From 2c244498c1419b076af83acd6903bad63dd53f7b Mon Sep 17 00:00:00 2001
From: Bartosz Bezak <bartosz@stackhpc.com>
Date: Mon, 23 Feb 2026 15:20:44 +0100
Subject: CI: use Tempest checkout in master jobs

Temporarily drop bcrypt from master upper-constraints in CI.

Keep tagged Tempest in upgrade jobs and stable branches

Change-Id: Iab349d3f5c3e104bf7ce8fefda29a46023766950
Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
---
 requirements.txt      |  2 +-
 tests/run-openbao.yml |  9 +++++++++
 tests/run.yml         | 26 ++++++++++++++++++++++++++
 zuul.d/base.yaml      |  1 +
 4 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 240eb3f26..32c6c8536 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 # Password hashing
-bcrypt>=4.3.0,<5 # Apache-2.0
+bcrypt>=4.3.0 # Apache-2.0
 
 # password generation
 cryptography>=2.1 # BSD/Apache-2.0
diff --git a/tests/run-openbao.yml b/tests/run-openbao.yml
index f8d2fe259..9b13fc34c 100644
--- a/tests/run-openbao.yml
+++ b/tests/run-openbao.yml
@@ -36,6 +36,15 @@
         cmd: "{{ 'python3.12' if ansible_facts.os_family == 'RedHat' else 'python3' }} -m venv {{ kolla_ansible_venv_path }}"
         creates: "{{ kolla_ansible_venv_path }}"
 
+    # TODO(bbezak): Drop this workaround once kolla-ansible supports bcrypt 5.
+    - name: Pin bcrypt to <5 in upper-constraints in CI
+      lineinfile:
+        path: "{{ upper_constraints_file }}"
+        regexp: '^bcrypt==='
+        line: 'bcrypt===4.3.0'
+        state: present
+      when: zuul.branch == 'master'
+
     - name: Ensure the latest tested pip
       pip:
         name: "pip==23.*"
diff --git a/tests/run.yml b/tests/run.yml
index 30899e760..57a3de61b 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -17,6 +17,7 @@
         ansible_collection_kolla_src_dir: "{{ ansible_env.PWD }}/src/{{ zuul.project.canonical_hostname }}/openstack/ansible-collection-kolla"
         kolla_ansible_src_dir: "{{ ansible_env.PWD }}/src/{{ zuul.project.canonical_hostname }}/openstack/kolla-ansible"
         kolla_ansible_local_src_dir: "{{ zuul.executor.work_root }}/src/{{ zuul.project.canonical_hostname }}/openstack/kolla-ansible"
+        tempest_src_dir: "{{ ansible_env.PWD }}/src/{{ zuul.project.canonical_hostname }}/openstack/tempest"
         infra_dockerhub_mirror: "http://{{ zuul_site_mirror_fqdn }}:8082/"
         need_build_image: "{{ kolla_build_images | default(false) }}"
         build_image_tag: "change_{{ zuul.change | default('none') }}"
@@ -253,6 +254,15 @@
         state: directory
       become: true
 
+    # TODO(bbezak): Drop this workaround once kolla-ansible supports bcrypt 5.
+    - name: Pin bcrypt to <5 in upper-constraints in CI
+      lineinfile:
+        path: "{{ upper_constraints_file }}"
+        regexp: '^bcrypt==='
+        line: 'bcrypt===4.3.0'
+        state: present
+      when: zuul.branch == 'master'
+
     - name: Create Kolla Ansible venv
       command:
         cmd: "{{ 'python3.12' if ansible_facts.os_family == 'RedHat' else 'python3' }} -m venv {{ kolla_ansible_venv_path }}"
@@ -416,6 +426,10 @@
 
         - import_role:
             name: kolla-ansible-tempest
+          vars:
+            kolla_ansible_tempest_packages:
+              - python-tempestconf
+              - "{{ tempest_src_dir if (zuul.branch == 'master' and not is_upgrade) else 'tempest' }}"
           when: openstack_core_tested
 
         - name: Run test-zun.sh script
@@ -610,6 +624,15 @@
               git log --pretty=oneline  -1
             chdir: "{{ ansible_env.HOME }}/src/opendev.org/openstack/requirements/"
 
+        # TODO(bbezak): Drop this workaround once kolla-ansible supports bcrypt 5.
+        - name: Pin bcrypt to <5 in upper-constraints in CI
+          lineinfile:
+            path: "{{ upper_constraints_file }}"
+            regexp: '^bcrypt==='
+            line: 'bcrypt===4.3.0'
+            state: present
+          when: zuul.branch == 'master'
+
         - name: Generate configuration files
           template:
             src: "{{ kolla_ansible_local_src_dir }}/{{ item.src }}"
@@ -706,6 +729,9 @@
             name: kolla-ansible-tempest
           vars:
             post_upgrade: true
+            kolla_ansible_tempest_packages:
+              - python-tempestconf
+              - "{{ tempest_src_dir if (zuul.branch == 'master' and not is_upgrade) else 'tempest' }}"
           when: openstack_core_tested
 
         - name: Run test-prometheus-opensearch.sh script (post-upgrade)
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 05bd823d6..a7ca7971b 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -10,6 +10,7 @@
       - openstack/ansible-collection-kolla
       - openstack/kolla
       - openstack/kolla-ansible
+      - openstack/tempest
       - openstack/requirements
     files:
       - ^ansible/site.yml
-- 
cgit v1.2.3