zuul: drop dead image-push post jobs and rename tox jobs#600
Merged
Conversation
The two post-pipeline jobs that rebuild and push the osism-ansible and inventory-reconciler container images have failed with RETRY_LIMIT on every run since 2025-09-24, when the GitHub repo was renamed cfg-generics -> generics (#560). Zuul encrypts each secret with the project's own RSA key. The secret SECRET_CFG_GENERICS was last encrypted against the key for project osism/cfg-generics. After the rename Zuul sees project osism/generics, a different key, and can no longer decrypt the secret. Both jobs pass it to their parent, so decryption fails on the executor before any playbook runs; the failure is retryable, so each attempt dies in ~1s with no logs and exhausts the retries. The failure went unnoticed for ~8 months because the jobs were redundant even when green: the image Dockerfiles git checkout a fixed tag pinned in osism/release, not generics main, so a post-on-main rebuild bakes in the pinned tag rather than the triggering commit. The real :latest refresh comes from the image repos' own post jobs and their nightly periodic builds, which these jobs merely duplicated. Remove the two job definitions, their post: pipeline entries, and the now-unused SECRET_CFG_GENERICS secret. Nothing else references the secret. The surviving cfg-generics-tox-* jobs are unaffected. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
The cfg-generics-* job-name prefix is a leftover from before the 2025-09-24 GitHub repo rename cfg-generics -> generics (#560). Drop the stale cfg- prefix from the five tox jobs and their references in the check and periodic-daily pipelines so the names match the current project name. Pure rename: the jobs, their parents, and their vars are unchanged. All references are local to this file; nothing in zuul-config or zuul-jobs points at the old names. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Roger Luethi <luethi@osism.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the two post-pipeline image-push jobs that have failed with
RETRY_LIMITon every run since the 2025-09-24cfg-generics→genericsrename, and drops the now-stalecfg-prefix from thesurviving tox jobs.
Two separate commits, one logical change each.
zuul: drop dead image-push post jobsZuul encrypts each secret with the project's own RSA key.
SECRET_CFG_GENERICSwas last encrypted against the key for projectosism/cfg-generics. After the repo was renamed, Zuul sees projectosism/generics(a different key) and can no longer decrypt thesecret. Both push jobs
pass-to-parentthat secret, so decryptionfails on the executor before any playbook runs; the failure is
retryable, so each attempt dies in ~1s with no logs and exhausts the
retries →
RETRY_LIMIT.The breakage went unnoticed for ~8 months because the jobs were
redundant even when green: the image Dockerfiles
git checkouta fixedtag pinned in
osism/release, not genericsmain, so a post-on-mainrebuild bakes in the pinned tag rather than the triggering commit. The
real
:latestrefresh comes from the image repos' own post jobs andtheir nightly periodic builds, which these jobs merely duplicated.
Removes the two job definitions, their
post:entries, and thenow-unused
SECRET_CFG_GENERICSsecret.zuul: rename cfg-generics-tox jobs to generics-toxPure rename dropping the stale
cfg-prefix from the five tox jobs andtheir references in the
checkandperiodic-dailypipelines. Noexternal references to the old names exist in
zuul-config/zuul-jobs.Context
Root-cause triage:
Verification
.zuul.yamlparses and passesyamllintafter each commit.jobs (
zuul-config,zuul-jobs, and this repo all checked).🤖 Generated with Claude Code