all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe27:295e
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 6f0cbfbc-c897-4d99-9335-15ec9016cca8
        host_id: 5afd8fc909abddfe2ce3a956a91bbe56629648b7209fd0acfa541862
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe27:295e
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.107
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.20
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe27:295e
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: bee75349e2d04f2a8551dd70e022667a
      build_refs:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode; require ip_forward\n\n##
          \u26A0\uFE0F Breaking behaviour: role now refuses to start if ip_forward
          is disabled\n\n`PostUp` runs `sysctl -n net.ipv4.ip_forward | grep -q '^1$'`
          before anything\nelse.  If ip forwarding is not enabled, `wg-quick up` **fails
          immediately**\nwith:\n\n```\nwireguard gateway: ip_forward is disabled\n```\n\nand
          `wg0` is not brought up.  On fully-deployed OSISM managers Docker enables\nip_forward
          at daemon start, so this check passes without any additional\nconfiguration.
          \ It will only fail if WireGuard is deployed before Docker, or\non a host
          where ip_forward is explicitly disabled.\n\n## Background\n\nWireGuard gateway
          mode (routing `192.168.16.0/20` through the manager to reach\ninternal testbed
          services) stopped working for new testbed deployments around\nOctober 2025.
          \ Root cause: `terraform-base` commit\n[6162ee9](https://github.com/osism/terraform-base/commit/6162ee93df1ada0f044df606b32af0b22fa7d4dc)\n(\"fix/remove
          broken address pairs\", required by\n[Neutron bug #2116249](https://bugs.launchpad.net/neutron/+bug/2116249))\nchanged
          the manager port's `allowed_address_pairs` from broken `/20` CIDR\nentries
          to correct `/32` host entries.\n\nThe broken CIDRs caused Neutron to skip
          installing anti-spoofing OpenFlow\nrules for the manager port, which accidentally
          allowed forwarded WireGuard\ntraffic (source `192.168.48.x`) through.  After
          the fix Neutron correctly\nenforces anti-spoofing and drops those packets,
          exposing the missing\nMASQUERADE that was always required for gateway mode
          to work.\n\n## What this PR adds\n\n- **MASQUERADE** rule in PostUp scoped
          to `wireguard_client_network` (derived\n  from `wireguard_server_address`,
          e.g. `192.168.48.0/24`) on\n  `wireguard_outbound_interface` (default: `ansible_default_ipv4.interface`).\n
          \ PostDown removes it.  Only WireGuard-forwarded packets are affected; existing\n
          \ Docker and host NAT rules are untouched.\n\n- **ip_forward check** in
          PostUp (see breaking behaviour above).\n\n- Two new variables: `wireguard_outbound_interface`
          and\n  `wireguard_client_network` \u2014 both have sensible defaults and
          can be\n  overridden.\n\n- New molecule test `test_gateway_forwarding`:
          verifies ip_forward is 1 and\n  that the exact MASQUERADE rule (parsed from
          the rendered PostUp in\n  `/etc/wireguard/wg0.conf`, checked with `iptables
          -t nat -C`) is present\n  after the role runs.\n\n## Test plan\n\n- [ ]
          Molecule `test_gateway_forwarding` passes (Zuul CI)\n- [ ] Verified end-to-end
          on regiocloud: WireGuard client connects, pings\n  testbed-node-0 (`192.168.16.10`)
          through the tunnel \u2014 0% packet loss\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        patchset: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: c800cc5b60074b41aa44ca3f86b6e1e3
      buildset_refs:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode; require ip_forward\n\n##
          \u26A0\uFE0F Breaking behaviour: role now refuses to start if ip_forward
          is disabled\n\n`PostUp` runs `sysctl -n net.ipv4.ip_forward | grep -q '^1$'`
          before anything\nelse.  If ip forwarding is not enabled, `wg-quick up` **fails
          immediately**\nwith:\n\n```\nwireguard gateway: ip_forward is disabled\n```\n\nand
          `wg0` is not brought up.  On fully-deployed OSISM managers Docker enables\nip_forward
          at daemon start, so this check passes without any additional\nconfiguration.
          \ It will only fail if WireGuard is deployed before Docker, or\non a host
          where ip_forward is explicitly disabled.\n\n## Background\n\nWireGuard gateway
          mode (routing `192.168.16.0/20` through the manager to reach\ninternal testbed
          services) stopped working for new testbed deployments around\nOctober 2025.
          \ Root cause: `terraform-base` commit\n[6162ee9](https://github.com/osism/terraform-base/commit/6162ee93df1ada0f044df606b32af0b22fa7d4dc)\n(\"fix/remove
          broken address pairs\", required by\n[Neutron bug #2116249](https://bugs.launchpad.net/neutron/+bug/2116249))\nchanged
          the manager port's `allowed_address_pairs` from broken `/20` CIDR\nentries
          to correct `/32` host entries.\n\nThe broken CIDRs caused Neutron to skip
          installing anti-spoofing OpenFlow\nrules for the manager port, which accidentally
          allowed forwarded WireGuard\ntraffic (source `192.168.48.x`) through.  After
          the fix Neutron correctly\nenforces anti-spoofing and drops those packets,
          exposing the missing\nMASQUERADE that was always required for gateway mode
          to work.\n\n## What this PR adds\n\n- **MASQUERADE** rule in PostUp scoped
          to `wireguard_client_network` (derived\n  from `wireguard_server_address`,
          e.g. `192.168.48.0/24`) on\n  `wireguard_outbound_interface` (default: `ansible_default_ipv4.interface`).\n
          \ PostDown removes it.  Only WireGuard-forwarded packets are affected; existing\n
          \ Docker and host NAT rules are untouched.\n\n- **ip_forward check** in
          PostUp (see breaking behaviour above).\n\n- Two new variables: `wireguard_outbound_interface`
          and\n  `wireguard_client_network` \u2014 both have sensible defaults and
          can be\n  overridden.\n\n- New molecule test `test_gateway_forwarding`:
          verifies ip_forward is 1 and\n  that the exact MASQUERADE rule (parsed from
          the rendered PostUp in\n  `/etc/wireguard/wg0.conf`, checked with `iptables
          -t nat -C`) is present\n  after the role runs.\n\n## Test plan\n\n- [ ]
          Molecule `test_gateway_forwarding` passes (Zuul CI)\n- [ ] Verified end-to-end
          on regiocloud: WireGuard client connects, pings\n  testbed-node-0 (`192.168.16.10`)
          through the tunnel \u2014 0% packet loss\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        patchset: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2086'
      change_message: "wireguard: add MASQUERADE for gateway mode; require ip_forward\n\n##
        \u26A0\uFE0F Breaking behaviour: role now refuses to start if ip_forward is
        disabled\n\n`PostUp` runs `sysctl -n net.ipv4.ip_forward | grep -q '^1$'`
        before anything\nelse.  If ip forwarding is not enabled, `wg-quick up` **fails
        immediately**\nwith:\n\n```\nwireguard gateway: ip_forward is disabled\n```\n\nand
        `wg0` is not brought up.  On fully-deployed OSISM managers Docker enables\nip_forward
        at daemon start, so this check passes without any additional\nconfiguration.
        \ It will only fail if WireGuard is deployed before Docker, or\non a host
        where ip_forward is explicitly disabled.\n\n## Background\n\nWireGuard gateway
        mode (routing `192.168.16.0/20` through the manager to reach\ninternal testbed
        services) stopped working for new testbed deployments around\nOctober 2025.
        \ Root cause: `terraform-base` commit\n[6162ee9](https://github.com/osism/terraform-base/commit/6162ee93df1ada0f044df606b32af0b22fa7d4dc)\n(\"fix/remove
        broken address pairs\", required by\n[Neutron bug #2116249](https://bugs.launchpad.net/neutron/+bug/2116249))\nchanged
        the manager port's `allowed_address_pairs` from broken `/20` CIDR\nentries
        to correct `/32` host entries.\n\nThe broken CIDRs caused Neutron to skip
        installing anti-spoofing OpenFlow\nrules for the manager port, which accidentally
        allowed forwarded WireGuard\ntraffic (source `192.168.48.x`) through.  After
        the fix Neutron correctly\nenforces anti-spoofing and drops those packets,
        exposing the missing\nMASQUERADE that was always required for gateway mode
        to work.\n\n## What this PR adds\n\n- **MASQUERADE** rule in PostUp scoped
        to `wireguard_client_network` (derived\n  from `wireguard_server_address`,
        e.g. `192.168.48.0/24`) on\n  `wireguard_outbound_interface` (default: `ansible_default_ipv4.interface`).\n
        \ PostDown removes it.  Only WireGuard-forwarded packets are affected; existing\n
        \ Docker and host NAT rules are untouched.\n\n- **ip_forward check** in PostUp
        (see breaking behaviour above).\n\n- Two new variables: `wireguard_outbound_interface`
        and\n  `wireguard_client_network` \u2014 both have sensible defaults and can
        be\n  overridden.\n\n- New molecule test `test_gateway_forwarding`: verifies
        ip_forward is 1 and\n  that the exact MASQUERADE rule (parsed from the rendered
        PostUp in\n  `/etc/wireguard/wg0.conf`, checked with `iptables -t nat -C`)
        is present\n  after the role runs.\n\n## Test plan\n\n- [ ] Molecule `test_gateway_forwarding`
        passes (Zuul CI)\n- [ ] Verified end-to-end on regiocloud: WireGuard client
        connects, pings\n  testbed-node-0 (`192.168.16.10`) through the tunnel \u2014
        0% packet loss\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-collection-services/pull/2086
      child_jobs: []
      commit_id: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
      event_id: 41f1f970-55d8-11f1-994d-2097df70fc94
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/bee75349e2d04f2a8551dd70e022667a/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/bee75349e2d04f2a8551dd70e022667a/work/logs
        result_data_file: /var/lib/zuul/builds/bee75349e2d04f2a8551dd70e022667a/work/results.json
        src_root: /var/lib/zuul/builds/bee75349e2d04f2a8551dd70e022667a/work/src
        work_root: /var/lib/zuul/builds/bee75349e2d04f2a8551dd70e022667a/work
      include_vars: []
      items:
      - branch: main
        change: '2086'
        change_message: "wireguard: add MASQUERADE for gateway mode; require ip_forward\n\n##
          \u26A0\uFE0F Breaking behaviour: role now refuses to start if ip_forward
          is disabled\n\n`PostUp` runs `sysctl -n net.ipv4.ip_forward | grep -q '^1$'`
          before anything\nelse.  If ip forwarding is not enabled, `wg-quick up` **fails
          immediately**\nwith:\n\n```\nwireguard gateway: ip_forward is disabled\n```\n\nand
          `wg0` is not brought up.  On fully-deployed OSISM managers Docker enables\nip_forward
          at daemon start, so this check passes without any additional\nconfiguration.
          \ It will only fail if WireGuard is deployed before Docker, or\non a host
          where ip_forward is explicitly disabled.\n\n## Background\n\nWireGuard gateway
          mode (routing `192.168.16.0/20` through the manager to reach\ninternal testbed
          services) stopped working for new testbed deployments around\nOctober 2025.
          \ Root cause: `terraform-base` commit\n[6162ee9](https://github.com/osism/terraform-base/commit/6162ee93df1ada0f044df606b32af0b22fa7d4dc)\n(\"fix/remove
          broken address pairs\", required by\n[Neutron bug #2116249](https://bugs.launchpad.net/neutron/+bug/2116249))\nchanged
          the manager port's `allowed_address_pairs` from broken `/20` CIDR\nentries
          to correct `/32` host entries.\n\nThe broken CIDRs caused Neutron to skip
          installing anti-spoofing OpenFlow\nrules for the manager port, which accidentally
          allowed forwarded WireGuard\ntraffic (source `192.168.48.x`) through.  After
          the fix Neutron correctly\nenforces anti-spoofing and drops those packets,
          exposing the missing\nMASQUERADE that was always required for gateway mode
          to work.\n\n## What this PR adds\n\n- **MASQUERADE** rule in PostUp scoped
          to `wireguard_client_network` (derived\n  from `wireguard_server_address`,
          e.g. `192.168.48.0/24`) on\n  `wireguard_outbound_interface` (default: `ansible_default_ipv4.interface`).\n
          \ PostDown removes it.  Only WireGuard-forwarded packets are affected; existing\n
          \ Docker and host NAT rules are untouched.\n\n- **ip_forward check** in
          PostUp (see breaking behaviour above).\n\n- Two new variables: `wireguard_outbound_interface`
          and\n  `wireguard_client_network` \u2014 both have sensible defaults and
          can be\n  overridden.\n\n- New molecule test `test_gateway_forwarding`:
          verifies ip_forward is 1 and\n  that the exact MASQUERADE rule (parsed from
          the rendered PostUp in\n  `/etc/wireguard/wg0.conf`, checked with `iptables
          -t nat -C`) is present\n  after the role runs.\n\n## Test plan\n\n- [ ]
          Molecule `test_gateway_forwarding` passes (Zuul CI)\n- [ ] Verified end-to-end
          on regiocloud: WireGuard client connects, pings\n  testbed-node-0 (`192.168.16.10`)
          through the tunnel \u2014 0% packet loss\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2086
        commit_id: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        patchset: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: d2lyZWd1YXJkOiBhZGQgTUFTUVVFUkFERSBmb3IgZ2F0ZXdheSBtb2RlOyByZXF1aXJlIGlwX2ZvcndhcmQKCiMjIOKaoO+4jyBCcmVha2luZyBiZWhhdmlvdXI6IHJvbGUgbm93IHJlZnVzZXMgdG8gc3RhcnQgaWYgaXBfZm9yd2FyZCBpcyBkaXNhYmxlZAoKYFBvc3RVcGAgcnVucyBgc3lzY3RsIC1uIG5ldC5pcHY0LmlwX2ZvcndhcmQgfCBncmVwIC1xICdeMSQnYCBiZWZvcmUgYW55dGhpbmcKZWxzZS4gIElmIGlwIGZvcndhcmRpbmcgaXMgbm90IGVuYWJsZWQsIGB3Zy1xdWljayB1cGAgKipmYWlscyBpbW1lZGlhdGVseSoqCndpdGg6CgpgYGAKd2lyZWd1YXJkIGdhdGV3YXk6IGlwX2ZvcndhcmQgaXMgZGlzYWJsZWQKYGBgCgphbmQgYHdnMGAgaXMgbm90IGJyb3VnaHQgdXAuICBPbiBmdWxseS1kZXBsb3llZCBPU0lTTSBtYW5hZ2VycyBEb2NrZXIgZW5hYmxlcwppcF9mb3J3YXJkIGF0IGRhZW1vbiBzdGFydCwgc28gdGhpcyBjaGVjayBwYXNzZXMgd2l0aG91dCBhbnkgYWRkaXRpb25hbApjb25maWd1cmF0aW9uLiAgSXQgd2lsbCBvbmx5IGZhaWwgaWYgV2lyZUd1YXJkIGlzIGRlcGxveWVkIGJlZm9yZSBEb2NrZXIsIG9yCm9uIGEgaG9zdCB3aGVyZSBpcF9mb3J3YXJkIGlzIGV4cGxpY2l0bHkgZGlzYWJsZWQuCgojIyBCYWNrZ3JvdW5kCgpXaXJlR3VhcmQgZ2F0ZXdheSBtb2RlIChyb3V0aW5nIGAxOTIuMTY4LjE2LjAvMjBgIHRocm91Z2ggdGhlIG1hbmFnZXIgdG8gcmVhY2gKaW50ZXJuYWwgdGVzdGJlZCBzZXJ2aWNlcykgc3RvcHBlZCB3b3JraW5nIGZvciBuZXcgdGVzdGJlZCBkZXBsb3ltZW50cyBhcm91bmQKT2N0b2JlciAyMDI1LiAgUm9vdCBjYXVzZTogYHRlcnJhZm9ybS1iYXNlYCBjb21taXQKWzYxNjJlZTldKGh0dHBzOi8vZ2l0aHViLmNvbS9vc2lzbS90ZXJyYWZvcm0tYmFzZS9jb21taXQvNjE2MmVlOTNkZjFhZGEwZjA0NGRmNjA2YjMyYWYwYjIyZmE3ZDRkYykKKCJmaXgvcmVtb3ZlIGJyb2tlbiBhZGRyZXNzIHBhaXJzIiwgcmVxdWlyZWQgYnkKW05ldXRyb24gYnVnICMyMTE2MjQ5XShodHRwczovL2J1Z3MubGF1bmNocGFkLm5ldC9uZXV0cm9uLytidWcvMjExNjI0OSkpCmNoYW5nZWQgdGhlIG1hbmFnZXIgcG9ydCdzIGBhbGxvd2VkX2FkZHJlc3NfcGFpcnNgIGZyb20gYnJva2VuIGAvMjBgIENJRFIKZW50cmllcyB0byBjb3JyZWN0IGAvMzJgIGhvc3QgZW50cmllcy4KClRoZSBicm9rZW4gQ0lEUnMgY2F1c2VkIE5ldXRyb24gdG8gc2tpcCBpbnN0YWxsaW5nIGFudGktc3Bvb2ZpbmcgT3BlbkZsb3cKcnVsZXMgZm9yIHRoZSBtYW5hZ2VyIHBvcnQsIHdoaWNoIGFjY2lkZW50YWxseSBhbGxvd2VkIGZvcndhcmRlZCBXaXJlR3VhcmQKdHJhZmZpYyAoc291cmNlIGAxOTIuMTY4LjQ4LnhgKSB0aHJvdWdoLiAgQWZ0ZXIgdGhlIGZpeCBOZXV0cm9uIGNvcnJlY3RseQplbmZvcmNlcyBhbnRpLXNwb29maW5nIGFuZCBkcm9wcyB0aG9zZSBwYWNrZXRzLCBleHBvc2luZyB0aGUgbWlzc2luZwpNQVNRVUVSQURFIHRoYXQgd2FzIGFsd2F5cyByZXF1aXJlZCBmb3IgZ2F0ZXdheSBtb2RlIHRvIHdvcmsuCgojIyBXaGF0IHRoaXMgUFIgYWRkcwoKLSAqKk1BU1FVRVJBREUqKiBydWxlIGluIFBvc3RVcCBzY29wZWQgdG8gYHdpcmVndWFyZF9jbGllbnRfbmV0d29ya2AgKGRlcml2ZWQKICBmcm9tIGB3aXJlZ3VhcmRfc2VydmVyX2FkZHJlc3NgLCBlLmcuIGAxOTIuMTY4LjQ4LjAvMjRgKSBvbgogIGB3aXJlZ3VhcmRfb3V0Ym91bmRfaW50ZXJmYWNlYCAoZGVmYXVsdDogYGFuc2libGVfZGVmYXVsdF9pcHY0LmludGVyZmFjZWApLgogIFBvc3REb3duIHJlbW92ZXMgaXQuICBPbmx5IFdpcmVHdWFyZC1mb3J3YXJkZWQgcGFja2V0cyBhcmUgYWZmZWN0ZWQ7IGV4aXN0aW5nCiAgRG9ja2VyIGFuZCBob3N0IE5BVCBydWxlcyBhcmUgdW50b3VjaGVkLgoKLSAqKmlwX2ZvcndhcmQgY2hlY2sqKiBpbiBQb3N0VXAgKHNlZSBicmVha2luZyBiZWhhdmlvdXIgYWJvdmUpLgoKLSBUd28gbmV3IHZhcmlhYmxlczogYHdpcmVndWFyZF9vdXRib3VuZF9pbnRlcmZhY2VgIGFuZAogIGB3aXJlZ3VhcmRfY2xpZW50X25ldHdvcmtgIOKAlCBib3RoIGhhdmUgc2Vuc2libGUgZGVmYXVsdHMgYW5kIGNhbiBiZQogIG92ZXJyaWRkZW4uCgotIE5ldyBtb2xlY3VsZSB0ZXN0IGB0ZXN0X2dhdGV3YXlfZm9yd2FyZGluZ2A6IHZlcmlmaWVzIGlwX2ZvcndhcmQgaXMgMSBhbmQKICB0aGF0IHRoZSBleGFjdCBNQVNRVUVSQURFIHJ1bGUgKHBhcnNlZCBmcm9tIHRoZSByZW5kZXJlZCBQb3N0VXAgaW4KICBgL2V0Yy93aXJlZ3VhcmQvd2cwLmNvbmZgLCBjaGVja2VkIHdpdGggYGlwdGFibGVzIC10IG5hdCAtQ2ApIGlzIHByZXNlbnQKICBhZnRlciB0aGUgcm9sZSBydW5zLgoKIyMgVGVzdCBwbGFuCgotIFsgXSBNb2xlY3VsZSBgdGVzdF9nYXRld2F5X2ZvcndhcmRpbmdgIHBhc3NlcyAoWnV1bCBDSSkKLSBbIF0gVmVyaWZpZWQgZW5kLXRvLWVuZCBvbiByZWdpb2Nsb3VkOiBXaXJlR3VhcmQgY2xpZW50IGNvbm5lY3RzLCBwaW5ncwogIHRlc3RiZWQtbm9kZS0wIChgMTkyLjE2OC4xNi4xMGApIHRocm91Z2ggdGhlIHR1bm5lbCDigJQgMCUgcGFja2V0IGxvc3MKCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUp
      patchset: 0d0d83126252ed2e3b108c9eb7c759c9b4b99bfa
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: 8a807efdaf305dca41dff7a3a2057c52348882e7
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2086/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
