all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fea6:61fa
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 7cc02e50-165d-499e-8f90-f0910e45617c
        host_id: ec4f54fa666de9bc553bc59c41683f12345b665d0b1af00d715e7318
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fea6:61fa
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.115
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.59
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fea6:61fa
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-black explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#54>'
      - '<Job python-black explicit: None implied: None source: osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: fb680dc688d7465ea7abebce4f941d28
      build_refs:
      - branch: main
        change: '2124'
        change_message: "manager: stop update-manager masking failures\n\n## Problem\n\nThe
          `osism-update-manager` wrapper had no error handling: no `set -e` / `pipefail`,
          no per-step guards, and its final command was `popd > /dev/null`. Any failure
          \u2014 a venv build that fails when `python3-venv` is missing, a `pip`/`uv`
          install, an `ansible-galaxy` collection install, the `ansible-playbook`
          run itself, or `osism reconciler sync` \u2014 was swallowed and the script
          exited **0**. Callers gating on `rc != 0` (an `&&`-chain, a `set -e` script,
          or an orchestrator) saw the manager update as a success even though the
          playbook never ran.\n\nThe `CONTAINER=true` path had the same defect in
          a different form: a bare `docker run` followed by a hardcoded `exit 0`,
          discarding the container's exit code.\n\n## Fix\n\n- Add `set -euo pipefail`
          so the first failure of any step aborts instead of slipping past the trailing
          `popd`. This covers the unguarded venv/pip/uv/galaxy steps as well as the
          playbook calls \u2014 the observed repro was a venv-build failure, not a
          playbook failure, so guarding only the playbook calls would not have caught
          it.\n- Change the container path from `docker run \u2026; exit 0` to `exec
          docker run \u2026` so the container exit code propagates. This mirrors the
          error-handling intent of the sibling `run.sh` in `osism/generics`.\n- Add
          a molecule assertion that the rendered wrapper contains `set -euo pipefail`,
          so the masking cannot silently return.\n\n## Verification\n\n- `bash -n`
          on the rendered template: syntax valid.\n- `shellcheck`: only a pre-existing
          SC1090 on the `source <(sed \u2026)` line (not introduced here).\n\n## Notes\n\n-
          This also makes the `CONTAINER=true` path fail loudly on its missing vault/SSH
          wiring instead of reporting a false success. Fixing that wiring is a separate,
          larger change and is tracked separately.\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2124
        commit_id: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        patchset: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: 37a43c4e17a940a8a860d9bc973c4766
      buildset_refs:
      - branch: main
        change: '2124'
        change_message: "manager: stop update-manager masking failures\n\n## Problem\n\nThe
          `osism-update-manager` wrapper had no error handling: no `set -e` / `pipefail`,
          no per-step guards, and its final command was `popd > /dev/null`. Any failure
          \u2014 a venv build that fails when `python3-venv` is missing, a `pip`/`uv`
          install, an `ansible-galaxy` collection install, the `ansible-playbook`
          run itself, or `osism reconciler sync` \u2014 was swallowed and the script
          exited **0**. Callers gating on `rc != 0` (an `&&`-chain, a `set -e` script,
          or an orchestrator) saw the manager update as a success even though the
          playbook never ran.\n\nThe `CONTAINER=true` path had the same defect in
          a different form: a bare `docker run` followed by a hardcoded `exit 0`,
          discarding the container's exit code.\n\n## Fix\n\n- Add `set -euo pipefail`
          so the first failure of any step aborts instead of slipping past the trailing
          `popd`. This covers the unguarded venv/pip/uv/galaxy steps as well as the
          playbook calls \u2014 the observed repro was a venv-build failure, not a
          playbook failure, so guarding only the playbook calls would not have caught
          it.\n- Change the container path from `docker run \u2026; exit 0` to `exec
          docker run \u2026` so the container exit code propagates. This mirrors the
          error-handling intent of the sibling `run.sh` in `osism/generics`.\n- Add
          a molecule assertion that the rendered wrapper contains `set -euo pipefail`,
          so the masking cannot silently return.\n\n## Verification\n\n- `bash -n`
          on the rendered template: syntax valid.\n- `shellcheck`: only a pre-existing
          SC1090 on the `source <(sed \u2026)` line (not introduced here).\n\n## Notes\n\n-
          This also makes the `CONTAINER=true` path fail loudly on its missing vault/SSH
          wiring instead of reporting a false success. Fixing that wiring is a separate,
          larger change and is tracked separately.\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2124
        commit_id: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        patchset: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2124'
      change_message: "manager: stop update-manager masking failures\n\n## Problem\n\nThe
        `osism-update-manager` wrapper had no error handling: no `set -e` / `pipefail`,
        no per-step guards, and its final command was `popd > /dev/null`. Any failure
        \u2014 a venv build that fails when `python3-venv` is missing, a `pip`/`uv`
        install, an `ansible-galaxy` collection install, the `ansible-playbook` run
        itself, or `osism reconciler sync` \u2014 was swallowed and the script exited
        **0**. Callers gating on `rc != 0` (an `&&`-chain, a `set -e` script, or an
        orchestrator) saw the manager update as a success even though the playbook
        never ran.\n\nThe `CONTAINER=true` path had the same defect in a different
        form: a bare `docker run` followed by a hardcoded `exit 0`, discarding the
        container's exit code.\n\n## Fix\n\n- Add `set -euo pipefail` so the first
        failure of any step aborts instead of slipping past the trailing `popd`. This
        covers the unguarded venv/pip/uv/galaxy steps as well as the playbook calls
        \u2014 the observed repro was a venv-build failure, not a playbook failure,
        so guarding only the playbook calls would not have caught it.\n- Change the
        container path from `docker run \u2026; exit 0` to `exec docker run \u2026`
        so the container exit code propagates. This mirrors the error-handling intent
        of the sibling `run.sh` in `osism/generics`.\n- Add a molecule assertion that
        the rendered wrapper contains `set -euo pipefail`, so the masking cannot silently
        return.\n\n## Verification\n\n- `bash -n` on the rendered template: syntax
        valid.\n- `shellcheck`: only a pre-existing SC1090 on the `source <(sed \u2026)`
        line (not introduced here).\n\n## Notes\n\n- This also makes the `CONTAINER=true`
        path fail loudly on its missing vault/SSH wiring instead of reporting a false
        success. Fixing that wiring is a separate, larger change and is tracked separately.\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-collection-services/pull/2124
      child_jobs: []
      commit_id: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
      event_id: 56d58640-70bd-11f1-8f1f-b2257bfa0c6a
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/fb680dc688d7465ea7abebce4f941d28/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/fb680dc688d7465ea7abebce4f941d28/work/logs
        result_data_file: /var/lib/zuul/builds/fb680dc688d7465ea7abebce4f941d28/work/results.json
        src_root: /var/lib/zuul/builds/fb680dc688d7465ea7abebce4f941d28/work/src
        work_root: /var/lib/zuul/builds/fb680dc688d7465ea7abebce4f941d28/work
      include_vars: []
      items:
      - branch: main
        change: '2124'
        change_message: "manager: stop update-manager masking failures\n\n## Problem\n\nThe
          `osism-update-manager` wrapper had no error handling: no `set -e` / `pipefail`,
          no per-step guards, and its final command was `popd > /dev/null`. Any failure
          \u2014 a venv build that fails when `python3-venv` is missing, a `pip`/`uv`
          install, an `ansible-galaxy` collection install, the `ansible-playbook`
          run itself, or `osism reconciler sync` \u2014 was swallowed and the script
          exited **0**. Callers gating on `rc != 0` (an `&&`-chain, a `set -e` script,
          or an orchestrator) saw the manager update as a success even though the
          playbook never ran.\n\nThe `CONTAINER=true` path had the same defect in
          a different form: a bare `docker run` followed by a hardcoded `exit 0`,
          discarding the container's exit code.\n\n## Fix\n\n- Add `set -euo pipefail`
          so the first failure of any step aborts instead of slipping past the trailing
          `popd`. This covers the unguarded venv/pip/uv/galaxy steps as well as the
          playbook calls \u2014 the observed repro was a venv-build failure, not a
          playbook failure, so guarding only the playbook calls would not have caught
          it.\n- Change the container path from `docker run \u2026; exit 0` to `exec
          docker run \u2026` so the container exit code propagates. This mirrors the
          error-handling intent of the sibling `run.sh` in `osism/generics`.\n- Add
          a molecule assertion that the rendered wrapper contains `set -euo pipefail`,
          so the masking cannot silently return.\n\n## Verification\n\n- `bash -n`
          on the rendered template: syntax valid.\n- `shellcheck`: only a pre-existing
          SC1090 on the `source <(sed \u2026)` line (not introduced here).\n\n## Notes\n\n-
          This also makes the `CONTAINER=true` path fail loudly on its missing vault/SSH
          wiring instead of reporting a false success. Fixing that wiring is a separate,
          larger change and is tracked separately.\n\n\U0001F916 Generated with [Claude
          Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-services/pull/2124
        commit_id: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        patchset: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: python-black
      jobtags: []
      max_attempts: 3
      message: bWFuYWdlcjogc3RvcCB1cGRhdGUtbWFuYWdlciBtYXNraW5nIGZhaWx1cmVzCgojIyBQcm9ibGVtCgpUaGUgYG9zaXNtLXVwZGF0ZS1tYW5hZ2VyYCB3cmFwcGVyIGhhZCBubyBlcnJvciBoYW5kbGluZzogbm8gYHNldCAtZWAgLyBgcGlwZWZhaWxgLCBubyBwZXItc3RlcCBndWFyZHMsIGFuZCBpdHMgZmluYWwgY29tbWFuZCB3YXMgYHBvcGQgPiAvZGV2L251bGxgLiBBbnkgZmFpbHVyZSDigJQgYSB2ZW52IGJ1aWxkIHRoYXQgZmFpbHMgd2hlbiBgcHl0aG9uMy12ZW52YCBpcyBtaXNzaW5nLCBhIGBwaXBgL2B1dmAgaW5zdGFsbCwgYW4gYGFuc2libGUtZ2FsYXh5YCBjb2xsZWN0aW9uIGluc3RhbGwsIHRoZSBgYW5zaWJsZS1wbGF5Ym9va2AgcnVuIGl0c2VsZiwgb3IgYG9zaXNtIHJlY29uY2lsZXIgc3luY2Ag4oCUIHdhcyBzd2FsbG93ZWQgYW5kIHRoZSBzY3JpcHQgZXhpdGVkICoqMCoqLiBDYWxsZXJzIGdhdGluZyBvbiBgcmMgIT0gMGAgKGFuIGAmJmAtY2hhaW4sIGEgYHNldCAtZWAgc2NyaXB0LCBvciBhbiBvcmNoZXN0cmF0b3IpIHNhdyB0aGUgbWFuYWdlciB1cGRhdGUgYXMgYSBzdWNjZXNzIGV2ZW4gdGhvdWdoIHRoZSBwbGF5Ym9vayBuZXZlciByYW4uCgpUaGUgYENPTlRBSU5FUj10cnVlYCBwYXRoIGhhZCB0aGUgc2FtZSBkZWZlY3QgaW4gYSBkaWZmZXJlbnQgZm9ybTogYSBiYXJlIGBkb2NrZXIgcnVuYCBmb2xsb3dlZCBieSBhIGhhcmRjb2RlZCBgZXhpdCAwYCwgZGlzY2FyZGluZyB0aGUgY29udGFpbmVyJ3MgZXhpdCBjb2RlLgoKIyMgRml4CgotIEFkZCBgc2V0IC1ldW8gcGlwZWZhaWxgIHNvIHRoZSBmaXJzdCBmYWlsdXJlIG9mIGFueSBzdGVwIGFib3J0cyBpbnN0ZWFkIG9mIHNsaXBwaW5nIHBhc3QgdGhlIHRyYWlsaW5nIGBwb3BkYC4gVGhpcyBjb3ZlcnMgdGhlIHVuZ3VhcmRlZCB2ZW52L3BpcC91di9nYWxheHkgc3RlcHMgYXMgd2VsbCBhcyB0aGUgcGxheWJvb2sgY2FsbHMg4oCUIHRoZSBvYnNlcnZlZCByZXBybyB3YXMgYSB2ZW52LWJ1aWxkIGZhaWx1cmUsIG5vdCBhIHBsYXlib29rIGZhaWx1cmUsIHNvIGd1YXJkaW5nIG9ubHkgdGhlIHBsYXlib29rIGNhbGxzIHdvdWxkIG5vdCBoYXZlIGNhdWdodCBpdC4KLSBDaGFuZ2UgdGhlIGNvbnRhaW5lciBwYXRoIGZyb20gYGRvY2tlciBydW4g4oCmOyBleGl0IDBgIHRvIGBleGVjIGRvY2tlciBydW4g4oCmYCBzbyB0aGUgY29udGFpbmVyIGV4aXQgY29kZSBwcm9wYWdhdGVzLiBUaGlzIG1pcnJvcnMgdGhlIGVycm9yLWhhbmRsaW5nIGludGVudCBvZiB0aGUgc2libGluZyBgcnVuLnNoYCBpbiBgb3Npc20vZ2VuZXJpY3NgLgotIEFkZCBhIG1vbGVjdWxlIGFzc2VydGlvbiB0aGF0IHRoZSByZW5kZXJlZCB3cmFwcGVyIGNvbnRhaW5zIGBzZXQgLWV1byBwaXBlZmFpbGAsIHNvIHRoZSBtYXNraW5nIGNhbm5vdCBzaWxlbnRseSByZXR1cm4uCgojIyBWZXJpZmljYXRpb24KCi0gYGJhc2ggLW5gIG9uIHRoZSByZW5kZXJlZCB0ZW1wbGF0ZTogc3ludGF4IHZhbGlkLgotIGBzaGVsbGNoZWNrYDogb25seSBhIHByZS1leGlzdGluZyBTQzEwOTAgb24gdGhlIGBzb3VyY2UgPChzZWQg4oCmKWAgbGluZSAobm90IGludHJvZHVjZWQgaGVyZSkuCgojIyBOb3RlcwoKLSBUaGlzIGFsc28gbWFrZXMgdGhlIGBDT05UQUlORVI9dHJ1ZWAgcGF0aCBmYWlsIGxvdWRseSBvbiBpdHMgbWlzc2luZyB2YXVsdC9TU0ggd2lyaW5nIGluc3RlYWQgb2YgcmVwb3J0aW5nIGEgZmFsc2Ugc3VjY2Vzcy4gRml4aW5nIHRoYXQgd2lyaW5nIGlzIGEgc2VwYXJhdGUsIGxhcmdlciBjaGFuZ2UgYW5kIGlzIHRyYWNrZWQgc2VwYXJhdGVseS4KCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUp
      patchset: aedd6a6fd7d972b7a9b75db6cc8b36be46b90110
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/python-black/run.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: 48aec5f4d948d6757908660aa996894e55bce491
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2124/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
