all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 162.253.55.140 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: local-path-provisioner kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_scenario: csi nodepool: az: nova cloud: public external_id: a81561ed-4672-484d-b7c4-02a7e45a4181 host_id: c9670958829e9c96e47d452d2c9c4ce9edaac336d3dbc4a3c4ec531c interface_ip: 162.253.55.140 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fe3b:a746 region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: a81561ed-4672-484d-b7c4-02a7e45a4181 host_id: c9670958829e9c96e47d452d2c9c4ce9edaac336d3dbc4a3c4ec531c interface_ip: 162.253.55.140 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fe3b:a746 region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: local-path-provisioner kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_scenario: csi zuul: _inheritance_path: - '' - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 6bda73a762674ac99c591d42bb548afc build_refs: - branch: main change: '3743' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `manila.yml`: contents: read - `pages.yml`: permissions: {} (defense-in-depth) ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/atmosphere/pull/3743 commit_id: 456cceaa002574d9564aa1ed65a635dfa04c0447 patchset: 456cceaa002574d9564aa1ed65a635dfa04c0447 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: e14ee6c97b3f48e08120cb8f386e87cd buildset_refs: - branch: main change: '3743' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `manila.yml`: contents: read - `pages.yml`: permissions: {} (defense-in-depth) ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/atmosphere/pull/3743 commit_id: 456cceaa002574d9564aa1ed65a635dfa04c0447 patchset: 456cceaa002574d9564aa1ed65a635dfa04c0447 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '3743' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `manila.yml`: contents: read - `pages.yml`: permissions: {} (defense-in-depth) ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/atmosphere/pull/3743 child_jobs: [] commit_id: 456cceaa002574d9564aa1ed65a635dfa04c0447 event_id: 8b37fd70-1d69-11f1-856f-0ab87ade7b00 executor: hostname: 0a8996d2b663 inventory_file: /var/lib/zuul/builds/6bda73a762674ac99c591d42bb548afc/ansible/inventory.yaml log_root: /var/lib/zuul/builds/6bda73a762674ac99c591d42bb548afc/work/logs result_data_file: /var/lib/zuul/builds/6bda73a762674ac99c591d42bb548afc/work/results.json src_root: /var/lib/zuul/builds/6bda73a762674ac99c591d42bb548afc/work/src work_root: /var/lib/zuul/builds/6bda73a762674ac99c591d42bb548afc/work include_vars: [] items: - branch: main change: '3743' change_message: 'ci: enforce least-privilege permissions for GitHub Actions workflows ## Enforce least-privilege permissions This PR adds explicit `permissions` blocks to GitHub Actions workflow files that currently have no permissions defined, following the principle of least privilege. ### Changes - `manila.yml`: contents: read - `pages.yml`: permissions: {} (defense-in-depth) ### Why Without explicit permissions, workflows inherit the default token permissions configured at the repository or organization level. By explicitly declaring the minimum required permissions, we reduce the blast radius if a workflow is compromised. ### References - [GitHub Actions security hardening](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) - [Automatic token authentication permissions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) ' change_url: https://github.com/vexxhost/atmosphere/pull/3743 commit_id: 456cceaa002574d9564aa1ed65a635dfa04c0447 patchset: 456cceaa002574d9564aa1ed65a635dfa04c0447 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-csi-local-path-provisioner jobtags: [] max_attempts: 3 message: Y2k6IGVuZm9yY2UgbGVhc3QtcHJpdmlsZWdlIHBlcm1pc3Npb25zIGZvciBHaXRIdWIgQWN0aW9ucyB3b3JrZmxvd3MKCiMjIEVuZm9yY2UgbGVhc3QtcHJpdmlsZWdlIHBlcm1pc3Npb25zCgpUaGlzIFBSIGFkZHMgZXhwbGljaXQgYHBlcm1pc3Npb25zYCBibG9ja3MgdG8gR2l0SHViIEFjdGlvbnMgd29ya2Zsb3cgZmlsZXMgdGhhdCBjdXJyZW50bHkgaGF2ZSBubyBwZXJtaXNzaW9ucyBkZWZpbmVkLCBmb2xsb3dpbmcgdGhlIHByaW5jaXBsZSBvZiBsZWFzdCBwcml2aWxlZ2UuCgojIyMgQ2hhbmdlcwotIGBtYW5pbGEueW1sYDogY29udGVudHM6IHJlYWQKLSBgcGFnZXMueW1sYDogcGVybWlzc2lvbnM6IHt9IChkZWZlbnNlLWluLWRlcHRoKQoKIyMjIFdoeQpXaXRob3V0IGV4cGxpY2l0IHBlcm1pc3Npb25zLCB3b3JrZmxvd3MgaW5oZXJpdCB0aGUgZGVmYXVsdCB0b2tlbiBwZXJtaXNzaW9ucyBjb25maWd1cmVkIGF0IHRoZSByZXBvc2l0b3J5IG9yIG9yZ2FuaXphdGlvbiBsZXZlbC4gQnkgZXhwbGljaXRseSBkZWNsYXJpbmcgdGhlIG1pbmltdW0gcmVxdWlyZWQgcGVybWlzc2lvbnMsIHdlIHJlZHVjZSB0aGUgYmxhc3QgcmFkaXVzIGlmIGEgd29ya2Zsb3cgaXMgY29tcHJvbWlzZWQuCgojIyMgUmVmZXJlbmNlcwotIFtHaXRIdWIgQWN0aW9ucyBzZWN1cml0eSBoYXJkZW5pbmddKGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvc2VjdXJpdHktZm9yLWdpdGh1Yi1hY3Rpb25zL3NlY3VyaXR5LWd1aWRlcy9zZWN1cml0eS1oYXJkZW5pbmctZm9yLWdpdGh1Yi1hY3Rpb25zKQotIFtBdXRvbWF0aWMgdG9rZW4gYXV0aGVudGljYXRpb24gcGVybWlzc2lvbnNdKGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvc2VjdXJpdHktZm9yLWdpdGh1Yi1hY3Rpb25zL3NlY3VyaXR5LWd1aWRlcy9hdXRvbWF0aWMtdG9rZW4tYXV0aGVudGljYXRpb24jcGVybWlzc2lvbnMtZm9yLXRoZS1naXRodWJfdG9rZW4pCg== patchset: 456cceaa002574d9564aa1ed65a635dfa04c0447 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 untrusted/project_3/github.com/vexxhost/atmosphere: canonical_name: github.com/vexxhost/atmosphere checkout: main commit: 456cceaa002574d9564aa1ed65a635dfa04c0447 untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 114b9110f78f4f7c82008d74be433df9d483f558 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere/test-playbooks/molecule/post.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/post_playbook_0/role_0/atmosphere link_target: untrusted/project_3/github.com/vexxhost/atmosphere role_path: ansible/post_playbook_0/role_0/atmosphere/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere/test-playbooks/molecule/pre.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_2/role_0/atmosphere link_target: untrusted/project_3/github.com/vexxhost/atmosphere role_path: ansible/pre_playbook_2/role_0/atmosphere/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: 456cceaa002574d9564aa1ed65a635dfa04c0447 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere ref: refs/pull/3743/head resources: {} tenant: oss timeout: 1800 topic: null voting: true