all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe75:d521
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: kolla
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 3d0db7e8-2939-445d-aedc-bf4a3fc4a810
        host_id: 25afcdcd4b24cc9d1766f11f81549380a3029030a455889bb61ec093
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe75:d521
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.245
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.43
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe75:d521
        region: null
        slot: null
      push_images: false
      version_openstack: '2024.1'
  vars:
    docker_namespace: kolla
    push_images: false
    version_openstack: '2024.1'
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-images-kolla-patch explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#76>'
      - '<Job container-images-kolla-patch-2024.1 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#94>'
      - '<Job container-images-kolla-patch-2024.1 explicit: None implied: None source:
        osism/container-images-kolla/.zuul.yaml@main#213>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 20fcd9cf19224c71acc05a881edf165e
      build_refs:
      - branch: main
        change: '737'
        change_message: "keystone: Drop 2025.2 patch 0004 merged upstream\n\n## What\n\nDrop
          `patches/2025.2/keystone/0004-Preserve-expires_at-when-rescoping-federated-tokens-.patch`
          (CVE-2026-44394). It has merged upstream into the moving `keystone-stable-2025.2`
          branch tarball, so the dry-run guard in `scripts/003-patch.sh` now reports
          \"Reversed (or previously applied) patch detected\" and exits 1, failing
          the `container-images-kolla-patch-2025.2` build.\n\nThis is the same situation
          #736 handled for patches 0001\u20130003.\n\n## Why now\n\n`container-images-kolla-patch-2025.2`
          last passed on 2026-06-09 11:30 and first failed on 2026-06-10 04:35 \u2014
          the first run after the fix landed upstream. Reproduced against the exact
          CI tarball (`keystone-28.0.2.dev16`):\n\n| Patch | dry-run exit | Status
          |\n|-------|-------------|--------|\n| `0004-Preserve-expires_at\u2026`
          (CVE-2026-44394) | 1 | merged upstream \u2192 dropped here |\n| `0005-Prevent-RBAC-policy-bypass\u2026`
          (CVE-2026-42999) | 0 | not yet upstream \u2192 kept |\n\nUpstream change:
          https://review.opendev.org/q/I0bbb8520e12c52edd01fb47c873f0227819706f5\n\nThis
          breaks every 2025.2 build (nightly main and all open PRs, including #735),
          independent of those PRs' own changes.\n\n## Scope\n\nRemoves only patch
          0004. Patch 0005 keeps its numbering (as in b769eb1 / #648).\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/737
        commit_id: 43f4ac65ebd6936a927945062528a76fd79d525b
        patchset: 43f4ac65ebd6936a927945062528a76fd79d525b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: b540c620f40644f3aaa640dda72f7689
      buildset_refs:
      - branch: main
        change: '737'
        change_message: "keystone: Drop 2025.2 patch 0004 merged upstream\n\n## What\n\nDrop
          `patches/2025.2/keystone/0004-Preserve-expires_at-when-rescoping-federated-tokens-.patch`
          (CVE-2026-44394). It has merged upstream into the moving `keystone-stable-2025.2`
          branch tarball, so the dry-run guard in `scripts/003-patch.sh` now reports
          \"Reversed (or previously applied) patch detected\" and exits 1, failing
          the `container-images-kolla-patch-2025.2` build.\n\nThis is the same situation
          #736 handled for patches 0001\u20130003.\n\n## Why now\n\n`container-images-kolla-patch-2025.2`
          last passed on 2026-06-09 11:30 and first failed on 2026-06-10 04:35 \u2014
          the first run after the fix landed upstream. Reproduced against the exact
          CI tarball (`keystone-28.0.2.dev16`):\n\n| Patch | dry-run exit | Status
          |\n|-------|-------------|--------|\n| `0004-Preserve-expires_at\u2026`
          (CVE-2026-44394) | 1 | merged upstream \u2192 dropped here |\n| `0005-Prevent-RBAC-policy-bypass\u2026`
          (CVE-2026-42999) | 0 | not yet upstream \u2192 kept |\n\nUpstream change:
          https://review.opendev.org/q/I0bbb8520e12c52edd01fb47c873f0227819706f5\n\nThis
          breaks every 2025.2 build (nightly main and all open PRs, including #735),
          independent of those PRs' own changes.\n\n## Scope\n\nRemoves only patch
          0004. Patch 0005 keeps its numbering (as in b769eb1 / #648).\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/737
        commit_id: 43f4ac65ebd6936a927945062528a76fd79d525b
        patchset: 43f4ac65ebd6936a927945062528a76fd79d525b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '737'
      change_message: "keystone: Drop 2025.2 patch 0004 merged upstream\n\n## What\n\nDrop
        `patches/2025.2/keystone/0004-Preserve-expires_at-when-rescoping-federated-tokens-.patch`
        (CVE-2026-44394). It has merged upstream into the moving `keystone-stable-2025.2`
        branch tarball, so the dry-run guard in `scripts/003-patch.sh` now reports
        \"Reversed (or previously applied) patch detected\" and exits 1, failing the
        `container-images-kolla-patch-2025.2` build.\n\nThis is the same situation
        #736 handled for patches 0001\u20130003.\n\n## Why now\n\n`container-images-kolla-patch-2025.2`
        last passed on 2026-06-09 11:30 and first failed on 2026-06-10 04:35 \u2014
        the first run after the fix landed upstream. Reproduced against the exact
        CI tarball (`keystone-28.0.2.dev16`):\n\n| Patch | dry-run exit | Status |\n|-------|-------------|--------|\n|
        `0004-Preserve-expires_at\u2026` (CVE-2026-44394) | 1 | merged upstream \u2192
        dropped here |\n| `0005-Prevent-RBAC-policy-bypass\u2026` (CVE-2026-42999)
        | 0 | not yet upstream \u2192 kept |\n\nUpstream change: https://review.opendev.org/q/I0bbb8520e12c52edd01fb47c873f0227819706f5\n\nThis
        breaks every 2025.2 build (nightly main and all open PRs, including #735),
        independent of those PRs' own changes.\n\n## Scope\n\nRemoves only patch 0004.
        Patch 0005 keeps its numbering (as in b769eb1 / #648).\n\n\U0001F916 Generated
        with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/container-images-kolla/pull/737
      child_jobs: []
      commit_id: 43f4ac65ebd6936a927945062528a76fd79d525b
      event_id: a0d963c0-6487-11f1-87fa-0557aadd8b34
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/20fcd9cf19224c71acc05a881edf165e/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/20fcd9cf19224c71acc05a881edf165e/work/logs
        result_data_file: /var/lib/zuul/builds/20fcd9cf19224c71acc05a881edf165e/work/results.json
        src_root: /var/lib/zuul/builds/20fcd9cf19224c71acc05a881edf165e/work/src
        work_root: /var/lib/zuul/builds/20fcd9cf19224c71acc05a881edf165e/work
      include_vars: []
      items:
      - branch: main
        change: '737'
        change_message: "keystone: Drop 2025.2 patch 0004 merged upstream\n\n## What\n\nDrop
          `patches/2025.2/keystone/0004-Preserve-expires_at-when-rescoping-federated-tokens-.patch`
          (CVE-2026-44394). It has merged upstream into the moving `keystone-stable-2025.2`
          branch tarball, so the dry-run guard in `scripts/003-patch.sh` now reports
          \"Reversed (or previously applied) patch detected\" and exits 1, failing
          the `container-images-kolla-patch-2025.2` build.\n\nThis is the same situation
          #736 handled for patches 0001\u20130003.\n\n## Why now\n\n`container-images-kolla-patch-2025.2`
          last passed on 2026-06-09 11:30 and first failed on 2026-06-10 04:35 \u2014
          the first run after the fix landed upstream. Reproduced against the exact
          CI tarball (`keystone-28.0.2.dev16`):\n\n| Patch | dry-run exit | Status
          |\n|-------|-------------|--------|\n| `0004-Preserve-expires_at\u2026`
          (CVE-2026-44394) | 1 | merged upstream \u2192 dropped here |\n| `0005-Prevent-RBAC-policy-bypass\u2026`
          (CVE-2026-42999) | 0 | not yet upstream \u2192 kept |\n\nUpstream change:
          https://review.opendev.org/q/I0bbb8520e12c52edd01fb47c873f0227819706f5\n\nThis
          breaks every 2025.2 build (nightly main and all open PRs, including #735),
          independent of those PRs' own changes.\n\n## Scope\n\nRemoves only patch
          0004. Patch 0005 keeps its numbering (as in b769eb1 / #648).\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/737
        commit_id: 43f4ac65ebd6936a927945062528a76fd79d525b
        patchset: 43f4ac65ebd6936a927945062528a76fd79d525b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: container-images-kolla-patch-2024.1
      jobtags: []
      max_attempts: 3
      message: a2V5c3RvbmU6IERyb3AgMjAyNS4yIHBhdGNoIDAwMDQgbWVyZ2VkIHVwc3RyZWFtCgojIyBXaGF0CgpEcm9wIGBwYXRjaGVzLzIwMjUuMi9rZXlzdG9uZS8wMDA0LVByZXNlcnZlLWV4cGlyZXNfYXQtd2hlbi1yZXNjb3BpbmctZmVkZXJhdGVkLXRva2Vucy0ucGF0Y2hgIChDVkUtMjAyNi00NDM5NCkuIEl0IGhhcyBtZXJnZWQgdXBzdHJlYW0gaW50byB0aGUgbW92aW5nIGBrZXlzdG9uZS1zdGFibGUtMjAyNS4yYCBicmFuY2ggdGFyYmFsbCwgc28gdGhlIGRyeS1ydW4gZ3VhcmQgaW4gYHNjcmlwdHMvMDAzLXBhdGNoLnNoYCBub3cgcmVwb3J0cyAiUmV2ZXJzZWQgKG9yIHByZXZpb3VzbHkgYXBwbGllZCkgcGF0Y2ggZGV0ZWN0ZWQiIGFuZCBleGl0cyAxLCBmYWlsaW5nIHRoZSBgY29udGFpbmVyLWltYWdlcy1rb2xsYS1wYXRjaC0yMDI1LjJgIGJ1aWxkLgoKVGhpcyBpcyB0aGUgc2FtZSBzaXR1YXRpb24gIzczNiBoYW5kbGVkIGZvciBwYXRjaGVzIDAwMDHigJMwMDAzLgoKIyMgV2h5IG5vdwoKYGNvbnRhaW5lci1pbWFnZXMta29sbGEtcGF0Y2gtMjAyNS4yYCBsYXN0IHBhc3NlZCBvbiAyMDI2LTA2LTA5IDExOjMwIGFuZCBmaXJzdCBmYWlsZWQgb24gMjAyNi0wNi0xMCAwNDozNSDigJQgdGhlIGZpcnN0IHJ1biBhZnRlciB0aGUgZml4IGxhbmRlZCB1cHN0cmVhbS4gUmVwcm9kdWNlZCBhZ2FpbnN0IHRoZSBleGFjdCBDSSB0YXJiYWxsIChga2V5c3RvbmUtMjguMC4yLmRldjE2YCk6Cgp8IFBhdGNoIHwgZHJ5LXJ1biBleGl0IHwgU3RhdHVzIHwKfC0tLS0tLS18LS0tLS0tLS0tLS0tLXwtLS0tLS0tLXwKfCBgMDAwNC1QcmVzZXJ2ZS1leHBpcmVzX2F04oCmYCAoQ1ZFLTIwMjYtNDQzOTQpIHwgMSB8IG1lcmdlZCB1cHN0cmVhbSDihpIgZHJvcHBlZCBoZXJlIHwKfCBgMDAwNS1QcmV2ZW50LVJCQUMtcG9saWN5LWJ5cGFzc+KApmAgKENWRS0yMDI2LTQyOTk5KSB8IDAgfCBub3QgeWV0IHVwc3RyZWFtIOKGkiBrZXB0IHwKClVwc3RyZWFtIGNoYW5nZTogaHR0cHM6Ly9yZXZpZXcub3BlbmRldi5vcmcvcS9JMGJiYjg1MjBlMTJjNTJlZGQwMWZiNDdjODczZjAyMjc4MTk3MDZmNQoKVGhpcyBicmVha3MgZXZlcnkgMjAyNS4yIGJ1aWxkIChuaWdodGx5IG1haW4gYW5kIGFsbCBvcGVuIFBScywgaW5jbHVkaW5nICM3MzUpLCBpbmRlcGVuZGVudCBvZiB0aG9zZSBQUnMnIG93biBjaGFuZ2VzLgoKIyMgU2NvcGUKClJlbW92ZXMgb25seSBwYXRjaCAwMDA0LiBQYXRjaCAwMDA1IGtlZXBzIGl0cyBudW1iZXJpbmcgKGFzIGluIGI3NjllYjEgLyAjNjQ4KS4KCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUp
      patchset: 43f4ac65ebd6936a927945062528a76fd79d525b
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/container-images-kolla:
            canonical_name: github.com/osism/container-images-kolla
            checkout: main
            commit: 824401131d408a778de803e4a35d12a3d966ca92
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
        playbooks:
        - path: untrusted/project_0/github.com/osism/container-images-kolla/playbooks/patch.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: 824401131d408a778de803e4a35d12a3d966ca92
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/737/head
      resources: {}
      tenant: osism
      timeout: 10800
      topic: null
      voting: true
