Chore: Update Sonar OpenJDK version
[releng/global-jjb.git] / jjb / lf-ci-jobs.yaml
index 881f7ce..0bfacdf 100644 (file)
@@ -1,5 +1,4 @@
 ---
-
 ####################
 # COMMON FUNCTIONS #
 ####################
       - config-file-provider:
           files:
             - file-id: jjbini
-              target: '$HOME/.config/jenkins_jobs/jenkins_jobs.ini'
-
-- builder:
-    name: lf-infra-jjbini-sandbox
-    # TODO: Consolidate this into jjbini when JJB2.0 is available.
-    builders:
-      - config-file-provider:
-          files:
-            - file-id: jjbini-sandbox
-              target: '$HOME/.config/jenkins_jobs/jenkins_jobs.ini'
+              target: "$HOME/.config/jenkins_jobs/jenkins_jobs.ini"
 
-- lf_packer: &lf_packer_common
-    name: lf-packer-common
+- _lf_packer_common: &lf_packer_common
+    name: lf_packer_common
     # Provide configuration common in packer jobs.
 
     ######################
 
     branch: master
     build-timeout: 90
-    cron: '@monthly'
+    cron: "@monthly"
     disable-job: false
-    github-url: 'https://github.com'
+    github-url: "https://github.com"
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
+    submodule-disable: false
+    packer-builder: openstack
     packer-cloud-settings: packer-cloud-env
-    packer-version: 1.2.5
+    packer-version: 1.9.1
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
-    disabled: '{disable-job}'
+    node: "{build-node}"
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
       - lf-packer-parameters:
-          packer-version: '{packer-version}'
+          packer-version: "{packer-version}"
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     publishers:
       - lf-infra-publish
     parameters:
       - string:
           name: JJB_VERSION
-          default: '{jjb-version}'
+          default: "{jjb-version}"
           description: Jenkins Job Builder version to download and install.
       - string:
           name: XDG_CACHE_HOME
-          default: '{jjb-cache}'
+          default: "{jjb-cache}"
           description: Jenkins Job Builder cache location.
 
 - parameter:
@@ -86,7 +78,7 @@
     parameters:
       - string:
           name: PACKER_VERSION
-          default: '{packer-version}'
+          default: "{packer-version}"
           description: Packer version to download and install.
 
 - parameter:
     parameters:
       - string:
           name: PUPPET_LINT_VERSION
-          default: '{puppet-lint-version}'
+          default: "{puppet-lint-version}"
           description: Puppet-lint version to download and install.
 
-- lf_jjb_common: &lf_jjb_common
+- _lf_jjb_common: &lf_jjb_common
     name: lf-jjb-common
 
     ######################
     branch: master
     build-timeout: 10
     disable-job: false
-    github-url: 'https://github.com'
-    jjb-cache: '$HOME/.cache/jenkins_jobs'
-    jjb-version: 2.8.0
+    github-url: "https://github.com"
+    jjb-cache: "$HOME/.cache/jenkins_jobs"
+    jjb-version: 5.0.4
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
+    submodule-disable: false
     throttle_categories: []
     throttle-enabled: false
     throttle-max-per-node: 1
     throttle-max-total: 0
-    throttle-option: 'project'
+    throttle-option: "project"
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
-        pattern: 'jjb/.*'
+        pattern: "jjb/.*"
       - compare-type: REG_EXP
-        pattern: 'global-jjb'
+        pattern: "global-jjb"
       - compare-type: REG_EXP
-        pattern: 'shell/.*'
+        pattern: "shell/.*"
 
     # github_included_regions MUST match gerrit_trigger_file_paths
     github_included_regions:
-      - 'jjb/.*'
-      - 'global-jjb'
-      - 'shell/.*'
+      - "jjb/.*"
+      - "global-jjb"
+      - "shell/.*"
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
-    disabled: '{disable-job}'
+    node: "{build-node}"
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - throttle:
-          categories: '{obj:throttle_categories}'
-          enabled: '{throttle-enabled}'
-          max-per-node: '{throttle-max-per-node}'
-          max-total: '{throttle-max-total}'
-          option: '{throttle-option}'
+          categories: "{obj:throttle_categories}"
+          enabled: "{throttle-enabled}"
+          max-per-node: "{throttle-max-per-node}"
+          max-total: "{throttle-max-total}"
+          option: "{throttle-option}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
       - lf-infra-jjb-parameters:
-          jjb-cache: '{jjb-cache}'
-          jjb-version: '{jjb-version}'
+          jjb-cache: "{jjb-cache}"
+          jjb-version: "{jjb-version}"
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     publishers:
       - lf-infra-publish
 ######################
 
 - job-template:
-    name: '{project-name}-gerrit-branch-lock-{stream}'
+    name: "{project-name}-gerrit-branch-lock"
     id: gerrit-branch-lock
 
     ######################
     # Default parameters #
     ######################
 
-    branch: master
+    branch: "**"
     disable-job: false
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
-    stream: master
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
     submodule-timeout: 10
+    submodule-disable: true
     gerrit_merge_triggers:
       - comment-added-contains-event:
           comment-contains-value: (un)?lock branch$
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
-    disabled: '{disable-job}'
+    node: "{build-node}"
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: ""
+          branch: "{branch}"
 
     wrappers:
       - lf-infra-wrappers:
           build-timeout: 5
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: ''
-          branch: '{branch}'
+          git-url: "{git-url}"
+          refspec: ""
+          branch: "$GERRIT_BRANCH"
           submodule-recursive: false
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "**"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
+          comment-text-parameter-mode: PLAIN
 
     builders:
       - shell: !include-raw-escape: ../shell/gerrit-branch-lock.sh
 
-
     publishers:
       - lf-infra-publish
 
     builders:
       - lf-infra-jjbini
       - inject:
-          properties-content: 'jenkins_silos={jenkins-silos}'
+          properties-content: "jenkins_silos={jenkins-silos}"
       - shell: !include-raw-escape: ../shell/jenkins-configure-clouds.sh
       - shell: rm -f "$HOME/.config/jenkins_jobs/jenkins_jobs.ini"
 
     builders:
       - lf-infra-jjbini
       - inject:
-          properties-content: 'jenkins_silos={jenkins-silos}'
+          properties-content: "jenkins_silos={jenkins-silos}"
       - shell: !include-raw-escape: ../shell/jenkins-configure-global-vars.sh
       - shell: rm -f "$HOME/.config/jenkins_jobs/jenkins_jobs.ini"
 
-- lf_jenkins_configuration: &lf_jenkins_cfg_merge
+- _lf_jenkins_configuration: &lf_jenkins_cfg_merge
     name: lf-jenkins-cfg-merge
 
     ######################
     ######################
 
     branch: master
-    cron: '@daily'
+    cron: "@daily"
     disable-job: false
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
-    github-url: 'https://github.com'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
+    github-url: "https://github.com"
     jenkins-silos: production sandbox
     submodule-timeout: 10
+    submodule-disable: false
 
     gerrit_merge_triggers:
       - change-merged-event
       - comment-added-contains-event:
-          comment-contains-value: remerge$
+          comment-contains-value: '^Patch Set\s+\d+:\s+remerge\s*$'
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: false
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: ''
+          project: "{project}"
+          stream: ""
           branch: master
 
     wrappers:
       - lf-infra-wrappers:
           build-timeout: 10
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     builders:
       - lf-infra-pre-build
       - lf-jenkins-cfg-global-vars:
-          jenkins-silos: '{jenkins-silos}'
+          jenkins-silos: "{jenkins-silos}"
       - lf-jenkins-cfg-clouds:
-          jenkins-silos: '{jenkins-silos}'
+          jenkins-silos: "{jenkins-silos}"
 
     publishers:
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-jenkins-cfg-merge'
+    name: "{project-name}-jenkins-cfg-merge"
     id: gerrit-jenkins-cfg-merge
     <<: *lf_jenkins_cfg_merge
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: 'refs/heads/{branch}'
-          branch: '{branch}'
+          git-url: "{git-url}"
+          refspec: "refs/heads/{branch}"
+          branch: "{branch}"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-jenkins-cfg-merge'
+    name: "{project-name}-jenkins-cfg-merge"
     id: github-jenkins-cfg-merge
     <<: *lf_jenkins_cfg_merge
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github
       - pollscm:
-          cron: ''
+          cron: ""
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'Jenkins CFG Merge'
+          status-context: "Jenkins CFG Merge"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
-          included-regions: '{obj:github_included_regions}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ###########################################
 # Jenkins Configuration Management Verify #
 ###########################################
 
-- lf_jenkins_configuration: &lf_jenkins_cfg_verify
+- _lf_jenkins_configuration: &lf_jenkins_cfg_verify
     name: lf-jenkins-cfg-verify
 
     ######################
     branch: master
     build-days-to-keep: 7
     disable-job: false
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
-    github-url: 'https://github.com'
-    openstack-cloud: vex
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
+    github-url: "https://github.com"
     submodule-timeout: 10
+    submodule-disable: false
 
     gerrit_verify_triggers:
       - patchset-created-event:
           exclude-no-code-change: false
       - draft-published-event
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: ''
+          project: "{project}"
+          stream: ""
           branch: master
 
     wrappers:
       - lf-infra-wrappers:
           build-timeout: 10
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
       - config-file-provider:
           # Listed after to override openstack-infra-wrappers clouds.yaml
           # definition
           files:
             - file-id: clouds-yaml
-              target: '$HOME/.config/openstack/clouds.yaml'
+              target: "$HOME/.config/openstack/clouds.yaml"
             - file-id: npmrc
-              target: '$HOME/.npmrc'
+              target: "$HOME/.npmrc"
             - file-id: pipconf
-              target: '$HOME/.config/pip/pip.conf'
+              target: "$HOME/.config/pip/pip.conf"
 
     builders:
       - lf-infra-pre-build
-      - inject:
-          properties-content: OS_CLOUD={openstack-cloud}
       - shell: !include-raw-escape: ../shell/jenkins-verify-images.sh
 
     publishers:
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-jenkins-cfg-verify'
+    name: "{project-name}-jenkins-cfg-verify"
     id: gerrit-jenkins-cfg-verify
     <<: *lf_jenkins_cfg_verify
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-jenkins-cfg-verify'
+    name: "{project-name}-jenkins-cfg-verify"
     id: github-jenkins-cfg-verify
     <<: *lf_jenkins_cfg_verify
 
     properties:
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'Jenkins CFG Verify'
+          status-context: "Jenkins CFG Verify"
           permit-all: true
           github-hooks: true
-          included-regions: '{obj:github_included_regions}'
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ###########################
 # JENKINS SANDBOX CLEANUP #
 ###########################
 
-- lf_jenkins_sandbox_cleanup: &lf_jenkins_sandbox_cleanup
+- _lf_jenkins_sandbox_cleanup: &lf_jenkins_sandbox_cleanup
     name: lf-jenkins-sandbox-cleanup
 
     ######################
 
     build-timeout: 30
     # Run every Saturday at 08:00 UTC
-    cron: '0 8 * * 6'
+    cron: "0 8 * * 6"
     disable-job: false
 
     #####################
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     parameters:
       - lf-infra-jjb-parameters:
-          jjb-cache: '{jjb-cache}'
-          jjb-version: '{jjb-version}'
+          jjb-cache: "{jjb-cache}"
+          jjb-version: "{jjb-version}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
 
     builders:
       - lf-infra-jjbini
       - shell: !include-raw-escape:
-          - ../shell/jjb-install.sh
           - ../shell/jenkins-sandbox-cleanup.sh
-          - ../shell/jjb-cleanup.sh
 
 - job-template:
-    name: '{project-name}-jenkins-sandbox-cleanup'
+    name: "{project-name}-jenkins-sandbox-cleanup"
     id: gerrit-jenkins-sandbox-cleanup
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_jenkins_sandbox_cleanup
 
 - job-template:
-    name: '{project-name}-jenkins-sandbox-cleanup'
+    name: "{project-name}-jenkins-sandbox-cleanup"
     id: github-jenkins-sandbox-cleanup
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_jenkins_sandbox_cleanup
 
-
 ##################
 # JJB DEPLOY JOB #
 ##################
 
-- lf_jjb_deploy_job: &lf_jjb_deploy_job
+- _lf_jjb_deploy_job: &lf_jjb_deploy_job
     name: lf-jjb-deploy-job
 
     ######################
     disable-job: false
     # jjb-deploy should always clone $PROJECT regardless of what
     # $GERRIT_PROJECT triggered the job.
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
     stream: master
     submodule-timeout: 10
+    submodule-disable: false
     gerrit_jjb_deploy_job_triggers:
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(jjb-deploy[:]* (?!\*+$).+$)'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(jjb-deploy[:]* (?!\*+$).+$)'
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
+      - lf-infra-jjb-parameters:
+          jjb-cache: "{jjb-cache}"
+          jjb-version: "{jjb-version}"
 
     wrappers:
       - lf-infra-wrappers:
           build-timeout: 5
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     builders:
-      - lf-pip-install:
-          pip-packages: jenkins-job-builder
-      - lf-infra-jjbini-sandbox
+      - lf-infra-jjbini
       - shell: !include-raw-escape: ../shell/jjb-deploy-job.sh
 
     publishers:
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-jjb-deploy-job'
+    name: "{project-name}-jjb-deploy-job"
     id: gerrit-jjb-deploy-job
+    <<: *lf_jjb_common
+    # yamllint disable-line rule:key-duplicates
     <<: *lf_jjb_deploy_job
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: 'refs/heads/{branch}'
-          branch: '{branch}'
+          git-url: "{git-url}"
+          refspec: "refs/heads/{branch}"
+          branch: "{branch}"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_jjb_deploy_job_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_jjb_deploy_job_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '**'
+              project-pattern: "**"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**'
+                  branch-pattern: "**"
           skip-vote:
-            success: true
+            successful: true
             failed: true
             unstable: true
             notbuilt: true
+          comment-text-parameter-mode: PLAIN
 
 - job-template:
-    name: '{project-name}-jjb-deploy-job'
+    name: "{project-name}-jjb-deploy-job"
     id: github-jjb-deploy-job
+    <<: *lf_jjb_common
+    # yamllint disable-line rule:key-duplicates
     <<: *lf_jjb_deploy_job
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 1
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
           trigger-phrase: '^jjb-deploy (?!\*+$).+$'
           only-trigger-phrase: true
-          status-context: 'JJB Deploy Job'
+          status-context: "JJB Deploy Job"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 #############
 # JJB Merge #
 #############
 
-- lf_jjb_merge: &lf_jjb_merge
+- _lf_jjb_merge: &lf_jjb_merge
     name: lf-jjb-merge
 
     ######################
     gerrit_merge_triggers:
       - change-merged-event
       - comment-added-contains-event:
-          comment-contains-value: remerge$
+          comment-contains-value: '^Patch Set\s+\d+:\s+remerge\s*$'
 
     #####################
     # Job Configuration #
       - inject:
           properties-content: JJB_WORKERS={jjb-workers}
       - shell: !include-raw-escape:
-          - ../shell/jjb-install.sh
           - ../shell/jjb-merge-job.sh
-          - ../shell/jjb-cleanup.sh
 
 - job-template:
-    name: '{project-name}-jjb-merge'
+    name: "{project-name}-jjb-merge"
     id: gerrit-jjb-merge
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_jjb_merge
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: ''
-          branch: '{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          git-url: "{git-url}"
+          refspec: ""
+          branch: "{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-jjb-merge'
+    name: "{project-name}-jjb-merge"
     id: github-jjb-merge
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github
       - pollscm:
-          cron: ''
+          cron: ""
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'JJB Merge'
+          status-context: "JJB Merge"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
-          included-regions: '{obj:github_included_regions}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ##############
 # JJB Verify #
 ##############
 
-- lf_jjb_verify: &lf_jjb_verify
+- _lf_jjb_verify: &lf_jjb_verify
     name: lf-jjb-verify
 
     ######################
     ######################
 
     build-concurrent: true
+    build-node-label-check: false
+    build-node-label-list: ""
 
     gerrit_verify_triggers:
       - patchset-created-event:
           exclude-no-code-change: false
       - draft-published-event
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
 
     #####################
     # Job Configuration #
     #####################
 
-    concurrent: '{build-concurrent}'
+    concurrent: "{build-concurrent}"
 
     builders:
       - lf-infra-pre-build
       - lf-infra-jjbini
       - shell: !include-raw-escape:
-          - ../shell/git-validate-jira-urls.sh
-          - ../shell/jjb-install.sh
           - ../shell/jjb-verify-job.sh
-          - ../shell/jjb-check-unicode.sh
-          - ../shell/jjb-cleanup.sh
+      - conditional-step:
+          condition-kind: boolean-expression
+          condition-expression: "{build-node-label-check}"
+          on-evaluation-failure: dont-run
+          steps:
+            - inject:
+                properties-content: EXTERNAL_LABELS="{build-node-label-list}"
+            - shell: !include-raw-escape:
+                - ../shell/jjb-verify-build-nodes.sh
       - lf-infra-gpg-verify-git-signature
 
 - job-template:
-    name: '{project-name}-jjb-verify'
+    name: "{project-name}-jjb-verify"
     id: gerrit-jjb-verify
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     # Default parameters #
     ######################
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     #####################
     # Job Configuration #
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-jjb-verify'
+    name: "{project-name}-jjb-verify"
     id: github-jjb-verify
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'JJB Verify'
+          status-context: "JJB Verify"
           permit-all: true
           github-hooks: true
-          included-regions: '{obj:github_included_regions}'
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ############################
 # JJB Verify Upstream GJJB #
 ############################
 
-- lf_jjb_verify: &lf_jjb_verify_upstream_gjjb
+- _lf_jjb_verify: &lf_jjb_verify_upstream_gjjb
     name: lf-jjb-verify-upstream-gjjb
 
     #####################
           git cherry-pick FETCH_HEAD
       - lf-infra-jjbini
       - shell: !include-raw-escape:
-          - ../shell/git-validate-jira-urls.sh
-          - ../shell/jjb-install.sh
           - ../shell/jjb-verify-job.sh
-          - ../shell/jjb-check-unicode.sh
-          - ../shell/jjb-cleanup.sh
-      - lf-infra-gpg-verify-git-signature
+
+    # All jobs are triggering from the same source
+    triggers:
+      - gerrit:
+          server-name: "lf-releng"
+          trigger-on:
+            - patchset-created-event:
+                exclude-drafts: true
+                exclude-trivial-rebase: false
+                exclude-no-code-change: false
+            - draft-published-event
+            - comment-added-contains-event:
+                comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
+          projects:
+            - project-compare-type: ANT
+              project-pattern: "releng/global-jjb"
+              branches:
+                - branch-compare-type: ANT
+                  branch-pattern: "**/master"
+          override-votes: true
+          gerrit-build-failed-codereview-value: -1
+          gerrit-build-failed-verified-value: 0
+          gerrit-build-successful-codereview-value: 1
+          gerrit-build-successful-verified-value: 0
 
 - job-template:
-    name: '{project-name}-jjb-verify-upstream-gjjb'
+    name: "{project-name}-jjb-verify-upstream-gjjb"
     id: gerrit-jjb-verify-upstream-gjjb
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     # Default parameters #
     ######################
 
-    git-url: '$GIT_URL/$PROJECT'
+    git-url: "$GIT_URL/$PROJECT"
     submodule-timeout: 10
+    submodule-disable: false
 
     #####################
     # Job Configuration #
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: ''
-          branch: 'master'
+          git-url: "{git-url}"
+          refspec: ""
+          branch: "master"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
-    triggers:
-      - gerrit:
-          server-name: 'LinuxFoundation'
-          trigger-on:
-            - patchset-created-event:
-                exclude-drafts: true
-                exclude-trivial-rebase: false
-                exclude-no-code-change: false
-            - draft-published-event
-            - comment-added-contains-event:
-                comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
-          projects:
-            - project-compare-type: ANT
-              project-pattern: 'releng/global-jjb'
-              branches:
-                - branch-compare-type: ANT
-                  branch-pattern: '**/master'
-          override-votes: true
-          gerrit-build-failed-codereview-value: -1
-          gerrit-build-failed-verified-value: 0
-          gerrit-build-successful-codereview-value: 1
-          gerrit-build-successful-verified-value: 0
+- job-template:
+    name: "{project-name}-jjb-verify-upstream-gjjb"
+    id: github-jjb-verify-upstream-gjjb
+    <<: *lf_jjb_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_jjb_verify_upstream_gjjb
+
+    ######################
+    # Default parameters #
+    ######################
+
+    git-url: "$GIT_URL/$PROJECT"
+    submodule-timeout: 10
+    submodule-disable: false
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    properties:
+      - lf-infra-properties:
+          project: "{project}"
+          build-days-to-keep: 7
+      - github:
+          url: "{github-url}/{github-org}/{project}"
+
+    scm:
+      - lf-infra-github-scm:
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
 #################
 # License Check #
 #################
 
-- lf_license_check: &lf_license_check
+- _lf_license_check: &lf_license_check
     name: lf-license-check
 
     ######################
     build-timeout: 15
     disable-job: false
     file-patterns: >
-        *.go
-        *.groovy
-        *.java
-        *.py
-        *.sh
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
+      *.go
+      *.groovy
+      *.java
+      *.py
+      *.sh
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
     lhc-version: 0.2.0
-    license-exclude-paths: ''
+    license-exclude-paths: ""
     licenses-allowed: Apache-2.0,EPL-1.0,MIT
-    project-pattern: '**'
+    project-pattern: "**"
     spdx-disable: false
     stream: master
     submodule-timeout: 10
+    submodule-disable: false
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     builders:
       - lf-license-check:
-          file-patterns: '{file-patterns}'
-          spdx-disable: '{spdx-disable}'
-          lhc-version: '{lhc-version}'
-          license-exclude-paths: '{license-exclude-paths}'
-          licenses-allowed: '{licenses-allowed}'
+          file-patterns: "{file-patterns}"
+          spdx-disable: "{spdx-disable}"
+          lhc-version: "{lhc-version}"
+          license-exclude-paths: "{license-exclude-paths}"
+          licenses-allowed: "{licenses-allowed}"
 
     publishers:
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-license-check'
+    name: "{project-name}-license-check"
     id: gerrit-license-check
     <<: *lf_license_check
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
           # Submodules are out of the project's control
           submodule-recursive: false
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
+          server-name: "{gerrit-server-name}"
           # Trigger should not be overridable as we want to always run
           trigger-on:
             - patchset-created-event:
                 exclude-no-code-change: false
             - draft-published-event
             - comment-added-contains-event:
-                comment-contains-value: recheck$
+                comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project-pattern}'
+              project-pattern: "{project-pattern}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**'
+                  branch-pattern: "**"
 
 - job-template:
-    name: '{project-name}-license-check'
+    name: "{project-name}-license-check"
     id: github-license-check
     <<: *lf_license_check
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
           # Submodules are out of the project's control
           submodule-recursive: false
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^recheck$'
+          trigger-phrase: "^recheck$"
           only-trigger-phrase: false
-          status-context: 'License Check'
+          status-context: "License Check"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ####################
 # Info YAML Verify #
 ####################
 
-- lf_info_yaml_verify: &lf_info_yaml_verify
+- _lf_info_yaml_verify: &lf_info_yaml_verify
     name: lf-info-yaml-verify
 
     ######################
           exclude-no-code-change: false
       - draft-published-event
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
 
     #####################
     # Job Configuration #
           - ../shell/info-file-validate.sh
 
 - job-template:
-    name: '{project-name}-info-yaml-verify'
+    name: "{project-name}-info-yaml-verify"
     id: gerrit-info-yaml-verify
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_info_yaml_verify
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
               file-paths:
                 - compare-type: REG_EXP
-                  pattern: 'INFO.yaml'
+                  pattern: "INFO.yaml"
 
 - job-template:
-    name: '{project-name}-info-yaml-verify'
+    name: "{project-name}-info-yaml-verify"
     id: github-info-yaml-verify
     <<: *lf_jjb_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_info_yaml_verify
 
-    github-url: 'https://github.com'
+    github-url: "https://github.com"
     properties:
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'INFO File Verify'
+          status-context: "INFO File Verify"
           permit-all: true
           github-hooks: true
           # included-regions MUST match gerrit file-paths
-          included-regions: 'INFO.yaml'
+          included-regions: "INFO.yaml"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ##################
 # OPENSTACK CRON #
 ##################
 
-- lf_openstack_cron: &lf_openstack_cron
+- _lf_openstack_cron: &lf_openstack_cron
     name: lf-openstack-cron
 
     ######################
     branch: master
     build-days-to-keep: 7
     build-timeout: 10
-    cron: '@hourly'
+    cron: "@hourly"
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
     openstack-cloud: vex
     openstack-image-cleanup: true
     openstack-image-cleanup-age: 30
     openstack-image-protect: true
+    openstack-port-cleanup: true
     openstack-server-cleanup: true
     openstack-stack-cleanup: true
     openstack-volume-cleanup: true
     stream: master
     submodule-timeout: 10
+    submodule-disable: false
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: false
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
       - string:
           name: JENKINS_URLS
-          default: '{jenkins-urls}'
+          default: "{jenkins-urls}"
           description: |
-              Space separated list of Jenkins URLs to check for active builds.
+            Space separated list of Jenkins URLs to check for active builds.
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
       # Listed after to override openstack-infra-wrappers clouds.yaml definition
       - config-file-provider:
           files:
             - file-id: clouds-yaml
-              target: '$HOME/.config/openstack/clouds.yaml'
+              target: "$HOME/.config/openstack/clouds.yaml"
             - file-id: npmrc
-              target: '$HOME/.npmrc'
+              target: "$HOME/.npmrc"
             - file-id: pipconf
-              target: '$HOME/.config/pip/pip.conf'
+              target: "$HOME/.config/pip/pip.conf"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
 
     builders:
       - lf-infra-pre-build
       - inject:
           properties-content: OS_CLOUD={openstack-cloud}
+      # K8s Clusters
+      - conditional-step:
+          condition-kind: boolean-expression
+          condition-expression: "{openstack-stack-cleanup}"
+          steps:
+            - shell: !include-raw-escape: ../shell/openstack-cleanup-orphaned-k8s-clusters.sh
       # Stacks
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{openstack-stack-cleanup}'
+          condition-expression: "{openstack-stack-cleanup}"
           steps:
             - shell: !include-raw-escape: ../shell/openstack-cleanup-orphaned-stacks.sh
       # Servers
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{openstack-server-cleanup}'
+          condition-expression: "{openstack-server-cleanup}"
           steps:
             - shell: !include-raw-escape: ../shell/openstack-cleanup-orphaned-servers.sh
+      # Ports
+      - conditional-step:
+          condition-kind: boolean-expression
+          condition-expression: "{openstack-port-cleanup}"
+          steps:
+            - shell: !include-raw-escape: ../shell/openstack-cleanup-orphaned-ports.sh
       # Volumes
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{openstack-volume-cleanup}'
+          condition-expression: "{openstack-volume-cleanup}"
           steps:
             - shell: !include-raw-escape: ../shell/openstack-cleanup-orphaned-volumes.sh
       # Images
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{openstack-image-protect}'
+          condition-expression: "{openstack-image-protect}"
           steps:
             - shell: !include-raw-escape: ../shell/openstack-protect-in-use-images.sh
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{openstack-image-cleanup}'
+          condition-expression: "{openstack-image-cleanup}"
           steps:
             - inject:
                 properties-content: OS_IMAGE_CLEANUP_AGE={openstack-image-cleanup-age}
 
     publishers:
       - lf-infra-publish
+      - global-jjb-email-notification:
+          email-recipients: "{failure-notification}"
+          email-prefix: "{failure-notification-prefix}"
 
 - job-template:
-    name: '{project-name}-openstack-cron'
+    name: "{project-name}-openstack-cron"
     id: gerrit-openstack-cron
     <<: *lf_openstack_cron
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: 'refs/heads/{branch}'
-          branch: '{branch}'
+          git-url: "{git-url}"
+          refspec: "refs/heads/{branch}"
+          branch: "{branch}"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
 - job-template:
-    name: '{project-name}-openstack-cron'
+    name: "{project-name}-openstack-cron"
     id: github-openstack-cron
     <<: *lf_openstack_cron
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
           submodule-recursive: true
-          submodule-timeout: '{submodule-timeout}'
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
 ################
 # Packer Merge #
 ################
 
-- lf_packer_merge: &lf_packer_merge
+- _lf_packer_merge: &lf_packer_merge
     name: lf-packer-merge
 
     ######################
 
     openstack: true
     openstack-cloud: vex
+    update-cloud-image: false
 
     #####################
     # Job Configuration #
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          stream: '{stream}'
-          branch: '{branch}'
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
       - lf-packer-parameters:
-          packer-version: '{packer-version}'
+          packer-version: "{packer-version}"
+      - bool:
+          name: UPDATE_CLOUD_IMAGE
+          default: "{update-cloud-image}"
+          description: "Update new built image on the cloud."
 
     builders:
       - lf-infra-packer-build:
-          openstack: '{openstack}'
-          openstack-cloud: '{openstack-cloud}'
-          packer-cloud-settings: '{packer-cloud-settings}'
-          packer-version: '{packer-version}'
-          platform: '{platforms}'
-          template: '{templates}'
+          openstack: "{openstack}"
+          openstack-cloud: "{openstack-cloud}"
+          packer-builder: "{packer-builder}"
+          packer-cloud-settings: "{packer-cloud-settings}"
+          packer-version: "{packer-version}"
+          platform: "{platforms}"
+          template: "{templates}"
+          update-cloud-image: "{update-cloud-image}"
       - description-setter:
-          description: '.*Creating the image:(.*)'
+          regexp: '(\s+.*)(ZZCI\s+.*\d+-\d+\.\d+)'
+          description: 'Image: \2'
+
+    publishers:
+      - lf-infra-publish
+      - trigger-parameterized-builds:
+          - project: "{project-name}-openstack-update-cloud-image"
+            condition: UNSTABLE_OR_BETTER
+            predefined-parameters: |
+              NEW_IMAGE_NAME=$NEW_IMAGE_NAME
+            property-file: variables.jenkins-trigger
+            fail-on-missing: true
 
 - job-template:
-    name: '{project-name}-packer-merge-{platforms}-{templates}'
+    name: "{project-name}-packer-merge-{platforms}-{templates}"
     id: gerrit-packer-merge
     <<: *lf_packer_common
     # yamllint disable-line rule:key-duplicates
     # Default parameters #
     ######################
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     gerrit_merge_triggers:
       - change-merged-event
       - comment-added-contains-event:
-          comment-contains-value: remerge$
+          comment-contains-value: '^Patch Set\s+\d+:\s+remerge\s*$'
 
     #####################
     # Job Configuration #
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
               file-paths:
                 - compare-type: REG_EXP
                   pattern: 'packer\/provision\/.*\.sh'
                   pattern: 'packer\/templates\/{templates}\.json'
                 - compare-type: REG_EXP
                   pattern: 'packer\/vars\/{platforms}\.json'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/provision\/{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/provision\/local-{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/templates\/{templates}\.json'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/vars\/{platforms}\.json'
 
 - job-template:
-    name: '{project-name}-packer-merge-{platforms}-{templates}'
+    name: "{project-name}-packer-merge-{platforms}-{templates}"
     id: github-packer-merge
     <<: *lf_packer_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
+          url: "{git-clone-url}{github-org}/{project}"
           refspec: >
-              +refs/heads/*:refs/remotes/origin/*
-              +refs/pull/*:refs/remotes/origin/pr/*
-          branch: '$GERRIT_REFSPEC'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+            +refs/heads/*:refs/remotes/origin/*
+            +refs/pull/*:refs/remotes/origin/pr/*
+          branch: "$GERRIT_REFSPEC"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github
       - pollscm:
-          cron: ''
+          cron: ""
 
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'Packer {platforms}-{templates} Merge'
+          status-context: "Packer {platforms}-{templates} Merge"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           # included-regions MUST match Gerrit Trigger file-paths
           included-regions:
             - 'packer\/provision\/.*\.sh'
             - 'packer\/provision\/local-{templates}\.yaml'
             - 'packer\/templates\/{templates}\.json'
             - 'packer\/vars\/{platforms}\.json'
+            - 'packer\/common-packer\/provision\/{templates}\.yaml'
+            - 'packer\/common-packer\/provision\/local-{templates}\.yaml'
+            - 'packer\/common-packer\/templates\/{templates}\.json'
+            - 'packer\/common-packer\/vars\/{platforms}\.json'
+
+          white-list-target-branches:
+            - "{branch}"
+
+- job-template:
+    name: "{project-name}-packer-verify-build-{platforms}-{templates}"
+    id: gerrit-packer-verify-build
+    <<: *lf_packer_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_packer_merge
+
+    ######################
+    # Default parameters #
+    ######################
+
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
+
+    gerrit_verify_triggers:
+      - comment-added-contains-event:
+          comment-contains-value: '^Patch Set\s+\d+:\s+(verify-build|packer-build)\s*$'
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    scm:
+      - lf-infra-gerrit-scm:
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: gerrit
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      - gerrit:
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
+          projects:
+            - project-compare-type: ANT
+              project-pattern: "{project}"
+              branches:
+                - branch-compare-type: ANT
+                  branch-pattern: "**/{branch}"
+              file-paths:
+                - compare-type: REG_EXP
+                  pattern: 'packer\/provision\/.*\.sh'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/provision\/.*\.bat'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/provision\/.*\.ps1'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/provision\/{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/provision\/local-{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/templates\/{templates}\.json'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/vars\/{platforms}\.json'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/provision\/{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/provision\/local-{templates}\.yaml'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/templates\/{templates}\.json'
+                - compare-type: REG_EXP
+                  pattern: 'packer\/common-packer\/vars\/{platforms}\.json'
+
+- job-template:
+    name: "{project-name}-packer-verify-build-{platforms}-{templates}"
+    id: github-packer-verify-build
+    <<: *lf_packer_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_packer_merge
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    properties:
+      - lf-infra-properties:
+          project: "{project}"
+          build-days-to-keep: 7
+      - github:
+          url: "{github-url}/{github-org}/{project}"
+
+    scm:
+      - lf-infra-github-scm:
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      - github-pull-request:
+          trigger-phrase: "^(verify-build|packer-build)$"
+          only-trigger-phrase: true
+          status-context: "Packer {platforms}-{templates} Verify Build"
+          permit-all: true
+          github-hooks: true
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
+          # included-regions MUST match Gerrit Trigger file-paths
+          included-regions:
+            - 'packer\/provision\/.*\.sh'
+            - 'packer\/provision\/.*\.bat'
+            - 'packer\/provision\/.*\.ps1'
+            - 'packer\/provision\/{templates}\.yaml'
+            - 'packer\/provision\/local-{templates}\.yaml'
+            - 'packer\/templates\/{templates}\.json'
+            - 'packer\/vars\/{platforms}\.json'
+            - 'packer\/common-packer\/vars\/{platforms}\.json'
+            - 'packer\/common-packer\/provision\/{templates}\.yaml'
+            - 'packer\/common-packer\/provision\/local-{templates}\.yaml'
+            - 'packer\/common-packer\/templates\/{templates}\.json'
 
 #################
 # Packer Verify #
 #################
 
-- lf_packer_verify: &lf_packer_verify
+- _lf_packer_verify: &lf_packer_verify
     name: lf-packer-verify
 
     ######################
           exclude-no-code-change: false
       - draft-published-event
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
 
     builders:
       - lf-infra-packer-validate:
-          openstack: '{openstack}'
-          openstack-cloud: '{openstack-cloud}'
-          packer-cloud-settings: '{packer-cloud-settings}'
-          packer-version: '{packer-version}'
+          openstack: "{openstack}"
+          openstack-cloud: "{openstack-cloud}"
+          packer-cloud-settings: "{packer-cloud-settings}"
+          packer-version: "{packer-version}"
 
 - job-template:
-    name: '{project-name}-packer-verify'
+    name: "{project-name}-packer-verify"
     id: gerrit-packer-verify
     <<: *lf_packer_common
     # yamllint disable-line rule:key-duplicates
     # Default parameters #
     ######################
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     #####################
     # Job Configuration #
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-packer-verify'
+    name: "{project-name}-packer-verify"
     id: github-packer-verify
     <<: *lf_packer_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'Packer Verify'
+          status-context: "Packer Verify"
           permit-all: true
           github-hooks: true
-          included-regions: '{obj:github_included_regions}'
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
+
+################################
+# Openstack Update Cloud Image #
+################################
+
+- _lf_openstack_cron: &lf_openstack_update_cloud_image
+    name: lf-openstack-update-cloud-image
+
+    ######################
+    # Default parameters #
+    ######################
+
+    branch: master
+    build-days-to-keep: 7
+    build-timeout: 10
+    cron: "@monthly"
+    disable-job: false
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    new-image-name: "all"
+    openstack-cloud: vex
+    stream: master
+    submodule-timeout: 10
+    submodule-disable: false
+    update-cloud-image: false
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    project-type: freestyle
+    node: "{build-node}"
+    concurrent: false
+    disabled: "{disable-job}"
+
+    properties:
+      - lf-infra-properties:
+          build-days-to-keep: "{build-days-to-keep}"
+
+    parameters:
+      - lf-infra-parameters:
+          project: "{project}"
+          stream: "{stream}"
+          branch: "{branch}"
+      - string:
+          name: NEW_IMAGE_NAME
+          default: "{new-image-name}"
+          description: "Name of cloud image to update in Jenkins"
+
+    wrappers:
+      - lf-infra-wrappers:
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+      # Listed after to override openstack-infra-wrappers clouds.yaml definition
+      - config-file-provider:
+          files:
+            - file-id: clouds-yaml
+              target: "$HOME/.config/openstack/clouds.yaml"
+            - file-id: npmrc
+              target: "$HOME/.npmrc"
+            - file-id: pipconf
+              target: "$HOME/.config/pip/pip.conf"
+
+    builders:
+      - lf-infra-pre-build
+      - inject:
+          properties-content: |
+            OS_CLOUD={openstack-cloud}
+      - shell: |
+          #!/bin/bash
+          echo "Extract the image type for commit message"
+          # echo IMAGE_TYPE=${{NEW_IMAGE_NAME% -*}} >> image-type.txt
+          IMAGE_TYPE=$(echo ${{NEW_IMAGE_NAME}} | tr -d "\'\"\ " | awk -F- '{{ print $2 " " $3 " " $4 }}')
+          echo IMAGE_TYPE=${{IMAGE_TYPE}} >> image-type.txt
+          cat image-type.txt
+      - inject:
+          properties-file: "image-type.txt"
+      - lf-infra-update-packer-images
+      - lf-infra-push-gerrit-patch:
+          project: "{project}"
+          gerrit-user: "{gerrit-user}"
+          gerrit-host: "{gerrit-host}"
+          gerrit-topic: "{gerrit-topic}"
+          gerrit-commit-message: "Update cloud image $IMAGE_TYPE"
+          reviewers-email: "{reviewers-email}"
+
+    publishers:
+      - lf-infra-publish
+
+- job-template:
+    name: "{project-name}-openstack-update-cloud-image"
+    id: gerrit-openstack-update-cloud-image
+    <<: *lf_openstack_update_cloud_image
+
+    ######################
+    # Default parameters #
+    ######################
+
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    scm:
+      - lf-infra-gerrit-scm:
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: false
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: gerrit
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      - timed: "{obj:cron}"
 
 #################
 # Puppet Verify #
 #################
 
-- lf_puppet_verify: &lf_puppet_verify
+- _lf_puppet_verify: &lf_puppet_verify
     name: lf-puppet-verify
 
     ######################
     build-days-to-keep: 7
     build-timeout: 15
     disable-job: false
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
-    github-url: 'https://github.com'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
+    github-url: "https://github.com"
     parallel: true
-    puppet-dir: ''
+    puppet-dir: ""
     puppet-lint-version: 2.3.6
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
+    submodule-disable: false
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
-        pattern: '.*'
+        pattern: ".*"
 
     # github_included_regions MUST match gerrit_trigger_file_paths
     github_included_regions:
-      - '.*'
+      - ".*"
 
     #####################
     # Job Configuration #
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
       - lf-puppet-parameters:
-          puppet-lint-version: '{puppet-lint-version}'
+          puppet-lint-version: "{puppet-lint-version}"
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     builders:
       - shell: !include-raw-escape: ../shell/puppet-lint.sh
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-puppet-verify'
+    name: "{project-name}-puppet-verify"
     id: gerrit-puppet-verify
     <<: *lf_puppet_verify
 
           exclude-no-code-change: false
       - draft-published-event
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set[ ]+[0-9]+:([ ]+|[\n]+)(recheck|reverify)$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
 
     #####################
     # Job Configuration #
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-puppet-verify'
+    name: "{project-name}-puppet-verify"
     id: github-puppet-verify
     <<: *lf_puppet_verify
 
 
     properties:
       - lf-infra-properties:
-          project: '{project}'
+          project: "{project}"
           build-days-to-keep: 7
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'Puppet Verify'
+          status-context: "Puppet Verify"
           permit-all: true
           github-hooks: true
-          included-regions: '{obj:github_included_regions}'
+          included-regions: "{obj:github_included_regions}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
+
+#########
+# Sonar #
+#########
+
+- _lf_sonar_common: &lf_sonar_common
+    name: lf-sonar-common
+
+    ######################
+    # Default parameters #
+    ######################
+
+    archive-artifacts: >
+      **/*.log
+
+    branch: master # Sonar should always be run on master branch
+    build-days-to-keep: 7
+    build-timeout: 60
+    cron: "H H * * *" # run daily
+    disable-job: false
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    sonarcloud-java-version: openjdk13
+    stream: master
+    submodule-recursive: true
+    submodule-timeout: 10
+    submodule-disable: false
+
+    # Sonar properties
+    sonar-task: ""
+    sonar-project-file: "sonar-project.properties"
+    sonar-properties: ""
+    sonar-java-opts: ""
+    sonar-additional-args: ""
+
+    gerrit_trigger_file_paths:
+      - compare-type: REG_EXP
+        pattern: ".*"
+
+    # github_included_regions MUST match gerrit_trigger_file_paths
+    github_included_regions:
+      - ".*"
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    project-type: freestyle
+    node: "{build-node}"
+
+    properties:
+      - lf-infra-properties:
+          build-days-to-keep: "{build-days-to-keep}"
+
+    wrappers:
+      - lf-infra-wrappers:
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    disabled: "{disable-job}"
+
+    parameters:
+      - lf-infra-parameters:
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
+      - string:
+          name: ARCHIVE_ARTIFACTS
+          default: "{archive-artifacts}"
+          description: Artifacts to archive to the logs server.
+
+    publishers:
+      - lf-infra-publish
+
+- _lf_sonar_builders: &lf_sonar_builders
+    name: lf-sonar-builders
+    builders:
+      - lf-infra-pre-build
+      - lf-update-java-alternatives:
+          java-version: "{sonarcloud-java-version}"
+      - lf-infra-sonar:
+          sonar-task: "{sonar-task}"
+          sonar-project-file: "{sonar-project-file}"
+          sonar-properties: "{sonar-properties}"
+          sonar-java-opts: "{sonar-java-opts}"
+          sonar-additional-args: "{sonar-additional-args}"
+
+- _lf_sonar_builders_prescan: &lf_sonar_builders_prescan
+    name: lf-sonar-builders-prescan
+    builders:
+      - lf-infra-pre-build
+      - lf-update-java-alternatives:
+          java-version: "{sonarcloud-java-version}"
+      - lf-infra-sonar-with-prescan:
+          sonar-task: "{sonar-task}"
+          sonar-project-file: "{sonar-project-file}"
+          sonar-properties: "{sonar-properties}"
+          sonar-java-opts: "{sonar-java-opts}"
+          sonar-additional-args: "{sonar-additional-args}"
+
+- _lf_sonar_builders_prescan_script: &lf_sonar_builders_prescan_script
+    name: lf-sonar-builders-prescan-script
+    builders:
+      - lf-infra-pre-build
+      - lf-update-java-alternatives:
+          java-version: "{sonarcloud-java-version}"
+      - shell: "{sonar-prescan-script}"
+      - lf-infra-sonar:
+          sonar-task: "{sonar-task}"
+          sonar-project-file: "{sonar-project-file}"
+          sonar-properties: "{sonar-properties}"
+          sonar-java-opts: "{sonar-java-opts}"
+          sonar-additional-args: "{sonar-additional-args}"
+
+- _lf_sonar_gerrit_common: &lf_sonar_gerrit_common
+    name: lf-sonar-gerrit-common
+    gerrit_sonar_triggers:
+      - comment-added-contains-event:
+          comment-contains-value: '^Patch Set\s+\d+:\s+run-sonar\s*$'
+
+    scm:
+      - lf-infra-gerrit-scm:
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: $GERRIT_REFSPEC
+          branch: $GERRIT_BRANCH
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+
+    triggers:
+      - timed: "{obj:cron}"
+      - gerrit:
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_sonar_triggers}"
+          projects:
+            - project-compare-type: "ANT"
+              project-pattern: "{project}"
+              branches:
+                - branch-compare-type: "ANT"
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
+          skip-vote:
+            successful: true
+            failed: true
+            unstable: true
+            notbuilt: true
+
+- _lf_sonar_github_common: &lf_sonar_github_common
+    name: lf-sonar-github-common
+    properties:
+      - lf-infra-properties:
+          build-days-to-keep: "{build-days-to-keep}"
+      - github:
+          url: "{github-url}/{github-org}/{project}"
+
+    scm:
+      - lf-infra-github-scm:
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      - github-pull-request:
+          trigger-phrase: "^run-sonar$"
+          only-trigger-phrase: false
+          status-context: "Python Sonar"
+          permit-all: true
+          github-hooks: true
+          white-list-target-branches:
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
+
+- job-template:
+    name: "{project-name}-sonar"
+    id: gerrit-sonar
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_gerrit_common
+
+- job-template:
+    name: "{project-name}-sonar"
+    id: github-sonar
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_github_common
+
+- job-template:
+    name: "{project-name}-sonar-prescan"
+    id: gerrit-sonar-prescan
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders_prescan
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_gerrit_common
+
+- job-template:
+    name: "{project-name}-sonar-prescan"
+    id: github-sonar-prescan
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders_prescan
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_github_common
+
+- job-template:
+    name: "{project-name}-sonar-prescan-script"
+    id: gerrit-sonar-prescan-script
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders_prescan_script
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_gerrit_common
+
+- job-template:
+    name: "{project-name}-sonar-prescan-script"
+    id: github-sonar-prescan-script
+    <<: *lf_sonar_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_builders_prescan_script
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_sonar_github_common
+
+#############
+# Pipelines #
+#############
+
+- _lf_pipelines_common: &lf_pipelines_common
+    name: lf-pipelines-common
+
+    ######################
+    # Default parameters #
+    ######################
+
+    branch: master
+    build-timeout: 90
+    disable-job: false
+    stream: master
+    submodule-recursive: true
+    submodule-timeout: 10
+    submodule-disable: false
+
+- _lf_global_pipelines_common: &lf_global_pipelines_common
+    name: lf-global-pipelines-common
+
+    # All jobs are triggering from the same source
+    git-url: https://gerrit.linuxfoundation.org/infra/releng/pipelines
+    triggers:
+      - gerrit:
+          server-name: "lf-releng"
+          trigger-on:
+            - patchset-created-event:
+                exclude-drafts: true
+                exclude-trivial-rebase: false
+                exclude-no-code-change: false
+            - draft-published-event
+            - comment-added-contains-event:
+                comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
+          projects:
+            - project-compare-type: ANT
+              project-pattern: "releng/pipelines"
+              branches:
+                - branch-compare-type: ANT
+                  branch-pattern: "**/master"
+
+- job-template:
+    name: "lf-pipelines-verify"
+    id: lf-pipelines-verify
+    <<: *lf_pipelines_common
+    <<: *lf_global_pipelines_common
+
+    project-type: pipeline
+    pipeline-scm:
+      scm:
+        - lf-infra-gerrit-scm:
+            git-url: "{git-url}"
+            refspec: "$GERRIT_REFSPEC"
+            branch: "$GERRIT_BRANCH"
+            submodule-recursive: "{submodule-recursive}"
+            submodule-timeout: "{submodule-timeout}"
+            submodule-disable: "{submodule-disable}"
+            choosing-strategy: gerrit
+            jenkins-ssh-credential: "{jenkins-ssh-credential}"
+    sandbox: true