[ideaship]

Nothing has run contrib/mirror.py automatically since 2024 — the GitHub
workflow went in 855780e (2021-08-05), the Zuul play in 3c21cc5
(2024-03-05) — so the catalog can reference objects the object store cannot
serve, with no signal when that happens. Six versions are in that state right
now: almalinux-10, centos-stream-10, opensuse-leap-16.0, rocky-10,
ubuntu-26.04, ubuntu-26.04-minimal, all added by #1260 and all answering
403.

That gap has already cost time twice, in both cases diagnosed as something
else:

• update.py points to missing images on S3 mirror #1268
• Make Cirros mirrorable to the object store #1273

What this does

Commit
c39da07	Fixes a disk leak: mirror_version() extracted compressed sources into tmp/ and never removed what it extracted (9 of 39 in-scope versions are compressed)
8261b89	Extracts the mirror's scope predicate as iter_mirrorable(), so a checker cannot drift from the uploader
aeade6e	Adds contrib/check_mirror.py, a credential-free checker, plus the check-mirror tox env
13da934	Wires two credential-free Zuul jobs and lands three playbooks, two of them inert
4da8b42	Documents the lifecycle in README.md

The checker probes anonymously, because that is how the system actually
operates: main.py hands Glance a plain mirror_url with no credentials, and
nothing in mirror.py verifies an object after upload. A mirrored object must
satisfy two independent conditions — the non-following HEAD gate main.py
itself applies before importing (200/302 only), and a ranged GET
following redirects that ends in bytes actually read. Neither implies the
other: a 301 the manager refuses still serves bytes fine over GET, the
gardenlinux upstream URLs answer 302 so trusting the first status alone would
pass a redirect to a target that is gone, and with stream=True a status-only
check would call a zero-byte object healthy.

Gaps are reported in two classes — pending mirror (an upload is owed) and
unmirrorable (the pin must be bumped first) — and never as "missing": the
store answers 403 both for a key that was never uploaded and for one that
lost public read permission, and the fix differs.

Exit codes are the contract the jobs read: 0 clean, 1 unmirrorable, 2 no
verdict reached, 3 pending only. check-upstream tolerates 3, so a change
adding a version passes; periodic-daily does not.

What is deliberately NOT here

The encrypted secret and the credentialed upload job. Nobody currently holds
the object-store keys, and a placeholder !encrypted/pkcs1-oaep value is a
Zuul configuration syntax error for the whole project, not just for that
job. README.md carries the exact block to add — secret name, data keys and
binding deliberately identical to the job removed in 3c21cc5, so an earlier
runbook still applies — behind that warning.

Consequence, stated plainly: periodic-daily goes red on merge and stays
red until someone with the keys runs an upload. That is the designed signal,
not a defect. check stays green.

Things a reviewer may want to poke at

• files: on check-upstream is an anchored regex, '^etc/images/.*\.yml$',
  not a glob. Zuul treats files: as regular expressions, and
  etc/images/*.yml as a regex matches nothing here — the job would never run,
  silently. (The repo's pre-existing irrelevant-files: - etc/images/* works
  by accident, since etc/images plus zero-or-more slashes matches as a
  prefix.)
• The accepted-exit-code variable is set per job with no default in the
  playbook. Zuul passes job vars into the inventory as all-group variables
  and Ansible ranks play vars above those, so a default in the playbook would
  override both jobs and quietly make the daily check tolerant. An assert
  task fails a job that forgets it.
• The upload playbook keeps no_log: true on the credentialed task and asserts
  both secret keys are defined first, because no_log would otherwise censor
  Ansible's own "undefined variable" message on the first run of a job nobody
  has ever run.

Testing

tox -e test -- test/unit: 140 tests, and green at every commit in the
series (107 / 113 / 140 / 140 / 140), not just at the tip. flake8, black,
mypy, yamllint clean. The checker was also run against the live store: exit
3, listing exactly the six versions above.

The Zuul job definitions themselves were not executed — there is no local Zuul
— so those are review-by-reading.

Merge order

This conflicts textually with one open PR, which adds "cirros" to the inline
allow-list inside main() that 8261b89 replaces with a module-level
constant:

• Make Cirros mirrorable to the object store #1273

Whichever lands second moves that one line into MIRRORED_SHORTNAME_PREFIXES.
Landing this one first makes that a trivial one-line diff. This PR does not
unblock it — its integration test imports Cirros from a mirror_url whose
object does not exist, and only an actual upload fixes that (filed separately
as an integration-test design issue).