all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe2b:d34a
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b6300f6a-08fb-4082-b4a1-39d5ab24af23
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe2b:d34a
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.107
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.163
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe2b:d34a
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/testbed/.zuul.yaml@main#324>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 11145b8e914b4127bead341dbafdbcf2
      build_refs:
      - branch: main
        change: '2910'
        change_message: "tempest: exclude TempURL with-prefix test\n\n## What\n\ntempest
          46.3.0 added\n`ObjectTempUrlTest.test_get_object_using_temp_url_with_prefix`
          (id\n`a4c34c55`, Launchpad #2142680), a prefix-scoped Swift TempURL test\n(`temp_url_prefix=`)
          that did not exist in 46.2.0. When `tempest:latest` picked\nup 46.3.0, the
          2026-06-19 periodic-midnight `testbed-deploy-current` and\n`testbed-deploy-next`
          jobs started failing on it with 403 AccessDenied.\n\nThis adds an unconditional
          exclusion in\n`scripts/check/302-openstack-with-tempest.sh`.\n\n## Root
          cause (verified against RGW source)\n\nThe tempest test was added purely
          as Swift coverage (#2142680, \"test missing\");\nit signs over the canonical
          `/v1/{account}/{container}/{prefix}` path, correct\nfor Swift. RGW serves
          Swift under `rgw_swift_url_prefix` (default `/swift`), and\nin `rgw_swift_auth.cc`
          `PrefixableSignatureHelper::calc`:\n\n- non-prefix TempURLs are verified
          against **two** path variants \u2014 the full\n  request URI and the URI
          with the swift prefix stripped \u2014 so the client's\n  `/v1/...` signature
          matches;\n- the **prefix** branch ignores the path variant and always signs
          over\n  `no_obj_uri` derived from the full `decoded_uri` (which includes
          `/swift`).\n\nSo the client's `prefix:/v1/...` signature never matches RGW's\n`prefix:/swift/v1/...`,
          and RGW returns 403. That is why the other five\n`ObjectTempUrl` tests pass
          and only the prefix variant fails.\n\nThis code is **identical in Reef (18.2.8)
          and Squid (19.2.4)**, so the failure\nis not release-dependent \u2014 it
          is triggered by the non-empty\n`rgw_swift_url_prefix` OSISM uses. Hence
          the exclusion is unconditional rather\nthan version-gated. It should be
          removed once the RGW bug is fixed (a\nreport/fix upstream is the proper
          resolution).\n\n## Not affected\n\n`testbed-deploy-stable` does not run
          the `tempest.api.object_storage` batch, so\nit never runs this test; its
          06-19 failure was an unrelated flaky\nshelve/unshelve timeout.\n\nReferences:\n\n-
          ceph/ceph#16370\n- https://tracker.ceph.com/issues/20398\n- https://bugs.launchpad.net/tempest/+bug/2142680\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2910
        commit_id: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        patchset: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
        src_dir: src/github.com/osism/testbed
        topic: null
      buildset: 6c234c5465174a6fa3968713b95dc41e
      buildset_refs:
      - branch: main
        change: '2910'
        change_message: "tempest: exclude TempURL with-prefix test\n\n## What\n\ntempest
          46.3.0 added\n`ObjectTempUrlTest.test_get_object_using_temp_url_with_prefix`
          (id\n`a4c34c55`, Launchpad #2142680), a prefix-scoped Swift TempURL test\n(`temp_url_prefix=`)
          that did not exist in 46.2.0. When `tempest:latest` picked\nup 46.3.0, the
          2026-06-19 periodic-midnight `testbed-deploy-current` and\n`testbed-deploy-next`
          jobs started failing on it with 403 AccessDenied.\n\nThis adds an unconditional
          exclusion in\n`scripts/check/302-openstack-with-tempest.sh`.\n\n## Root
          cause (verified against RGW source)\n\nThe tempest test was added purely
          as Swift coverage (#2142680, \"test missing\");\nit signs over the canonical
          `/v1/{account}/{container}/{prefix}` path, correct\nfor Swift. RGW serves
          Swift under `rgw_swift_url_prefix` (default `/swift`), and\nin `rgw_swift_auth.cc`
          `PrefixableSignatureHelper::calc`:\n\n- non-prefix TempURLs are verified
          against **two** path variants \u2014 the full\n  request URI and the URI
          with the swift prefix stripped \u2014 so the client's\n  `/v1/...` signature
          matches;\n- the **prefix** branch ignores the path variant and always signs
          over\n  `no_obj_uri` derived from the full `decoded_uri` (which includes
          `/swift`).\n\nSo the client's `prefix:/v1/...` signature never matches RGW's\n`prefix:/swift/v1/...`,
          and RGW returns 403. That is why the other five\n`ObjectTempUrl` tests pass
          and only the prefix variant fails.\n\nThis code is **identical in Reef (18.2.8)
          and Squid (19.2.4)**, so the failure\nis not release-dependent \u2014 it
          is triggered by the non-empty\n`rgw_swift_url_prefix` OSISM uses. Hence
          the exclusion is unconditional rather\nthan version-gated. It should be
          removed once the RGW bug is fixed (a\nreport/fix upstream is the proper
          resolution).\n\n## Not affected\n\n`testbed-deploy-stable` does not run
          the `tempest.api.object_storage` batch, so\nit never runs this test; its
          06-19 failure was an unrelated flaky\nshelve/unshelve timeout.\n\nReferences:\n\n-
          ceph/ceph#16370\n- https://tracker.ceph.com/issues/20398\n- https://bugs.launchpad.net/tempest/+bug/2142680\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2910
        commit_id: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        patchset: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
        src_dir: src/github.com/osism/testbed
        topic: null
      change: '2910'
      change_message: "tempest: exclude TempURL with-prefix test\n\n## What\n\ntempest
        46.3.0 added\n`ObjectTempUrlTest.test_get_object_using_temp_url_with_prefix`
        (id\n`a4c34c55`, Launchpad #2142680), a prefix-scoped Swift TempURL test\n(`temp_url_prefix=`)
        that did not exist in 46.2.0. When `tempest:latest` picked\nup 46.3.0, the
        2026-06-19 periodic-midnight `testbed-deploy-current` and\n`testbed-deploy-next`
        jobs started failing on it with 403 AccessDenied.\n\nThis adds an unconditional
        exclusion in\n`scripts/check/302-openstack-with-tempest.sh`.\n\n## Root cause
        (verified against RGW source)\n\nThe tempest test was added purely as Swift
        coverage (#2142680, \"test missing\");\nit signs over the canonical `/v1/{account}/{container}/{prefix}`
        path, correct\nfor Swift. RGW serves Swift under `rgw_swift_url_prefix` (default
        `/swift`), and\nin `rgw_swift_auth.cc` `PrefixableSignatureHelper::calc`:\n\n-
        non-prefix TempURLs are verified against **two** path variants \u2014 the
        full\n  request URI and the URI with the swift prefix stripped \u2014 so the
        client's\n  `/v1/...` signature matches;\n- the **prefix** branch ignores
        the path variant and always signs over\n  `no_obj_uri` derived from the full
        `decoded_uri` (which includes `/swift`).\n\nSo the client's `prefix:/v1/...`
        signature never matches RGW's\n`prefix:/swift/v1/...`, and RGW returns 403.
        That is why the other five\n`ObjectTempUrl` tests pass and only the prefix
        variant fails.\n\nThis code is **identical in Reef (18.2.8) and Squid (19.2.4)**,
        so the failure\nis not release-dependent \u2014 it is triggered by the non-empty\n`rgw_swift_url_prefix`
        OSISM uses. Hence the exclusion is unconditional rather\nthan version-gated.
        It should be removed once the RGW bug is fixed (a\nreport/fix upstream is
        the proper resolution).\n\n## Not affected\n\n`testbed-deploy-stable` does
        not run the `tempest.api.object_storage` batch, so\nit never runs this test;
        its 06-19 failure was an unrelated flaky\nshelve/unshelve timeout.\n\nReferences:\n\n-
        ceph/ceph#16370\n- https://tracker.ceph.com/issues/20398\n- https://bugs.launchpad.net/tempest/+bug/2142680\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/testbed/pull/2910
      child_jobs: []
      commit_id: f40e37c86f53fa8c11f7020cbb7c630048058ffc
      event_id: 60aac320-6bc1-11f1-91c5-6a684c0466f7
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/11145b8e914b4127bead341dbafdbcf2/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/11145b8e914b4127bead341dbafdbcf2/work/logs
        result_data_file: /var/lib/zuul/builds/11145b8e914b4127bead341dbafdbcf2/work/results.json
        src_root: /var/lib/zuul/builds/11145b8e914b4127bead341dbafdbcf2/work/src
        work_root: /var/lib/zuul/builds/11145b8e914b4127bead341dbafdbcf2/work
      include_vars: []
      items:
      - branch: main
        change: '2910'
        change_message: "tempest: exclude TempURL with-prefix test\n\n## What\n\ntempest
          46.3.0 added\n`ObjectTempUrlTest.test_get_object_using_temp_url_with_prefix`
          (id\n`a4c34c55`, Launchpad #2142680), a prefix-scoped Swift TempURL test\n(`temp_url_prefix=`)
          that did not exist in 46.2.0. When `tempest:latest` picked\nup 46.3.0, the
          2026-06-19 periodic-midnight `testbed-deploy-current` and\n`testbed-deploy-next`
          jobs started failing on it with 403 AccessDenied.\n\nThis adds an unconditional
          exclusion in\n`scripts/check/302-openstack-with-tempest.sh`.\n\n## Root
          cause (verified against RGW source)\n\nThe tempest test was added purely
          as Swift coverage (#2142680, \"test missing\");\nit signs over the canonical
          `/v1/{account}/{container}/{prefix}` path, correct\nfor Swift. RGW serves
          Swift under `rgw_swift_url_prefix` (default `/swift`), and\nin `rgw_swift_auth.cc`
          `PrefixableSignatureHelper::calc`:\n\n- non-prefix TempURLs are verified
          against **two** path variants \u2014 the full\n  request URI and the URI
          with the swift prefix stripped \u2014 so the client's\n  `/v1/...` signature
          matches;\n- the **prefix** branch ignores the path variant and always signs
          over\n  `no_obj_uri` derived from the full `decoded_uri` (which includes
          `/swift`).\n\nSo the client's `prefix:/v1/...` signature never matches RGW's\n`prefix:/swift/v1/...`,
          and RGW returns 403. That is why the other five\n`ObjectTempUrl` tests pass
          and only the prefix variant fails.\n\nThis code is **identical in Reef (18.2.8)
          and Squid (19.2.4)**, so the failure\nis not release-dependent \u2014 it
          is triggered by the non-empty\n`rgw_swift_url_prefix` OSISM uses. Hence
          the exclusion is unconditional rather\nthan version-gated. It should be
          removed once the RGW bug is fixed (a\nreport/fix upstream is the proper
          resolution).\n\n## Not affected\n\n`testbed-deploy-stable` does not run
          the `tempest.api.object_storage` batch, so\nit never runs this test; its
          06-19 failure was an unrelated flaky\nshelve/unshelve timeout.\n\nReferences:\n\n-
          ceph/ceph#16370\n- https://tracker.ceph.com/issues/20398\n- https://bugs.launchpad.net/tempest/+bug/2142680\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/testbed/pull/2910
        commit_id: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        patchset: f40e37c86f53fa8c11f7020cbb7c630048058ffc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          name: osism/testbed
          short_name: testbed
          src_dir: src/github.com/osism/testbed
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: dGVtcGVzdDogZXhjbHVkZSBUZW1wVVJMIHdpdGgtcHJlZml4IHRlc3QKCiMjIFdoYXQKCnRlbXBlc3QgNDYuMy4wIGFkZGVkCmBPYmplY3RUZW1wVXJsVGVzdC50ZXN0X2dldF9vYmplY3RfdXNpbmdfdGVtcF91cmxfd2l0aF9wcmVmaXhgIChpZApgYTRjMzRjNTVgLCBMYXVuY2hwYWQgIzIxNDI2ODApLCBhIHByZWZpeC1zY29wZWQgU3dpZnQgVGVtcFVSTCB0ZXN0CihgdGVtcF91cmxfcHJlZml4PWApIHRoYXQgZGlkIG5vdCBleGlzdCBpbiA0Ni4yLjAuIFdoZW4gYHRlbXBlc3Q6bGF0ZXN0YCBwaWNrZWQKdXAgNDYuMy4wLCB0aGUgMjAyNi0wNi0xOSBwZXJpb2RpYy1taWRuaWdodCBgdGVzdGJlZC1kZXBsb3ktY3VycmVudGAgYW5kCmB0ZXN0YmVkLWRlcGxveS1uZXh0YCBqb2JzIHN0YXJ0ZWQgZmFpbGluZyBvbiBpdCB3aXRoIDQwMyBBY2Nlc3NEZW5pZWQuCgpUaGlzIGFkZHMgYW4gdW5jb25kaXRpb25hbCBleGNsdXNpb24gaW4KYHNjcmlwdHMvY2hlY2svMzAyLW9wZW5zdGFjay13aXRoLXRlbXBlc3Quc2hgLgoKIyMgUm9vdCBjYXVzZSAodmVyaWZpZWQgYWdhaW5zdCBSR1cgc291cmNlKQoKVGhlIHRlbXBlc3QgdGVzdCB3YXMgYWRkZWQgcHVyZWx5IGFzIFN3aWZ0IGNvdmVyYWdlICgjMjE0MjY4MCwgInRlc3QgbWlzc2luZyIpOwppdCBzaWducyBvdmVyIHRoZSBjYW5vbmljYWwgYC92MS97YWNjb3VudH0ve2NvbnRhaW5lcn0ve3ByZWZpeH1gIHBhdGgsIGNvcnJlY3QKZm9yIFN3aWZ0LiBSR1cgc2VydmVzIFN3aWZ0IHVuZGVyIGByZ3dfc3dpZnRfdXJsX3ByZWZpeGAgKGRlZmF1bHQgYC9zd2lmdGApLCBhbmQKaW4gYHJnd19zd2lmdF9hdXRoLmNjYCBgUHJlZml4YWJsZVNpZ25hdHVyZUhlbHBlcjo6Y2FsY2A6CgotIG5vbi1wcmVmaXggVGVtcFVSTHMgYXJlIHZlcmlmaWVkIGFnYWluc3QgKip0d28qKiBwYXRoIHZhcmlhbnRzIOKAlCB0aGUgZnVsbAogIHJlcXVlc3QgVVJJIGFuZCB0aGUgVVJJIHdpdGggdGhlIHN3aWZ0IHByZWZpeCBzdHJpcHBlZCDigJQgc28gdGhlIGNsaWVudCdzCiAgYC92MS8uLi5gIHNpZ25hdHVyZSBtYXRjaGVzOwotIHRoZSAqKnByZWZpeCoqIGJyYW5jaCBpZ25vcmVzIHRoZSBwYXRoIHZhcmlhbnQgYW5kIGFsd2F5cyBzaWducyBvdmVyCiAgYG5vX29ial91cmlgIGRlcml2ZWQgZnJvbSB0aGUgZnVsbCBgZGVjb2RlZF91cmlgICh3aGljaCBpbmNsdWRlcyBgL3N3aWZ0YCkuCgpTbyB0aGUgY2xpZW50J3MgYHByZWZpeDovdjEvLi4uYCBzaWduYXR1cmUgbmV2ZXIgbWF0Y2hlcyBSR1cncwpgcHJlZml4Oi9zd2lmdC92MS8uLi5gLCBhbmQgUkdXIHJldHVybnMgNDAzLiBUaGF0IGlzIHdoeSB0aGUgb3RoZXIgZml2ZQpgT2JqZWN0VGVtcFVybGAgdGVzdHMgcGFzcyBhbmQgb25seSB0aGUgcHJlZml4IHZhcmlhbnQgZmFpbHMuCgpUaGlzIGNvZGUgaXMgKippZGVudGljYWwgaW4gUmVlZiAoMTguMi44KSBhbmQgU3F1aWQgKDE5LjIuNCkqKiwgc28gdGhlIGZhaWx1cmUKaXMgbm90IHJlbGVhc2UtZGVwZW5kZW50IOKAlCBpdCBpcyB0cmlnZ2VyZWQgYnkgdGhlIG5vbi1lbXB0eQpgcmd3X3N3aWZ0X3VybF9wcmVmaXhgIE9TSVNNIHVzZXMuIEhlbmNlIHRoZSBleGNsdXNpb24gaXMgdW5jb25kaXRpb25hbCByYXRoZXIKdGhhbiB2ZXJzaW9uLWdhdGVkLiBJdCBzaG91bGQgYmUgcmVtb3ZlZCBvbmNlIHRoZSBSR1cgYnVnIGlzIGZpeGVkIChhCnJlcG9ydC9maXggdXBzdHJlYW0gaXMgdGhlIHByb3BlciByZXNvbHV0aW9uKS4KCiMjIE5vdCBhZmZlY3RlZAoKYHRlc3RiZWQtZGVwbG95LXN0YWJsZWAgZG9lcyBub3QgcnVuIHRoZSBgdGVtcGVzdC5hcGkub2JqZWN0X3N0b3JhZ2VgIGJhdGNoLCBzbwppdCBuZXZlciBydW5zIHRoaXMgdGVzdDsgaXRzIDA2LTE5IGZhaWx1cmUgd2FzIGFuIHVucmVsYXRlZCBmbGFreQpzaGVsdmUvdW5zaGVsdmUgdGltZW91dC4KClJlZmVyZW5jZXM6CgotIGNlcGgvY2VwaCMxNjM3MAotIGh0dHBzOi8vdHJhY2tlci5jZXBoLmNvbS9pc3N1ZXMvMjAzOTgKLSBodHRwczovL2J1Z3MubGF1bmNocGFkLm5ldC90ZW1wZXN0LytidWcvMjE0MjY4MAoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: f40e37c86f53fa8c11f7020cbb7c630048058ffc
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/testbed
        name: osism/testbed
        short_name: testbed
        src_dir: src/github.com/osism/testbed
      projects:
        github.com/osism/testbed:
          canonical_hostname: github.com
          canonical_name: github.com/osism/testbed
          checkout: main
          checkout_description: zuul branch
          commit: c52e14e74dbc36c9a37fe2f3cf93b431ab6b471d
          name: osism/testbed
          required: false
          short_name: testbed
          src_dir: src/github.com/osism/testbed
      ref: refs/pull/2910/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
