFZhbGlkYXRpb24KCi0gUmVuZGVyZWQgKyBgYmFzaCAtbmAgY2xlYW47IHN0dWJiZWQtZW5naW5lIHNtb2tlIGNvdmVycyBhdXRvL3RydWUvZmFsc2UvaW52YWxpZAogIHNlbGVjdGlvbiBhbmQgdGhlIHZhdWx0L1RUWS9hcmcgY2FzZXM7IG1vbGVjdWxlIGFzc2VydGlvbnMgYWRkZWQgcGVyIGNvbW1pdC4KLSAqKkxpdmUtdmFsaWRhdGVkIEdSRUVOKiogb24gYSByZWFsIHNlZWQtY29udGFpbmVyLWRlcGxveWVkIG1hbmFnZXIgKG5vCiAgYHB5dGhvbjMtdmVudmApOiB2YXVsdCBkZWNyeXB0IHN1Y2NlZWRzLCB0aGUgb3BlcmF0b3Iga2V5IGlzIG1hdGVyaWFsaXplZCBpbnRvCiAgdGhlIHdyaXRhYmxlIG1vdW50LCBTU0ggdG8gYGhvc3RzOiBtYW5hZ2VyYCB3b3JrcywgY29uZGl0aW9uYWwgYC10YCBvdmVyCiAgbm9uLWludGVyYWN0aXZlIFNTSCwgYW5kIHRoZSBleGl0IGNvZGUgcHJvcGFnYXRlcyDigJQgYEFwcGx5IHJvbGUgbWFuYWdlcgogIG9rPTQ0IGNoYW5nZWQ9NyBmYWlsZWQ9MGAsIGFsbCBjb250YWluZXIgdmVyc2lvbnMgbWF0Y2gsIGByYyAwYC4KCkRvY0ltcGFjdCDigJQgdGhlIHVwZ3JhZGUgZ3VpZGUgbmVlZHMgYSBtYXRjaGluZyBzZWVkLWNvbnRhaW5lciB1cGRhdGUgc3RvcnkKKHdoaWNoIGluc3RhbGwgcGF0aCDihpIgd2hpY2ggdXBkYXRlIHBhdGgpLCBkcmFmdGVkIGluOgoKLSBvc2lzbS9vc2lzbS5naXRodWIuaW8jMTAwOQoKSXRzIGdhdGVkIGNvbW1pdCBkb2N1bWVudHMgdGhpcyBQUidzIGBDT05UQUlORVI9YXV0b2AgYmVoYXZpb3VyIGFuZCBzaG91bGQgbGFuZAp3aXRoL2FmdGVyIHRoaXMgZml4LgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSkK
      patchset: 4f57cc50d64089b4469f4f3d1a053799407e2b0c
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: 01d070148ad259b54f62036c254cdf1f34e0afe5
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2125/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
