The sr_fingerprint module was rewritten to accept structured parameters
(status, role_name, role_path, etc.) instead of a free-form sr_message.
Update the role tasks and tests to match the new module interface.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Feature: Write roles fingerprints to /var/log/sysroles.jsonl [citest_skip]
Reason: By default logs are printed to rsyslog. This change adds a possibility to write logs to a file on the system for the downstream users.
Result: For the upstream, this makes rsyslog log message more detailed. For the downstream - also writes logs to /var/log/sysroles.jsonl
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
dependabot updates are DoSing our ci tests - we have a limited number of github
action jobs and a dependabot update can eat up all of those for several hours,
causing problems for "real" PRs that we need testing for immediately.
Instead, tell these updates to skip ci testing, and we will manually
trigger specific roles/tests as needed when there is a dependabot update.
see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#prefix
for more information.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
It's time to test with F44 and drop F42.
Use ansible-core 2.21 for testing - this is now the latest stable version.
Deprecate podman 5 install hack in favor of official github action
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
There are a few problems with the NPM commitlint
* NPM is problematic
* Having to install NPM and commitlint and dependencies is slow and heavyweight
* commitlint is overkill for our simple use case
We have our own pr_title_lint.py which is small and works exactly for our use case.
Enhance coderabbit checks for PRs and test cleanup
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
- Add info about .coderabbit.yam for AI assistants to contributing.md
- Note that CodeRabbit uses config from the main branch so this change will apply
after this PR is merged.
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
The recently released ansible.posix 2.2.0 does not work on EL7.
Pin the version of ansible.posix to 2.1.X.
NOTE: Even though this role might not support EL7, this update
is applied to all system roles for consistency. Plus, when this
role is part of the system roles collection, all roles must use
the same version of ansible.posix - there is no way for a role
which is part of a collection to use a different version of a
dependency than the version used by the other roles.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Sourcery that we currently use cannot read documentation files and best
practices, it's rather a refactoring tool.
So I want to introduce CodeRabbit that allows creating .coderabbit.yaml with
custom rules and conventions.
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
Feature: Add a fingerprint string to the system log to indicate when the role began
successfully, and when the role finished successfully. The fingerprint string indicates
the role name, a timestamp, and the platform.
Reason: Users can see when the role was used and if it was used successfully. This
information from the system log can be collected by log scanners and aggregators
for further analysis.
Result: The role logs fingerprints to the system log.
This also adds a test to check if the fingerprints were written upon a successful
role invocation.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
ansible-lint requires the dependencies in meta/collection-requirements.yml
and tests/collection-requirements.yml to be installed. tox-lsr 3.18.1
will ensure they are installed.
Refactor the tests somewhat so that the collection and test steps are separate.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
https://github.com/ansible-collections/partner-certification-checker/blob/main/README.md
Unfortunately we cannot use the checkers provided by their team because they assume
the git repo is in collection format - you cannot convert to collection format first
then point the checkers at that collection. Instead, implement our own checkers that
do the same (and more) - check with multiple versions of ansible-lint and ansible-test
to ensure we cover:
* all supported versions of EL
* Automation Hub gating
* the latest versions of Ansible, including the latest milestone version
This requires the latest version of tox-lsr
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Some of the older Testing Farm machines refer to the old site name in the yum repos.
Ensure that they use the correct site name.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The role gathers the facts it uses. For example, if the user uses
`ANSIBLE_GATHERING=explicit`, the role uses the `setup` module with the
facts and subsets it requires.
This change allows us to test this. Before every role invocation, the test
will use `meta: clear_facts` so that the role starts with no facts.
Create a task file tests/tasks/run_role_with_clear_facts.yml to do the tasks
to clear the facts and run the role. Note that this means we don't need to
use `gather_facts` for the tests.
Some vars defined using `ansible_facts` have been changed to be defined with
`set_fact` instead. This is because of the fact that `vars` are lazily
evaluated - the var might be referenced when the facts have been cleared, and
will issue an error like `ansible_facts["distribution"] is undefined`. This is
typically done for blocks that have a `when` condition that uses `ansible_facts`
and the block has a role invocation using run_role_with_clear_facts.yml
These have been rewritten to define the `when` condition using `set_fact`. This
is because the `when` condition is evaluated every time a task is invoked in the
block, and if the facts are cleared, this will raise an undefined variable error.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.1 has a fix for the broken container tests
There was one shell function for both setting up the callback plugins and the connection plugin.
When this function was skipped, the ANSIBLE_CONNECTION_PLUGINS environment variable was not
set, so all subsequent tests failed. The connection plugin must be present and the env. var.
must be set in order to run any container tests. The code was fixed to ensure that there is
always a connection plugin installed in the correct location and that ANSIBLE_CONNECTION_PLUGINS
is always set and contains this path.
Also, setting up the callback plugins and the connection plugin is already idempotent, so no
reason to skip them.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.0 has some container test improvements - better output, faster runs
Use Ansible 2.20 for qemu/container tests on fedora 43
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
the latest version of tox 4.49 has a strange issue - it thinks that a tox testenv
like `[qemu-ansible-core-2.20]` is specifying python 2.20 which conflicts with the
testenv basepython of python 3.latest. There appears to be no way to workaround this.
So, rename all of the testenvs to use `major-minor` instead of `major.minor` e.g.
`[qemu-ansible-core-2-20]`
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The ansible version is specified as a YAML floating point number. This causes
`2.20` to be converted to `2.2` which breaks platforms that use ansible 2.20.
Ensure it and similar version numbers are specified in YAML as strings.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The new ansible-lint@v26 does not like it when there is a .collection directory
with a galaxy.yml in the converted collection, so remove it, since it is not
needed for ansible-lint.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Ansible 2.20 has deprecated the use of Ansible facts as variables. For
example, `ansible_distribution` is now deprecated in favor of
`ansible_facts["distribution"]`. This is due to making the default
setting `INJECT_FACTS_AS_VARS=false`. For now, this will create WARNING
messages, but in Ansible 2.24 it will be an error.
In order to ensure that commits and PRs conform to this, use
ANSIBLE_INJECT_FACT_VARS=false by default in our CI testing.
Update README-ostree.md if needed.
See https://docs.ansible.com/projects/ansible/latest/porting_guides/porting_guide_core_2.20.html#inject-facts-as-vars
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
