all: children: controllers: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 199.204.45.70 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul cilium_helm_values: operator: replicas: 1 cilium_ipv4_cidr: 172.24.0.0/16 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' kubernetes_version: 1.34.0 molecule_scenario: upload-helm-chart nodepool: az: nova cloud: public external_id: f2882cf8-f0b8-41ce-aea5-b0653336ddcd host_id: 41a201ef72a259be12e3756e510383f2b77edc2ac36483fdab96a683 interface_ip: 199.204.45.70 label: debian-trixie node_properties: {} private_ipv4: 199.204.45.70 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.70 public_ipv6: 2604:e100:1:0:f816:3eff:fea0:bd92 region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: f2882cf8-f0b8-41ce-aea5-b0653336ddcd host_id: 41a201ef72a259be12e3756e510383f2b77edc2ac36483fdab96a683 interface_ip: 199.204.45.70 label: debian-trixie node_properties: {} private_ipv4: 199.204.45.70 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.70 public_ipv6: 2604:e100:1:0:f816:3eff:fea0:bd92 region: ca-ymq-1 slot: null uuid: null vars: cilium_helm_values: operator: replicas: 1 kubernetes_version: 1.34.0 molecule_scenario: upload-helm-chart zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 18269cbb7eb7489098289af7fd60a961 build_refs: - branch: main change: '236' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `bump.yaml`: contents: write, pull-requests: write ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/236 commit_id: 0a618e9c0485bbb67f1d612a4544c8c535070000 patchset: 0a618e9c0485bbb67f1d612a4544c8c535070000 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null buildset: d7d4014123b34a0e8c1158fe61496777 buildset_refs: - branch: main change: '236' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `bump.yaml`: contents: write, pull-requests: write ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/236 commit_id: 0a618e9c0485bbb67f1d612a4544c8c535070000 patchset: 0a618e9c0485bbb67f1d612a4544c8c535070000 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null change: '236' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `bump.yaml`: contents: write, pull-requests: write ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/236 child_jobs: [] commit_id: 0a618e9c0485bbb67f1d612a4544c8c535070000 event_id: c2871620-1bcb-11f1-9a65-bf7aaf81b926 executor: hostname: 0a8996d2b663 inventory_file: /var/lib/zuul/builds/18269cbb7eb7489098289af7fd60a961/ansible/inventory.yaml log_root: /var/lib/zuul/builds/18269cbb7eb7489098289af7fd60a961/work/logs result_data_file: /var/lib/zuul/builds/18269cbb7eb7489098289af7fd60a961/work/results.json src_root: /var/lib/zuul/builds/18269cbb7eb7489098289af7fd60a961/work/src work_root: /var/lib/zuul/builds/18269cbb7eb7489098289af7fd60a961/work include_vars: [] items: - branch: main change: '236' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `bump.yaml`: contents: write, pull-requests: write ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/236 commit_id: 0a618e9c0485bbb67f1d612a4544c8c535070000 patchset: 0a618e9c0485bbb67f1d612a4544c8c535070000 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null job: ansible-collection-kubernetes-molecule-upload-helm-chart jobtags: [] max_attempts: 3 message: Y2k6IGVuZm9yY2UgbGVhc3QtcHJpdmlsZWdlIHBlcm1pc3Npb25zIGZvciBHaXRIdWIgQWN0aW9ucyB3b3JrZmxvd3MKCiMjIEVuZm9yY2UgbGVhc3QtcHJpdmlsZWdlIHBlcm1pc3Npb25zCgpUaGlzIFBSIGFkZHMgZXhwbGljaXQgYHBlcm1pc3Npb25zYCBibG9ja3MgdG8gR2l0SHViIEFjdGlvbnMgd29ya2Zsb3cgZmlsZXMgdGhhdCBjdXJyZW50bHkgaGF2ZSBubyBwZXJtaXNzaW9ucyBkZWZpbmVkLCBmb2xsb3dpbmcgdGhlIHByaW5jaXBsZSBvZiBsZWFzdCBwcml2aWxlZ2UuCgojIyMgQ2hhbmdlcwotIGBidW1wLnlhbWxgOiBjb250ZW50czogd3JpdGUsIHB1bGwtcmVxdWVzdHM6IHdyaXRlCgojIyMgV2h5CldpdGhvdXQgZXhwbGljaXQgcGVybWlzc2lvbnMsIHdvcmtmbG93cyBpbmhlcml0IHRoZSBkZWZhdWx0IHRva2VuIHBlcm1pc3Npb25zIGNvbmZpZ3VyZWQgYXQgdGhlIHJlcG9zaXRvcnkgb3Igb3JnYW5pemF0aW9uIGxldmVsLiBCeSBleHBsaWNpdGx5IGRlY2xhcmluZyB0aGUgbWluaW11bSByZXF1aXJlZCBwZXJtaXNzaW9ucywgd2UgcmVkdWNlIHRoZSBibGFzdCByYWRpdXMgaWYgYSB3b3JrZmxvdyBpcyBjb21wcm9taXNlZC4KCiMjIyBSZWZlcmVuY2VzCi0gW0dpdEh1YiBBY3Rpb25zIHNlY3VyaXR5IGhhcmRlbmluZ10oaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9zZWN1cml0eS1mb3ItZ2l0aHViLWFjdGlvbnMvc2VjdXJpdHktZ3VpZGVzL3NlY3VyaXR5LWhhcmRlbmluZy1mb3ItZ2l0aHViLWFjdGlvbnMpCi0gW0F1dG9tYXRpYyB0b2tlbiBhdXRoZW50aWNhdGlvbiBwZXJtaXNzaW9uc10oaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9zZWN1cml0eS1mb3ItZ2l0aHViLWFjdGlvbnMvc2VjdXJpdHktZ3VpZGVzL2F1dG9tYXRpYy10b2tlbi1hdXRoZW50aWNhdGlvbiNwZXJtaXNzaW9ucy1mb3ItdGhlLWdpdGh1Yl90b2tlbikK patchset: 0a618e9c0485bbb67f1d612a4544c8c535070000 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes projects: github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: c8f52a8b13d345fed544e2912e947f0d2998dc98 name: vexxhost/ansible-collection-kubernetes required: false short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes ref: refs/pull/236/head resources: {} tenant: oss timeout: 1800 topic: null voting: true