all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe86:15f7
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b2ab5749-d07c-43b8-ac21-47ab84452fb5
        host_id: 25afcdcd4b24cc9d1766f11f81549380a3029030a455889bb61ec093
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe86:15f7
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.24
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.205
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe86:15f7
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/container-images/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: eeed492895de4078bc6c57202a4c1585
      build_refs:
      - branch: main
        change: '907'
        change_message: "ansible-lint: lint repos read-only\n\n## What\n\nMake the
          `ansible-lint` image lint a repository **without writing into it**.\nThe
          mounted project at `/zuul` is no longer modified.\n\n## Why\n\nThe entrypoint
          copied the custom rules into `/zuul/.ansible-lint-rules` and\nwrote the
          merged config back to `/zuul/.ansible-lint`, mutating the project\nmount
          on every run. That blocks read-only mounts and leaves spurious git-dirty\nstate
          in the linted repo. The copy was load-bearing only because the two custom\nrules
          loaded their YAML lists via `os.getcwd()/.ansible-lint-rules/...`, so a\ncopy
          had to exist inside the linted tree.\n\n## How\n\n- Both rule modules now
          locate their `*_list.yaml` via\n  `_RULES_DIR = os.path.dirname(os.path.abspath(__file__))`
          instead of\n  `os.getcwd()`. The rules and lists move into `files/rules/`
          and are baked into\n  the image at `/opt/osism/ansible-lint-rules/`.\n-
          `prepare-config.py` writes the merged config to `/tmp/ansible-lint.yml`
          and\n  forces `rulesdir` to the baked path (so a repo-local `rulesdir` pointing
          at a\n  path we no longer create is overridden).\n- `run.sh` keeps caches
          in `/tmp` (`XDG_CACHE_HOME`) and runs\n  `ansiblelint -c /tmp/ansible-lint.yml
          --nocolor -R --offline`. Nothing is\n  written under `/zuul`.\n\n## Verification\n\nThe
          rebuilt image was diffed against the published image across all consumer\nrepos
          that run the `ansible-lint` job (testbed, the ansible-collection-* repos,\nosism-kubernetes,
          the container-image-* repos, ansible-playbooks{,-manager},\ncfg-cookiecutter,
          ci-image, cloud-in-a-box, deb-packaging, metalbox,\nnew-testbed): **identical
          findings and exit codes, no mutation of the mount,\nand the `N failure(s)`
          summary line preserved** for every one. Relative\n`exclude_paths` (baseline
          and repo-local merged) continue to resolve against the\nproject root, not
          the config location.\n\n## Depends on\n\n- osism/cloud-in-a-box#442 \u2014
          removes a vestigial empty `.ansible-lint` that the\n  old image masked by
          overwriting; should merge first (or together) so its CI\n  stays green under
          the read-only image.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/907
        commit_id: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        patchset: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      buildset: 4add0a77813e4df3ad99e9ea14ee3131
      buildset_refs:
      - branch: main
        change: '907'
        change_message: "ansible-lint: lint repos read-only\n\n## What\n\nMake the
          `ansible-lint` image lint a repository **without writing into it**.\nThe
          mounted project at `/zuul` is no longer modified.\n\n## Why\n\nThe entrypoint
          copied the custom rules into `/zuul/.ansible-lint-rules` and\nwrote the
          merged config back to `/zuul/.ansible-lint`, mutating the project\nmount
          on every run. That blocks read-only mounts and leaves spurious git-dirty\nstate
          in the linted repo. The copy was load-bearing only because the two custom\nrules
          loaded their YAML lists via `os.getcwd()/.ansible-lint-rules/...`, so a\ncopy
          had to exist inside the linted tree.\n\n## How\n\n- Both rule modules now
          locate their `*_list.yaml` via\n  `_RULES_DIR = os.path.dirname(os.path.abspath(__file__))`
          instead of\n  `os.getcwd()`. The rules and lists move into `files/rules/`
          and are baked into\n  the image at `/opt/osism/ansible-lint-rules/`.\n-
          `prepare-config.py` writes the merged config to `/tmp/ansible-lint.yml`
          and\n  forces `rulesdir` to the baked path (so a repo-local `rulesdir` pointing
          at a\n  path we no longer create is overridden).\n- `run.sh` keeps caches
          in `/tmp` (`XDG_CACHE_HOME`) and runs\n  `ansiblelint -c /tmp/ansible-lint.yml
          --nocolor -R --offline`. Nothing is\n  written under `/zuul`.\n\n## Verification\n\nThe
          rebuilt image was diffed against the published image across all consumer\nrepos
          that run the `ansible-lint` job (testbed, the ansible-collection-* repos,\nosism-kubernetes,
          the container-image-* repos, ansible-playbooks{,-manager},\ncfg-cookiecutter,
          ci-image, cloud-in-a-box, deb-packaging, metalbox,\nnew-testbed): **identical
          findings and exit codes, no mutation of the mount,\nand the `N failure(s)`
          summary line preserved** for every one. Relative\n`exclude_paths` (baseline
          and repo-local merged) continue to resolve against the\nproject root, not
          the config location.\n\n## Depends on\n\n- osism/cloud-in-a-box#442 \u2014
          removes a vestigial empty `.ansible-lint` that the\n  old image masked by
          overwriting; should merge first (or together) so its CI\n  stays green under
          the read-only image.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/907
        commit_id: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        patchset: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      change: '907'
      change_message: "ansible-lint: lint repos read-only\n\n## What\n\nMake the `ansible-lint`
        image lint a repository **without writing into it**.\nThe mounted project
        at `/zuul` is no longer modified.\n\n## Why\n\nThe entrypoint copied the custom
        rules into `/zuul/.ansible-lint-rules` and\nwrote the merged config back to
        `/zuul/.ansible-lint`, mutating the project\nmount on every run. That blocks
        read-only mounts and leaves spurious git-dirty\nstate in the linted repo.
        The copy was load-bearing only because the two custom\nrules loaded their
        YAML lists via `os.getcwd()/.ansible-lint-rules/...`, so a\ncopy had to exist
        inside the linted tree.\n\n## How\n\n- Both rule modules now locate their
        `*_list.yaml` via\n  `_RULES_DIR = os.path.dirname(os.path.abspath(__file__))`
        instead of\n  `os.getcwd()`. The rules and lists move into `files/rules/`
        and are baked into\n  the image at `/opt/osism/ansible-lint-rules/`.\n- `prepare-config.py`
        writes the merged config to `/tmp/ansible-lint.yml` and\n  forces `rulesdir`
        to the baked path (so a repo-local `rulesdir` pointing at a\n  path we no
        longer create is overridden).\n- `run.sh` keeps caches in `/tmp` (`XDG_CACHE_HOME`)
        and runs\n  `ansiblelint -c /tmp/ansible-lint.yml --nocolor -R --offline`.
        Nothing is\n  written under `/zuul`.\n\n## Verification\n\nThe rebuilt image
        was diffed against the published image across all consumer\nrepos that run
        the `ansible-lint` job (testbed, the ansible-collection-* repos,\nosism-kubernetes,
        the container-image-* repos, ansible-playbooks{,-manager},\ncfg-cookiecutter,
        ci-image, cloud-in-a-box, deb-packaging, metalbox,\nnew-testbed): **identical
        findings and exit codes, no mutation of the mount,\nand the `N failure(s)`
        summary line preserved** for every one. Relative\n`exclude_paths` (baseline
        and repo-local merged) continue to resolve against the\nproject root, not
        the config location.\n\n## Depends on\n\n- osism/cloud-in-a-box#442 \u2014
        removes a vestigial empty `.ansible-lint` that the\n  old image masked by
        overwriting; should merge first (or together) so its CI\n  stays green under
        the read-only image.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/container-images/pull/907
      child_jobs: []
      commit_id: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
      event_id: d0bce220-5f09-11f1-9e41-2042c6804f93
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/eeed492895de4078bc6c57202a4c1585/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/eeed492895de4078bc6c57202a4c1585/work/logs
        result_data_file: /var/lib/zuul/builds/eeed492895de4078bc6c57202a4c1585/work/results.json
        src_root: /var/lib/zuul/builds/eeed492895de4078bc6c57202a4c1585/work/src
        work_root: /var/lib/zuul/builds/eeed492895de4078bc6c57202a4c1585/work
      include_vars: []
      items:
      - branch: main
        change: '907'
        change_message: "ansible-lint: lint repos read-only\n\n## What\n\nMake the
          `ansible-lint` image lint a repository **without writing into it**.\nThe
          mounted project at `/zuul` is no longer modified.\n\n## Why\n\nThe entrypoint
          copied the custom rules into `/zuul/.ansible-lint-rules` and\nwrote the
          merged config back to `/zuul/.ansible-lint`, mutating the project\nmount
          on every run. That blocks read-only mounts and leaves spurious git-dirty\nstate
          in the linted repo. The copy was load-bearing only because the two custom\nrules
          loaded their YAML lists via `os.getcwd()/.ansible-lint-rules/...`, so a\ncopy
          had to exist inside the linted tree.\n\n## How\n\n- Both rule modules now
          locate their `*_list.yaml` via\n  `_RULES_DIR = os.path.dirname(os.path.abspath(__file__))`
          instead of\n  `os.getcwd()`. The rules and lists move into `files/rules/`
          and are baked into\n  the image at `/opt/osism/ansible-lint-rules/`.\n-
          `prepare-config.py` writes the merged config to `/tmp/ansible-lint.yml`
          and\n  forces `rulesdir` to the baked path (so a repo-local `rulesdir` pointing
          at a\n  path we no longer create is overridden).\n- `run.sh` keeps caches
          in `/tmp` (`XDG_CACHE_HOME`) and runs\n  `ansiblelint -c /tmp/ansible-lint.yml
          --nocolor -R --offline`. Nothing is\n  written under `/zuul`.\n\n## Verification\n\nThe
          rebuilt image was diffed against the published image across all consumer\nrepos
          that run the `ansible-lint` job (testbed, the ansible-collection-* repos,\nosism-kubernetes,
          the container-image-* repos, ansible-playbooks{,-manager},\ncfg-cookiecutter,
          ci-image, cloud-in-a-box, deb-packaging, metalbox,\nnew-testbed): **identical
          findings and exit codes, no mutation of the mount,\nand the `N failure(s)`
          summary line preserved** for every one. Relative\n`exclude_paths` (baseline
          and repo-local merged) continue to resolve against the\nproject root, not
          the config location.\n\n## Depends on\n\n- osism/cloud-in-a-box#442 \u2014
          removes a vestigial empty `.ansible-lint` that the\n  old image masked by
          overwriting; should merge first (or together) so its CI\n  stays green under
          the read-only image.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/907
        commit_id: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        patchset: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
          src_dir: src/github.com/osism/container-images
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: YW5zaWJsZS1saW50OiBsaW50IHJlcG9zIHJlYWQtb25seQoKIyMgV2hhdAoKTWFrZSB0aGUgYGFuc2libGUtbGludGAgaW1hZ2UgbGludCBhIHJlcG9zaXRvcnkgKip3aXRob3V0IHdyaXRpbmcgaW50byBpdCoqLgpUaGUgbW91bnRlZCBwcm9qZWN0IGF0IGAvenV1bGAgaXMgbm8gbG9uZ2VyIG1vZGlmaWVkLgoKIyMgV2h5CgpUaGUgZW50cnlwb2ludCBjb3BpZWQgdGhlIGN1c3RvbSBydWxlcyBpbnRvIGAvenV1bC8uYW5zaWJsZS1saW50LXJ1bGVzYCBhbmQKd3JvdGUgdGhlIG1lcmdlZCBjb25maWcgYmFjayB0byBgL3p1dWwvLmFuc2libGUtbGludGAsIG11dGF0aW5nIHRoZSBwcm9qZWN0Cm1vdW50IG9uIGV2ZXJ5IHJ1bi4gVGhhdCBibG9ja3MgcmVhZC1vbmx5IG1vdW50cyBhbmQgbGVhdmVzIHNwdXJpb3VzIGdpdC1kaXJ0eQpzdGF0ZSBpbiB0aGUgbGludGVkIHJlcG8uIFRoZSBjb3B5IHdhcyBsb2FkLWJlYXJpbmcgb25seSBiZWNhdXNlIHRoZSB0d28gY3VzdG9tCnJ1bGVzIGxvYWRlZCB0aGVpciBZQU1MIGxpc3RzIHZpYSBgb3MuZ2V0Y3dkKCkvLmFuc2libGUtbGludC1ydWxlcy8uLi5gLCBzbyBhCmNvcHkgaGFkIHRvIGV4aXN0IGluc2lkZSB0aGUgbGludGVkIHRyZWUuCgojIyBIb3cKCi0gQm90aCBydWxlIG1vZHVsZXMgbm93IGxvY2F0ZSB0aGVpciBgKl9saXN0LnlhbWxgIHZpYQogIGBfUlVMRVNfRElSID0gb3MucGF0aC5kaXJuYW1lKG9zLnBhdGguYWJzcGF0aChfX2ZpbGVfXykpYCBpbnN0ZWFkIG9mCiAgYG9zLmdldGN3ZCgpYC4gVGhlIHJ1bGVzIGFuZCBsaXN0cyBtb3ZlIGludG8gYGZpbGVzL3J1bGVzL2AgYW5kIGFyZSBiYWtlZCBpbnRvCiAgdGhlIGltYWdlIGF0IGAvb3B0L29zaXNtL2Fuc2libGUtbGludC1ydWxlcy9gLgotIGBwcmVwYXJlLWNvbmZpZy5weWAgd3JpdGVzIHRoZSBtZXJnZWQgY29uZmlnIHRvIGAvdG1wL2Fuc2libGUtbGludC55bWxgIGFuZAogIGZvcmNlcyBgcnVsZXNkaXJgIHRvIHRoZSBiYWtlZCBwYXRoIChzbyBhIHJlcG8tbG9jYWwgYHJ1bGVzZGlyYCBwb2ludGluZyBhdCBhCiAgcGF0aCB3ZSBubyBsb25nZXIgY3JlYXRlIGlzIG92ZXJyaWRkZW4pLgotIGBydW4uc2hgIGtlZXBzIGNhY2hlcyBpbiBgL3RtcGAgKGBYREdfQ0FDSEVfSE9NRWApIGFuZCBydW5zCiAgYGFuc2libGVsaW50IC1jIC90bXAvYW5zaWJsZS1saW50LnltbCAtLW5vY29sb3IgLVIgLS1vZmZsaW5lYC4gTm90aGluZyBpcwogIHdyaXR0ZW4gdW5kZXIgYC96dXVsYC4KCiMjIFZlcmlmaWNhdGlvbgoKVGhlIHJlYnVpbHQgaW1hZ2Ugd2FzIGRpZmZlZCBhZ2FpbnN0IHRoZSBwdWJsaXNoZWQgaW1hZ2UgYWNyb3NzIGFsbCBjb25zdW1lcgpyZXBvcyB0aGF0IHJ1biB0aGUgYGFuc2libGUtbGludGAgam9iICh0ZXN0YmVkLCB0aGUgYW5zaWJsZS1jb2xsZWN0aW9uLSogcmVwb3MsCm9zaXNtLWt1YmVybmV0ZXMsIHRoZSBjb250YWluZXItaW1hZ2UtKiByZXBvcywgYW5zaWJsZS1wbGF5Ym9va3N7LC1tYW5hZ2VyfSwKY2ZnLWNvb2tpZWN1dHRlciwgY2ktaW1hZ2UsIGNsb3VkLWluLWEtYm94LCBkZWItcGFja2FnaW5nLCBtZXRhbGJveCwKbmV3LXRlc3RiZWQpOiAqKmlkZW50aWNhbCBmaW5kaW5ncyBhbmQgZXhpdCBjb2Rlcywgbm8gbXV0YXRpb24gb2YgdGhlIG1vdW50LAphbmQgdGhlIGBOIGZhaWx1cmUocylgIHN1bW1hcnkgbGluZSBwcmVzZXJ2ZWQqKiBmb3IgZXZlcnkgb25lLiBSZWxhdGl2ZQpgZXhjbHVkZV9wYXRoc2AgKGJhc2VsaW5lIGFuZCByZXBvLWxvY2FsIG1lcmdlZCkgY29udGludWUgdG8gcmVzb2x2ZSBhZ2FpbnN0IHRoZQpwcm9qZWN0IHJvb3QsIG5vdCB0aGUgY29uZmlnIGxvY2F0aW9uLgoKIyMgRGVwZW5kcyBvbgoKLSBvc2lzbS9jbG91ZC1pbi1hLWJveCM0NDIg4oCUIHJlbW92ZXMgYSB2ZXN0aWdpYWwgZW1wdHkgYC5hbnNpYmxlLWxpbnRgIHRoYXQgdGhlCiAgb2xkIGltYWdlIG1hc2tlZCBieSBvdmVyd3JpdGluZzsgc2hvdWxkIG1lcmdlIGZpcnN0IChvciB0b2dldGhlcikgc28gaXRzIENJCiAgc3RheXMgZ3JlZW4gdW5kZXIgdGhlIHJlYWQtb25seSBpbWFnZS4KCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUp
      patchset: f09ebb88ad0e25847a3d8a3c329a53d6912f2e08
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images
        name: osism/container-images
        short_name: container-images
        src_dir: src/github.com/osism/container-images
      projects:
        github.com/osism/container-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          checkout: main
          checkout_description: zuul branch
          commit: 6afd94608fc02d7c85f367dd3a2894e60ed9aaec
          name: osism/container-images
          required: false
          short_name: container-images
          src_dir: src/github.com/osism/container-images
      ref: refs/pull/907/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
