all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fefa:3d89
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: fcf7007e-aad1-40c2-8240-cfa2cb8f1584
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fefa:3d89
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.109
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.151
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fefa:3d89
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/python-osism/.zuul.yaml@main#138>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: e5c45c1b301a488b83f375d9d4bde9b3
      build_refs:
      - branch: main
        change: '2338'
        change_message: "Restrict SONiC SNMP and gNMI access to the OOB management
          network\n\nCloses #2330\n\n## What this does\n\nThe generated SONiC ConfigDB
          bound the SNMP agent to the OOB IP in the mgmt VRF but never restricted
          which source networks can reach it, and the gNMI/telemetry server (static
          `TELEMETRY|gnmi` base entry) listened on all interfaces with no restriction
          at all.\n\nThis PR emits, per device with an OOB IP, control-plane ACLs
          handled by `caclmgrd`: `ACL_TABLE` entries of type `CTRLPLANE` bound to
          the `SNMP` and `EXTERNAL_CLIENT` (gNMI) services, each with an `ACL_RULE`
          that accepts only the device's network-normalised OOB management subnet.
          Binding a service in a CTRLPLANE table makes caclmgrd install an implicit
          default-drop for that service, so all other sources lose access.\n\n## Commit
          walkthrough\n\n1. **Restrict SONiC SNMP and gNMI access to the OOB network**
          \u2014 adds the shared `_add_ctrlplane_acls` helper (the home for #2329's
          `SSH_ONLY` as well), registers `ACL_TABLE`/`ACL_RULE` as generator-owned
          on-demand tables (dropped from the base config up front, rebuilt on every
          regen, absent without an OOB IP), wires the helper into `generate_sonic_config`
          inside the management-interface block, and covers the helper with unit tests
          (tables/rules emitted, network-normalised `SRC_IP`, `TELEMETRY|gnmi|port`
          handling, wholesale replacement of pre-existing entries, non-IPv4 skip,
          ownership registration).\n2. **Add orchestrator wiring tests for control-plane
          ACLs** \u2014 patches `_add_ctrlplane_acls` in the orchestrator helper fixture
          like the other section helpers and pins the wiring: called exactly once
          with `(config, oob_ip, prefix_len)` when an OOB IP exists; not invoked (and
          the owned tables stay absent, including stale base-config entries) when
          there is none.\n\n## Deviations from the issue\n\n- **`L4_DST_PORT` added
          to the `GNMI_ONLY` rule.** The issue's example rule carries only `PRIORITY`/`PACKET_ACTION`/`SRC_IP`/`IP_TYPE`,
          and its note says `EXTERNAL_CLIENT` \"maps to the configured `TELEMETRY|gnmi|port`\".
          The issue asked to verify this against caclmgrd before relying on it \u2014
          verification against `sonic-host-services` (202211, 202305, 202311, 202405,
          master) shows no `TELEMETRY`/`GNMI` lookup exists in any of these versions:
          `EXTERNAL_CLIENT` has no built-in destination port, the rule must provide
          it via `L4_DST_PORT`, and a CTRLPLANE table whose rules yield no destination
          port is **skipped entirely** (syslog warning only) \u2014 the issue's exact
          example would have been a silent no-op for gNMI. The generator therefore
          performs the `TELEMETRY|gnmi|port` mapping itself and writes it into the
          rule, falling back to the telemetry container default `8080` when the base
          config sets no port. The SNMP rule needs no port (fixed `161` in caclmgrd's
          `ACL_SERVICES`).\n- **Non-IPv4 OOB IPs skip ACL generation with a warning**
          instead of crashing. The issue assumed `IPv4Network(...)` unconditionally;
          `get_device_oob_ip` can legitimately return an IPv6 address (NetBox `oob_ip`
          or a mgmt interface with only a v6 address), and an unguarded `IPv4Network`
          would abort the device's entire config generation. The skip path is logged
          and unit-tested.\n- **`SSH_ONLY` is not emitted here** \u2014 that is #2329's
          scope (still open). The helper is written and documented as the shared home
          for it; adding SSH is a one-entry change.\n- **No `sonic-acl` YANG model
          added.** The issue's \"Consider adding...\" relates to #2258; the validator
          continues to report `ACL_TABLE`/`ACL_RULE` as warnings (\"No YANG schema
          for table...\"), not errors, exactly as the issue describes.\n\n## Verification\n\n-
          `pipenv run pytest` \u2014 1150 passed (full unit suite; includes the existing
          exhaustive owned-table stale-drop test, which automatically covers the two
          new owned tables)\n- `pipenv run flake8` on the changed files \u2014 clean\n-
          caclmgrd semantics verified against `sonic-net/sonic-host-services` branches
          202211 \u2192 master (`ACL_SERVICES`, `EXTERNAL_CLIENT` port handling, `is_rule_ipv4`,
          implicit drop)\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/python-osism/pull/2338
        commit_id: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        patchset: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      buildset: eb7ca2ba2c394faa915862cee93f2acd
      buildset_refs:
      - branch: main
        change: '2338'
        change_message: "Restrict SONiC SNMP and gNMI access to the OOB management
          network\n\nCloses #2330\n\n## What this does\n\nThe generated SONiC ConfigDB
          bound the SNMP agent to the OOB IP in the mgmt VRF but never restricted
          which source networks can reach it, and the gNMI/telemetry server (static
          `TELEMETRY|gnmi` base entry) listened on all interfaces with no restriction
          at all.\n\nThis PR emits, per device with an OOB IP, control-plane ACLs
          handled by `caclmgrd`: `ACL_TABLE` entries of type `CTRLPLANE` bound to
          the `SNMP` and `EXTERNAL_CLIENT` (gNMI) services, each with an `ACL_RULE`
          that accepts only the device's network-normalised OOB management subnet.
          Binding a service in a CTRLPLANE table makes caclmgrd install an implicit
          default-drop for that service, so all other sources lose access.\n\n## Commit
          walkthrough\n\n1. **Restrict SONiC SNMP and gNMI access to the OOB network**
          \u2014 adds the shared `_add_ctrlplane_acls` helper (the home for #2329's
          `SSH_ONLY` as well), registers `ACL_TABLE`/`ACL_RULE` as generator-owned
          on-demand tables (dropped from the base config up front, rebuilt on every
          regen, absent without an OOB IP), wires the helper into `generate_sonic_config`
          inside the management-interface block, and covers the helper with unit tests
          (tables/rules emitted, network-normalised `SRC_IP`, `TELEMETRY|gnmi|port`
          handling, wholesale replacement of pre-existing entries, non-IPv4 skip,
          ownership registration).\n2. **Add orchestrator wiring tests for control-plane
          ACLs** \u2014 patches `_add_ctrlplane_acls` in the orchestrator helper fixture
          like the other section helpers and pins the wiring: called exactly once
          with `(config, oob_ip, prefix_len)` when an OOB IP exists; not invoked (and
          the owned tables stay absent, including stale base-config entries) when
          there is none.\n\n## Deviations from the issue\n\n- **`L4_DST_PORT` added
          to the `GNMI_ONLY` rule.** The issue's example rule carries only `PRIORITY`/`PACKET_ACTION`/`SRC_IP`/`IP_TYPE`,
          and its note says `EXTERNAL_CLIENT` \"maps to the configured `TELEMETRY|gnmi|port`\".
          The issue asked to verify this against caclmgrd before relying on it \u2014
          verification against `sonic-host-services` (202211, 202305, 202311, 202405,
          master) shows no `TELEMETRY`/`GNMI` lookup exists in any of these versions:
          `EXTERNAL_CLIENT` has no built-in destination port, the rule must provide
          it via `L4_DST_PORT`, and a CTRLPLANE table whose rules yield no destination
          port is **skipped entirely** (syslog warning only) \u2014 the issue's exact
          example would have been a silent no-op for gNMI. The generator therefore
          performs the `TELEMETRY|gnmi|port` mapping itself and writes it into the
          rule, falling back to the telemetry container default `8080` when the base
          config sets no port. The SNMP rule needs no port (fixed `161` in caclmgrd's
          `ACL_SERVICES`).\n- **Non-IPv4 OOB IPs skip ACL generation with a warning**
          instead of crashing. The issue assumed `IPv4Network(...)` unconditionally;
          `get_device_oob_ip` can legitimately return an IPv6 address (NetBox `oob_ip`
          or a mgmt interface with only a v6 address), and an unguarded `IPv4Network`
          would abort the device's entire config generation. The skip path is logged
          and unit-tested.\n- **`SSH_ONLY` is not emitted here** \u2014 that is #2329's
          scope (still open). The helper is written and documented as the shared home
          for it; adding SSH is a one-entry change.\n- **No `sonic-acl` YANG model
          added.** The issue's \"Consider adding...\" relates to #2258; the validator
          continues to report `ACL_TABLE`/`ACL_RULE` as warnings (\"No YANG schema
          for table...\"), not errors, exactly as the issue describes.\n\n## Verification\n\n-
          `pipenv run pytest` \u2014 1150 passed (full unit suite; includes the existing
          exhaustive owned-table stale-drop test, which automatically covers the two
          new owned tables)\n- `pipenv run flake8` on the changed files \u2014 clean\n-
          caclmgrd semantics verified against `sonic-net/sonic-host-services` branches
          202211 \u2192 master (`ACL_SERVICES`, `EXTERNAL_CLIENT` port handling, `is_rule_ipv4`,
          implicit drop)\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/python-osism/pull/2338
        commit_id: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        patchset: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      change: '2338'
      change_message: "Restrict SONiC SNMP and gNMI access to the OOB management network\n\nCloses
        #2330\n\n## What this does\n\nThe generated SONiC ConfigDB bound the SNMP
        agent to the OOB IP in the mgmt VRF but never restricted which source networks
        can reach it, and the gNMI/telemetry server (static `TELEMETRY|gnmi` base
        entry) listened on all interfaces with no restriction at all.\n\nThis PR emits,
        per device with an OOB IP, control-plane ACLs handled by `caclmgrd`: `ACL_TABLE`
        entries of type `CTRLPLANE` bound to the `SNMP` and `EXTERNAL_CLIENT` (gNMI)
        services, each with an `ACL_RULE` that accepts only the device's network-normalised
        OOB management subnet. Binding a service in a CTRLPLANE table makes caclmgrd
        install an implicit default-drop for that service, so all other sources lose
        access.\n\n## Commit walkthrough\n\n1. **Restrict SONiC SNMP and gNMI access
        to the OOB network** \u2014 adds the shared `_add_ctrlplane_acls` helper (the
        home for #2329's `SSH_ONLY` as well), registers `ACL_TABLE`/`ACL_RULE` as
        generator-owned on-demand tables (dropped from the base config up front, rebuilt
        on every regen, absent without an OOB IP), wires the helper into `generate_sonic_config`
        inside the management-interface block, and covers the helper with unit tests
        (tables/rules emitted, network-normalised `SRC_IP`, `TELEMETRY|gnmi|port`
        handling, wholesale replacement of pre-existing entries, non-IPv4 skip, ownership
        registration).\n2. **Add orchestrator wiring tests for control-plane ACLs**
        \u2014 patches `_add_ctrlplane_acls` in the orchestrator helper fixture like
        the other section helpers and pins the wiring: called exactly once with `(config,
        oob_ip, prefix_len)` when an OOB IP exists; not invoked (and the owned tables
        stay absent, including stale base-config entries) when there is none.\n\n##
        Deviations from the issue\n\n- **`L4_DST_PORT` added to the `GNMI_ONLY` rule.**
        The issue's example rule carries only `PRIORITY`/`PACKET_ACTION`/`SRC_IP`/`IP_TYPE`,
        and its note says `EXTERNAL_CLIENT` \"maps to the configured `TELEMETRY|gnmi|port`\".
        The issue asked to verify this against caclmgrd before relying on it \u2014
        verification against `sonic-host-services` (202211, 202305, 202311, 202405,
        master) shows no `TELEMETRY`/`GNMI` lookup exists in any of these versions:
        `EXTERNAL_CLIENT` has no built-in destination port, the rule must provide
        it via `L4_DST_PORT`, and a CTRLPLANE table whose rules yield no destination
        port is **skipped entirely** (syslog warning only) \u2014 the issue's exact
        example would have been a silent no-op for gNMI. The generator therefore performs
        the `TELEMETRY|gnmi|port` mapping itself and writes it into the rule, falling
        back to the telemetry container default `8080` when the base config sets no
        port. The SNMP rule needs no port (fixed `161` in caclmgrd's `ACL_SERVICES`).\n-
        **Non-IPv4 OOB IPs skip ACL generation with a warning** instead of crashing.
        The issue assumed `IPv4Network(...)` unconditionally; `get_device_oob_ip`
        can legitimately return an IPv6 address (NetBox `oob_ip` or a mgmt interface
        with only a v6 address), and an unguarded `IPv4Network` would abort the device's
        entire config generation. The skip path is logged and unit-tested.\n- **`SSH_ONLY`
        is not emitted here** \u2014 that is #2329's scope (still open). The helper
        is written and documented as the shared home for it; adding SSH is a one-entry
        change.\n- **No `sonic-acl` YANG model added.** The issue's \"Consider adding...\"
        relates to #2258; the validator continues to report `ACL_TABLE`/`ACL_RULE`
        as warnings (\"No YANG schema for table...\"), not errors, exactly as the
        issue describes.\n\n## Verification\n\n- `pipenv run pytest` \u2014 1150 passed
        (full unit suite; includes the existing exhaustive owned-table stale-drop
        test, which automatically covers the two new owned tables)\n- `pipenv run
        flake8` on the changed files \u2014 clean\n- caclmgrd semantics verified against
        `sonic-net/sonic-host-services` branches 202211 \u2192 master (`ACL_SERVICES`,
        `EXTERNAL_CLIENT` port handling, `is_rule_ipv4`, implicit drop)\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/python-osism/pull/2338
      child_jobs: []
      commit_id: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
      event_id: 5ba03e80-688a-11f1-93e0-498a84aadcdb
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/e5c45c1b301a488b83f375d9d4bde9b3/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/e5c45c1b301a488b83f375d9d4bde9b3/work/logs
        result_data_file: /var/lib/zuul/builds/e5c45c1b301a488b83f375d9d4bde9b3/work/results.json
        src_root: /var/lib/zuul/builds/e5c45c1b301a488b83f375d9d4bde9b3/work/src
        work_root: /var/lib/zuul/builds/e5c45c1b301a488b83f375d9d4bde9b3/work
      include_vars: []
      items:
      - branch: main
        change: '2338'
        change_message: "Restrict SONiC SNMP and gNMI access to the OOB management
          network\n\nCloses #2330\n\n## What this does\n\nThe generated SONiC ConfigDB
          bound the SNMP agent to the OOB IP in the mgmt VRF but never restricted
          which source networks can reach it, and the gNMI/telemetry server (static
          `TELEMETRY|gnmi` base entry) listened on all interfaces with no restriction
          at all.\n\nThis PR emits, per device with an OOB IP, control-plane ACLs
          handled by `caclmgrd`: `ACL_TABLE` entries of type `CTRLPLANE` bound to
          the `SNMP` and `EXTERNAL_CLIENT` (gNMI) services, each with an `ACL_RULE`
          that accepts only the device's network-normalised OOB management subnet.
          Binding a service in a CTRLPLANE table makes caclmgrd install an implicit
          default-drop for that service, so all other sources lose access.\n\n## Commit
          walkthrough\n\n1. **Restrict SONiC SNMP and gNMI access to the OOB network**
          \u2014 adds the shared `_add_ctrlplane_acls` helper (the home for #2329's
          `SSH_ONLY` as well), registers `ACL_TABLE`/`ACL_RULE` as generator-owned
          on-demand tables (dropped from the base config up front, rebuilt on every
          regen, absent without an OOB IP), wires the helper into `generate_sonic_config`
          inside the management-interface block, and covers the helper with unit tests
          (tables/rules emitted, network-normalised `SRC_IP`, `TELEMETRY|gnmi|port`
          handling, wholesale replacement of pre-existing entries, non-IPv4 skip,
          ownership registration).\n2. **Add orchestrator wiring tests for control-plane
          ACLs** \u2014 patches `_add_ctrlplane_acls` in the orchestrator helper fixture
          like the other section helpers and pins the wiring: called exactly once
          with `(config, oob_ip, prefix_len)` when an OOB IP exists; not invoked (and
          the owned tables stay absent, including stale base-config entries) when
          there is none.\n\n## Deviations from the issue\n\n- **`L4_DST_PORT` added
          to the `GNMI_ONLY` rule.** The issue's example rule carries only `PRIORITY`/`PACKET_ACTION`/`SRC_IP`/`IP_TYPE`,
          and its note says `EXTERNAL_CLIENT` \"maps to the configured `TELEMETRY|gnmi|port`\".
          The issue asked to verify this against caclmgrd before relying on it \u2014
          verification against `sonic-host-services` (202211, 202305, 202311, 202405,
          master) shows no `TELEMETRY`/`GNMI` lookup exists in any of these versions:
          `EXTERNAL_CLIENT` has no built-in destination port, the rule must provide
          it via `L4_DST_PORT`, and a CTRLPLANE table whose rules yield no destination
          port is **skipped entirely** (syslog warning only) \u2014 the issue's exact
          example would have been a silent no-op for gNMI. The generator therefore
          performs the `TELEMETRY|gnmi|port` mapping itself and writes it into the
          rule, falling back to the telemetry container default `8080` when the base
          config sets no port. The SNMP rule needs no port (fixed `161` in caclmgrd's
          `ACL_SERVICES`).\n- **Non-IPv4 OOB IPs skip ACL generation with a warning**
          instead of crashing. The issue assumed `IPv4Network(...)` unconditionally;
          `get_device_oob_ip` can legitimately return an IPv6 address (NetBox `oob_ip`
          or a mgmt interface with only a v6 address), and an unguarded `IPv4Network`
          would abort the device's entire config generation. The skip path is logged
          and unit-tested.\n- **`SSH_ONLY` is not emitted here** \u2014 that is #2329's
          scope (still open). The helper is written and documented as the shared home
          for it; adding SSH is a one-entry change.\n- **No `sonic-acl` YANG model
          added.** The issue's \"Consider adding...\" relates to #2258; the validator
          continues to report `ACL_TABLE`/`ACL_RULE` as warnings (\"No YANG schema
          for table...\"), not errors, exactly as the issue describes.\n\n## Verification\n\n-
          `pipenv run pytest` \u2014 1150 passed (full unit suite; includes the existing
          exhaustive owned-table stale-drop test, which automatically covers the two
          new owned tables)\n- `pipenv run flake8` on the changed files \u2014 clean\n-
          caclmgrd semantics verified against `sonic-net/sonic-host-services` branches
          202211 \u2192 master (`ACL_SERVICES`, `EXTERNAL_CLIENT` port handling, `is_rule_ipv4`,
          implicit drop)\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/python-osism/pull/2338
        commit_id: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        patchset: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: UmVzdHJpY3QgU09OaUMgU05NUCBhbmQgZ05NSSBhY2Nlc3MgdG8gdGhlIE9PQiBtYW5hZ2VtZW50IG5ldHdvcmsKCkNsb3NlcyAjMjMzMAoKIyMgV2hhdCB0aGlzIGRvZXMKClRoZSBnZW5lcmF0ZWQgU09OaUMgQ29uZmlnREIgYm91bmQgdGhlIFNOTVAgYWdlbnQgdG8gdGhlIE9PQiBJUCBpbiB0aGUgbWdtdCBWUkYgYnV0IG5ldmVyIHJlc3RyaWN0ZWQgd2hpY2ggc291cmNlIG5ldHdvcmtzIGNhbiByZWFjaCBpdCwgYW5kIHRoZSBnTk1JL3RlbGVtZXRyeSBzZXJ2ZXIgKHN0YXRpYyBgVEVMRU1FVFJZfGdubWlgIGJhc2UgZW50cnkpIGxpc3RlbmVkIG9uIGFsbCBpbnRlcmZhY2VzIHdpdGggbm8gcmVzdHJpY3Rpb24gYXQgYWxsLgoKVGhpcyBQUiBlbWl0cywgcGVyIGRldmljZSB3aXRoIGFuIE9PQiBJUCwgY29udHJvbC1wbGFuZSBBQ0xzIGhhbmRsZWQgYnkgYGNhY2xtZ3JkYDogYEFDTF9UQUJMRWAgZW50cmllcyBvZiB0eXBlIGBDVFJMUExBTkVgIGJvdW5kIHRvIHRoZSBgU05NUGAgYW5kIGBFWFRFUk5BTF9DTElFTlRgIChnTk1JKSBzZXJ2aWNlcywgZWFjaCB3aXRoIGFuIGBBQ0xfUlVMRWAgdGhhdCBhY2NlcHRzIG9ubHkgdGhlIGRldmljZSdzIG5ldHdvcmstbm9ybWFsaXNlZCBPT0IgbWFuYWdlbWVudCBzdWJuZXQuIEJpbmRpbmcgYSBzZXJ2aWNlIGluIGEgQ1RSTFBMQU5FIHRhYmxlIG1ha2VzIGNhY2xtZ3JkIGluc3RhbGwgYW4gaW1wbGljaXQgZGVmYXVsdC1kcm9wIGZvciB0aGF0IHNlcnZpY2UsIHNvIGFsbCBvdGhlciBzb3VyY2VzIGxvc2UgYWNjZXNzLgoKIyMgQ29tbWl0IHdhbGt0aHJvdWdoCgoxLiAqKlJlc3RyaWN0IFNPTmlDIFNOTVAgYW5kIGdOTUkgYWNjZXNzIHRvIHRoZSBPT0IgbmV0d29yayoqIOKAlCBhZGRzIHRoZSBzaGFyZWQgYF9hZGRfY3RybHBsYW5lX2FjbHNgIGhlbHBlciAodGhlIGhvbWUgZm9yICMyMzI5J3MgYFNTSF9PTkxZYCBhcyB3ZWxsKSwgcmVnaXN0ZXJzIGBBQ0xfVEFCTEVgL2BBQ0xfUlVMRWAgYXMgZ2VuZXJhdG9yLW93bmVkIG9uLWRlbWFuZCB0YWJsZXMgKGRyb3BwZWQgZnJvbSB0aGUgYmFzZSBjb25maWcgdXAgZnJvbnQsIHJlYnVpbHQgb24gZXZlcnkgcmVnZW4sIGFic2VudCB3aXRob3V0IGFuIE9PQiBJUCksIHdpcmVzIHRoZSBoZWxwZXIgaW50byBgZ2VuZXJhdGVfc29uaWNfY29uZmlnYCBpbnNpZGUgdGhlIG1hbmFnZW1lbnQtaW50ZXJmYWNlIGJsb2NrLCBhbmQgY292ZXJzIHRoZSBoZWxwZXIgd2l0aCB1bml0IHRlc3RzICh0YWJsZXMvcnVsZXMgZW1pdHRlZCwgbmV0d29yay1ub3JtYWxpc2VkIGBTUkNfSVBgLCBgVEVMRU1FVFJZfGdubWl8cG9ydGAgaGFuZGxpbmcsIHdob2xlc2FsZSByZXBsYWNlbWVudCBvZiBwcmUtZXhpc3RpbmcgZW50cmllcywgbm9uLUlQdjQgc2tpcCwgb3duZXJzaGlwIHJlZ2lzdHJhdGlvbikuCjIuICoqQWRkIG9yY2hlc3RyYXRvciB3aXJpbmcgdGVzdHMgZm9yIGNvbnRyb2wtcGxhbmUgQUNMcyoqIOKAlCBwYXRjaGVzIGBfYWRkX2N0cmxwbGFuZV9hY2xzYCBpbiB0aGUgb3JjaGVzdHJhdG9yIGhlbHBlciBmaXh0dXJlIGxpa2UgdGhlIG90aGVyIHNlY3Rpb24gaGVscGVycyBhbmQgcGlucyB0aGUgd2lyaW5nOiBjYWxsZWQgZXhhY3RseSBvbmNlIHdpdGggYChjb25maWcsIG9vYl9pcCwgcHJlZml4X2xlbilgIHdoZW4gYW4gT09CIElQIGV4aXN0czsgbm90IGludm9rZWQgKGFuZCB0aGUgb3duZWQgdGFibGVzIHN0YXkgYWJzZW50LCBpbmNsdWRpbmcgc3RhbGUgYmFzZS1jb25maWcgZW50cmllcykgd2hlbiB0aGVyZSBpcyBub25lLgoKIyMgRGV2aWF0aW9ucyBmcm9tIHRoZSBpc3N1ZQoKLSAqKmBMNF9EU1RfUE9SVGAgYWRkZWQgdG8gdGhlIGBHTk1JX09OTFlgIHJ1bGUuKiogVGhlIGlzc3VlJ3MgZXhhbXBsZSBydWxlIGNhcnJpZXMgb25seSBgUFJJT1JJVFlgL2BQQUNLRVRfQUNUSU9OYC9gU1JDX0lQYC9gSVBfVFlQRWAsIGFuZCBpdHMgbm90ZSBzYXlzIGBFWFRFUk5BTF9DTElFTlRgICJtYXBzIHRvIHRoZSBjb25maWd1cmVkIGBURUxFTUVUUll8Z25taXxwb3J0YCIuIFRoZSBpc3N1ZSBhc2tlZCB0byB2ZXJpZnkgdGhpcyBhZ2FpbnN0IGNhY2xtZ3JkIGJlZm9yZSByZWx5aW5nIG9uIGl0IOKAlCB2ZXJpZmljYXRpb24gYWdhaW5zdCBgc29uaWMtaG9zdC1zZXJ2aWNlc2AgKDIwMjIxMSwgMjAyMzA1LCAyMDIzMTEsIDIwMjQwNSwgbWFzdGVyKSBzaG93cyBubyBgVEVMRU1FVFJZYC9gR05NSWAgbG9va3VwIGV4aXN0cyBpbiBhbnkgb2YgdGhlc2UgdmVyc2lvbnM6IGBFWFRFUk5BTF9DTElFTlRgIGhhcyBubyBidWlsdC1pbiBkZXN0aW5hdGlvbiBwb3J0LCB0aGUgcnVsZSBtdXN0IHByb3ZpZGUgaXQgdmlhIGBMNF9EU1RfUE9SVGAsIGFuZCBhIENUUkxQTEFORSB0YWJsZSB3aG9zZSBydWxlcyB5aWVsZCBubyBkZXN0aW5hdGlvbiBwb3J0IGlzICoqc2tpcHBlZCBlbnRpcmVseSoqIChzeXNsb2cgd2FybmluZyBvbmx5KSDigJQgdGhlIGlzc3VlJ3MgZXhhY3QgZXhhbXBsZSB3b3VsZCBoYXZlIGJlZW4gYSBzaWxlbnQgbm8tb3AgZm9yIGdOTUkuIFRoZSBnZW5lcmF0b3IgdGhlcmVmb3JlIHBlcmZvcm1zIHRoZSBgVEVMRU1FVFJZfGdubWl8cG9ydGAgbWFwcGluZyBpdHNlbGYgYW5kIHdyaXRlcyBpdCBpbnRvIHRoZSBydWxlLCBmYWxsaW5nIGJhY2sgdG8gdGhlIHRlbGVtZXRyeSBjb250YWluZXIgZGVmYXVsdCBgODA4MGAgd2hlbiB0aGUgYmFzZSBjb25maWcgc2V0cyBubyBwb3J0LiBUaGUgU05NUCBydWxlIG5lZWRzIG5vIHBvcnQgKGZpeGVkIGAxNjFgIGluIGNhY2xtZ3JkJ3MgYEFDTF9TRVJWSUNFU2ApLgotICoqTm9uLUlQdjQgT09CIElQcyBza2lwIEFDTCBnZW5lcmF0aW9uIHdpdGggYSB3YXJuaW5nKiogaW5zdGVhZCBvZiBjcmFzaGluZy4gVGhlIGlzc3VlIGFzc3VtZWQgYElQdjROZXR3b3JrKC4uLilgIHVuY29uZGl0aW9uYWxseTsgYGdldF9kZXZpY2Vfb29iX2lwYCBjYW4gbGVnaXRpbWF0ZWx5IHJldHVybiBhbiBJUHY2IGFkZHJlc3MgKE5ldEJveCBgb29iX2lwYCBvciBhIG1nbXQgaW50ZXJmYWNlIHdpdGggb25seSBhIHY2IGFkZHJlc3MpLCBhbmQgYW4gdW5ndWFyZGVkIGBJUHY0TmV0d29ya2Agd291bGQgYWJvcnQgdGhlIGRldmljZSdzIGVudGlyZSBjb25maWcgZ2VuZXJhdGlvbi4gVGhlIHNraXAgcGF0aCBpcyBsb2dnZWQgYW5kIHVuaXQtdGVzdGVkLgotICoqYFNTSF9PTkxZYCBpcyBub3QgZW1pdHRlZCBoZXJlKiog4oCUIHRoYXQgaXMgIzIzMjkncyBzY29wZSAoc3RpbGwgb3BlbikuIFRoZSBoZWxwZXIgaXMgd3JpdHRlbiBhbmQgZG9jdW1lbnRlZCBhcyB0aGUgc2hhcmVkIGhvbWUgZm9yIGl0OyBhZGRpbmcgU1NIIGlzIGEgb25lLWVudHJ5IGNoYW5nZS4KLSAqKk5vIGBzb25pYy1hY2xgIFlBTkcgbW9kZWwgYWRkZWQuKiogVGhlIGlzc3VlJ3MgIkNvbnNpZGVyIGFkZGluZy4uLiIgcmVsYXRlcyB0byAjMjI1ODsgdGhlIHZhbGlkYXRvciBjb250aW51ZXMgdG8gcmVwb3J0IGBBQ0xfVEFCTEVgL2BBQ0xfUlVMRWAgYXMgd2FybmluZ3MgKCJObyBZQU5HIHNjaGVtYSBmb3IgdGFibGUuLi4iKSwgbm90IGVycm9ycywgZXhhY3RseSBhcyB0aGUgaXNzdWUgZGVzY3JpYmVzLgoKIyMgVmVyaWZpY2F0aW9uCgotIGBwaXBlbnYgcnVuIHB5dGVzdGAg4oCUIDExNTAgcGFzc2VkIChmdWxsIHVuaXQgc3VpdGU7IGluY2x1ZGVzIHRoZSBleGlzdGluZyBleGhhdXN0aXZlIG93bmVkLXRhYmxlIHN0YWxlLWRyb3AgdGVzdCwgd2hpY2ggYXV0b21hdGljYWxseSBjb3ZlcnMgdGhlIHR3byBuZXcgb3duZWQgdGFibGVzKQotIGBwaXBlbnYgcnVuIGZsYWtlOGAgb24gdGhlIGNoYW5nZWQgZmlsZXMg4oCUIGNsZWFuCi0gY2FjbG1ncmQgc2VtYW50aWNzIHZlcmlmaWVkIGFnYWluc3QgYHNvbmljLW5ldC9zb25pYy1ob3N0LXNlcnZpY2VzYCBicmFuY2hlcyAyMDIyMTEg4oaSIG1hc3RlciAoYEFDTF9TRVJWSUNFU2AsIGBFWFRFUk5BTF9DTElFTlRgIHBvcnQgaGFuZGxpbmcsIGBpc19ydWxlX2lwdjRgLCBpbXBsaWNpdCBkcm9wKQoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSkK
      patchset: 5f30a862b7fc4c4526f12b2a1619cd4d60571a41
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/python-osism
        name: osism/python-osism
        short_name: python-osism
        src_dir: src/github.com/osism/python-osism
      projects:
        github.com/osism/python-osism:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          checkout: main
          checkout_description: zuul branch
          commit: 7611eea7981df768eb16be0272ebdb3e80cb08e1
          name: osism/python-osism
          required: false
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
      ref: refs/pull/2338/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
