all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:febf:1c59
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 36898093-6e20-44fa-9921-b67b6d82d77a
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:febf:1c59
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.144
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.17
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:febf:1c59
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job netbox-manager-e2e explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/netbox-manager/.zuul.yaml@main#32>'
      - '<Job netbox-manager-e2e explicit: None implied: None source: osism/netbox-manager/.zuul.yaml@main#39>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: a9b966c3480c4486970902f1b7b78f8c
      build_refs:
      - branch: main
        change: '288'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check
          the [Dependency Dashboard](../issues/1) for more information.\n\n---\n\n###
          GitPython: Incomplete unsafe_git_clone_options denylist omits --template
          enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/netbox-manager).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/netbox-manager/pull/288
        commit_id: 417e1f609af59e3f55509de1ec50f706468f3e40
        patchset: 417e1f609af59e3f55509de1ec50f706468f3e40
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/netbox-manager
          name: osism/netbox-manager
          short_name: netbox-manager
        src_dir: src/github.com/osism/netbox-manager
        topic: null
      buildset: b6a9422847a246c79fdfd67fa6a933a7
      buildset_refs:
      - branch: main
        change: '288'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check
          the [Dependency Dashboard](../issues/1) for more information.\n\n---\n\n###
          GitPython: Incomplete unsafe_git_clone_options denylist omits --template
          enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/netbox-manager).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/netbox-manager/pull/288
        commit_id: 417e1f609af59e3f55509de1ec50f706468f3e40
        patchset: 417e1f609af59e3f55509de1ec50f706468f3e40
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/netbox-manager
          name: osism/netbox-manager
          short_name: netbox-manager
        src_dir: src/github.com/osism/netbox-manager
        topic: null
      change: '288'
      change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis PR
        contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [GitPython](https://redirect.github.com/gitpython-developers/GitPython) |
        `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
        |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check
        the [Dependency Dashboard](../issues/1) for more information.\n\n---\n\n###
        GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling
        arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
        denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
        into the new repository and runs them (`post-checkout` fires during clone),
        so a caller who can influence clone options can achieve arbitrary command
        execution in the default `allow_unsafe_options=False` configuration.\n\n#####
        Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
        \u2014 `--template` is absent. The guard candidate `['--template']` passes
        `check_unsafe_options` (verified). git copies the hook directory and executes
        `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
        do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
        Impact\nArbitrary OS command execution during clone (default config). Requires
        an attacker-readable directory containing an executable hook \u2014 a genuine
        second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
        or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
        Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
        +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
        post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
        Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x). Guard:
        n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
        Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
        Bypass proof: `--template` not on the denylist -> passes (verified candidate
        `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout`
        at checkout. Impact: ACE, default config (verified marker created).\n\n#####
        Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']`
        passed with no error; staged `post-checkout` hook executed during `clone_from`,
        creating the marker. Independent of the value-smuggle bypass (`--template`
        is a legitimate long option that survives any single-char-value fix). Not
        covered by any existing advisory.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
        Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing
        options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)**
        \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 7.5 / 10
        (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Arbitrary file overwrite via git diff --output argument injection
        in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()` forwards
        `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
        guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
        giving a broad surface. `git diff --output=<path>` writes real patch content
        to an attacker-chosen path, enabling arbitrary file overwrite.\n\n##### Root
        Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
        anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0,
        other)`, placing the caller-supplied `other` ref BEFORE the `--` separator,
        so a value of `--output=/path` is parsed by git as an option \u2014 a value-only
        control path requiring no kwarg key.\n\n##### Impact\nOverwrite/corrupt any
        file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`,
        configs, lockfiles). Content is real diff/patch bytes (attacker-influenced).
        Per the skill's rule, controlling WHICH file is overwritten = I:H regardless
        of content constraints.\n\n##### Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
        output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
        (105 bytes verified)\n\n##### Value-control (attacker controls only the ref
        string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')          #
        14-byte victim -> 146 bytes of diff-tree output\n```\n\n##### Attack Chain\n1.
        Entry (value-control): `commit.diff(other=<user ref>)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`.
        Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in
        the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink:
        `git diff-tree <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git
        opens+truncates the target then writes diff content. Impact: overwrite/corrupt
        any file at process privilege (attacker chooses the path). Verified argv and
        victim overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag
        3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`)
        overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
        This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
        \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
        Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
        to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
        before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
        by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
        Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Unsafe git option guard bypass via single-character kwarg value
        token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
        guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since)
        can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`,
        `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token
        inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False`
        configuration this yields arbitrary command execution via `--upload-pack`.\n\n#####
        Root Cause\nThe guard builds its candidate option list from kwarg KEYS only:
        `_option_candidates([], {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']`
        (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n`
        is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n',
        value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv
        tokens `['-n', '--upload-pack=<cmd>']`. git then parses the second token as
        `--upload-pack` and executes the attacker-supplied command. The guard never
        inspects the value that becomes a separate argv token.\n\n##### Impact\nArbitrary
        OS command execution as the host process (via `--upload-pack`) in the default
        configuration, affecting all guarded methods since they all build candidates
        through the name-only `_option_candidates`.\n\n##### Proof of Concept\n```python\nfrom
        git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch
        /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE created -> ACE. Direct-name
        form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on
        a guarded revision command: `iter_commits('HEAD', g='--output=/path')` ->
        candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n#####
        Attack Chain\n1. Entry: app forwards a user-supplied options dict -> `Repo.clone_from(url,
        path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([],
        kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([],
        {\"n\":\"--upload-pack=...\"})` -> `['-n']` (key-only), not on denylist ->
        no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n',
        value, split_single_char_options=True)` -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`.
        Guard: none (guard already passed on name-only candidate). Bypass proof: verified
        transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
        -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
        created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
        HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
        `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with
        the payload created the marker file; the direct-name `upload_pack=` form raised
        UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96
        long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split)
        are BLOCKED on HEAD \u2014 this is a distinct kwarg-value->separate-token
        vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nMake
        `_option_candidates` also emit candidates derived from single-character kwarg
        VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options`
        over the fully-transformed argv rather than the reconstructed name-only candidate
        list.\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n####
        Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
        [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
        - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
        What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
        in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
        Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
        manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
        conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
        Close this PR and you won't be reminded about these updates again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/netbox-manager).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/netbox-manager/pull/288
      child_jobs: []
      commit_id: 417e1f609af59e3f55509de1ec50f706468f3e40
      event_id: bb69e730-87bb-11f1-8b48-1ebb26e6fdfc
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/a9b966c3480c4486970902f1b7b78f8c/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/a9b966c3480c4486970902f1b7b78f8c/work/logs
        result_data_file: /var/lib/zuul/builds/a9b966c3480c4486970902f1b7b78f8c/work/results.json
        src_root: /var/lib/zuul/builds/a9b966c3480c4486970902f1b7b78f8c/work/src
        work_root: /var/lib/zuul/builds/a9b966c3480c4486970902f1b7b78f8c/work
      include_vars: []
      items:
      - branch: main
        change: '288'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check
          the [Dependency Dashboard](../issues/1) for more information.\n\n---\n\n###
          GitPython: Incomplete unsafe_git_clone_options denylist omits --template
          enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/netbox-manager).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/netbox-manager/pull/288
        commit_id: 417e1f609af59e3f55509de1ec50f706468f3e40
        patchset: 417e1f609af59e3f55509de1ec50f706468f3e40
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/netbox-manager
          name: osism/netbox-manager
          short_name: netbox-manager
          src_dir: src/github.com/osism/netbox-manager
        topic: null
      job: netbox-manager-e2e
      jobtags: []
      max_attempts: 3
      message: VXBkYXRlIGRlcGVuZGVuY3kgR2l0UHl0aG9uIHRvIHYzLjEuNTQgW1NFQ1VSSVRZXQoKVGhpcyBQUiBjb250YWlucyB0aGUgZm9sbG93aW5nIHVwZGF0ZXM6Cgp8IFBhY2thZ2UgfCBDaGFuZ2UgfCBbQWdlXShodHRwczovL2RvY3MucmVub3ZhdGVib3QuY29tL21lcmdlLWNvbmZpZGVuY2UvKSB8IFtDb25maWRlbmNlXShodHRwczovL2RvY3MucmVub3ZhdGVib3QuY29tL21lcmdlLWNvbmZpZGVuY2UvKSB8CnwtLS18LS0tfC0tLXwtLS18CnwgW0dpdFB5dGhvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbikgfCBgPT0zLjEuNTNgIOKGkiBgPT0zLjEuNTRgIHwgIVthZ2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9hZ2UvcHlwaS9naXRweXRob24vMy4xLjU0P3NsaW09dHJ1ZSkgfCAhW2NvbmZpZGVuY2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9jb25maWRlbmNlL3B5cGkvZ2l0cHl0aG9uLzMuMS41My8zLjEuNTQ/c2xpbT10cnVlKSB8CgotLS0KCj4gWyFXQVJOSU5HXQo+IFNvbWUgZGVwZW5kZW5jaWVzIGNvdWxkIG5vdCBiZSBsb29rZWQgdXAuIENoZWNrIHRoZSBbRGVwZW5kZW5jeSBEYXNoYm9hcmRdKC4uL2lzc3Vlcy8xKSBmb3IgbW9yZSBpbmZvcm1hdGlvbi4KCi0tLQoKIyMjIEdpdFB5dGhvbjogSW5jb21wbGV0ZSB1bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnMgZGVueWxpc3Qgb21pdHMgLS10ZW1wbGF0ZSBlbmFibGluZyBhcmJpdHJhcnkgY29tbWFuZCBleGVjdXRpb24gdmlhIGNsb25lIGhvb2tzCltHSFNBLTZwOGgtM3dneC05N2dmXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLTZwOGgtM3dneC05N2dmKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgU3VtbWFyeQpHaXRQeXRob24ncyBgdW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zYCBkZW55bGlzdCBvbWl0cyBgLS10ZW1wbGF0ZWAuIGBnaXQgY2xvbmUgLS10ZW1wbGF0ZT08ZGlyPmAgY29waWVzIGA8ZGlyPi9ob29rcy9gIGludG8gdGhlIG5ldyByZXBvc2l0b3J5IGFuZCBydW5zIHRoZW0gKGBwb3N0LWNoZWNrb3V0YCBmaXJlcyBkdXJpbmcgY2xvbmUpLCBzbyBhIGNhbGxlciB3aG8gY2FuIGluZmx1ZW5jZSBjbG9uZSBvcHRpb25zIGNhbiBhY2hpZXZlIGFyYml0cmFyeSBjb21tYW5kIGV4ZWN1dGlvbiBpbiB0aGUgZGVmYXVsdCBgYWxsb3dfdW5zYWZlX29wdGlvbnM9RmFsc2VgIGNvbmZpZ3VyYXRpb24uCgojIyMjIyBSb290IENhdXNlCmBiYXNlLnB5OjE0NS0xNTJgIGRlZmluZXMgYHVuc2FmZV9naXRfY2xvbmVfb3B0aW9ucyA9IFsiLS11cGxvYWQtcGFjayIsIi11IiwiLS1jb25maWciLCItYyJdYCDigJQgYC0tdGVtcGxhdGVgIGlzIGFic2VudC4gVGhlIGd1YXJkIGNhbmRpZGF0ZSBgWyctLXRlbXBsYXRlJ11gIHBhc3NlcyBgY2hlY2tfdW5zYWZlX29wdGlvbnNgICh2ZXJpZmllZCkuIGdpdCBjb3BpZXMgdGhlIGhvb2sgZGlyZWN0b3J5IGFuZCBleGVjdXRlcyBgcG9zdC1jaGVja291dGAgYXQgY2hlY2tvdXQgdGltZS4gZ2l0J3MgYHByb3RvY29sLmFsbG93YC9gR0lUX0FMTE9XX1BST1RPQ09MYCBkbyBub3QgZ2F0ZSBgLS10ZW1wbGF0ZWA7IHRoZSBpbmNvbXBsZXRlIGRlbnlsaXN0IGlzIHRoZSBvbmx5IGRlZmVuc2UuCgojIyMjIyBJbXBhY3QKQXJiaXRyYXJ5IE9TIGNvbW1hbmQgZXhlY3V0aW9uIGR1cmluZyBjbG9uZSAoZGVmYXVsdCBjb25maWcpLiBSZXF1aXJlcyBhbiBhdHRhY2tlci1yZWFkYWJsZSBkaXJlY3RvcnkgY29udGFpbmluZyBhbiBleGVjdXRhYmxlIGhvb2sg4oCUIGEgZ2VudWluZSBzZWNvbmQgcHJlY29uZGl0aW9uIChyZWFsaXN0aWMgdmlhIHNoYXJlZCBmaWxlc3lzdGVtcywgdXBsb2FkIGRpcnMsIGAvdG1wYCwgb3IgYXR0YWNrZXItd3JpdGFibGUgbmV0d29yayBwYXRocyksIHJlZmxlY3RlZCBhcyBBQzpILgoKIyMjIyMgUHJvb2Ygb2YgQ29uY2VwdApgYGBweXRob24KCiMjIyMjIGF0dGFja2VyIHN0YWdlcyA8ZGlyPi9ob29rcy9wb3N0LWNoZWNrb3V0IChjaG1vZCAreCkKZnJvbSBnaXQgaW1wb3J0IFJlcG8KUmVwby5jbG9uZV9mcm9tKHNyYywgZHN0LCB0ZW1wbGF0ZT0nPGRpcj4nKSAgICMgcG9zdC1jaGVja291dCBob29rIGV4ZWN1dGVzIC0+IG1hcmtlciBjcmVhdGVkICh2ZXJpZmllZCkKYGBgCgojIyMjIyBBdHRhY2sgQ2hhaW4KMS4gU2V0dXA6IGF0dGFja2VyIHN0YWdlcyBgPGRpcj4vaG9va3MvcG9zdC1jaGVja291dGAgKGNobW9kICt4KS4gR3VhcmQ6IG4vYSAoZmlsZXN5c3RlbSkuCjIuIEVudHJ5OiBgUmVwby5jbG9uZV9mcm9tKHVybCwgcGF0aCwgdGVtcGxhdGU9JzxkaXI+JylgLiBHdWFyZDogYGNoZWNrX3Vuc2FmZV9vcHRpb25zKGNhbmRpZGF0ZXM9WyctLXRlbXBsYXRlJ10sIHVuc2FmZT11bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnMpYC4gQnlwYXNzIHByb29mOiBgLS10ZW1wbGF0ZWAgbm90IG9uIHRoZSBkZW55bGlzdCAtPiBwYXNzZXMgKHZlcmlmaWVkIGNhbmRpZGF0ZSBgWyctLXRlbXBsYXRlJ11gLCBubyBlcnJvcikuCjMuIFNpbms6IGdpdCBjb3BpZXMgdGhlIGhvb2sgYW5kIGV4ZWN1dGVzIGBwb3N0LWNoZWNrb3V0YCBhdCBjaGVja291dC4gSW1wYWN0OiBBQ0UsIGRlZmF1bHQgY29uZmlnICh2ZXJpZmllZCBtYXJrZXIgY3JlYXRlZCkuCgojIyMjIyBCeXBhc3MgRXZpZGVuY2UKTGl2ZS12ZXJpZmllZCBvbiBIRUFEICh0YWcgMy4xLjUzKTogZ3VhcmQgY2FuZGlkYXRlIGBbJy0tdGVtcGxhdGUnXWAgcGFzc2VkIHdpdGggbm8gZXJyb3I7IHN0YWdlZCBgcG9zdC1jaGVja291dGAgaG9vayBleGVjdXRlZCBkdXJpbmcgYGNsb25lX2Zyb21gLCBjcmVhdGluZyB0aGUgbWFya2VyLiBJbmRlcGVuZGVudCBvZiB0aGUgdmFsdWUtc211Z2dsZSBieXBhc3MgKGAtLXRlbXBsYXRlYCBpcyBhIGxlZ2l0aW1hdGUgbG9uZyBvcHRpb24gdGhhdCBzdXJ2aXZlcyBhbnkgc2luZ2xlLWNoYXItdmFsdWUgZml4KS4gTm90IGNvdmVyZWQgYnkgYW55IGV4aXN0aW5nIGFkdmlzb3J5LgoKIyMjIyMgQWZmZWN0ZWQgVmVyc2lvbnMKYDw9IDMuMS41M2AKCiMjIyMjIFN1Z2dlc3RlZCBGaXgKQWRkIGAtLXRlbXBsYXRlYCAoYW5kIGF1ZGl0IGZvciBvdGhlciBob29rL2V4ZWMtaW5mbHVlbmNpbmcgb3B0aW9ucykgdG8gYHVuc2FmZV9naXRfY2xvbmVfb3B0aW9uc2AuCgotLS0KUmVwb3J0ZWQgYnkgKip6eCAoSmFjZSkqKiDigJQgR2l0SHViOiBAJiM4MjAzO21hbnVzLXVzZQoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDcuNSAvIDEwIChIaWdoKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjMuMS9BVjpOL0FDOkgvUFI6TC9VSTpOL1M6VS9DOkgvSTpIL0E6SGAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS02cDhoLTN3Z3gtOTdnZl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNnA4aC0zd2d4LTk3Z2YpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvZmZjYjUzNTllODc2MTlmNGZlNGE3MGE0YWZmNWYwOGM1NTgwYmE5N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvZmZjYjUzNTllODc2MTlmNGZlNGE3MGE0YWZmNWYwOGM1NTgwYmE5NykKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbikKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTQpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS02cDhoLTN3Z3gtOTdnZikgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBHaXRQeXRob246IEFyYml0cmFyeSBmaWxlIG92ZXJ3cml0ZSB2aWEgZ2l0IGRpZmYgLS1vdXRwdXQgYXJndW1lbnQgaW5qZWN0aW9uIGluIERpZmZhYmxlLmRpZmYgKGtleS0gYW5kIHZhbHVlLWNvbnRyb2xsZWQpCltHSFNBLWZqcjQteDY2My1td3hjXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLWZqcjQteDY2My1td3hjKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgU3VtbWFyeQpgRGlmZmFibGUuZGlmZigpYCBmb3J3YXJkcyBgKiprd2FyZ3NgIHN0cmFpZ2h0IGludG8gYGRpZmZgL2BkaWZmX3RyZWVgIHdpdGggKipubyoqIGBjaGVja191bnNhZmVfb3B0aW9uc2AgZ3VhcmQuIGBEaWZmYWJsZWAgaXMgbWl4ZWQgaW50byBgQ29tbWl0YCwgYFRyZWVgLCBgSW5kZXhGaWxlYCwgYW5kIGBTdWJtb2R1bGVgLCBnaXZpbmcgYSBicm9hZCBzdXJmYWNlLiBgZ2l0IGRpZmYgLS1vdXRwdXQ9PHBhdGg+YCB3cml0ZXMgcmVhbCBwYXRjaCBjb250ZW50IHRvIGFuIGF0dGFja2VyLWNob3NlbiBwYXRoLCBlbmFibGluZyBhcmJpdHJhcnkgZmlsZSBvdmVyd3JpdGUuCgojIyMjIyBSb290IENhdXNlCmBkaWZmLnB5OjE4OC0yODNgIGJ1aWxkcyBhbmQgcnVucyB0aGUgZGlmZiBjb21tYW5kIHdpdGggbm8gYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBhbnl3aGVyZSBpbiB0aGUgbWV0aG9kIChncmVwLWNvbmZpcm1lZCkuIEFkZGl0aW9uYWxseSBgZGlmZi5weToyNjVgIGRvZXMgYGFyZ3MuaW5zZXJ0KDAsIG90aGVyKWAsIHBsYWNpbmcgdGhlIGNhbGxlci1zdXBwbGllZCBgb3RoZXJgIHJlZiBCRUZPUkUgdGhlIGAtLWAgc2VwYXJhdG9yLCBzbyBhIHZhbHVlIG9mIGAtLW91dHB1dD0vcGF0aGAgaXMgcGFyc2VkIGJ5IGdpdCBhcyBhbiBvcHRpb24g4oCUIGEgdmFsdWUtb25seSBjb250cm9sIHBhdGggcmVxdWlyaW5nIG5vIGt3YXJnIGtleS4KCiMjIyMjIEltcGFjdApPdmVyd3JpdGUvY29ycnVwdCBhbnkgZmlsZSBhdCBwcm9jZXNzIHByaXZpbGVnZSB3aXRoIGF0dGFja2VyLWNob3NlbiBwYXRoIChlLmcuIGB+Ly5zc2gvYXV0aG9yaXplZF9rZXlzYCwgY29uZmlncywgbG9ja2ZpbGVzKS4gQ29udGVudCBpcyByZWFsIGRpZmYvcGF0Y2ggYnl0ZXMgKGF0dGFja2VyLWluZmx1ZW5jZWQpLiBQZXIgdGhlIHNraWxsJ3MgcnVsZSwgY29udHJvbGxpbmcgV0hJQ0ggZmlsZSBpcyBvdmVyd3JpdHRlbiA9IEk6SCByZWdhcmRsZXNzIG9mIGNvbnRlbnQgY29uc3RyYWludHMuCgojIyMjIyBQcm9vZiBvZiBDb25jZXB0CmBgYHB5dGhvbgoKIyMjIyMgS2V5LWNvbnRyb2w6CmNvbW1pdC5kaWZmKG90aGVyX2NvbW1pdCwgb3V0cHV0PScvaG9tZS9hcHAvLnNzaC9hdXRob3JpemVkX2tleXMnKSAgICMgdmljdGltIG92ZXJ3cml0dGVuIHdpdGggZGlmZiAoMTA1IGJ5dGVzIHZlcmlmaWVkKQoKIyMjIyMgVmFsdWUtY29udHJvbCAoYXR0YWNrZXIgY29udHJvbHMgb25seSB0aGUgcmVmIHN0cmluZyk6CmNvbW1pdC5kaWZmKG90aGVyPSctLW91dHB1dD0vaG9tZS9hcHAvLnNzaC9hdXRob3JpemVkX2tleXMnKSAgICAgICAgICAjIDE0LWJ5dGUgdmljdGltIC0+IDE0NiBieXRlcyBvZiBkaWZmLXRyZWUgb3V0cHV0CmBgYAoKIyMjIyMgQXR0YWNrIENoYWluCjEuIEVudHJ5ICh2YWx1ZS1jb250cm9sKTogYGNvbW1pdC5kaWZmKG90aGVyPTx1c2VyIHJlZj4pYCB3aXRoIGBvdGhlciA9ICItLW91dHB1dD0vaG9tZS9hcHAvLnNzaC9hdXRob3JpemVkX2tleXMiYC4gR3VhcmQ6IG5vbmUgaW4gYERpZmZhYmxlLmRpZmZgLiBCeXBhc3MgcHJvb2Y6IG5vIGBjaGVja191bnNhZmVfb3B0aW9uc2AgaW4gdGhlIG1ldGhvZCBib2R5IChncmVwKTsgYG90aGVyYCBpbnNlcnRlZCBwcmUtYC0tYCBhdCBkaWZmLnB5OjI2NS4KMi4gU2luazogYGdpdCBkaWZmLXRyZWUgPHNoYT4gLS1vdXRwdXQ9L2hvbWUvYXBwLy5zc2gvYXV0aG9yaXplZF9rZXlzIC1yIC4uLmAgLT4gZ2l0IG9wZW5zK3RydW5jYXRlcyB0aGUgdGFyZ2V0IHRoZW4gd3JpdGVzIGRpZmYgY29udGVudC4gSW1wYWN0OiBvdmVyd3JpdGUvY29ycnVwdCBhbnkgZmlsZSBhdCBwcm9jZXNzIHByaXZpbGVnZSAoYXR0YWNrZXIgY2hvb3NlcyB0aGUgcGF0aCkuIFZlcmlmaWVkIGFyZ3YgYW5kIHZpY3RpbSBvdmVyd3JpdGUgbGl2ZS4KCiMjIyMjIEJ5cGFzcyBFdmlkZW5jZQpMaXZlLXZlcmlmaWVkIG9uIEhFQUQgKHRhZyAzLjEuNTMpOiBib3RoIGtleS1jb250cm9sIChgb3V0cHV0PWApIGFuZCB2YWx1ZS1jb250cm9sIChgb3RoZXI9Jy0tb3V0cHV0PS4uLidgKSBvdmVyd3JvdGUgYSB2aWN0aW0gZmlsZSB3aXRoIHJlYWwgZGlmZi10cmVlIGNvbnRlbnQ7IGFyZ3YgY29uZmlybWVkIGBbJ2dpdCcsJ2RpZmYtdHJlZScsJzxzaGE+JywnLS1vdXRwdXQ9L3ZpY3RpbScsJy1yJywuLi5dYC4gVGhpcyBpcyB0aGUgc2FtZSB2YWx1ZS1jb250cm9sIG1vZGVsIEdIU0EtOTU2eCBkZWVtZWQgZml4LXdvcnRoeSBmb3IgYGl0ZXJfY29tbWl0cyhyZXY9Jy0tb3V0cHV0PScpYCDigJQgYnV0IGBkaWZmYCBpcyBhIGRpc3RpbmN0LCB1bmd1YXJkZWQgc2luayBOT1QgdG91Y2hlZCBieSB0aGF0IGZpeC4KCiMjIyMjIEFmZmVjdGVkIFZlcnNpb25zCmA8PSAzLjEuNTNgCgojIyMjIyBTdWdnZXN0ZWQgRml4CkFkZCBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIHRvIGBEaWZmYWJsZS5kaWZmYCAobWlycm9yaW5nIGBpdGVyX2NvbW1pdHNgL2BhcmNoaXZlYCksIGFuZC9vciBwbGFjZSBgLS1lbmQtb2Ytb3B0aW9uc2AgYmVmb3JlIHRoZSBgb3RoZXJgIHJlZiBzbyBpdCBjYW5ub3QgYmUgcGFyc2VkIGFzIGFuIG9wdGlvbi4KCi0tLQpSZXBvcnRlZCBieSAqKnp4IChKYWNlKSoqIOKAlCBHaXRIdWI6IEAmIzgyMDM7bWFudXMtdXNlCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogOC4xIC8gMTAgKEhpZ2gpCi0gVmVjdG9yIFN0cmluZzogYENWU1M6My4xL0FWOk4vQUM6TC9QUjpML1VJOk4vUzpVL0M6Ti9JOkgvQTpIYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWZqcjQteDY2My1td3hjXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1manI0LXg2NjMtbXd4YykKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC8xZDUxYjg5MWQ3ZjIzNjA0NGE2YWExNzQ5OGVjNjgyYjYzZGFkNmU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC8xZDUxYjg5MWQ3ZjIzNjA0NGE2YWExNzQ5OGVjNjgyYjYzZGFkNmU2KQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NCkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSBbT1NWXShodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9HSFNBLWZqcjQteDY2My1td3hjKSBhbmQgdGhlIFtHaXRIdWIgQWR2aXNvcnkgRGF0YWJhc2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UpIChbQ0MtQlkgNC4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlL2Jsb2IvbWFpbi9MSUNFTlNFLm1kKSkuCjwvZGV0YWlscz4KCi0tLQoKIyMjIEdpdFB5dGhvbjogVW5zYWZlIGdpdCBvcHRpb24gZ3VhcmQgYnlwYXNzIHZpYSBzaW5nbGUtY2hhcmFjdGVyIGt3YXJnIHZhbHVlIHRva2VuIHNtdWdnbGluZyBlbmFibGVzIGFyYml0cmFyeSBjb21tYW5kIGV4ZWN1dGlvbgpbR0hTQS1yOW1yLW0zN2MtNWZyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS1yOW1yLW0zN2MtNWZyMykKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIFN1bW1hcnkKR2l0UHl0aG9uJ3MgYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBndWFyZCAodGhlIGNvbnRyb2wgaW50cm9kdWNlZCBieSBDVkUtMjAyNi00MjIxNSAvIEdIU0EtMmY5NiBhbmQgaGFyZGVuZWQgc2luY2UpIGNhbiBiZSBieXBhc3NlZCBmb3IgKipldmVyeSoqIGd1YXJkZWQgbWV0aG9kIChgY2xvbmVgL2BjbG9uZV9mcm9tYCwgYGZldGNoYC9gcHVsbGAvYHB1c2hgLCBgbHNfcmVtb3RlYCwgYGl0ZXJfY29tbWl0c2AsIGBibGFtZWAsIGBhcmNoaXZlYCkgYnkgc211Z2dsaW5nIGFuIG9wdGlvbiB0b2tlbiBpbnNpZGUgdGhlIFZBTFVFIG9mIGEgc2luZ2xlLWNoYXJhY3RlciBrd2FyZy4gSW4gdGhlIGRlZmF1bHQgYGFsbG93X3Vuc2FmZV9vcHRpb25zPUZhbHNlYCBjb25maWd1cmF0aW9uIHRoaXMgeWllbGRzIGFyYml0cmFyeSBjb21tYW5kIGV4ZWN1dGlvbiB2aWEgYC0tdXBsb2FkLXBhY2tgLgoKIyMjIyMgUm9vdCBDYXVzZQpUaGUgZ3VhcmQgYnVpbGRzIGl0cyBjYW5kaWRhdGUgb3B0aW9uIGxpc3QgZnJvbSBrd2FyZyBLRVlTIG9ubHk6IGBfb3B0aW9uX2NhbmRpZGF0ZXMoW10sIHsibiI6Ii0tdXBsb2FkLXBhY2s9PGNtZD4ifSlgIHJldHVybnMgYFsnLW4nXWAgKGNtZC5weToxMDQyLTEwNDYgZGVyaXZlcyB0aGUgY2FuZGlkYXRlIGZyb20gdGhlIGtleSwgbmV2ZXIgdGhlIHZhbHVlKS4gYC1uYCBpcyBub3Qgb24gdGhlIGRlbnlsaXN0LCBzbyBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIHBhc3Nlcy4gQnV0IGB0cmFuc2Zvcm1fa3dhcmcoJ24nLCB2YWx1ZSwgc3BsaXRfc2luZ2xlX2NoYXJfb3B0aW9ucz1UcnVlKWAgKGNtZC5weToxNjAwLTE2MDYpIGVtaXRzICoqdHdvKiogYXJndiB0b2tlbnMgYFsnLW4nLCAnLS11cGxvYWQtcGFjaz08Y21kPiddYC4gZ2l0IHRoZW4gcGFyc2VzIHRoZSBzZWNvbmQgdG9rZW4gYXMgYC0tdXBsb2FkLXBhY2tgIGFuZCBleGVjdXRlcyB0aGUgYXR0YWNrZXItc3VwcGxpZWQgY29tbWFuZC4gVGhlIGd1YXJkIG5ldmVyIGluc3BlY3RzIHRoZSB2YWx1ZSB0aGF0IGJlY29tZXMgYSBzZXBhcmF0ZSBhcmd2IHRva2VuLgoKIyMjIyMgSW1wYWN0CkFyYml0cmFyeSBPUyBjb21tYW5kIGV4ZWN1dGlvbiBhcyB0aGUgaG9zdCBwcm9jZXNzICh2aWEgYC0tdXBsb2FkLXBhY2tgKSBpbiB0aGUgZGVmYXVsdCBjb25maWd1cmF0aW9uLCBhZmZlY3RpbmcgYWxsIGd1YXJkZWQgbWV0aG9kcyBzaW5jZSB0aGV5IGFsbCBidWlsZCBjYW5kaWRhdGVzIHRocm91Z2ggdGhlIG5hbWUtb25seSBgX29wdGlvbl9jYW5kaWRhdGVzYC4KCiMjIyMjIFByb29mIG9mIENvbmNlcHQKYGBgcHl0aG9uCmZyb20gZ2l0IGltcG9ydCBSZXBvClJlcG8uY2xvbmVfZnJvbShiYXJlX3JlcG8sIG91dF9kaXIsIG49Ii0tdXBsb2FkLXBhY2s9dG91Y2ggL3RtcC9BQ0U7Z2l0LXVwbG9hZC1wYWNrIikKCiMjIyMjIC90bXAvQUNFIGNyZWF0ZWQgLT4gQUNFLiBEaXJlY3QtbmFtZSBmb3JtIHVwbG9hZF9wYWNrPSIuLi4iIGlzIGNvcnJlY3RseSBCTE9DS0VELgpgYGAKRmlsZS13cml0ZSB2YXJpYW50IG9uIGEgZ3VhcmRlZCByZXZpc2lvbiBjb21tYW5kOiBgaXRlcl9jb21taXRzKCdIRUFEJywgZz0nLS1vdXRwdXQ9L3BhdGgnKWAgLT4gY2FuZGlkYXRlIGBbJy1nJ11gIHBhc3NlcywgYXJndiBgWyctZycsJy0tb3V0cHV0PS9wYXRoJ11gLCB2aWN0aW0gZmlsZSB0cnVuY2F0ZWQuCgojIyMjIyBBdHRhY2sgQ2hhaW4KMS4gRW50cnk6IGFwcCBmb3J3YXJkcyBhIHVzZXItc3VwcGxpZWQgb3B0aW9ucyBkaWN0IC0+IGBSZXBvLmNsb25lX2Zyb20odXJsLCBwYXRoLCBuPSItLXVwbG9hZC1wYWNrPXRvdWNoIC90bXAvQUNFO2dpdC11cGxvYWQtcGFjayIpYC4gR3VhcmQ6IGBjaGVja191bnNhZmVfb3B0aW9ucyhvcHRpb25zPV9vcHRpb25fY2FuZGlkYXRlcyhbXSwga3dhcmdzKSwgdW5zYWZlPXVuc2FmZV9naXRfY2xvbmVfb3B0aW9ucylgIGF0IGJhc2UucHkuIEJ5cGFzcyBwcm9vZjogYF9vcHRpb25fY2FuZGlkYXRlcyhbXSwgeyJuIjoiLS11cGxvYWQtcGFjaz0uLi4ifSlgIC0+IGBbJy1uJ11gIChrZXktb25seSksIG5vdCBvbiBkZW55bGlzdCAtPiBubyBVbnNhZmVPcHRpb25FcnJvciAodmVyaWZpZWQgbGl2ZSkuCjIuIFRyYW5zZm9ybTogYHRyYW5zZm9ybV9rd2FyZygnbicsIHZhbHVlLCBzcGxpdF9zaW5nbGVfY2hhcl9vcHRpb25zPVRydWUpYCAtPiBgWyctbicsICctLXVwbG9hZC1wYWNrPXRvdWNoIC90bXAvQUNFO2dpdC11cGxvYWQtcGFjayddYC4gR3VhcmQ6IG5vbmUgKGd1YXJkIGFscmVhZHkgcGFzc2VkIG9uIG5hbWUtb25seSBjYW5kaWRhdGUpLiBCeXBhc3MgcHJvb2Y6IHZlcmlmaWVkIHRyYW5zZm9ybSBlbWl0cyB0d28gdG9rZW5zLgozLiBTaW5rOiBgZ2l0IGNsb25lIC1uIC0tdXBsb2FkLXBhY2s9J3RvdWNoIC4uLjtnaXQtdXBsb2FkLXBhY2snIC0tIDxzcmM+IDxkc3Q+YDsgZ2l0IHBhcnNlcyBhbmQgcnVucyB0aGUgc2Vjb25kIHRva2VuLiBJbXBhY3Q6IEFDRSAobWFya2VyIGNyZWF0ZWQsIHZlcmlmaWVkIGVuZC10by1lbmQpLgoKIyMjIyMgQnlwYXNzIEV2aWRlbmNlCkxpdmUtdmVyaWZpZWQgb24gSEVBRCAodGFnIDMuMS41Myk6IGBfb3B0aW9uX2NhbmRpZGF0ZXNgIHJldHVybnMga2V5LW9ubHkgY2FuZGlkYXRlIGBbJy1uJ11gOyBgdHJhbnNmb3JtX2t3YXJnc2AgZW1pdHMgdGhlIHNtdWdnbGVkIGAtLXVwbG9hZC1wYWNrPWAgdG9rZW47IGNsb25lX2Zyb20gd2l0aCB0aGUgcGF5bG9hZCBjcmVhdGVkIHRoZSBtYXJrZXIgZmlsZTsgdGhlIGRpcmVjdC1uYW1lIGB1cGxvYWRfcGFjaz1gIGZvcm0gcmFpc2VkIFVuc2FmZU9wdGlvbkVycm9yLiBBbGwgcHJpb3IgYnlwYXNzZXMgKEdIU0EtcnBtNSB1bmRlcnNjb3JlIGtleSwgR0hTQS0yZjk2IGxvbmctb3B0aW9uIGFiYnJldmlhdGlvbiwgR0hTQS12Mzk2IGpvaW5lZCBzaG9ydCBvcHRpb24sIEdIU0EteDJxeCBtdWx0aS1iZWZvcmUtc3BsaXQpIGFyZSBCTE9DS0VEIG9uIEhFQUQg4oCUIHRoaXMgaXMgYSBkaXN0aW5jdCBrd2FyZy12YWx1ZS0+c2VwYXJhdGUtdG9rZW4gdmVjdG9yLgoKIyMjIyMgQWZmZWN0ZWQgVmVyc2lvbnMKYDw9IDMuMS41M2AKCiMjIyMjIFN1Z2dlc3RlZCBGaXgKTWFrZSBgX29wdGlvbl9jYW5kaWRhdGVzYCBhbHNvIGVtaXQgY2FuZGlkYXRlcyBkZXJpdmVkIGZyb20gc2luZ2xlLWNoYXJhY3RlciBrd2FyZyBWQUxVRVMgd2hlbiBgc3BsaXRfc2luZ2xlX2NoYXJfb3B0aW9uc2AgaXMgaW4gZWZmZWN0LCBPUiBydW4gYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBvdmVyIHRoZSBmdWxseS10cmFuc2Zvcm1lZCBhcmd2IHJhdGhlciB0aGFuIHRoZSByZWNvbnN0cnVjdGVkIG5hbWUtb25seSBjYW5kaWRhdGUgbGlzdC4KCi0tLQpSZXBvcnRlZCBieSAqKnp4IChKYWNlKSoqIOKAlCBHaXRIdWI6IEAmIzgyMDM7bWFudXMtdXNlCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogOC44IC8gMTAgKEhpZ2gpCi0gVmVjdG9yIFN0cmluZzogYENWU1M6My4xL0FWOk4vQUM6TC9QUjpML1VJOk4vUzpVL0M6SC9JOkgvQTpIYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLXI5bXItbTM3Yy01ZnIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1yOW1yLW0zN2MtNWZyMykKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC9lOGQwZmJmNzc0ZDFmNmJhYTNiNDgxYWRmZTQ4YmQyNjJlNDNiNDUzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC9lOGQwZmJmNzc0ZDFmNmJhYTNiNDgxYWRmZTQ4YmQyNjJlNDNiNDUzKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NCkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSBbT1NWXShodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9HSFNBLXI5bXItbTM3Yy01ZnIzKSBhbmQgdGhlIFtHaXRIdWIgQWR2aXNvcnkgRGF0YWJhc2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UpIChbQ0MtQlkgNC4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlL2Jsb2IvbWFpbi9MSUNFTlNFLm1kKSkuCjwvZGV0YWlscz4KCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24gKEdpdFB5dGhvbik8L3N1bW1hcnk+CgojIyMgW2B2My4xLjU0YF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0KTogLSBTRUNVUklUWQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbXBhcmUvMy4xLjUzLi4uMy4xLjU0KQoKIyMjIyBXaGF0J3MgQ2hhbmdlZAoKLSBIYXJkZW4gdW5zYWZlIEdpdCBvcHRpb24gdmFsaWRhdGlvbiBieSBbQCYjODIwMztCeXJvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0J5cm9uKSBpbiBbIyYjODIwMzsyMTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MCkKCioqRnVsbCBDaGFuZ2Vsb2cqKjogPGh0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tcGFyZS8zLjEuNTMuLi4zLjEuNTQ+Cgo8L2RldGFpbHM+CgotLS0KCiMjIyBDb25maWd1cmF0aW9uCgrwn5OFICoqU2NoZWR1bGUqKjogKFVUQykKCi0gQnJhbmNoIGNyZWF0aW9uCiAgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkKLSBBdXRvbWVyZ2UKICAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKQoK8J+apiAqKkF1dG9tZXJnZSoqOiBEaXNhYmxlZCBieSBjb25maWcuIFBsZWFzZSBtZXJnZSB0aGlzIG1hbnVhbGx5IG9uY2UgeW91IGFyZSBzYXRpc2ZpZWQuCgrimbsgKipSZWJhc2luZyoqOiBXaGVuZXZlciBQUiBiZWNvbWVzIGNvbmZsaWN0ZWQsIG9yIHlvdSB0aWNrIHRoZSByZWJhc2UvcmV0cnkgY2hlY2tib3guCgrwn5SVICoqSWdub3JlKio6IENsb3NlIHRoaXMgUFIgYW5kIHlvdSB3b24ndCBiZSByZW1pbmRlZCBhYm91dCB0aGVzZSB1cGRhdGVzIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL25ldGJveC1tYW5hZ2VyKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJME15NHlPREF1TUNJc0luVndaR0YwWldSSmJsWmxjaUk2SWpRekxqSTRNQzR3SWl3aWRHRnlaMlYwUW5KaGJtTm9Jam9pYldGcGJpSXNJbXhoWW1Wc2N5STZXeUp5Wlc1dmRtRjBaU0pkZlE9PS0tPgo=
      patchset: 417e1f609af59e3f55509de1ec50f706468f3e40
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/netbox-manager:
            canonical_name: github.com/osism/netbox-manager
            checkout: main
            commit: d215448d2cdd572b5e1cfd20f5f4be342bee0e93
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
        playbooks:
        - path: untrusted/project_0/github.com/osism/netbox-manager/playbooks/test-e2e.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/netbox-manager
        name: osism/netbox-manager
        short_name: netbox-manager
        src_dir: src/github.com/osism/netbox-manager
      projects:
        github.com/osism/netbox-manager:
          canonical_hostname: github.com
          canonical_name: github.com/osism/netbox-manager
          checkout: main
          checkout_description: zuul branch
          commit: d215448d2cdd572b5e1cfd20f5f4be342bee0e93
          name: osism/netbox-manager
          required: false
          short_name: netbox-manager
          src_dir: src/github.com/osism/netbox-manager
      ref: refs/pull/288/head
      resources: {}
      tenant: osism
      timeout: 2400
      topic: null
      voting: true
