all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 199.204.45.113 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ nodepool: az: yul2 cloud: public external_id: 45470b74-3aec-44c1-a795-58e4b4cffd45 host_id: 1338700d28abaf70516697563709cb5989e78902918a96f23cebed44 interface_ip: 199.204.45.113 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.113 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.113 public_ipv6: 2604:e100:1:0:f816:3eff:fe65:35d7 region: ca-ymq-1 slot: null zuul_node: az: yul2 cloud: public external_id: 45470b74-3aec-44c1-a795-58e4b4cffd45 host_id: 1338700d28abaf70516697563709cb5989e78902918a96f23cebed44 interface_ip: 199.204.45.113 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.113 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.113 public_ipv6: 2604:e100:1:0:f816:3eff:fe65:35d7 region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ zuul: _inheritance_path: - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: fdabdb67ed88406bbc3edd63cd05f331 build_refs: - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- On every push to `main` and `stable/*`, `atmosphere-release publish` publishes the manifest as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`. It looks up the merged pull request through the GitHub API and asks Zuul for the newest buildset in which every job passed for that PR's head commit (`gate`, then `check`). If that buildset's manifest was generated from the same image inputs as this commit, it is published unchanged, so what ships is exactly what CI deployed. Otherwise (direct push, no passing buildset, logs expired, or another merge changed the image list) the manifest the `build` job just generated is published with `com.vexxhost.atmosphere.tested: \"false\"`.\n- Manifests record `inputs`, a digest of the rendered image list before tags are resolved, and pushes are reproducible (fixed creation time), so the same manifest always has the same artifact digest wherever it is pushed.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. OCI references are read through `atmosphere_image_mirrors` and `atmosphere_image_prefix` like every image, so Harbor-prefix and mirror users also fetch the manifest through their cache. `atmosphere_release_manifest_ca_file` adds a private CA to trust; credentials come from the Docker configuration. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `publish`, `digest`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Go: `publish` against a fake Zuul API (tested manifest used unchanged with the same artifact digest, gate searched before check, failed buildsets skipped, fallback when inputs changed, nothing passed or Zuul is unreachable), and reproducible pushes.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content, and against an HTTPS registry with a private CA and basic authentication (fails without the CA or credentials), including fetching the manifest through the prefix and mirror rules. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nWith vexxhost/atmosphere-zuul-jobs#7, an `atmosphere-release-manifest` job generates this change's release manifest once per buildset. Every molecule job (AIO, CSI, Keycloak) depends on it, pushes that exact manifest to a TLS registry with password authentication on its node, checks the pushed digest matches, and deploys by registry reference with `atmosphere_release_manifest`, `atmosphere_release_manifest_ca_file` and a mirror rule, the same path customers use for published releases. That buildset's manifest is what `publish` publishes after merge.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: 670b370b6d7178e2a722357848c7c4f21b05e404 patchset: 670b370b6d7178e2a722357848c7c4f21b05e404 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: 16e1182065bd4d709cf1e9c18e39639f buildset_refs: - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- On every push to `main` and `stable/*`, `atmosphere-release publish` publishes the manifest as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`. It looks up the merged pull request through the GitHub API and asks Zuul for the newest buildset in which every job passed for that PR's head commit (`gate`, then `check`). If that buildset's manifest was generated from the same image inputs as this commit, it is published unchanged, so what ships is exactly what CI deployed. Otherwise (direct push, no passing buildset, logs expired, or another merge changed the image list) the manifest the `build` job just generated is published with `com.vexxhost.atmosphere.tested: \"false\"`.\n- Manifests record `inputs`, a digest of the rendered image list before tags are resolved, and pushes are reproducible (fixed creation time), so the same manifest always has the same artifact digest wherever it is pushed.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. OCI references are read through `atmosphere_image_mirrors` and `atmosphere_image_prefix` like every image, so Harbor-prefix and mirror users also fetch the manifest through their cache. `atmosphere_release_manifest_ca_file` adds a private CA to trust; credentials come from the Docker configuration. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `publish`, `digest`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Go: `publish` against a fake Zuul API (tested manifest used unchanged with the same artifact digest, gate searched before check, failed buildsets skipped, fallback when inputs changed, nothing passed or Zuul is unreachable), and reproducible pushes.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content, and against an HTTPS registry with a private CA and basic authentication (fails without the CA or credentials), including fetching the manifest through the prefix and mirror rules. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nWith vexxhost/atmosphere-zuul-jobs#7, an `atmosphere-release-manifest` job generates this change's release manifest once per buildset. Every molecule job (AIO, CSI, Keycloak) depends on it, pushes that exact manifest to a TLS registry with password authentication on its node, checks the pushed digest matches, and deploys by registry reference with `atmosphere_release_manifest`, `atmosphere_release_manifest_ca_file` and a mirror rule, the same path customers use for published releases. That buildset's manifest is what `publish` publishes after merge.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: 670b370b6d7178e2a722357848c7c4f21b05e404 patchset: 670b370b6d7178e2a722357848c7c4f21b05e404 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- On every push to `main` and `stable/*`, `atmosphere-release publish` publishes the manifest as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`. It looks up the merged pull request through the GitHub API and asks Zuul for the newest buildset in which every job passed for that PR's head commit (`gate`, then `check`). If that buildset's manifest was generated from the same image inputs as this commit, it is published unchanged, so what ships is exactly what CI deployed. Otherwise (direct push, no passing buildset, logs expired, or another merge changed the image list) the manifest the `build` job just generated is published with `com.vexxhost.atmosphere.tested: \"false\"`.\n- Manifests record `inputs`, a digest of the rendered image list before tags are resolved, and pushes are reproducible (fixed creation time), so the same manifest always has the same artifact digest wherever it is pushed.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. OCI references are read through `atmosphere_image_mirrors` and `atmosphere_image_prefix` like every image, so Harbor-prefix and mirror users also fetch the manifest through their cache. `atmosphere_release_manifest_ca_file` adds a private CA to trust; credentials come from the Docker configuration. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `publish`, `digest`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Go: `publish` against a fake Zuul API (tested manifest used unchanged with the same artifact digest, gate searched before check, failed buildsets skipped, fallback when inputs changed, nothing passed or Zuul is unreachable), and reproducible pushes.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content, and against an HTTPS registry with a private CA and basic authentication (fails without the CA or credentials), including fetching the manifest through the prefix and mirror rules. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nWith vexxhost/atmosphere-zuul-jobs#7, an `atmosphere-release-manifest` job generates this change's release manifest once per buildset. Every molecule job (AIO, CSI, Keycloak) depends on it, pushes that exact manifest to a TLS registry with password authentication on its node, checks the pushed digest matches, and deploys by registry reference with `atmosphere_release_manifest`, `atmosphere_release_manifest_ca_file` and a mirror rule, the same path customers use for published releases. That buildset's manifest is what `publish` publishes after merge.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 child_jobs: - atmosphere-molecule-aio-openvswitch - atmosphere-molecule-aio-ovn - atmosphere-molecule-csi-local-path-provisioner - atmosphere-molecule-csi-rbd - atmosphere-molecule-keycloak commit_id: 670b370b6d7178e2a722357848c7c4f21b05e404 event_id: 6c23a360-c969-11f1-9c87-5022dc6ad212 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/fdabdb67ed88406bbc3edd63cd05f331/ansible/inventory.yaml log_root: /var/lib/zuul/builds/fdabdb67ed88406bbc3edd63cd05f331/work/logs result_data_file: /var/lib/zuul/builds/fdabdb67ed88406bbc3edd63cd05f331/work/results.json src_root: /var/lib/zuul/builds/fdabdb67ed88406bbc3edd63cd05f331/work/src work_root: /var/lib/zuul/builds/fdabdb67ed88406bbc3edd63cd05f331/work include_vars: [] items: - branch: main change: '7' change_message: 'feat(molecule): deploy from one release manifest per buildset The molecule jobs deploy whatever tags `roles/defaults/vars/main.yml` points at when each job runs, while releases ship digest-pinned images. With vexxhost/atmosphere#4420, Atmosphere publishes a digest-pinned release manifest per commit; this makes CI generate that manifest once per buildset and deploy exactly it, through the same registry path customers use. - **`atmosphere-release-manifest` job** (`atmosphere-build-manifest` role): builds `atmosphere-release` from the change under test, generates the manifest (resolving tags through `harbor.atmosphere.dev/` to avoid upstream rate limits; the manifest records the original references) and returns the manifest and the binary as Zuul artifacts, with the digest of the artifact that pushing the manifest produces. - **Molecule jobs** depend on it. Their pre-run uses the new `atmosphere-use-manifest` role: it starts a CNCF Distribution registry on the node (pinned, checksum-verified) with TLS from a throwaway CA and password authentication, pushes the manifest, and fails unless the pushed artifact has the digest the build job reported. Atmosphere then reads it by reference (`atmosphere_release_manifest`, `atmosphere_release_manifest_ca_file`, and a mirror rule that keeps `atmosphere_image_prefix` away from that registry). - Every job therefore deploys the same manifest, and after merge `atmosphere-release publish` finds this buildset''s manifest through the Zuul API and publishes it unchanged. This calls `cmd/atmosphere-release` on every branch these jobs run against, so it must merge **after** vexxhost/atmosphere#4420 and its backports. Tested through `Depends-On` from vexxhost/atmosphere#4420 and by the role tests in #8. ' change_url: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7 commit_id: ff3b350ee39f2370048cfa7c3350df5abe02d5f1 patchset: ff3b350ee39f2370048cfa7c3350df5abe02d5f1 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere-zuul-jobs name: vexxhost/atmosphere-zuul-jobs short_name: atmosphere-zuul-jobs src_dir: src/github.com/vexxhost/atmosphere-zuul-jobs topic: null - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- On every push to `main` and `stable/*`, `atmosphere-release publish` publishes the manifest as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`. It looks up the merged pull request through the GitHub API and asks Zuul for the newest buildset in which every job passed for that PR's head commit (`gate`, then `check`). If that buildset's manifest was generated from the same image inputs as this commit, it is published unchanged, so what ships is exactly what CI deployed. Otherwise (direct push, no passing buildset, logs expired, or another merge changed the image list) the manifest the `build` job just generated is published with `com.vexxhost.atmosphere.tested: \"false\"`.\n- Manifests record `inputs`, a digest of the rendered image list before tags are resolved, and pushes are reproducible (fixed creation time), so the same manifest always has the same artifact digest wherever it is pushed.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. OCI references are read through `atmosphere_image_mirrors` and `atmosphere_image_prefix` like every image, so Harbor-prefix and mirror users also fetch the manifest through their cache. `atmosphere_release_manifest_ca_file` adds a private CA to trust; credentials come from the Docker configuration. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `publish`, `digest`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Go: `publish` against a fake Zuul API (tested manifest used unchanged with the same artifact digest, gate searched before check, failed buildsets skipped, fallback when inputs changed, nothing passed or Zuul is unreachable), and reproducible pushes.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content, and against an HTTPS registry with a private CA and basic authentication (fails without the CA or credentials), including fetching the manifest through the prefix and mirror rules. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nWith vexxhost/atmosphere-zuul-jobs#7, an `atmosphere-release-manifest` job generates this change's release manifest once per buildset. Every molecule job (AIO, CSI, Keycloak) depends on it, pushes that exact manifest to a TLS registry with password authentication on its node, checks the pushed digest matches, and deploys by registry reference with `atmosphere_release_manifest`, `atmosphere_release_manifest_ca_file` and a mirror rule, the same path customers use for published releases. That buildset's manifest is what `publish` publishes after merge.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: 670b370b6d7178e2a722357848c7c4f21b05e404 patchset: 670b370b6d7178e2a722357848c7c4f21b05e404 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-release-manifest jobtags: [] max_attempts: 3 message: ZmVhdDogcHVibGlzaCByZWxlYXNlIG1hbmlmZXN0cyBhbmQgZGVwbG95IGZyb20gdGhlbQoKVG9kYXkgYSByZWxlYXNlIHJlc29sdmVzIGltYWdlIHRhZ3MgYXQgcmVsZWFzZSB0aW1lLCBhZnRlciBDSSBoYXMgcnVuOiA4OCBvZiB0aGUgMjMyIGVudHJpZXMgaW4gYHJvbGVzL2RlZmF1bHRzL3ZhcnMvbWFpbi55bWxgIGFyZSBwbGFpbiB0YWdzLCBhbmQgYGNtZC9waW5pbWFnZXNgIHJlc29sdmVzIHRoZW0gaW50byB0aGUgR2FsYXh5IGNvbGxlY3Rpb24sIHNpbGVudGx5IHNraXBwaW5nIGFueSBpdCBjYW5ub3QgcmVzb2x2ZSAoaXQgbG9ncyA5NCBlcnJvcnMgb24gYG1haW5gIHRvZGF5KS4gVGhlIGRpZ2VzdHMgYSByZWxlYXNlIHNoaXBzIGFyZSBvbmx5IHJlY29yZGVkIGluc2lkZSB0aGUgR2FsYXh5IHRhcmJhbGwsIGFuZCBtaXJyb3JpbmcgZm9yIGFpci1nYXBwZWQgaW5zdGFsbHMgZ29lcyB0aHJvdWdoIHRoZSBgaW1hZ2VfbWFuaWZlc3RgIHJvbGUsIHdob3NlIHJlZ2lzdHJ5IHJld3JpdGUga2VlcHMgb25seSB0aGUgbGFzdCBwYXRoIGNvbXBvbmVudCwgc28gYHJvb2svY2VwaGAgYW5kIGBjZXBoL2NlcGhgIGJvdGggYmVjb21lIGA8cmVnaXN0cnk+L2NlcGhgLgoKVGhpcyBQUiBtYWtlcyBhIGRpZ2VzdC1waW5uZWQgKipyZWxlYXNlIG1hbmlmZXN0KiogdGhlIHNvdXJjZSBvZiB0cnV0aCBmb3Igd2hpY2ggaW1hZ2VzIGEgY29tbWl0IG9yIHJlbGVhc2UgZGVwbG95cy4KCioqUHVibGlzaGluZyoqCi0gT24gZXZlcnkgcHVzaCB0byBgbWFpbmAgYW5kIGBzdGFibGUvKmAsIGBhdG1vc3BoZXJlLXJlbGVhc2UgcHVibGlzaGAgcHVibGlzaGVzIHRoZSBtYW5pZmVzdCBhcyBhbiBPQ0kgYXJ0aWZhY3QgdG8gYGdoY3IuaW8vdmV4eGhvc3QvYXRtb3NwaGVyZS1yZWxlYXNlYCwgdGFnZ2VkIHdpdGggdGhlIGZ1bGwgY29tbWl0IFNIQSBhbmQgdGhlIGJyYW5jaCAoYG1haW5gLCBgc3RhYmxlLTIwMjUuMmAsIC4uLikgYXMgY29tcHV0ZWQgYnkgYGRvY2tlci9tZXRhZGF0YS1hY3Rpb25gLiBJdCBsb29rcyB1cCB0aGUgbWVyZ2VkIHB1bGwgcmVxdWVzdCB0aHJvdWdoIHRoZSBHaXRIdWIgQVBJIGFuZCBhc2tzIFp1dWwgZm9yIHRoZSBuZXdlc3QgYnVpbGRzZXQgaW4gd2hpY2ggZXZlcnkgam9iIHBhc3NlZCBmb3IgdGhhdCBQUidzIGhlYWQgY29tbWl0IChgZ2F0ZWAsIHRoZW4gYGNoZWNrYCkuIElmIHRoYXQgYnVpbGRzZXQncyBtYW5pZmVzdCB3YXMgZ2VuZXJhdGVkIGZyb20gdGhlIHNhbWUgaW1hZ2UgaW5wdXRzIGFzIHRoaXMgY29tbWl0LCBpdCBpcyBwdWJsaXNoZWQgdW5jaGFuZ2VkLCBzbyB3aGF0IHNoaXBzIGlzIGV4YWN0bHkgd2hhdCBDSSBkZXBsb3llZC4gT3RoZXJ3aXNlIChkaXJlY3QgcHVzaCwgbm8gcGFzc2luZyBidWlsZHNldCwgbG9ncyBleHBpcmVkLCBvciBhbm90aGVyIG1lcmdlIGNoYW5nZWQgdGhlIGltYWdlIGxpc3QpIHRoZSBtYW5pZmVzdCB0aGUgYGJ1aWxkYCBqb2IganVzdCBnZW5lcmF0ZWQgaXMgcHVibGlzaGVkIHdpdGggYGNvbS52ZXh4aG9zdC5hdG1vc3BoZXJlLnRlc3RlZDogImZhbHNlImAuCi0gTWFuaWZlc3RzIHJlY29yZCBgaW5wdXRzYCwgYSBkaWdlc3Qgb2YgdGhlIHJlbmRlcmVkIGltYWdlIGxpc3QgYmVmb3JlIHRhZ3MgYXJlIHJlc29sdmVkLCBhbmQgcHVzaGVzIGFyZSByZXByb2R1Y2libGUgKGZpeGVkIGNyZWF0aW9uIHRpbWUpLCBzbyB0aGUgc2FtZSBtYW5pZmVzdCBhbHdheXMgaGFzIHRoZSBzYW1lIGFydGlmYWN0IGRpZ2VzdCB3aGVyZXZlciBpdCBpcyBwdXNoZWQuCi0gYHJlbGVhc2UueWFtbGAgdXNlcyBgZG9ja2VyL21ldGFkYXRhLWFjdGlvbmAgZm9yIHRoZSByZWxlYXNlIHRhZyBhbmQgcHJvbW90ZXMgdGhlIHJlbGVhc2VkIGNvbW1pdCdzIG1hbmlmZXN0IHRvIGl0IChubyB0YWcgaXMgcmVzb2x2ZWQgYWdhaW4pLiBHb1JlbGVhc2VyIChgLmdvcmVsZWFzZXIueWFtbGApIGF0dGFjaGVzIGBhdG1vc3BoZXJlLXJlbGVhc2VgIGFyY2hpdmVzIGZvciBsaW51eC9kYXJ3aW4gYW1kNjQvYXJtNjQsIHRoZWlyIGNoZWNrc3VtcyBhbmQgdGhlIHJlbGVhc2UgbWFuaWZlc3QgdG8gdGhlIGV4aXN0aW5nIEdpdEh1YiByZWxlYXNlIHdpdGhvdXQgdG91Y2hpbmcgaXRzIG5vdGVzLCBhbmQgdGhlIEdhbGF4eSBjb2xsZWN0aW9uIGlzIHBpbm5lZCBmcm9tIHRoYXQgc2FtZSBtYW5pZmVzdC4KCioqRGVwbG95aW5nKioKLSBgYXRtb3NwaGVyZV9yZWxlYXNlX21hbmlmZXN0YCAoT0NJIHJlZmVyZW5jZSBvciBmaWxlIHBhdGgpIGRlcGxveXMgZXhhY3RseSBhIG1hbmlmZXN0J3MgaW1hZ2VzLiBPQ0kgcmVmZXJlbmNlcyBhcmUgcmVhZCB0aHJvdWdoIGBhdG1vc3BoZXJlX2ltYWdlX21pcnJvcnNgIGFuZCBgYXRtb3NwaGVyZV9pbWFnZV9wcmVmaXhgIGxpa2UgZXZlcnkgaW1hZ2UsIHNvIEhhcmJvci1wcmVmaXggYW5kIG1pcnJvciB1c2VycyBhbHNvIGZldGNoIHRoZSBtYW5pZmVzdCB0aHJvdWdoIHRoZWlyIGNhY2hlLiBgYXRtb3NwaGVyZV9yZWxlYXNlX21hbmlmZXN0X2NhX2ZpbGVgIGFkZHMgYSBwcml2YXRlIENBIHRvIHRydXN0OyBjcmVkZW50aWFscyBjb21lIGZyb20gdGhlIERvY2tlciBjb25maWd1cmF0aW9uLiBLdWJlcm5ldGVzIGNvbnRyb2wgcGxhbmUgaW1hZ2VzIGZhbGwgYmFjayB0byB0aGUgdGFnIHdoZW4gYW5vdGhlciBgYXRtb3NwaGVyZV9rdWJlcm5ldGVzX3ZlcnNpb25gIGlzIGRlcGxveWVkLgotIGBhdG1vc3BoZXJlX2ltYWdlX21pcnJvcnNgIHJlZGlyZWN0cyBpbWFnZXMgcGVyIHJlZ2lzdHJ5LCBuYW1lc3BhY2Ugb3IgcmVwb3NpdG9yeSAobW9zdCBzcGVjaWZpYyBydWxlIHdpbnMpOyBgYXRtb3NwaGVyZV9pbWFnZV9wcmVmaXhgIHN0aWxsIGFwcGxpZXMgdG8gZXZlcnl0aGluZyBubyBydWxlIG1hdGNoZXMsIHNvIEhhcmJvciBwcm94eSBwcm9qZWN0cyB3aXRoIGN1c3RvbSBuYW1lcyBub3cgd29yayB0b28uCi0gUmVzb2x1dGlvbiBoYXBwZW5zIGluIHRoZSByZW5kZXJlZCByZWZlcmVuY2VzLCBzbyBpdCB3b3JrcyB3aXRoIGFueSBLdWJlcm5ldGVzIGFuZCBjb250YWluZXIgcnVudGltZS4gYGF0bW9zcGhlcmVfaW1hZ2Vfb3ZlcnJpZGVzYCBhcmUgYXBwbGllZCBsYXN0LCB1bmNoYW5nZWQuCgoqKmBhdG1vc3BoZXJlLXJlbGVhc2VgIGNvbW1hbmQqKiAoYGNtZC9hdG1vc3BoZXJlLXJlbGVhc2VgLCByZXBsYWNlcyBgY21kL3BpbmltYWdlc2ApCi0gYGdlbmVyYXRlIFstLXdyaXRlLXZhcnNdIFstLXJlc29sdmUtcHJlZml4XWAsIGBwdXNoYCwgYHByb21vdGVgLCBgcHVibGlzaGAsIGBkaWdlc3RgLCBgc2hvd2AsIGBkaWZmYCwgYGNoZWNrYC4gYHB1c2hgIGFuZCBgcHJvbW90ZWAgdGFrZSBgcmVwb3NpdG9yeTp0YWdgIHJlZmVyZW5jZXMsIHNvIHRoZXkgY29uc3VtZSBgZG9ja2VyL21ldGFkYXRhLWFjdGlvbmAgb3V0cHV0IGRpcmVjdGx5OyBgLS1yZXNvbHZlLXByZWZpeGAgcmVzb2x2ZXMgdGFncyB0aHJvdWdoIGEgcHVsbC10aHJvdWdoIGNhY2hlIChmYWxsaW5nIGJhY2sgdG8gdGhlIHNvdXJjZSByZWdpc3RyeSkgdG8gYXZvaWQgdXBzdHJlYW0gcmF0ZSBsaW1pdHMuCi0gYG1pcnJvcmAgdG8gYSByZWdpc3RyeSwgb3IgYC0tdG8tZGlyYCAvIGAtLWZyb20tZGlyYCBmb3IgZGlzY29ubmVjdGVkIHNpdGVzLCBpbiBgbmVzdGVkYCwgYGZsYXRgIChgcXVheS5pby0tY2VwaC0tY2VwaGApIG9yIGBzaW5nbGUtcmVwb2AgbGF5b3V0cy4gSW1hZ2VzIGFyZSBjb3BpZWQgd2l0aCBldmVyeSBwbGF0Zm9ybSBzbyBkaWdlc3RzIG5ldmVyIGNoYW5nZSwgZWFjaCBkaWdlc3QgaXMgdmVyaWZpZWQsIGt1YmVhZG0ncyBpbWFnZXMgc3RheSB1bmRlciBvbmUgcHJlZml4IHdpdGggdGhlaXIgb3JpZ2luYWwgbmFtZXMsIHRoZSBtYW5pZmVzdCBhcnRpZmFjdCBpdHNlbGYgaXMgY29waWVkIHdpdGggaXRzIGRpZ2VzdCBpbnRhY3QsIGFuZCB0aGUgYGF0bW9zcGhlcmVfcmVsZWFzZV9tYW5pZmVzdGAgLyBgYXRtb3NwaGVyZV9pbWFnZV9taXJyb3JzYCB2YXJzIGFyZSB3cml0dGVuIG91dC4KClRoZSBgaW1hZ2VfbWFuaWZlc3RgIHJvbGUga2VlcHMgd29ya2luZyBidXQgbm93IHdhcm5zIHRoYXQgaXQgaXMgZGVwcmVjYXRlZC4KCiMjIyBDb21wYXRpYmlsaXR5CgpEZXBsb3ltZW50cyB0aGF0IHNldCBub25lIG9mIHRoZSBuZXcgdmFyaWFibGVzIGdldCBieXRlLWlkZW50aWNhbCBgYXRtb3NwaGVyZV9pbWFnZXNgOiBJIHJlbmRlcmVkIHRoZSBgZGVmYXVsdHNgIHJvbGUgdGhyb3VnaCBgYW5zaWJsZS1wbGF5Ym9va2AgYmVmb3JlIGFuZCBhZnRlciB0aGlzIGNoYW5nZSB3aXRoIG5vIHByZWZpeCwgd2l0aCBhIEhhcmJvciBwcmVmaXgsIGFuZCB3aXRoIHByZWZpeCArIG92ZXJyaWRlcywgb24gYG1haW5gICgyMzEgaW1hZ2VzKSBhbmQgb24gYHN0YWJsZS96ZWRgICgyMTYgaW1hZ2VzKTsgYWxsIG91dHB1dHMgYXJlIGlkZW50aWNhbC4gYHdyaXRlLXZhcnNgIHByb2R1Y2VzIHRoZSBzYW1lIHZhcnMgZmlsZSBhcyBgcGluaW1hZ2VzYCBleGNlcHQgdGhhdCBDZXBoIGlzIG5vdyBwaW5uZWQgdG9vIChgcGluaW1hZ2VzYCBjb3VsZCBub3QgcmVzb2x2ZSBpdHMgYHt7IGNlcGhfdmVyc2lvbiB9fWAgdGVtcGxhdGUpLgoKIyMjIFRlc3RpbmcKCi0gR286IGBpbnRlcm5hbC9yZWxlYXNlbWFuaWZlc3RgIHRlc3RzIGNvdmVyIGdlbmVyYXRpb24sIGB3cml0ZS12YXJzYCwgcHVzaC9mZXRjaC9wcm9tb3RlLCBldmVyeSBtaXJyb3IgbGF5b3V0IHdpdGggbXVsdGktYXJjaCBpbWFnZXMgaW4gaW4tbWVtb3J5IHJlZ2lzdHJpZXMsIGRpcmVjdG9yeSBleHBvcnQvaW1wb3J0LCBkaWdlc3QtbWlzbWF0Y2ggZGV0ZWN0aW9uLCByZWdpc3RyaWVzIHdpdGggcG9ydHMgYW5kIHJldHJ5IG9uIHJhdGUgbGltaXRzLgotIEdvOiBgcHVibGlzaGAgYWdhaW5zdCBhIGZha2UgWnV1bCBBUEkgKHRlc3RlZCBtYW5pZmVzdCB1c2VkIHVuY2hhbmdlZCB3aXRoIHRoZSBzYW1lIGFydGlmYWN0IGRpZ2VzdCwgZ2F0ZSBzZWFyY2hlZCBiZWZvcmUgY2hlY2ssIGZhaWxlZCBidWlsZHNldHMgc2tpcHBlZCwgZmFsbGJhY2sgd2hlbiBpbnB1dHMgY2hhbmdlZCwgbm90aGluZyBwYXNzZWQgb3IgWnV1bCBpcyB1bnJlYWNoYWJsZSksIGFuZCByZXByb2R1Y2libGUgcHVzaGVzLgotIFB5dGhvbjogdGhlIGByZXNvbHZlX2ltYWdlc2AgZmlsdGVyIGFuZCB0aGUgR28gcmVzb2x2ZXIgcnVuIHRoZSBzYW1lIGNhc2VzIGZyb20gYGludGVybmFsL3JlbGVhc2VtYW5pZmVzdC90ZXN0ZGF0YS9yZXNvbHZlLnlhbWxgOyB0aGUgbG9va3VwIGlzIHRlc3RlZCBhZ2FpbnN0IGEgbG9jYWwgSFRUUCByZWdpc3RyeSB3aXRoIHRva2VuIGF1dGggYW5kIGJsb2IgcmVkaXJlY3RzIChjcmVkZW50aWFscyBtdXN0IG5vdCByZWFjaCBzdG9yYWdlKSBhbmQgdGFtcGVyZWQgY29udGVudCwgYW5kIGFnYWluc3QgYW4gSFRUUFMgcmVnaXN0cnkgd2l0aCBhIHByaXZhdGUgQ0EgYW5kIGJhc2ljIGF1dGhlbnRpY2F0aW9uIChmYWlscyB3aXRob3V0IHRoZSBDQSBvciBjcmVkZW50aWFscyksIGluY2x1ZGluZyBmZXRjaGluZyB0aGUgbWFuaWZlc3QgdGhyb3VnaCB0aGUgcHJlZml4IGFuZCBtaXJyb3IgcnVsZXMuIEEgbmV3IGBweXRob24tdGVzdGAgQ0kgam9iIHJ1bnMgdGhlc2UgKHRoZSBleGlzdGluZyBgdGVzdHMvdW5pdGAgc3VpdGUgaXMgbm90IHJ1biBpbiBDSSBhbmQgaGFzIGEgc3RhbGUgbWFnbnVtIGV4cGVjdGF0aW9uLCBzbyB0aGUgam9iIG9ubHkgcnVucyB0aGUgbmV3IHRlc3RzKS4KLSBFbmQgdG8gZW5kIGFnYWluc3QgYSBsb2NhbCBDTkNGIERpc3RyaWJ1dGlvbiByZWdpc3RyeSB3aXRoIHJlYWwgaW1hZ2VzIGZyb20gYHJlZ2lzdHJ5Lms4cy5pb2AsIGBnaGNyLmlvYCBhbmQgRG9ja2VyIEh1YjogYGdlbmVyYXRlYCwgYHB1c2hgLCBgcHJvbW90ZWAsIGBzaG93YCwgbmVzdGVkIG1pcnJvciwgZXhwb3J0IOKGkiBmbGF0IGltcG9ydCwgYGNoZWNrYCwgYGRpZmZgLCBwbHVzIGRlcGxveWluZyB0aGUgbWlycm9yZWQgbWFuaWZlc3QgdGhyb3VnaCB0aGUgbG9va3VwLgotIGBnZW5lcmF0ZWAgYWdhaW5zdCB0aGUgcmVhbCByZWdpc3RyaWVzIHJlc29sdmVzIGFsbCAyMzEgaW1hZ2VzIG9uIGBtYWluYCBhbmQgYHN0YWJsZS8yMDI1LjJgLgoKIyMjIEJhY2twb3J0cwoKYGdvLm1vZGAgYW5kIGBnby5zdW1gIGFyZSB1bnRvdWNoZWQ7IGV2ZXJ5IGRlcGVuZGVuY3kgaXMgYWxyZWFkeSBwcmVzZW50IGF0IHRoZSBzYW1lIHZlcnNpb24gb24gYWxsIHN0YWJsZSBicmFuY2hlcy4KCi0gYHN0YWJsZS8yMDI1LjJgIGNoZXJyeS1waWNrcyBjbGVhbmx5IGFuZCBwYXNzZXMgZXZlcnl0aGluZyBhYm92ZS4KLSBgc3RhYmxlLzIwMjUuMWAgYmFjayB0byBgc3RhYmxlL3plZGAgY29uZmxpY3QgaW4gb25lIGh1bmsgb2YgYHJvbGVzL2RlZmF1bHRzL3ZhcnMvbWFpbi55bWxgOiB0aGUgY29uZmxpY3QgY29udGV4dCBpbmNsdWRlcyBgbWFpbmAncyBgX2F0bW9zcGhlcmVfc3RvcmFnZWAgYmxvY2ssIHdoaWNoIHRob3NlIGJyYW5jaGVzIGRvbid0IGhhdmUuIFJlc29sdmUgaXQgYnkga2VlcGluZyB0aGUgbmV3IGBhdG1vc3BoZXJlX2ltYWdlc2AgYmxvY2sgYW5kIGRyb3BwaW5nIHRoZSBgX2F0bW9zcGhlcmVfc3RvcmFnZWAgbGluZXMuIEkgZGlkIHRoaXMgb24gYHN0YWJsZS96ZWRgIGFuZCB0aGUgR28gdGVzdHMsIFB5dGhvbiB0ZXN0cyBhbmQgdGhlIG9sZC9uZXcgcmVuZGVyaW5nIGNvbXBhcmlzb24gYWxsIHBhc3MuCgojIyMgQ0kgZGVwbG95cyB0aGUgbWFuaWZlc3QKCldpdGggdmV4eGhvc3QvYXRtb3NwaGVyZS16dXVsLWpvYnMjNywgYW4gYGF0bW9zcGhlcmUtcmVsZWFzZS1tYW5pZmVzdGAgam9iIGdlbmVyYXRlcyB0aGlzIGNoYW5nZSdzIHJlbGVhc2UgbWFuaWZlc3Qgb25jZSBwZXIgYnVpbGRzZXQuIEV2ZXJ5IG1vbGVjdWxlIGpvYiAoQUlPLCBDU0ksIEtleWNsb2FrKSBkZXBlbmRzIG9uIGl0LCBwdXNoZXMgdGhhdCBleGFjdCBtYW5pZmVzdCB0byBhIFRMUyByZWdpc3RyeSB3aXRoIHBhc3N3b3JkIGF1dGhlbnRpY2F0aW9uIG9uIGl0cyBub2RlLCBjaGVja3MgdGhlIHB1c2hlZCBkaWdlc3QgbWF0Y2hlcywgYW5kIGRlcGxveXMgYnkgcmVnaXN0cnkgcmVmZXJlbmNlIHdpdGggYGF0bW9zcGhlcmVfcmVsZWFzZV9tYW5pZmVzdGAsIGBhdG1vc3BoZXJlX3JlbGVhc2VfbWFuaWZlc3RfY2FfZmlsZWAgYW5kIGEgbWlycm9yIHJ1bGUsIHRoZSBzYW1lIHBhdGggY3VzdG9tZXJzIHVzZSBmb3IgcHVibGlzaGVkIHJlbGVhc2VzLiBUaGF0IGJ1aWxkc2V0J3MgbWFuaWZlc3QgaXMgd2hhdCBgcHVibGlzaGAgcHVibGlzaGVzIGFmdGVyIG1lcmdlLgoKIyMjIEJlZm9yZSBtZXJnaW5nIC8gZm9sbG93LXVwcwoKLSBBZnRlciB0aGUgZmlyc3QgcHVzaCBwdWJsaXNoZXMgYGdoY3IuaW8vdmV4eGhvc3QvYXRtb3NwaGVyZS1yZWxlYXNlYCwgbWFrZSB0aGUgcGFja2FnZSBwdWJsaWMgYW5kIHNldCByZXRlbnRpb24gKGtlZXAgcmVsZWFzZSB0YWdzOyBjb21taXQgdGFncyBjYW4gYmUgcHJ1bmVkKS4KLSBEb2NrZXIgSHViJ3MgYW5vbnltb3VzIHJhdGUgbGltaXQgY2FuIHN0aWxsIGZhaWwgYGdlbmVyYXRlYCBhZnRlciBpdHMgcmV0cmllczsgcHJldmlvdXNseSB0aGlzIHNpbGVudGx5IHByb2R1Y2VkIHVucGlubmVkIGltYWdlcy4KLSBgaGFyYm9yLmF0bW9zcGhlcmUuZGV2YCBoYXMgbm8gcHJveHkgcHJvamVjdCBmb3IgYHBhY2thZ2VzLnZleHhob3N0LmNvbWAgKHVzZWQgYnkgYHByb21ldGhldXNfc21hcnRjdGxfZXhwb3J0ZXJgKS4KLSBUaGUgZG9jcyBidWlsZCB3aXRoIGAtV2AgYWxyZWFkeSBmYWlscyBvbiBgbWFpbmAgYmVjYXVzZSBvZiBleGlzdGluZyB3YXJuaW5ncyBpbiBgYWRtaW4vbW9uaXRvcmluZy5yc3RgIGFuZCBgYXJjaC9pbWFnZXMucnN0YDsgdGhlIG5ldyBwYWdlIGFkZHMgbm9uZS4KCkRlcGVuZHMtT246IGh0dHBzOi8vZ2l0aHViLmNvbS92ZXh4aG9zdC9hdG1vc3BoZXJlLXp1dWwtam9icy9wdWxsLzcK patchset: 670b370b6d7178e2a722357848c7c4f21b05e404 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: ff3b350ee39f2370048cfa7c3350df5abe02d5f1 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 untrusted/project_3/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 playbooks: - path: untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/release-manifest/run.yaml roles: - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_0/atmosphere-zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/playbook_0/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/playbook_0/role_3/zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_3/zuul-jobs/roles post_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: 670b370b6d7178e2a722357848c7c4f21b05e404 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere-zuul-jobs: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main checkout_description: zuul branch commit: ff3b350ee39f2370048cfa7c3350df5abe02d5f1 name: vexxhost/atmosphere-zuul-jobs required: false short_name: atmosphere-zuul-jobs src_dir: src/github.com/vexxhost/atmosphere-zuul-jobs ref: refs/pull/4420/head resources: {} tenant: oss timeout: 1800 topic: null voting: true