# Shared zuul config specific to the OpenStack Project
# Contains definitions of trusted jobs
# Overrides jobs from:
#    https://opendev.org/zuul/zuul-jobs

- job:
    name: publish-openstack-artifacts
    nodeset: ubuntu-focal
    description: |
      Publish job to upload artifacts to tarballs.openstack.org
    post-review: true
    post-run: playbooks/publish/openstack-artifacts.yaml
    secrets:
      - secret: afs_tarballs_opendev_org
        name: afs

- job:
    name: release-openstack-puppet
    parent: publish-openstack-artifacts
    description: |
      Sign and release puppet tarballs to tarballs.o.o.
    pre-run: playbooks/puppet-tarball/pre.yaml
    run: playbooks/puppet-tarball/run.yaml
    post-run:
      - playbooks/puppet-tarball/post.yaml
      - playbooks/publish/puppetforge.yaml
    secrets:
      - gpg_key
      - name: puppetforge
        secret: openstack_puppetforge_credentials

- job:
    name: release-openstack-python
    parent: publish-openstack-artifacts
    description: |
      Release python tarballs / wheels to pypi.
    pre-run: playbooks/pti-python-tarball/pre.yaml
    run: playbooks/pti-python-tarball/run.yaml
    post-run:
      - playbooks/pti-python-tarball/post.yaml
      - playbooks/publish/pypi.yaml
    secrets:
      - secret: pypi_secret
        name: pypi_info
      - gpg_key
    vars:
      release_python: python3

- job:
    name: test-release-openstack
    nodeset: ubuntu-focal
    parent: base
    description: |
      Test building python tarballs / wheels and the packaging metadata.
    pre-run: playbooks/pti-python-tarball/pre.yaml
    run: playbooks/pti-python-tarball/check.yaml
    vars:
      release_python: python3
    files:
      - setup.cfg
      - setup.py
      - README.rst

- job:
    name: publish-openstack-python-tarball
    parent: publish-openstack-artifacts
    description: |
      Release and sign OpenStack python tarballs to tarballs.o.o.
      It is similar to release-openstack-python but
      omits PyPI publication.
    pre-run: playbooks/pti-python-tarball/pre.yaml
    run: playbooks/pti-python-tarball/run.yaml
    post-run:
      - playbooks/pti-python-tarball/post.yaml
    secrets:
      - gpg_key
    vars:
      release_python: python3

- job:
    name: publish-openstack-sphinx-docs-base
    nodeset: ubuntu-xenial
    description: |
      Base job for publishing sphinx documentation to
      /afs/.openstack.org/docs/.

      This job is obsolete, use ``publish-openstack-tox-docs-base`` instead.
    abstract: true
    protected: true
    pre-run:
      - playbooks/sphinx/pre.yaml
    run: playbooks/sphinx/run.yaml
    post-run:
      - playbooks/publish/openstack-afs.yaml
    required-projects:
      - name: openstack/requirements
    roles:
      - zuul: zuul/zuul-jobs
      - zuul: openstack/openstack-zuul-jobs
    secrets:
      - secret: afsdocs_secret
        name: afs
    vars:
      constraints_file: '{{ ansible_user_dir }}/src/opendev.org/openstack/requirements/upper-constraints.txt'

- job:
    name: publish-openstack-sphinx-docs
    parent: publish-openstack-sphinx-docs-base
    description: |
      Publish the results of the build-openstack-sphinx-docs job to
      /afs/.openstack.org/docs/{{ zuul.project.short_name }}.

      Publishes depending on branch to latest/ (for master), or the
      basename of the branch like pike (for stable/pike).

      This is the publication job for ``build-openstack-sphinx-docs``.
      This job is obsolete and should not be used anymore since rocky,
      use ``promote-openstack-docs`` instead.

    final: true
    pre-run:
      # TODO(mordred) REMOVE THIS HACK
      - playbooks/sphinx/neutron-horizon-hack.yaml
    post-run:
      - playbooks/sphinx/post.yaml
    required-projects:
      # TODO(mordred) REMOVE THIS HACK ONCE neutron-horizon-hack is removed
      - name: openstack/neutron
      - name: openstack/horizon

- job:
    name: promote-openstack-tox-docs
    parent: opendev-promote-docs-base
    description: |
      Promote content from openstack-tox-docs job for projects that
      run tox using the docs environment following OpenStack PTI.

      Publish the results of the docs tox job to
      /afs/.openstack.org/docs/{{ zuul.project.short_name }}.

      Publishes depending on branch to latest/ (for master), or the
      basename of the branch like pike (for stable/pike).

      This is the promote job for ``openstack-tox-docs``.
    final: true
    vars:
      download_artifact_job: openstack-tox-docs
    secrets:
      - secret: afsdocs_secret-tox-docs
        name: afs
        pass-to-parent: true

- job:
    name: promote-openstack-tox-docs-direct
    parent: opendev-promote-docs-base
    description: |
      Promote content from openstack-tox-docs job for projects that
      run tox using the docs environment following OpenStack PTI.

      Publish the results of the docs tox job to
      /afs/.openstack.org/docs/{{ zuul.project.short_name }}.

      Publishing is done from master branch directly without using /latest.

      This is a promote job for ``openstack-tox-docs``.
    final: true
    branches: master
    vars:
      download_artifact_job: openstack-tox-docs
    secrets:
      - secret: afsdocs_secret-tox-docs-direct
        name: afs
        pass-to-parent: true

- job:
    name: promote-tox-docs-special-base
    parent: opendev-promote-docs-base
    description: |
      Promote content from openstack-tox-docs job for some projects
      that need a special location.

      Publish the results of the tox-docs job to
      /afs/.openstack.org/docs/{special_publish_directory}.

      This is a promote job for ``openstack-tox-docs``.

      A job needs to set the variable `special_publish_directory`.
    abstract: true
    protected: true
    vars:
      download_artifact_job: openstack-tox-docs
    secrets:
      - secret: afsdocs_secret-tox-docs-special
        name: afs
        pass-to-parent: true

- job:
    name: promote-openstack-contributor-guide
    parent: promote-tox-docs-special-base
    description: |
      Publish contributor-guide documents to
      https://docs.openstack.org/contributors
    final: true
    allowed-projects:
      - openstack/contributor-guide
    branches: master
    vars:
      special_publish_directory: "contributors"

# AFS sync issues happen when multiple publish jobs run at the same time
# so we make it synchronous to avoid job failures
- semaphore:
    name: publish-releasenotes
    max: 1

- job:
    name: publish-openstack-releasenotes-python3
    description: |
      Publish the results of build-openstack-releasenotes to
      /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
      Uses python3.
    # This job is final because its sets the afs_subpath
    # variable; it is not safe to let that be overridden in an
    # untrusted job because it would allow writing outside of the
    # project's directory on the production doc site.
    final: true
    pre-run: playbooks/releasenotes/pre.yaml
    run: playbooks/releasenotes/run.yaml
    post-run:
      - playbooks/publish/releasenotes.yaml
      - playbooks/publish/openstack-afs.yaml
    semaphores: publish-releasenotes
    override-branch: master
    # Building translated releasenotes can take long for large repositories
    timeout: 3600
    required-projects:
      - name: openstack/requirements
    roles:
      - zuul: openstack/openstack-zuul-jobs
      - zuul: zuul/zuul-jobs
    vars:
      sphinx_python: python3
      afs_subpath: "/releasenotes/{{ zuul.project.short_name }}"
      constraints_file: '{{ ansible_user_dir }}/src/opendev.org/openstack/requirements/upper-constraints.txt'
      sphinx_build_dir: releasenotes/build
    secrets:
      - secret: afsdocs_secret
        name: afs

- job:
    name: promote-openstack-releasenotes
    parent: opendev-promote-docs-base
    description: |
      Promote the results of build-openstack-releasenotes to
      /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
    final: true
    vars:
      download_artifact_job: build-openstack-releasenotes
    secrets:
      - secret: afsdocs_secret-releasenotes
        name: afs
        pass-to-parent: true
    # Same file list as for job build-reno-releasenotes that is
    # defined in zuul/zuul-jobs repo, file zuul.d/python-jobs.yaml.
    # Keep those lists in sync.
    files:
      - ^releasenotes/.*
      - bindep.txt
      - doc/requirements.txt
      - test-requirements.txt
      - tox.ini

- job:
    name: promote-openstack-specs-site
    parent: promote-tox-docs-site-base
    final: true
    description: |
      Publish OpenStack specs index.

      Publish specs index to
      /afs/.openstack.org/project/specs.openstack.org/

      This is a promote job for ``build-openstack-specs-site``.
    allowed-projects:
      - openstack/project-config
    vars:
      download_artifact_job: build-openstack-specs-site
      publish_site: "specs.openstack.org"

- job:
    name: promote-openstack-specs
    parent: promote-tox-docs-site-base
    final: true
    description: |
      Publish OpenStack specs project.

      Publish specs index to
      /afs/.openstack.org/project/specs.openstack.org/{zuul[project][name]}.

      This is a promote job for ``openstack-tox-docs``.
    vars:
      download_artifact_job: openstack-tox-docs
      publish_site: "specs.openstack.org/{zuul[project][name]}"

- job:
    name: promote-tox-docs-infra
    parent: opendev-promote-docs-base
    description: |
      Promote content from tox-docs job for Infra projects.

      Publish the results of the tox-docs job to
      /afs/.openstack.org/docs/infra/{{ zuul.project.short_name }}.

      This is a promote job for ``opendev-tox-docs``.
    final: true
    vars:
      download_artifact_job: opendev-tox-docs
    secrets:
      - secret: afsdocs_secret-tox-docs-infra
        name: afs
        pass-to-parent: true
    branches: master

- job:
    name: promote-service-types-authority
    parent: promote-tox-docs-site-base
    description: |
      Publish OpenStack Service Types Authority to
      /afs/.openstack.org/project/service-typs.openstack.org/.

      This is a promote job for ``service-types-authority-tox-publish``.
    final: true
    run: playbooks/service-types/promote.yaml
    allowed-projects:
      - openstack/service-types-authority
    vars:
      download_artifact_job: service-types-authority-tox-publish
      publish_site: "service-types.openstack.org"
    secrets:
      - secret: afsdocs_secret-tox-docs-site
        name: afs
        pass-to-parent: true

- job:
    name: promote-irc-meetings-ical
    parent: promote-tox-docs-site-base
    description: |
      Publish OpenDev Meetings site/ical to
      /afs/.openstack.org/project/meetings.opendev.org/.

      This is a promote job for ``irc-meetings-ical-tox-publish``.
    final: true
    run: playbooks/service-types/promote.yaml
    allowed-projects:
      - opendev/irc-meetings
    vars:
      download_artifact_job: irc-meetings-ical-tox-publish
      publish_site: "meetings.opendev.org"
    secrets:
      - secret: afsdocs_secret-tox-docs-site
        name: afs
        pass-to-parent: true

- job:
    name: promote-infra-index
    parent: promote-tox-docs-special-base
    description: |
      Promote infra index.html to
      https://docs.openstack.org/infra/
    allowed-projects:
      - openstack/project-config
    final: true
    branches: master
    vars:
      download_artifact_job: project-config-infra-docs-index
      special_publish_directory: "infra"

- job:
    name: publish-infra-publications-index
    description: |
      Publish the publication index
    final: true
    run: playbooks/publications-index/run.yaml
    post-run:
      - playbooks/publish/publications-index.yaml
      - playbooks/publish/openstack-afs.yaml
    # Index is always published from master
    override-branch: master
    allowed-projects:
      - opendev/publications
    roles:
      - zuul: zuul/zuul-jobs
      - zuul: openstack/openstack-zuul-jobs
    vars:
      afs_subpath: "/infra/publications/"
      tox_envlist: infra-docs
    secrets:
      - secret: afsdocs_secret
        name: afs

- job:
    name: publish-infra-publications
    description: |
      Publish one publication from opendev/publications
    final: true
    run: playbooks/publications/run.yaml
    post-run:
      - playbooks/publish/publications.yaml
      - playbooks/publish/openstack-afs.yaml
    allowed-projects:
      - opendev/publications
    roles:
      - zuul: zuul/zuul-jobs
      - zuul: openstack/openstack-zuul-jobs
    vars:
      afs_subpath: "/infra/publications/"
      tox_envlist: infra-docs
    secrets:
      - secret: afsdocs_secret
        name: afs

- job:
    name: publish-openstack-python-branch-tarball
    parent: publish-openstack-artifacts
    description: |
      Publish the results of the tox-tarball job to tarballs.openstack.org.
    pre-run: playbooks/pti-python-tarball/pre.yaml
    run: playbooks/pti-python-tarball/run.yaml
    post-run: playbooks/python-branch-tarball/post.yaml
    vars:
      release_python: python3

# AFS sync issues happen when multiple publish jobs run at the same time
# so we make it synchronous to avoid job failures
- semaphore:
    name: publish-release-docs
    max: 1

- job:
    name: publish-tox-docs-releases
    description: |
      Publish content of openstack/releases to
      /afs/.openstack.org/project/releases.openstack.org/.

      Builds the docs using ``tox -e docs``.
    final: true
    roles:
      - zuul: openstack/openstack-zuul-jobs
    pre-run: playbooks/project-config/pre-tox.yaml
    run: playbooks/project-config/run-tox.yaml
    post-run:
      - playbooks/project-config/post-tox.yaml
      - playbooks/sphinx/post-infra.yaml
      - playbooks/publish/releases-afs.yaml
    semaphores: publish-release-docs
    allowed-projects:
      - openstack/releases
    required-projects:
      - openstack/requirements
    secrets:
      - secret: afsdocs_secret
        name: afs
    vars:
      tox_envlist: docs
      afs_subpath: "/{{ zuul.project.short_name }}"

- job:
    name: promote-tox-docs-site-base
    parent: opendev-promote-docs-base
    description: |
      Promote content from openstack-tox-docs job for some projects
      that need a special location.

      Publish the results of the tox-docs job to
      /afs/.openstack.org/project/{publish_site}.

      This is a promote job for ``openstack-tox-docs``.

      A job needs to set the variables `publish_site`.
    abstract: true
    protected: true
    vars:
      download_artifact_job: openstack-tox-docs
    secrets:
      - secret: afsdocs_secret-tox-docs-site
        name: afs
        pass-to-parent: true

- job:
    name: promote-airship-docs-website
    parent: promote-tox-docs-site-base
    description: |
      Promote root site content for docs.airshipit.org to airshipit.org/docs.
    final: true
    allowed-projects:
      - airship/docs
    vars:
      publish_site: "airshipit.org/docs"

- job:
    name: promote-airship-project-docs
    parent: promote-tox-docs-site-base
    description: |
      Promote subproject doc content for docs.airshipit.org site.
    final: true
    allowed-projects:
      - airship/airshipctl
      - airship/airshipui
      - airship/armada
      - airship/charts
      - airship/deckhand
      - airship/divingbell
      - airship/drydock
      - airship/election
      - airship/governance
      - airship/pegleg
      - airship/porthole
      - airship/promenade
      - airship/shipyard
      - airship/specs
      - airship/spyglass
      - airship/spyglass-plugin-xls
      - airship/treasuremap
    vars:
      publish_site: "airshipit.org/docs/{zuul[project][short_name]}"

- job:
    name: promote-governance-election
    parent: promote-tox-docs-site-base
    description:
      Promote content to governance.openstack.org/election.
    final: true
    allowed-projects:
      - openstack/election
    vars:
      publish_site: "governance.openstack.org/election"

- job:
    name: promote-governance-ideas
    parent: promote-tox-docs-site-base
    description:
      Promote content to governance.openstack.org/ideas.
    final: true
    allowed-projects:
      - openstack/ideas
    vars:
      publish_site: "governance.openstack.org/ideas"

- job:
    name: promote-governance-sigs
    parent: promote-tox-docs-site-base
    description: |
      Promote content to governance.openstack.org/sigs.
    final: true
    allowed-projects:
      - openstack/governance-sigs
    vars:
      publish_site: "governance.openstack.org/sigs"

- job:
    name: promote-governance-tc
    parent: promote-tox-docs-site-base
    description: |
      Promote content to governance.openstack.org/sigs.
    final: true
    allowed-projects:
      - openstack/governance
    vars:
      publish_site: "governance.openstack.org/tc"

- job:
    name: promote-governance-website
    parent: promote-tox-docs-site-base
    description: |
      Promote content to governance.openstack.org.
    final: true
    allowed-projects:
      - openstack/governance-website
    vars:
      publish_site: "governance.openstack.org/governance"

- job:
    name: promote-security
    parent: promote-tox-docs-site-base
    description: |
      Promote content to security.openstack.org.
    final: true
    allowed-projects:
      - openstack/ossa
    vars:
      publish_site: "security.openstack.org"

- job:
    name: promote-openstack-manuals
    description: |
      Promote content fron build-openstack-manuals job and
      publishes it on docs.openstack.org website.
    parent: opendev-promote-docs-base
    final: true
    timeout: 2700
    allowed-projects:
      - openstack/openstack-manuals
      - openstack/security-doc
      - openstack/training-guides
    vars:
      write_root_marker: false
      download_artifact_job: build-tox-manuals-publishdocs
    secrets:
      - secret: afsdocs_secret-openstack-manuals
        name: afs
        pass-to-parent: true

- job:
    name: promote-openstack-manuals-lang
    description: |
      Promote content fron build-openstack-manuals-lang job and
      publishes it on docs.openstack.org website.
    parent: opendev-promote-docs-base
    final: true
    allowed-projects:
      - openstack/openstack-manuals
      - openstack/security-doc
      - openstack/training-guides
    vars:
      write_root_marker: false
      download_artifact_job: build-tox-manuals-publishlang
    secrets:
      - secret: afsdocs_secret-openstack-manuals
        name: afs
        pass-to-parent: true

- job:
    name: promote-openstack-manuals-developer
    description: |
      Promote content fron build-openstack-manuals job and
      publishes it on developer.openstack.org website.
    parent: opendev-promote-docs-base
    final: true
    allowed-projects:
      - openstack/api-site
    vars:
      write_root_marker: false
      download_artifact_job: build-tox-manuals-publishdocs
    secrets:
      - secret: afsdeveloper_secret-openstack-manuals
        name: afs
        pass-to-parent: true

- job:
    name: promote-api-guide
    parent: opendev-promote-docs-base
    description: |
      Publish api-guide document to
      https://docs.openstack.org/api-guide.

      This job is run in a promote pipeline to publish documents built
      in the gate pipeline.
    # We only publish the master branch, so no need to run
    # for changes on other branches.
    branches: master
    final: true
    run: playbooks/api-jobs/promote.yaml
    vars:
      api_path: api-guide
      download_artifact_job: build-openstack-api-guide
    roles:
      - zuul: zuul/zuul-jobs
      - zuul: openstack/openstack-zuul-jobs
    secrets:
      - secret: afsdocs_secret
        name: afs

- job:
    name: promote-api-ref
    parent: opendev-promote-docs-base
    description: |
      Publish api-ref document to
      https://docs.openstack.org/api-ref.

      This job is run in a promote pipeline to publish documents built
      in the gate pipeline.
    # We only publish the master branch, so no need to run
    # for changes on other branches.
    branches: master
    final: true
    run: playbooks/api-jobs/promote.yaml
    vars:
      api_path: api-ref
      download_artifact_job: build-openstack-api-ref
    roles:
      - zuul: zuul/zuul-jobs
      - zuul: openstack/openstack-zuul-jobs
    secrets:
      - secret: afsdocs_secret
        name: afs

- job:
    name: promote-deploy-guide
    parent: opendev-promote-docs-base
    description: |
      Promote content from build-openstack-deploy-guide.

      Publish the results of the build-openstack-deploy-guide job to
      /afs/.openstack.org/docs/deploy-guide/{{ zuul.project.short_name }}.

      Publishes depending on branch to latest/ (for master), or the
      basename of the branch like pike (for stable/pike).
    final: true
    vars:
      download_artifact_job: build-openstack-deploy-guide
    secrets:
      - secret: afsdocs_secret-deploy-guide
        name: afs
        pass-to-parent: true

- job:
    name: publish-openstack-javascript-content
    parent: publish-openstack-artifacts
    description: |
      Publish javascript content tarballs to tarballs.openstack.org.

      Content tarballs contain the built javascript/css/html artifacts. They
      are different from source tarballs, which are handled by the
      publish-openstack-javascript-tarball job.
    pre-run: playbooks/javascript/pre.yaml
    run: playbooks/javascript/content.yaml
    post-run: playbooks/javascript/publish.yaml
    vars:
      npm_command: build

- job:
    name: publish-openstack-stackviz-element
    parent: publish-openstack-artifacts
    description: |
      Publish javascript content tarballs to tarballs.opendev.org.

      Content tarballs contain the built javascript/css/html artifacts. They
      are different from source tarballs, which are handled by the
      publish-openstack-javascript-tarball job.

      This job publishes the tar ball as
      https://tarballs.opendev.org/{{ zuul.project.name }}/dist/{{ zuul.project.short_name }}-latest.tar.gz.
      This is specific to openstack/stackviz.
    allowed-projects:
      - openstack/stackviz
    pre-run: playbooks/javascript/pre.yaml
    run: playbooks/javascript/content.yaml
    post-run: playbooks/javascript/post-stackviz.yaml
    branches:
      - master
    vars:
      node_version: 10
      npm_command: prod

- job:
    name: release-openstack-javascript
    parent: publish-openstack-artifacts
    description: |
      Release javascript tarballs to npm.
    pre-run: playbooks/javascript/pre.yaml
    run: playbooks/javascript/tarball.yaml
    post-run: playbooks/javascript/release.yaml
    secrets:
      - npm_credentials
      - gpg_key

- job:
    name: openstack-upload-github-mirror
    parent: opendev-upload-git-mirror
    description: |
      Mirrors official projects to github's openstack org
    final: true
    protected: true
    secrets:
      - name: git_mirror_credentials
        secret: openstack-github-mirroring
        pass-to-parent: true

- job:
    name: maintain-github-openstack-mirror
    description: |
      Runs maintenance scripts for the OpenStack GitHub mirror. The script
      updates the descriptions, creates new repositories, archives retired
      ones, and closes any open PR. It is meant to be run periodically.
    final: true
    protected: true
    run: playbooks/maintain-github-mirror/run.yaml
    required-projects:
      - name: openstack/governance
    secrets:
      - name: github_credentials
        secret: openstack-github-mirroring
    vars:
      project_config: "{{ zuul.projects['opendev.org/openstack/project-config'].src_dir }}"
      governance: "{{ zuul.projects['opendev.org/openstack/governance'].src_dir }}"


- job:
    name: propose-updates
    pre-run: playbooks/proposal/pre.yaml
    description: |
      Sync content to other projects as a proposed change.
    run: playbooks/proposal/propose-updates.yaml
    protected: true
    # Note(frickler): The nodeset is pinned to Focal because we
    # require both python 3.8 and 3.9 to be available.  This is setup
    # in the pre.yaml playbook above; so if this nodeset changes we
    # need to carefully consider the python versions any change
    # distribution provides and modify the playbook/job accordingly.
    nodeset: ubuntu-focal
    secrets:
      - secret: proposal_ssh_key
        name: ssh_key

- job:
    name: propose-update-constraints
    parent: propose-updates
    description: |
      Update constraint files for requirements project with a
      proposed change.
    run: playbooks/proposal/propose-update-constraints.yaml
    protected: true
    dependencies:
      - release-openstack-python

- job:
    name: propose-project-config-update
    parent: propose-updates
    description: |
      Update project-config files with a proposed change.
    run: playbooks/proposal/propose-project-config-update.yaml
    protected: true

# The wheel builds can finish at similar times, so to avoid many
# overlapping "vos release" processes we restrict it with a semaphore.
- semaphore:
    name: wheel-release
    max: 1

- job:
    name: release-wheel-cache
    abstract: true
    protected: true
    description: |
        Release a wheel cache volume
    run:
      - name: playbooks/wheel/release.yaml
        semaphores: wheel-release
    nodeset:
      nodes: []
    secrets:
      - name: afs
        secret: afsadmin_keytab

- job:
    name: publish-wheel-cache-centos-8-stream
    description: |
      Publish CentOS Stream 8 wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-centos-8-stream
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-centos-8-stream
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.cent8sx64'

- job:
    name: publish-wheel-cache-centos-8-stream-arm64
    description: |
      Publish CentOS Stream 8 wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-centos-8-stream-arm64
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-centos-8-stream-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.cent8sa64'

- job:
    name: publish-wheel-cache-centos-9-stream
    description: |
      Publish CentOS Stream 9 wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-centos-9-stream
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-centos-9-stream
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.cent9sx64'

- job:
    name: publish-wheel-cache-centos-9-stream-arm64
    description: |
      Publish CentOS Stream 9 wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-centos-9-stream-arm64
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-centos-9-stream-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.cent9sa64'

- job:
    name: publish-wheel-cache-debian-bullseye
    description: |
      Publish Debian bullseye wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-debian-bullseye
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-debian-bullseye
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.deb11x64'

- job:
    name: publish-wheel-cache-debian-bullseye-arm64
    description: |
      Publish Debian bullseye wheels for OpenStack CI mirrors.
    parent: build-wheel-cache-debian-bullseye-arm64
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-debian-bullseye-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.deb11a64'

- job:
    name: publish-wheel-cache-ubuntu-jammy
    parent: build-wheel-cache-ubuntu-jammy
    description: |
      Publish Ubuntu Jammy wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-jammy
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.jammyx64'

- job:
    name: publish-wheel-cache-ubuntu-jammy-arm64
    parent: build-wheel-cache-ubuntu-jammy-arm64
    description: |
      Publish Ubuntu Jammy wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-jammy-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.jammya64'

- job:
    name: publish-wheel-cache-ubuntu-focal
    parent: build-wheel-cache-ubuntu-focal
    description: |
      Publish Ubuntu Focal wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-focal
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.focalx64'

- job:
    name: publish-wheel-cache-ubuntu-focal-arm64
    parent: build-wheel-cache-ubuntu-focal-arm64
    description: |
      Publish Ubuntu Focal wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-focal-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.focala64'

- job:
    name: publish-wheel-cache-ubuntu-bionic
    parent: build-wheel-cache-ubuntu-bionic
    description: |
      Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-bionic
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.bionicx64'

- job:
    name: publish-wheel-cache-ubuntu-bionic-arm64
    parent: build-wheel-cache-ubuntu-bionic-arm64
    description: |
      Publish Ubuntu Bionic wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-bionic-arm64
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.bionica64'

- job:
    name: publish-wheel-cache-ubuntu-xenial
    parent: build-wheel-cache-ubuntu-xenial
    description: |
      Publish Ubuntu Xenial wheels for OpenStack CI mirrors.
    pre-run: playbooks/openafs-client/setup.yaml
    post-run: playbooks/publish/wheel-mirror.yaml
    allowed-projects:
      - openstack/requirements
    final: true
    secrets:
      - name: afs
        secret: wheel_keytab

- job:
    name: release-wheel-cache-ubuntu-xenial
    parent: release-wheel-cache
    final: true
    vars:
      wheel_volume: 'mirror.wheel.xenialx64'

- job:
    name: check-release-approval
    description: |
      Checks that release requests were approved by PTL or release liaison.

      This job is specific to the openstack/releases repository.
    files:
      - ^deliverables/.*$
    allowed-projects:
      - openstack/releases
    required-projects:
      - name: openstack/governance
    run: playbooks/check-release-approval/run.yaml
    final: true
    timeout: 120
    nodeset:
      nodes: []

- job:
    name: tag-releases
    description: |
      Tag projects for a release.
    pre-run: playbooks/release/pre.yaml
    run: playbooks/release/tag.yaml
    post-run: playbooks/release/post.yaml
    final: true
    timeout: 7200
    secrets:
      - name: lp_creds
        secret: lp_creds
      - name: ssh_key
        secret: release_ssh_key
      - gpg_key


- job:
    name: trigger-readthedocs-webhook
    description: |
      Trigger readthedocs to rebuild documentation

      Note this job requires some external setup.

      #. add the ``openstackci`` user as an admin to your RTD project
      #. generate a webhook URL via the "Integrations" dashboard page
      #. provide the ``id`` from that URL in a ``rtd_webhook_id`` variable

      You probably do not want to use this job directly, but rather
      include the `docs-on-readthedocs template
      <https://docs.openstack.org/infra/openstack-zuul-jobs/project-templates.html#project_template-docs-on-readthedocs>`__

    run: playbooks/publish/trigger-rtd.yaml
    post-review: true
    final: true
    secrets:
      - rtd_credentials

- job:
    name: project-config-check-main-yaml
    description: |
      Check file zuul.d/main.yaml in project-config.
    pre-run: playbooks/check-main-yaml/pre.yaml
    run: playbooks/project-config/run-tox.yaml
    post-run: playbooks/check-main-yaml/post.yaml
    allowed-projects:
      - openstack/project-config
    final: true
    vars:
      tox_envlist: add-projects-to-main
    files:
      - zuul/main.yaml
      - gerrit/projects.yaml

# Limit number of translation jobs accessing translation server since
# Zanata has problems with too many concurrent accesses.
- semaphore:
    name: translations
    max: 10

- job:
    name: upstream-translation-update
    parent: propose-updates
    description: |
      Push strings for translation to translation server.
    roles:
      - zuul: openstack/openstack-zuul-jobs
    pre-run: playbooks/translation/pre.yaml
    run: playbooks/translation/upstream-translation-update.yaml
    post-run:
      - playbooks/translation/post.yaml
      - playbooks/translation/openstack-translation-artifacts.yaml
    semaphores: translations
    protected: true
    vars:
      constraints_file: '{{ ansible_user_dir }}/src/opendev.org/openstack/requirements/upper-constraints.txt'
    required-projects:
      - openstack/horizon
      - openstack/requirements
    # Zanata-cli needs Java 8 and will fail with newer Java, Bionic has Java 8
    # This was tested with Zanata up to version 4.6.2 (current release in March 2019).
    nodeset: ubuntu-bionic
    secrets:
      - zanata_api_credentials
      - secret: afs_tarballs_opendev_org
        name: afs

- job:
    name: propose-translation-update
    parent: propose-updates
    description: |
      Import translations from translation server to projects as
      proposed change.
    roles:
      - zuul: openstack/openstack-zuul-jobs
    pre-run: playbooks/translation/pre.yaml
    run: playbooks/translation/propose-translation-update.yaml
    post-run: playbooks/translation/post.yaml
    vars:
      constraints_file: '{{ ansible_user_dir }}/src/opendev.org/openstack/requirements/upper-constraints.txt'
    semaphores: translations
    protected: true
    required-projects:
      - openstack/horizon
      - openstack/requirements
    # Zanata-cli needs Java 8 and will fail with newer Java, Bionic has Java 8.
    # This was tested with Zanata up to version 4.6.2 (current release in March 2019).
    nodeset: ubuntu-bionic
    secrets:
      - zanata_api_credentials

- job:
    name: project-config-bindep-fallback
    abstract: true
    description: |
      Check installation of binary packages for file
      nodepool/elements/bindep-fallback.txt.
    run: playbooks/bindep-fallback/run.yaml
    files:
      - nodepool/elements/bindep-fallback.txt
      - playbooks/bindep-fallback/run.yaml

- job:
    name: project-config-bindep-fallback-ubuntu-xenial
    parent: project-config-bindep-fallback
    description: |
      Check installation of binary packages for file
      nodepool/elements/bindep-fallback.txt.

      The testing is done for Ubuntu Xenial.
    nodeset: ubuntu-xenial

- job:
    name: openstack-fips
    abstract: true
    description: |
      Base job for OpenStack jobs that enables an
      Ubuntu Advantage subscription if FIPS is enabled.
    secrets:
      - secret: openstack_ubuntu_fips
        name: ubuntu_ua_token
    pre-run: playbooks/openstack-fips/pre.yaml