Skip to content

zuul: drop dead image-push post jobs and rename tox jobs#600

Merged
berendt merged 2 commits into
mainfrom
drop-dead-image-push-jobs
Jun 24, 2026
Merged

zuul: drop dead image-push post jobs and rename tox jobs#600
berendt merged 2 commits into
mainfrom
drop-dead-image-push-jobs

Conversation

@ideaship

Copy link
Copy Markdown
Contributor

Summary

Removes the two post-pipeline image-push jobs that have failed with
RETRY_LIMIT on every run since the 2025-09-24 cfg-generics
generics rename, and drops the now-stale cfg- prefix from the
surviving tox jobs.

Two separate commits, one logical change each.

zuul: drop dead image-push post jobs

Zuul encrypts each secret with the project's own RSA key.
SECRET_CFG_GENERICS was last encrypted against the key for project
osism/cfg-generics. After the repo was renamed, Zuul sees project
osism/generics (a different key) and can no longer decrypt the
secret. Both push jobs pass-to-parent that secret, so decryption
fails on the executor before any playbook runs; the failure is
retryable, so each attempt dies in ~1s with no logs and exhausts the
retries → RETRY_LIMIT.

The breakage went unnoticed for ~8 months because the jobs were
redundant even when green: the image Dockerfiles git checkout a fixed
tag pinned in osism/release, not generics main, so a post-on-main
rebuild bakes in the pinned tag rather than the triggering commit. The
real :latest refresh comes from the image repos' own post jobs and
their nightly periodic builds, which these jobs merely duplicated.

Removes the two job definitions, their post: entries, and the
now-unused SECRET_CFG_GENERICS secret.

zuul: rename cfg-generics-tox jobs to generics-tox

Pure rename dropping the stale cfg- prefix from the five tox jobs and
their references in the check and periodic-daily pipelines. No
external references to the old names exist in zuul-config/zuul-jobs.

Context

Root-cause triage:

Verification

  • .zuul.yaml parses and passes yamllint after each commit.
  • Confirmed nothing outside this file references the removed or renamed
    jobs (zuul-config, zuul-jobs, and this repo all checked).

🤖 Generated with Claude Code

ideaship added 2 commits June 24, 2026 08:11
The two post-pipeline jobs that rebuild and push the osism-ansible and
inventory-reconciler container images have failed with RETRY_LIMIT on
every run since 2025-09-24, when the GitHub repo was renamed
cfg-generics -> generics (#560).

Zuul encrypts each secret with the project's own RSA key. The secret
SECRET_CFG_GENERICS was last encrypted against the key for project
osism/cfg-generics. After the rename Zuul sees project osism/generics,
a different key, and can no longer decrypt the secret. Both jobs pass
it to their parent, so decryption fails on the executor before any
playbook runs; the failure is retryable, so each attempt dies in ~1s
with no logs and exhausts the retries.

The failure went unnoticed for ~8 months because the jobs were
redundant even when green: the image Dockerfiles git checkout a fixed
tag pinned in osism/release, not generics main, so a post-on-main
rebuild bakes in the pinned tag rather than the triggering commit. The
real :latest refresh comes from the image repos' own post jobs and
their nightly periodic builds, which these jobs merely duplicated.

Remove the two job definitions, their post: pipeline entries, and the
now-unused SECRET_CFG_GENERICS secret. Nothing else references the
secret. The surviving cfg-generics-tox-* jobs are unaffected.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
The cfg-generics-* job-name prefix is a leftover from before the
2025-09-24 GitHub repo rename cfg-generics -> generics (#560). Drop the
stale cfg- prefix from the five tox jobs and their references in the
check and periodic-daily pipelines so the names match the current
project name.

Pure rename: the jobs, their parents, and their vars are unchanged.
All references are local to this file; nothing in zuul-config or
zuul-jobs points at the old names.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Roger Luethi <luethi@osism.tech>
@ideaship ideaship marked this pull request as ready for review June 24, 2026 06:56
@berendt berendt merged commit 40cfe7a into main Jun 24, 2026
3 checks passed
@berendt berendt deleted the drop-dead-image-push-jobs branch June 24, 2026 07:34
@github-project-automation github-project-automation Bot moved this from Ready to Done in Human Board Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants