all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:feb8:403c
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: d349de0b-b667-4690-8f96-a3db92393112
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:feb8:403c
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.84
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.89
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:feb8:403c
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/testbed/.zuul.yaml@main#324>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: bb5d6d2f7aa54a39bf6b91680b633aa0
      build_refs:
      - branch: main
        change: '2916'
        change_message: "manager: overlay generics ansible.cfg via gilt\n\n## Problem\n\nThe
          testbed's `environments/manager/` ships no `ansible.cfg`, unlike every cookiecutter-built
          deployment, which overlays one from `osism/generics` (it sets `host_key_checking
          = false`). The `gilt.yml` overlay pulled only `images.yml` and the render/set-versions
          helpers, leaving the manager environment without an `ansible.cfg`.\n\nThis
          breaks the new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`). That path runs `osism.manager.manager` from the `osism/seed`
          image via `ansible-playbook -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key behaviour there comes solely from a cwd `ansible.cfg`. With none
          present, Ansible falls back to its default `host_key_checking = True`, so
          `Apply role manager`'s first SSH to the manager runs strict checking against
          an empty `known_hosts` and aborts:\n\n```\nfatal: [testbed-manager]: UNREACHABLE!
          => {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via
          ssh: Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nfailing
          `testbed-update` at the final re-apply (first seen periodic-midnight build
          `b842f678`, 2026-06-28). Deploy-time manager apply does not hit this because
          it runs from the `osism-ansible` image, which bakes `host_key_checking =
          false`.\n\n## Fix\n\nOverlay `environments/manager/ansible.cfg` from generics
          like `images.yml`, so the testbed's manager environment matches production
          and tracks the single generics source.\n\n## Notes\n\n- Production and tbng
          are unaffected \u2014 they already overlay this generics file.\n- Companion
          change `osism/container-images#941` bakes a fallback `ansible.cfg` into
          the seed image (defense-in-depth); this PR aligns the testbed config itself.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2916
        commit_id: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        patchset: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
        src_dir: src/github.com/osism/testbed
        topic: null
      buildset: 81a5fcb73e0945f49ce8d112215ab963
      buildset_refs:
      - branch: main
        change: '2916'
        change_message: "manager: overlay generics ansible.cfg via gilt\n\n## Problem\n\nThe
          testbed's `environments/manager/` ships no `ansible.cfg`, unlike every cookiecutter-built
          deployment, which overlays one from `osism/generics` (it sets `host_key_checking
          = false`). The `gilt.yml` overlay pulled only `images.yml` and the render/set-versions
          helpers, leaving the manager environment without an `ansible.cfg`.\n\nThis
          breaks the new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`). That path runs `osism.manager.manager` from the `osism/seed`
          image via `ansible-playbook -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key behaviour there comes solely from a cwd `ansible.cfg`. With none
          present, Ansible falls back to its default `host_key_checking = True`, so
          `Apply role manager`'s first SSH to the manager runs strict checking against
          an empty `known_hosts` and aborts:\n\n```\nfatal: [testbed-manager]: UNREACHABLE!
          => {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via
          ssh: Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nfailing
          `testbed-update` at the final re-apply (first seen periodic-midnight build
          `b842f678`, 2026-06-28). Deploy-time manager apply does not hit this because
          it runs from the `osism-ansible` image, which bakes `host_key_checking =
          false`.\n\n## Fix\n\nOverlay `environments/manager/ansible.cfg` from generics
          like `images.yml`, so the testbed's manager environment matches production
          and tracks the single generics source.\n\n## Notes\n\n- Production and tbng
          are unaffected \u2014 they already overlay this generics file.\n- Companion
          change `osism/container-images#941` bakes a fallback `ansible.cfg` into
          the seed image (defense-in-depth); this PR aligns the testbed config itself.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2916
        commit_id: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        patchset: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
        src_dir: src/github.com/osism/testbed
        topic: null
      change: '2916'
      change_message: "manager: overlay generics ansible.cfg via gilt\n\n## Problem\n\nThe
        testbed's `environments/manager/` ships no `ansible.cfg`, unlike every cookiecutter-built
        deployment, which overlays one from `osism/generics` (it sets `host_key_checking
        = false`). The `gilt.yml` overlay pulled only `images.yml` and the render/set-versions
        helpers, leaving the manager environment without an `ansible.cfg`.\n\nThis
        breaks the new `osism update manager` seed-container path (wired in `ansible-collection-services`
        `f1e7869f`). That path runs `osism.manager.manager` from the `osism/seed`
        image via `ansible-playbook -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
        Host-key behaviour there comes solely from a cwd `ansible.cfg`. With none
        present, Ansible falls back to its default `host_key_checking = True`, so
        `Apply role manager`'s first SSH to the manager runs strict checking against
        an empty `known_hosts` and aborts:\n\n```\nfatal: [testbed-manager]: UNREACHABLE!
        => {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via ssh:
        Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nfailing
        `testbed-update` at the final re-apply (first seen periodic-midnight build
        `b842f678`, 2026-06-28). Deploy-time manager apply does not hit this because
        it runs from the `osism-ansible` image, which bakes `host_key_checking = false`.\n\n##
        Fix\n\nOverlay `environments/manager/ansible.cfg` from generics like `images.yml`,
        so the testbed's manager environment matches production and tracks the single
        generics source.\n\n## Notes\n\n- Production and tbng are unaffected \u2014
        they already overlay this generics file.\n- Companion change `osism/container-images#941`
        bakes a fallback `ansible.cfg` into the seed image (defense-in-depth); this
        PR aligns the testbed config itself.\n\n\U0001F916 Generated with [Claude
        Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/testbed/pull/2916
      child_jobs: []
      commit_id: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
      event_id: 0b81c110-72eb-11f1-9f97-231ec4e17f6f
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/bb5d6d2f7aa54a39bf6b91680b633aa0/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/bb5d6d2f7aa54a39bf6b91680b633aa0/work/logs
        result_data_file: /var/lib/zuul/builds/bb5d6d2f7aa54a39bf6b91680b633aa0/work/results.json
        src_root: /var/lib/zuul/builds/bb5d6d2f7aa54a39bf6b91680b633aa0/work/src
        work_root: /var/lib/zuul/builds/bb5d6d2f7aa54a39bf6b91680b633aa0/work
      include_vars: []
      items:
      - branch: main
        change: '2916'
        change_message: "manager: overlay generics ansible.cfg via gilt\n\n## Problem\n\nThe
          testbed's `environments/manager/` ships no `ansible.cfg`, unlike every cookiecutter-built
          deployment, which overlays one from `osism/generics` (it sets `host_key_checking
          = false`). The `gilt.yml` overlay pulled only `images.yml` and the render/set-versions
          helpers, leaving the manager environment without an `ansible.cfg`.\n\nThis
          breaks the new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`). That path runs `osism.manager.manager` from the `osism/seed`
          image via `ansible-playbook -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key behaviour there comes solely from a cwd `ansible.cfg`. With none
          present, Ansible falls back to its default `host_key_checking = True`, so
          `Apply role manager`'s first SSH to the manager runs strict checking against
          an empty `known_hosts` and aborts:\n\n```\nfatal: [testbed-manager]: UNREACHABLE!
          => {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via
          ssh: Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nfailing
          `testbed-update` at the final re-apply (first seen periodic-midnight build
          `b842f678`, 2026-06-28). Deploy-time manager apply does not hit this because
          it runs from the `osism-ansible` image, which bakes `host_key_checking =
          false`.\n\n## Fix\n\nOverlay `environments/manager/ansible.cfg` from generics
          like `images.yml`, so the testbed's manager environment matches production
          and tracks the single generics source.\n\n## Notes\n\n- Production and tbng
          are unaffected \u2014 they already overlay this generics file.\n- Companion
          change `osism/container-images#941` bakes a fallback `ansible.cfg` into
          the seed image (defense-in-depth); this PR aligns the testbed config itself.\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2916
        commit_id: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        patchset: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
          src_dir: src/github.com/osism/testbed
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: bWFuYWdlcjogb3ZlcmxheSBnZW5lcmljcyBhbnNpYmxlLmNmZyB2aWEgZ2lsdAoKIyMgUHJvYmxlbQoKVGhlIHRlc3RiZWQncyBgZW52aXJvbm1lbnRzL21hbmFnZXIvYCBzaGlwcyBubyBgYW5zaWJsZS5jZmdgLCB1bmxpa2UgZXZlcnkgY29va2llY3V0dGVyLWJ1aWx0IGRlcGxveW1lbnQsIHdoaWNoIG92ZXJsYXlzIG9uZSBmcm9tIGBvc2lzbS9nZW5lcmljc2AgKGl0IHNldHMgYGhvc3Rfa2V5X2NoZWNraW5nID0gZmFsc2VgKS4gVGhlIGBnaWx0LnltbGAgb3ZlcmxheSBwdWxsZWQgb25seSBgaW1hZ2VzLnltbGAgYW5kIHRoZSByZW5kZXIvc2V0LXZlcnNpb25zIGhlbHBlcnMsIGxlYXZpbmcgdGhlIG1hbmFnZXIgZW52aXJvbm1lbnQgd2l0aG91dCBhbiBgYW5zaWJsZS5jZmdgLgoKVGhpcyBicmVha3MgdGhlIG5ldyBgb3Npc20gdXBkYXRlIG1hbmFnZXJgIHNlZWQtY29udGFpbmVyIHBhdGggKHdpcmVkIGluIGBhbnNpYmxlLWNvbGxlY3Rpb24tc2VydmljZXNgIGBmMWU3ODY5ZmApLiBUaGF0IHBhdGggcnVucyBgb3Npc20ubWFuYWdlci5tYW5hZ2VyYCBmcm9tIHRoZSBgb3Npc20vc2VlZGAgaW1hZ2UgdmlhIGBhbnNpYmxlLXBsYXlib29rIC1pIGhvc3RzYCwgd2l0aCB0aGUgd29ya2luZyBkaXJlY3RvcnkgYXQgYC9vcHQvY29uZmlndXJhdGlvbi9lbnZpcm9ubWVudHMvbWFuYWdlcmAuIEhvc3Qta2V5IGJlaGF2aW91ciB0aGVyZSBjb21lcyBzb2xlbHkgZnJvbSBhIGN3ZCBgYW5zaWJsZS5jZmdgLiBXaXRoIG5vbmUgcHJlc2VudCwgQW5zaWJsZSBmYWxscyBiYWNrIHRvIGl0cyBkZWZhdWx0IGBob3N0X2tleV9jaGVja2luZyA9IFRydWVgLCBzbyBgQXBwbHkgcm9sZSBtYW5hZ2VyYCdzIGZpcnN0IFNTSCB0byB0aGUgbWFuYWdlciBydW5zIHN0cmljdCBjaGVja2luZyBhZ2FpbnN0IGFuIGVtcHR5IGBrbm93bl9ob3N0c2AgYW5kIGFib3J0czoKCmBgYApmYXRhbDogW3Rlc3RiZWQtbWFuYWdlcl06IFVOUkVBQ0hBQkxFISA9PiB7ImNoYW5nZWQiOiBmYWxzZSwKICAibXNnIjogIkZhaWxlZCB0byBjb25uZWN0IHRvIHRoZSBob3N0IHZpYSBzc2g6IEhvc3Qga2V5CiAgdmVyaWZpY2F0aW9uIGZhaWxlZC4iLCAidW5yZWFjaGFibGUiOiB0cnVlfQpgYGAKCmZhaWxpbmcgYHRlc3RiZWQtdXBkYXRlYCBhdCB0aGUgZmluYWwgcmUtYXBwbHkgKGZpcnN0IHNlZW4gcGVyaW9kaWMtbWlkbmlnaHQgYnVpbGQgYGI4NDJmNjc4YCwgMjAyNi0wNi0yOCkuIERlcGxveS10aW1lIG1hbmFnZXIgYXBwbHkgZG9lcyBub3QgaGl0IHRoaXMgYmVjYXVzZSBpdCBydW5zIGZyb20gdGhlIGBvc2lzbS1hbnNpYmxlYCBpbWFnZSwgd2hpY2ggYmFrZXMgYGhvc3Rfa2V5X2NoZWNraW5nID0gZmFsc2VgLgoKIyMgRml4CgpPdmVybGF5IGBlbnZpcm9ubWVudHMvbWFuYWdlci9hbnNpYmxlLmNmZ2AgZnJvbSBnZW5lcmljcyBsaWtlIGBpbWFnZXMueW1sYCwgc28gdGhlIHRlc3RiZWQncyBtYW5hZ2VyIGVudmlyb25tZW50IG1hdGNoZXMgcHJvZHVjdGlvbiBhbmQgdHJhY2tzIHRoZSBzaW5nbGUgZ2VuZXJpY3Mgc291cmNlLgoKIyMgTm90ZXMKCi0gUHJvZHVjdGlvbiBhbmQgdGJuZyBhcmUgdW5hZmZlY3RlZCDigJQgdGhleSBhbHJlYWR5IG92ZXJsYXkgdGhpcyBnZW5lcmljcyBmaWxlLgotIENvbXBhbmlvbiBjaGFuZ2UgYG9zaXNtL2NvbnRhaW5lci1pbWFnZXMjOTQxYCBiYWtlcyBhIGZhbGxiYWNrIGBhbnNpYmxlLmNmZ2AgaW50byB0aGUgc2VlZCBpbWFnZSAoZGVmZW5zZS1pbi1kZXB0aCk7IHRoaXMgUFIgYWxpZ25zIHRoZSB0ZXN0YmVkIGNvbmZpZyBpdHNlbGYuCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQ==
      patchset: 8dbd62bb5a289f2e7a7c3a6c13ff3563e0fe8db4
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/testbed
        name: osism/testbed
        short_name: testbed
        src_dir: src/github.com/osism/testbed
      projects:
        github.com/osism/testbed:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          checkout: main
          checkout_description: zuul branch
          commit: f773e5ada914ab113af167446f805eff0375e72b
          name: osism/testbed
          required: false
          short_name: testbed
          src_dir: src/github.com/osism/testbed
      ref: refs/pull/2916/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
