all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe00:297b
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 23e903da-aad6-467f-b82a-fb6ada6f3a62
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe00:297b
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.228
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.70
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe00:297b
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/container-images/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: e2883538ba8b424fa30e90df1fda415e
      build_refs:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for a latent\noctavia-tempest-plugin
          cert-fixture bug that Python 3.13 surfaces.\n\n`octavia_tempest_plugin/common/cert_utils.py`
          builds its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, but under\n**non-strict** X.509 verification \u2014 the historical
          default \u2014 OpenSSL never checks\nfor them, so the chain verifies and
          the tests pass.\n\n## Why it fails here but not upstream\n\n**Python 3.13's
          `ssl.create_default_context()` enables `VERIFY_X509_STRICT` by\ndefault.**
          This image ships Python 3.13, and the barbican TLS scenario tests\n(`test_tls_barbican`)
          connect back to the load balancer with `httpx`, which builds\nits TLS context
          from that default \u2014 so the client now does strict verification and\nrejects
          the fixture chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED] certificate
          verify failed: Missing Authority Key Identifier\n```\n\nUpstream octavia-tempest-plugin
          CI never hits this: the OpenStack gate runs on\ndistro Python (3.10/3.12),
          where `create_default_context()` does **not** set\n`X509_STRICT`, so the
          missing key identifiers are tolerated and the tests pass. The\nfixtures
          were always non-compliant; Python 3.13 \u2014 which this image adopts ahead
          of\nthe gate \u2014 is simply what surfaces it. Octavia itself is unaffected:
          its own\namphora/server/client CAs already carry SKI+AKI.\n\n## Fix\n\nAdd
          the standard key-identifier pair: a `SubjectKeyIdentifier` on the CA and
          a\nmatching `AuthorityKeyIdentifier` (derived from the issuer public key)
          on the\nserver and client leaf certs. Both use RFC 5280 method 1 (SHA1 of
          the public key),\nso the leaf AKI keyid matches the CA SKI keyid and the
          chain builds. This is the\nRFC-compliant fix, not a workaround.\n\n## Verification\n\nBuilt
          a local image (base + this patch applied through the build's `patch -p1\n--forward`
          gate) and ran the barbican TLS traffic tests through the tempest role on\na
          live full-profile cluster:\n\n- `openssl verify -x509_strict` on regenerated
          fixtures: `error 85 Missing\n  Authority Key Identifier` \u2192 **OK**\n-
          `test_http_1_1_tls_traffic` \u2192 **pass**, `test_http_2_tls_traffic` \u2192
          **pass**\n  (both previously failed only on this cert check)\n\n(`test_http_1_1_tls_hsts_traffic`
          still fails, but on an unrelated\n`httpx.ConnectTimeout` to the VIP \u2014
          a separate HSTS-listener data-path issue, not\nthis cert problem.)\n\n##
          Notes\n\n- Self-expiring (OSISM P5): once octavia-tempest-plugin ships these
          extensions and\n  the pin bumps past it, the `--dry-run` gate fails the
          build and this file must be\n  deleted.\n- Sibling of the same-mechanism
          patch:\n  - osism/container-images#945\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 6f20ec95cce143471db2c4069593cfae5795dbc9
        patchset: 6f20ec95cce143471db2c4069593cfae5795dbc9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      buildset: e6e7f61bd45242afad0caff0369637e2
      buildset_refs:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for a latent\noctavia-tempest-plugin
          cert-fixture bug that Python 3.13 surfaces.\n\n`octavia_tempest_plugin/common/cert_utils.py`
          builds its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, but under\n**non-strict** X.509 verification \u2014 the historical
          default \u2014 OpenSSL never checks\nfor them, so the chain verifies and
          the tests pass.\n\n## Why it fails here but not upstream\n\n**Python 3.13's
          `ssl.create_default_context()` enables `VERIFY_X509_STRICT` by\ndefault.**
          This image ships Python 3.13, and the barbican TLS scenario tests\n(`test_tls_barbican`)
          connect back to the load balancer with `httpx`, which builds\nits TLS context
          from that default \u2014 so the client now does strict verification and\nrejects
          the fixture chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED] certificate
          verify failed: Missing Authority Key Identifier\n```\n\nUpstream octavia-tempest-plugin
          CI never hits this: the OpenStack gate runs on\ndistro Python (3.10/3.12),
          where `create_default_context()` does **not** set\n`X509_STRICT`, so the
          missing key identifiers are tolerated and the tests pass. The\nfixtures
          were always non-compliant; Python 3.13 \u2014 which this image adopts ahead
          of\nthe gate \u2014 is simply what surfaces it. Octavia itself is unaffected:
          its own\namphora/server/client CAs already carry SKI+AKI.\n\n## Fix\n\nAdd
          the standard key-identifier pair: a `SubjectKeyIdentifier` on the CA and
          a\nmatching `AuthorityKeyIdentifier` (derived from the issuer public key)
          on the\nserver and client leaf certs. Both use RFC 5280 method 1 (SHA1 of
          the public key),\nso the leaf AKI keyid matches the CA SKI keyid and the
          chain builds. This is the\nRFC-compliant fix, not a workaround.\n\n## Verification\n\nBuilt
          a local image (base + this patch applied through the build's `patch -p1\n--forward`
          gate) and ran the barbican TLS traffic tests through the tempest role on\na
          live full-profile cluster:\n\n- `openssl verify -x509_strict` on regenerated
          fixtures: `error 85 Missing\n  Authority Key Identifier` \u2192 **OK**\n-
          `test_http_1_1_tls_traffic` \u2192 **pass**, `test_http_2_tls_traffic` \u2192
          **pass**\n  (both previously failed only on this cert check)\n\n(`test_http_1_1_tls_hsts_traffic`
          still fails, but on an unrelated\n`httpx.ConnectTimeout` to the VIP \u2014
          a separate HSTS-listener data-path issue, not\nthis cert problem.)\n\n##
          Notes\n\n- Self-expiring (OSISM P5): once octavia-tempest-plugin ships these
          extensions and\n  the pin bumps past it, the `--dry-run` gate fails the
          build and this file must be\n  deleted.\n- Sibling of the same-mechanism
          patch:\n  - osism/container-images#945\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 6f20ec95cce143471db2c4069593cfae5795dbc9
        patchset: 6f20ec95cce143471db2c4069593cfae5795dbc9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      change: '947'
      change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
        `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
        (same mechanism/gating as the affinity patch) for a latent\noctavia-tempest-plugin
        cert-fixture bug that Python 3.13 surfaces.\n\n`octavia_tempest_plugin/common/cert_utils.py`
        builds its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
        certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be present,
        but under\n**non-strict** X.509 verification \u2014 the historical default
        \u2014 OpenSSL never checks\nfor them, so the chain verifies and the tests
        pass.\n\n## Why it fails here but not upstream\n\n**Python 3.13's `ssl.create_default_context()`
        enables `VERIFY_X509_STRICT` by\ndefault.** This image ships Python 3.13,
        and the barbican TLS scenario tests\n(`test_tls_barbican`) connect back to
        the load balancer with `httpx`, which builds\nits TLS context from that default
        \u2014 so the client now does strict verification and\nrejects the fixture
        chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
        Missing Authority Key Identifier\n```\n\nUpstream octavia-tempest-plugin CI
        never hits this: the OpenStack gate runs on\ndistro Python (3.10/3.12), where
        `create_default_context()` does **not** set\n`X509_STRICT`, so the missing
        key identifiers are tolerated and the tests pass. The\nfixtures were always
        non-compliant; Python 3.13 \u2014 which this image adopts ahead of\nthe gate
        \u2014 is simply what surfaces it. Octavia itself is unaffected: its own\namphora/server/client
        CAs already carry SKI+AKI.\n\n## Fix\n\nAdd the standard key-identifier pair:
        a `SubjectKeyIdentifier` on the CA and a\nmatching `AuthorityKeyIdentifier`
        (derived from the issuer public key) on the\nserver and client leaf certs.
        Both use RFC 5280 method 1 (SHA1 of the public key),\nso the leaf AKI keyid
        matches the CA SKI keyid and the chain builds. This is the\nRFC-compliant
        fix, not a workaround.\n\n## Verification\n\nBuilt a local image (base + this
        patch applied through the build's `patch -p1\n--forward` gate) and ran the
        barbican TLS traffic tests through the tempest role on\na live full-profile
        cluster:\n\n- `openssl verify -x509_strict` on regenerated fixtures: `error
        85 Missing\n  Authority Key Identifier` \u2192 **OK**\n- `test_http_1_1_tls_traffic`
        \u2192 **pass**, `test_http_2_tls_traffic` \u2192 **pass**\n  (both previously
        failed only on this cert check)\n\n(`test_http_1_1_tls_hsts_traffic` still
        fails, but on an unrelated\n`httpx.ConnectTimeout` to the VIP \u2014 a separate
        HSTS-listener data-path issue, not\nthis cert problem.)\n\n## Notes\n\n- Self-expiring
        (OSISM P5): once octavia-tempest-plugin ships these extensions and\n  the
        pin bumps past it, the `--dry-run` gate fails the build and this file must
        be\n  deleted.\n- Sibling of the same-mechanism patch:\n  - osism/container-images#945\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/container-images/pull/947
      child_jobs: []
      commit_id: 6f20ec95cce143471db2c4069593cfae5795dbc9
      event_id: ed60e030-7df3-11f1-8a81-24e2a5f4f886
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/e2883538ba8b424fa30e90df1fda415e/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/e2883538ba8b424fa30e90df1fda415e/work/logs
        result_data_file: /var/lib/zuul/builds/e2883538ba8b424fa30e90df1fda415e/work/results.json
        src_root: /var/lib/zuul/builds/e2883538ba8b424fa30e90df1fda415e/work/src
        work_root: /var/lib/zuul/builds/e2883538ba8b424fa30e90df1fda415e/work
      include_vars: []
      items:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for a latent\noctavia-tempest-plugin
          cert-fixture bug that Python 3.13 surfaces.\n\n`octavia_tempest_plugin/common/cert_utils.py`
          builds its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, but under\n**non-strict** X.509 verification \u2014 the historical
          default \u2014 OpenSSL never checks\nfor them, so the chain verifies and
          the tests pass.\n\n## Why it fails here but not upstream\n\n**Python 3.13's
          `ssl.create_default_context()` enables `VERIFY_X509_STRICT` by\ndefault.**
          This image ships Python 3.13, and the barbican TLS scenario tests\n(`test_tls_barbican`)
          connect back to the load balancer with `httpx`, which builds\nits TLS context
          from that default \u2014 so the client now does strict verification and\nrejects
          the fixture chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED] certificate
          verify failed: Missing Authority Key Identifier\n```\n\nUpstream octavia-tempest-plugin
          CI never hits this: the OpenStack gate runs on\ndistro Python (3.10/3.12),
          where `create_default_context()` does **not** set\n`X509_STRICT`, so the
          missing key identifiers are tolerated and the tests pass. The\nfixtures
          were always non-compliant; Python 3.13 \u2014 which this image adopts ahead
          of\nthe gate \u2014 is simply what surfaces it. Octavia itself is unaffected:
          its own\namphora/server/client CAs already carry SKI+AKI.\n\n## Fix\n\nAdd
          the standard key-identifier pair: a `SubjectKeyIdentifier` on the CA and
          a\nmatching `AuthorityKeyIdentifier` (derived from the issuer public key)
          on the\nserver and client leaf certs. Both use RFC 5280 method 1 (SHA1 of
          the public key),\nso the leaf AKI keyid matches the CA SKI keyid and the
          chain builds. This is the\nRFC-compliant fix, not a workaround.\n\n## Verification\n\nBuilt
          a local image (base + this patch applied through the build's `patch -p1\n--forward`
          gate) and ran the barbican TLS traffic tests through the tempest role on\na
          live full-profile cluster:\n\n- `openssl verify -x509_strict` on regenerated
          fixtures: `error 85 Missing\n  Authority Key Identifier` \u2192 **OK**\n-
          `test_http_1_1_tls_traffic` \u2192 **pass**, `test_http_2_tls_traffic` \u2192
          **pass**\n  (both previously failed only on this cert check)\n\n(`test_http_1_1_tls_hsts_traffic`
          still fails, but on an unrelated\n`httpx.ConnectTimeout` to the VIP \u2014
          a separate HSTS-listener data-path issue, not\nthis cert problem.)\n\n##
          Notes\n\n- Self-expiring (OSISM P5): once octavia-tempest-plugin ships these
          extensions and\n  the pin bumps past it, the `--dry-run` gate fails the
          build and this file must be\n  deleted.\n- Sibling of the same-mechanism
          patch:\n  - osism/container-images#945\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 6f20ec95cce143471db2c4069593cfae5795dbc9
        patchset: 6f20ec95cce143471db2c4069593cfae5795dbc9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
          src_dir: src/github.com/osism/container-images
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: dGVtcGVzdDogcGF0Y2ggb2N0YXZpYSBjZXJ0LXV0aWxzIGZvciBBS0kvU0tJCgojIyBXaGF0CgpBZGQgYHRlbXBlc3QvZmlsZXMvcGF0Y2hlcy8wMDAyLW9jdGF2aWEtY2VydC11dGlscy1ha2kucGF0Y2hgLCBhIHNlbGYtZXhwaXJpbmcKcGF0Y2ggKHNhbWUgbWVjaGFuaXNtL2dhdGluZyBhcyB0aGUgYWZmaW5pdHkgcGF0Y2gpIGZvciBhIGxhdGVudApvY3RhdmlhLXRlbXBlc3QtcGx1Z2luIGNlcnQtZml4dHVyZSBidWcgdGhhdCBQeXRob24gMy4xMyBzdXJmYWNlcy4KCmBvY3RhdmlhX3RlbXBlc3RfcGx1Z2luL2NvbW1vbi9jZXJ0X3V0aWxzLnB5YCBidWlsZHMgaXRzIHRlc3QgQ0Egd2l0aG91dCBhCmBTdWJqZWN0S2V5SWRlbnRpZmllcmAgYW5kIHRoZSBsZWFmIHNlcnZlci9jbGllbnQgY2VydHMgd2l0aG91dCBhbgpgQXV0aG9yaXR5S2V5SWRlbnRpZmllcmAuIFJGQyA1MjgwIHNheXMgYm90aCBTSE9VTEQgYmUgcHJlc2VudCwgYnV0IHVuZGVyCioqbm9uLXN0cmljdCoqIFguNTA5IHZlcmlmaWNhdGlvbiDigJQgdGhlIGhpc3RvcmljYWwgZGVmYXVsdCDigJQgT3BlblNTTCBuZXZlciBjaGVja3MKZm9yIHRoZW0sIHNvIHRoZSBjaGFpbiB2ZXJpZmllcyBhbmQgdGhlIHRlc3RzIHBhc3MuCgojIyBXaHkgaXQgZmFpbHMgaGVyZSBidXQgbm90IHVwc3RyZWFtCgoqKlB5dGhvbiAzLjEzJ3MgYHNzbC5jcmVhdGVfZGVmYXVsdF9jb250ZXh0KClgIGVuYWJsZXMgYFZFUklGWV9YNTA5X1NUUklDVGAgYnkKZGVmYXVsdC4qKiBUaGlzIGltYWdlIHNoaXBzIFB5dGhvbiAzLjEzLCBhbmQgdGhlIGJhcmJpY2FuIFRMUyBzY2VuYXJpbyB0ZXN0cwooYHRlc3RfdGxzX2JhcmJpY2FuYCkgY29ubmVjdCBiYWNrIHRvIHRoZSBsb2FkIGJhbGFuY2VyIHdpdGggYGh0dHB4YCwgd2hpY2ggYnVpbGRzCml0cyBUTFMgY29udGV4dCBmcm9tIHRoYXQgZGVmYXVsdCDigJQgc28gdGhlIGNsaWVudCBub3cgZG9lcyBzdHJpY3QgdmVyaWZpY2F0aW9uIGFuZApyZWplY3RzIHRoZSBmaXh0dXJlIGNoYWluOgoKYGBgCltTU0w6IENFUlRJRklDQVRFX1ZFUklGWV9GQUlMRURdIGNlcnRpZmljYXRlIHZlcmlmeSBmYWlsZWQ6IE1pc3NpbmcgQXV0aG9yaXR5IEtleSBJZGVudGlmaWVyCmBgYAoKVXBzdHJlYW0gb2N0YXZpYS10ZW1wZXN0LXBsdWdpbiBDSSBuZXZlciBoaXRzIHRoaXM6IHRoZSBPcGVuU3RhY2sgZ2F0ZSBydW5zIG9uCmRpc3RybyBQeXRob24gKDMuMTAvMy4xMiksIHdoZXJlIGBjcmVhdGVfZGVmYXVsdF9jb250ZXh0KClgIGRvZXMgKipub3QqKiBzZXQKYFg1MDlfU1RSSUNUYCwgc28gdGhlIG1pc3Npbmcga2V5IGlkZW50aWZpZXJzIGFyZSB0b2xlcmF0ZWQgYW5kIHRoZSB0ZXN0cyBwYXNzLiBUaGUKZml4dHVyZXMgd2VyZSBhbHdheXMgbm9uLWNvbXBsaWFudDsgUHl0aG9uIDMuMTMg4oCUIHdoaWNoIHRoaXMgaW1hZ2UgYWRvcHRzIGFoZWFkIG9mCnRoZSBnYXRlIOKAlCBpcyBzaW1wbHkgd2hhdCBzdXJmYWNlcyBpdC4gT2N0YXZpYSBpdHNlbGYgaXMgdW5hZmZlY3RlZDogaXRzIG93bgphbXBob3JhL3NlcnZlci9jbGllbnQgQ0FzIGFscmVhZHkgY2FycnkgU0tJK0FLSS4KCiMjIEZpeAoKQWRkIHRoZSBzdGFuZGFyZCBrZXktaWRlbnRpZmllciBwYWlyOiBhIGBTdWJqZWN0S2V5SWRlbnRpZmllcmAgb24gdGhlIENBIGFuZCBhCm1hdGNoaW5nIGBBdXRob3JpdHlLZXlJZGVudGlmaWVyYCAoZGVyaXZlZCBmcm9tIHRoZSBpc3N1ZXIgcHVibGljIGtleSkgb24gdGhlCnNlcnZlciBhbmQgY2xpZW50IGxlYWYgY2VydHMuIEJvdGggdXNlIFJGQyA1MjgwIG1ldGhvZCAxIChTSEExIG9mIHRoZSBwdWJsaWMga2V5KSwKc28gdGhlIGxlYWYgQUtJIGtleWlkIG1hdGNoZXMgdGhlIENBIFNLSSBrZXlpZCBhbmQgdGhlIGNoYWluIGJ1aWxkcy4gVGhpcyBpcyB0aGUKUkZDLWNvbXBsaWFudCBmaXgsIG5vdCBhIHdvcmthcm91bmQuCgojIyBWZXJpZmljYXRpb24KCkJ1aWx0IGEgbG9jYWwgaW1hZ2UgKGJhc2UgKyB0aGlzIHBhdGNoIGFwcGxpZWQgdGhyb3VnaCB0aGUgYnVpbGQncyBgcGF0Y2ggLXAxCi0tZm9yd2FyZGAgZ2F0ZSkgYW5kIHJhbiB0aGUgYmFyYmljYW4gVExTIHRyYWZmaWMgdGVzdHMgdGhyb3VnaCB0aGUgdGVtcGVzdCByb2xlIG9uCmEgbGl2ZSBmdWxsLXByb2ZpbGUgY2x1c3RlcjoKCi0gYG9wZW5zc2wgdmVyaWZ5IC14NTA5X3N0cmljdGAgb24gcmVnZW5lcmF0ZWQgZml4dHVyZXM6IGBlcnJvciA4NSBNaXNzaW5nCiAgQXV0aG9yaXR5IEtleSBJZGVudGlmaWVyYCDihpIgKipPSyoqCi0gYHRlc3RfaHR0cF8xXzFfdGxzX3RyYWZmaWNgIOKGkiAqKnBhc3MqKiwgYHRlc3RfaHR0cF8yX3Rsc190cmFmZmljYCDihpIgKipwYXNzKioKICAoYm90aCBwcmV2aW91c2x5IGZhaWxlZCBvbmx5IG9uIHRoaXMgY2VydCBjaGVjaykKCihgdGVzdF9odHRwXzFfMV90bHNfaHN0c190cmFmZmljYCBzdGlsbCBmYWlscywgYnV0IG9uIGFuIHVucmVsYXRlZApgaHR0cHguQ29ubmVjdFRpbWVvdXRgIHRvIHRoZSBWSVAg4oCUIGEgc2VwYXJhdGUgSFNUUy1saXN0ZW5lciBkYXRhLXBhdGggaXNzdWUsIG5vdAp0aGlzIGNlcnQgcHJvYmxlbS4pCgojIyBOb3RlcwoKLSBTZWxmLWV4cGlyaW5nIChPU0lTTSBQNSk6IG9uY2Ugb2N0YXZpYS10ZW1wZXN0LXBsdWdpbiBzaGlwcyB0aGVzZSBleHRlbnNpb25zIGFuZAogIHRoZSBwaW4gYnVtcHMgcGFzdCBpdCwgdGhlIGAtLWRyeS1ydW5gIGdhdGUgZmFpbHMgdGhlIGJ1aWxkIGFuZCB0aGlzIGZpbGUgbXVzdCBiZQogIGRlbGV0ZWQuCi0gU2libGluZyBvZiB0aGUgc2FtZS1tZWNoYW5pc20gcGF0Y2g6CiAgLSBvc2lzbS9jb250YWluZXItaW1hZ2VzIzk0NQoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSkK
      patchset: 6f20ec95cce143471db2c4069593cfae5795dbc9
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images
        name: osism/container-images
        short_name: container-images
        src_dir: src/github.com/osism/container-images
      projects:
        github.com/osism/container-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          checkout: main
          checkout_description: zuul branch
          commit: 9edb9172c92ddf98bc1efd45797d2a945df17f0b
          name: osism/container-images
          required: false
          short_name: container-images
          src_dir: src/github.com/osism/container-images
      ref: refs/pull/947/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
