all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 162.253.55.140 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ nodepool: az: yul2 cloud: public external_id: 3f04a379-d9fb-4a0e-8fe3-5d8ec1acdeec host_id: 37e81cee0a506baf7361396a1e34dba16b963700582224f7eddff306 interface_ip: 162.253.55.140 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fe2b:26ab region: ca-ymq-1 slot: null zuul_node: az: yul2 cloud: public external_id: 3f04a379-d9fb-4a0e-8fe3-5d8ec1acdeec host_id: 37e81cee0a506baf7361396a1e34dba16b963700582224f7eddff306 interface_ip: 162.253.55.140 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fe2b:26ab region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ zuul: _inheritance_path: - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 924f21dc47234ec79f3d3b6808be580f build_refs: - branch: main change: '4096' change_message: 'fix(keycloak): upgrade bundled server to 26.8.1 Upgrades the bundled Keycloak from 24.0.5 to 26.8.1, the latest release. This picks up every security fix since 24.0.5, including CVE-2026-90997, which was only fixed in 26.7.4 and later. ## Why 26.8.1 and not 26.6.x Keycloak 26.0 through 26.6.x run a consent cleanup migration (`unique-consentuser-mysql`) that uses `CREATE TABLE ... AS SELECT`. PXC rejects that statement in `MASTER` strict mode. Our role relaxed strict mode with `SET GLOBAL` through the service IP, which only changes one node. That node ran the statement and replicated it, the other two nodes rejected it, and Galera''s consistency vote evicted the writer (PXC-4689 / PXC-4824, #2671). The 25.x releases used a temporary table, which Galera doesn''t replicate, so they never triggered this. Keycloak 26.7.0 replaced the statement with `CREATE TABLE` plus `INSERT ... SELECT` and added a guard against it (keycloak/keycloak#49551). Upgrading straight from 24.0.5 is supported: Keycloak runs every intermediate migration in order on first start. ## Changes - Keycloak image `26.8.1-1`, pinned by digest. The proxy and management-port changes from the original PR carry over. - `KC_FEATURES` is no longer set, so Keycloak''s supported defaults apply. Before, it enabled the deprecated legacy token exchange and FGAP v1. 26.8 enables federated client authentication and the JWT authorization grant by default, and those replace the legacy flow. - `doc/source/user/auth.rst` now documents the two supported methods: federated client authentication for workloads using client credentials, and the JWT authorization grant for users already linked to the external identity provider. Both share one identity provider setup, then continue with the same Keystone steps. - The admin user is now created with `KC_BOOTSTRAP_ADMIN_*`, replacing the deprecated `KEYCLOAK_ADMIN*` variables, and the SPI options use the new `--spi-x--y--z` format. - Strict mode is relaxed and restored on every PXC pod, and restored in an `always` block so a failed rollout can''t leave it relaxed. - `community.general` is bumped from 7.3.0 to 11.4.9. Starting with 11.4.0, `keycloak_client` compares the normalized client before updating, which fixes the false "changed" caused by client scope reordering. The `ansible-core` floor rises to 2.16, as 11.x requires; `uv.lock` already resolves 2.17+. - Every `changed_when: false` override on Keycloak tasks is removed: the realm and client tasks in the Keystone role, and the realm, client scope and client tasks in the kube-prometheus-stack role. Molecule''s idempotence pass now checks all of them. ## Upgrade notes The schema migration is one-way. Back up the `keycloak` database before upgrading. Users have to sign in again afterwards. Deployments that raised the Keycloak replica count above 1 should scale it to 0 before upgrading, so old and new pods never run at the same time. ## Testing `atmosphere-molecule-keycloak` covers a fresh 26.8.1 install on PXC together with Keystone and Horizon, including Molecule''s idempotence pass. That job runs PXC with a single node, so it can''t reproduce the multi-node eviction above. That fix relies on the upstream change and on applying strict mode to every node. ' change_url: https://github.com/vexxhost/atmosphere/pull/4096 commit_id: 41349d9be739f13a14d49b9ef17f5c6d3a81558d patchset: 41349d9be739f13a14d49b9ef17f5c6d3a81558d project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: da4d72d227f441cdb68f419d0470bdea buildset_refs: - branch: main change: '4096' change_message: 'fix(keycloak): upgrade bundled server to 26.8.1 Upgrades the bundled Keycloak from 24.0.5 to 26.8.1, the latest release. This picks up every security fix since 24.0.5, including CVE-2026-90997, which was only fixed in 26.7.4 and later. ## Why 26.8.1 and not 26.6.x Keycloak 26.0 through 26.6.x run a consent cleanup migration (`unique-consentuser-mysql`) that uses `CREATE TABLE ... AS SELECT`. PXC rejects that statement in `MASTER` strict mode. Our role relaxed strict mode with `SET GLOBAL` through the service IP, which only changes one node. That node ran the statement and replicated it, the other two nodes rejected it, and Galera''s consistency vote evicted the writer (PXC-4689 / PXC-4824, #2671). The 25.x releases used a temporary table, which Galera doesn''t replicate, so they never triggered this. Keycloak 26.7.0 replaced the statement with `CREATE TABLE` plus `INSERT ... SELECT` and added a guard against it (keycloak/keycloak#49551). Upgrading straight from 24.0.5 is supported: Keycloak runs every intermediate migration in order on first start. ## Changes - Keycloak image `26.8.1-1`, pinned by digest. The proxy and management-port changes from the original PR carry over. - `KC_FEATURES` is no longer set, so Keycloak''s supported defaults apply. Before, it enabled the deprecated legacy token exchange and FGAP v1. 26.8 enables federated client authentication and the JWT authorization grant by default, and those replace the legacy flow. - `doc/source/user/auth.rst` now documents the two supported methods: federated client authentication for workloads using client credentials, and the JWT authorization grant for users already linked to the external identity provider. Both share one identity provider setup, then continue with the same Keystone steps. - The admin user is now created with `KC_BOOTSTRAP_ADMIN_*`, replacing the deprecated `KEYCLOAK_ADMIN*` variables, and the SPI options use the new `--spi-x--y--z` format. - Strict mode is relaxed and restored on every PXC pod, and restored in an `always` block so a failed rollout can''t leave it relaxed. - `community.general` is bumped from 7.3.0 to 11.4.9. Starting with 11.4.0, `keycloak_client` compares the normalized client before updating, which fixes the false "changed" caused by client scope reordering. The `ansible-core` floor rises to 2.16, as 11.x requires; `uv.lock` already resolves 2.17+. - Every `changed_when: false` override on Keycloak tasks is removed: the realm and client tasks in the Keystone role, and the realm, client scope and client tasks in the kube-prometheus-stack role. Molecule''s idempotence pass now checks all of them. ## Upgrade notes The schema migration is one-way. Back up the `keycloak` database before upgrading. Users have to sign in again afterwards. Deployments that raised the Keycloak replica count above 1 should scale it to 0 before upgrading, so old and new pods never run at the same time. ## Testing `atmosphere-molecule-keycloak` covers a fresh 26.8.1 install on PXC together with Keystone and Horizon, including Molecule''s idempotence pass. That job runs PXC with a single node, so it can''t reproduce the multi-node eviction above. That fix relies on the upstream change and on applying strict mode to every node. ' change_url: https://github.com/vexxhost/atmosphere/pull/4096 commit_id: 41349d9be739f13a14d49b9ef17f5c6d3a81558d patchset: 41349d9be739f13a14d49b9ef17f5c6d3a81558d project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4096' change_message: 'fix(keycloak): upgrade bundled server to 26.8.1 Upgrades the bundled Keycloak from 24.0.5 to 26.8.1, the latest release. This picks up every security fix since 24.0.5, including CVE-2026-90997, which was only fixed in 26.7.4 and later. ## Why 26.8.1 and not 26.6.x Keycloak 26.0 through 26.6.x run a consent cleanup migration (`unique-consentuser-mysql`) that uses `CREATE TABLE ... AS SELECT`. PXC rejects that statement in `MASTER` strict mode. Our role relaxed strict mode with `SET GLOBAL` through the service IP, which only changes one node. That node ran the statement and replicated it, the other two nodes rejected it, and Galera''s consistency vote evicted the writer (PXC-4689 / PXC-4824, #2671). The 25.x releases used a temporary table, which Galera doesn''t replicate, so they never triggered this. Keycloak 26.7.0 replaced the statement with `CREATE TABLE` plus `INSERT ... SELECT` and added a guard against it (keycloak/keycloak#49551). Upgrading straight from 24.0.5 is supported: Keycloak runs every intermediate migration in order on first start. ## Changes - Keycloak image `26.8.1-1`, pinned by digest. The proxy and management-port changes from the original PR carry over. - `KC_FEATURES` is no longer set, so Keycloak''s supported defaults apply. Before, it enabled the deprecated legacy token exchange and FGAP v1. 26.8 enables federated client authentication and the JWT authorization grant by default, and those replace the legacy flow. - `doc/source/user/auth.rst` now documents the two supported methods: federated client authentication for workloads using client credentials, and the JWT authorization grant for users already linked to the external identity provider. Both share one identity provider setup, then continue with the same Keystone steps. - The admin user is now created with `KC_BOOTSTRAP_ADMIN_*`, replacing the deprecated `KEYCLOAK_ADMIN*` variables, and the SPI options use the new `--spi-x--y--z` format. - Strict mode is relaxed and restored on every PXC pod, and restored in an `always` block so a failed rollout can''t leave it relaxed. - `community.general` is bumped from 7.3.0 to 11.4.9. Starting with 11.4.0, `keycloak_client` compares the normalized client before updating, which fixes the false "changed" caused by client scope reordering. The `ansible-core` floor rises to 2.16, as 11.x requires; `uv.lock` already resolves 2.17+. - Every `changed_when: false` override on Keycloak tasks is removed: the realm and client tasks in the Keystone role, and the realm, client scope and client tasks in the kube-prometheus-stack role. Molecule''s idempotence pass now checks all of them. ## Upgrade notes The schema migration is one-way. Back up the `keycloak` database before upgrading. Users have to sign in again afterwards. Deployments that raised the Keycloak replica count above 1 should scale it to 0 before upgrading, so old and new pods never run at the same time. ## Testing `atmosphere-molecule-keycloak` covers a fresh 26.8.1 install on PXC together with Keystone and Horizon, including Molecule''s idempotence pass. That job runs PXC with a single node, so it can''t reproduce the multi-node eviction above. That fix relies on the upstream change and on applying strict mode to every node. ' change_url: https://github.com/vexxhost/atmosphere/pull/4096 child_jobs: - atmosphere-molecule-aio-openvswitch - atmosphere-molecule-aio-ovn - atmosphere-molecule-csi-local-path-provisioner - atmosphere-molecule-csi-rbd - atmosphere-molecule-keycloak commit_id: 41349d9be739f13a14d49b9ef17f5c6d3a81558d event_id: 266a5d30-d244-11f1-90a8-098a4e35e908 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/924f21dc47234ec79f3d3b6808be580f/ansible/inventory.yaml log_root: /var/lib/zuul/builds/924f21dc47234ec79f3d3b6808be580f/work/logs result_data_file: /var/lib/zuul/builds/924f21dc47234ec79f3d3b6808be580f/work/results.json src_root: /var/lib/zuul/builds/924f21dc47234ec79f3d3b6808be580f/work/src work_root: /var/lib/zuul/builds/924f21dc47234ec79f3d3b6808be580f/work include_vars: [] items: - branch: main change: '4096' change_message: 'fix(keycloak): upgrade bundled server to 26.8.1 Upgrades the bundled Keycloak from 24.0.5 to 26.8.1, the latest release. This picks up every security fix since 24.0.5, including CVE-2026-90997, which was only fixed in 26.7.4 and later. ## Why 26.8.1 and not 26.6.x Keycloak 26.0 through 26.6.x run a consent cleanup migration (`unique-consentuser-mysql`) that uses `CREATE TABLE ... AS SELECT`. PXC rejects that statement in `MASTER` strict mode. Our role relaxed strict mode with `SET GLOBAL` through the service IP, which only changes one node. That node ran the statement and replicated it, the other two nodes rejected it, and Galera''s consistency vote evicted the writer (PXC-4689 / PXC-4824, #2671). The 25.x releases used a temporary table, which Galera doesn''t replicate, so they never triggered this. Keycloak 26.7.0 replaced the statement with `CREATE TABLE` plus `INSERT ... SELECT` and added a guard against it (keycloak/keycloak#49551). Upgrading straight from 24.0.5 is supported: Keycloak runs every intermediate migration in order on first start. ## Changes - Keycloak image `26.8.1-1`, pinned by digest. The proxy and management-port changes from the original PR carry over. - `KC_FEATURES` is no longer set, so Keycloak''s supported defaults apply. Before, it enabled the deprecated legacy token exchange and FGAP v1. 26.8 enables federated client authentication and the JWT authorization grant by default, and those replace the legacy flow. - `doc/source/user/auth.rst` now documents the two supported methods: federated client authentication for workloads using client credentials, and the JWT authorization grant for users already linked to the external identity provider. Both share one identity provider setup, then continue with the same Keystone steps. - The admin user is now created with `KC_BOOTSTRAP_ADMIN_*`, replacing the deprecated `KEYCLOAK_ADMIN*` variables, and the SPI options use the new `--spi-x--y--z` format. - Strict mode is relaxed and restored on every PXC pod, and restored in an `always` block so a failed rollout can''t leave it relaxed. - `community.general` is bumped from 7.3.0 to 11.4.9. Starting with 11.4.0, `keycloak_client` compares the normalized client before updating, which fixes the false "changed" caused by client scope reordering. The `ansible-core` floor rises to 2.16, as 11.x requires; `uv.lock` already resolves 2.17+. - Every `changed_when: false` override on Keycloak tasks is removed: the realm and client tasks in the Keystone role, and the realm, client scope and client tasks in the kube-prometheus-stack role. Molecule''s idempotence pass now checks all of them. ## Upgrade notes The schema migration is one-way. Back up the `keycloak` database before upgrading. Users have to sign in again afterwards. Deployments that raised the Keycloak replica count above 1 should scale it to 0 before upgrading, so old and new pods never run at the same time. ## Testing `atmosphere-molecule-keycloak` covers a fresh 26.8.1 install on PXC together with Keystone and Horizon, including Molecule''s idempotence pass. That job runs PXC with a single node, so it can''t reproduce the multi-node eviction above. That fix relies on the upstream change and on applying strict mode to every node. ' change_url: https://github.com/vexxhost/atmosphere/pull/4096 commit_id: 41349d9be739f13a14d49b9ef17f5c6d3a81558d patchset: 41349d9be739f13a14d49b9ef17f5c6d3a81558d project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-release-manifest jobtags: [] max_attempts: 3 message: Zml4KGtleWNsb2FrKTogdXBncmFkZSBidW5kbGVkIHNlcnZlciB0byAyNi44LjEKClVwZ3JhZGVzIHRoZSBidW5kbGVkIEtleWNsb2FrIGZyb20gMjQuMC41IHRvIDI2LjguMSwgdGhlIGxhdGVzdCByZWxlYXNlLiBUaGlzIHBpY2tzIHVwIGV2ZXJ5IHNlY3VyaXR5IGZpeCBzaW5jZSAyNC4wLjUsIGluY2x1ZGluZyBDVkUtMjAyNi05MDk5Nywgd2hpY2ggd2FzIG9ubHkgZml4ZWQgaW4gMjYuNy40IGFuZCBsYXRlci4KCiMjIFdoeSAyNi44LjEgYW5kIG5vdCAyNi42LngKCktleWNsb2FrIDI2LjAgdGhyb3VnaCAyNi42LnggcnVuIGEgY29uc2VudCBjbGVhbnVwIG1pZ3JhdGlvbiAoYHVuaXF1ZS1jb25zZW50dXNlci1teXNxbGApIHRoYXQgdXNlcyBgQ1JFQVRFIFRBQkxFIC4uLiBBUyBTRUxFQ1RgLiBQWEMgcmVqZWN0cyB0aGF0IHN0YXRlbWVudCBpbiBgTUFTVEVSYCBzdHJpY3QgbW9kZS4gT3VyIHJvbGUgcmVsYXhlZCBzdHJpY3QgbW9kZSB3aXRoIGBTRVQgR0xPQkFMYCB0aHJvdWdoIHRoZSBzZXJ2aWNlIElQLCB3aGljaCBvbmx5IGNoYW5nZXMgb25lIG5vZGUuIFRoYXQgbm9kZSByYW4gdGhlIHN0YXRlbWVudCBhbmQgcmVwbGljYXRlZCBpdCwgdGhlIG90aGVyIHR3byBub2RlcyByZWplY3RlZCBpdCwgYW5kIEdhbGVyYSdzIGNvbnNpc3RlbmN5IHZvdGUgZXZpY3RlZCB0aGUgd3JpdGVyIChQWEMtNDY4OSAvIFBYQy00ODI0LCAjMjY3MSkuIFRoZSAyNS54IHJlbGVhc2VzIHVzZWQgYSB0ZW1wb3JhcnkgdGFibGUsIHdoaWNoIEdhbGVyYSBkb2Vzbid0IHJlcGxpY2F0ZSwgc28gdGhleSBuZXZlciB0cmlnZ2VyZWQgdGhpcy4gS2V5Y2xvYWsgMjYuNy4wIHJlcGxhY2VkIHRoZSBzdGF0ZW1lbnQgd2l0aCBgQ1JFQVRFIFRBQkxFYCBwbHVzIGBJTlNFUlQgLi4uIFNFTEVDVGAgYW5kIGFkZGVkIGEgZ3VhcmQgYWdhaW5zdCBpdCAoa2V5Y2xvYWsva2V5Y2xvYWsjNDk1NTEpLiBVcGdyYWRpbmcgc3RyYWlnaHQgZnJvbSAyNC4wLjUgaXMgc3VwcG9ydGVkOiBLZXljbG9hayBydW5zIGV2ZXJ5IGludGVybWVkaWF0ZSBtaWdyYXRpb24gaW4gb3JkZXIgb24gZmlyc3Qgc3RhcnQuCgojIyBDaGFuZ2VzCgotIEtleWNsb2FrIGltYWdlIGAyNi44LjEtMWAsIHBpbm5lZCBieSBkaWdlc3QuIFRoZSBwcm94eSBhbmQgbWFuYWdlbWVudC1wb3J0IGNoYW5nZXMgZnJvbSB0aGUgb3JpZ2luYWwgUFIgY2Fycnkgb3Zlci4KLSBgS0NfRkVBVFVSRVNgIGlzIG5vIGxvbmdlciBzZXQsIHNvIEtleWNsb2FrJ3Mgc3VwcG9ydGVkIGRlZmF1bHRzIGFwcGx5LiBCZWZvcmUsIGl0IGVuYWJsZWQgdGhlIGRlcHJlY2F0ZWQgbGVnYWN5IHRva2VuIGV4Y2hhbmdlIGFuZCBGR0FQIHYxLiAyNi44IGVuYWJsZXMgZmVkZXJhdGVkIGNsaWVudCBhdXRoZW50aWNhdGlvbiBhbmQgdGhlIEpXVCBhdXRob3JpemF0aW9uIGdyYW50IGJ5IGRlZmF1bHQsIGFuZCB0aG9zZSByZXBsYWNlIHRoZSBsZWdhY3kgZmxvdy4KLSBgZG9jL3NvdXJjZS91c2VyL2F1dGgucnN0YCBub3cgZG9jdW1lbnRzIHRoZSB0d28gc3VwcG9ydGVkIG1ldGhvZHM6IGZlZGVyYXRlZCBjbGllbnQgYXV0aGVudGljYXRpb24gZm9yIHdvcmtsb2FkcyB1c2luZyBjbGllbnQgY3JlZGVudGlhbHMsIGFuZCB0aGUgSldUIGF1dGhvcml6YXRpb24gZ3JhbnQgZm9yIHVzZXJzIGFscmVhZHkgbGlua2VkIHRvIHRoZSBleHRlcm5hbCBpZGVudGl0eSBwcm92aWRlci4gQm90aCBzaGFyZSBvbmUgaWRlbnRpdHkgcHJvdmlkZXIgc2V0dXAsIHRoZW4gY29udGludWUgd2l0aCB0aGUgc2FtZSBLZXlzdG9uZSBzdGVwcy4KLSBUaGUgYWRtaW4gdXNlciBpcyBub3cgY3JlYXRlZCB3aXRoIGBLQ19CT09UU1RSQVBfQURNSU5fKmAsIHJlcGxhY2luZyB0aGUgZGVwcmVjYXRlZCBgS0VZQ0xPQUtfQURNSU4qYCB2YXJpYWJsZXMsIGFuZCB0aGUgU1BJIG9wdGlvbnMgdXNlIHRoZSBuZXcgYC0tc3BpLXgtLXktLXpgIGZvcm1hdC4KLSBTdHJpY3QgbW9kZSBpcyByZWxheGVkIGFuZCByZXN0b3JlZCBvbiBldmVyeSBQWEMgcG9kLCBhbmQgcmVzdG9yZWQgaW4gYW4gYGFsd2F5c2AgYmxvY2sgc28gYSBmYWlsZWQgcm9sbG91dCBjYW4ndCBsZWF2ZSBpdCByZWxheGVkLgotIGBjb21tdW5pdHkuZ2VuZXJhbGAgaXMgYnVtcGVkIGZyb20gNy4zLjAgdG8gMTEuNC45LiBTdGFydGluZyB3aXRoIDExLjQuMCwgYGtleWNsb2FrX2NsaWVudGAgY29tcGFyZXMgdGhlIG5vcm1hbGl6ZWQgY2xpZW50IGJlZm9yZSB1cGRhdGluZywgd2hpY2ggZml4ZXMgdGhlIGZhbHNlICJjaGFuZ2VkIiBjYXVzZWQgYnkgY2xpZW50IHNjb3BlIHJlb3JkZXJpbmcuIFRoZSBgYW5zaWJsZS1jb3JlYCBmbG9vciByaXNlcyB0byAyLjE2LCBhcyAxMS54IHJlcXVpcmVzOyBgdXYubG9ja2AgYWxyZWFkeSByZXNvbHZlcyAyLjE3Ky4KLSBFdmVyeSBgY2hhbmdlZF93aGVuOiBmYWxzZWAgb3ZlcnJpZGUgb24gS2V5Y2xvYWsgdGFza3MgaXMgcmVtb3ZlZDogdGhlIHJlYWxtIGFuZCBjbGllbnQgdGFza3MgaW4gdGhlIEtleXN0b25lIHJvbGUsIGFuZCB0aGUgcmVhbG0sIGNsaWVudCBzY29wZSBhbmQgY2xpZW50IHRhc2tzIGluIHRoZSBrdWJlLXByb21ldGhldXMtc3RhY2sgcm9sZS4gTW9sZWN1bGUncyBpZGVtcG90ZW5jZSBwYXNzIG5vdyBjaGVja3MgYWxsIG9mIHRoZW0uCgojIyBVcGdyYWRlIG5vdGVzCgpUaGUgc2NoZW1hIG1pZ3JhdGlvbiBpcyBvbmUtd2F5LiBCYWNrIHVwIHRoZSBga2V5Y2xvYWtgIGRhdGFiYXNlIGJlZm9yZSB1cGdyYWRpbmcuIFVzZXJzIGhhdmUgdG8gc2lnbiBpbiBhZ2FpbiBhZnRlcndhcmRzLiBEZXBsb3ltZW50cyB0aGF0IHJhaXNlZCB0aGUgS2V5Y2xvYWsgcmVwbGljYSBjb3VudCBhYm92ZSAxIHNob3VsZCBzY2FsZSBpdCB0byAwIGJlZm9yZSB1cGdyYWRpbmcsIHNvIG9sZCBhbmQgbmV3IHBvZHMgbmV2ZXIgcnVuIGF0IHRoZSBzYW1lIHRpbWUuCgojIyBUZXN0aW5nCgpgYXRtb3NwaGVyZS1tb2xlY3VsZS1rZXljbG9ha2AgY292ZXJzIGEgZnJlc2ggMjYuOC4xIGluc3RhbGwgb24gUFhDIHRvZ2V0aGVyIHdpdGggS2V5c3RvbmUgYW5kIEhvcml6b24sIGluY2x1ZGluZyBNb2xlY3VsZSdzIGlkZW1wb3RlbmNlIHBhc3MuIFRoYXQgam9iIHJ1bnMgUFhDIHdpdGggYSBzaW5nbGUgbm9kZSwgc28gaXQgY2FuJ3QgcmVwcm9kdWNlIHRoZSBtdWx0aS1ub2RlIGV2aWN0aW9uIGFib3ZlLiBUaGF0IGZpeCByZWxpZXMgb24gdGhlIHVwc3RyZWFtIGNoYW5nZSBhbmQgb24gYXBwbHlpbmcgc3RyaWN0IG1vZGUgdG8gZXZlcnkgbm9kZS4K patchset: 41349d9be739f13a14d49b9ef17f5c6d3a81558d pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: 4ee8667d55d1aa6230b954e7dc0574946f8c4373 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 untrusted/project_3/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 playbooks: - path: untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/release-manifest/run.yaml roles: - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_0/atmosphere-zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/playbook_0/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/playbook_0/role_3/zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_3/zuul-jobs/roles post_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: 59bcdf4d09803f595e3d5279b28cf3fdecd5fa83 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere ref: refs/pull/4096/head resources: {} tenant: oss timeout: 1800 topic: null voting: true