Feature: Add a fingerprint string to the system log to indicate when the role began
successfully, and when the role finished successfully. The fingerprint string indicates
the role name, a timestamp, and the platform.
Reason: Users can see when the role was used and if it was used successfully. This
information from the system log can be collected by log scanners and aggregators
for further analysis.
Result: The role logs fingerprints to the system log.
This also adds a test to check if the fingerprints were written upon a successful
role invocation.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
ansible-lint requires the dependencies in meta/collection-requirements.yml
and tests/collection-requirements.yml to be installed. tox-lsr 3.18.1
will ensure they are installed.
Refactor the tests somewhat so that the collection and test steps are separate.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
https://github.com/ansible-collections/partner-certification-checker/blob/main/README.md
Unfortunately we cannot use the checkers provided by their team because they assume
the git repo is in collection format - you cannot convert to collection format first
then point the checkers at that collection. Instead, implement our own checkers that
do the same (and more) - check with multiple versions of ansible-lint and ansible-test
to ensure we cover:
* all supported versions of EL
* Automation Hub gating
* the latest versions of Ansible, including the latest milestone version
This requires the latest version of tox-lsr
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Some of the older Testing Farm machines refer to the old site name in the yum repos.
Ensure that they use the correct site name.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The role gathers the facts it uses. For example, if the user uses
`ANSIBLE_GATHERING=explicit`, the role uses the `setup` module with the
facts and subsets it requires.
This change allows us to test this. Before every role invocation, the test
will use `meta: clear_facts` so that the role starts with no facts.
Create a task file tests/tasks/run_role_with_clear_facts.yml to do the tasks
to clear the facts and run the role. Note that this means we don't need to
use `gather_facts` for the tests.
Some vars defined using `ansible_facts` have been changed to be defined with
`set_fact` instead. This is because of the fact that `vars` are lazily
evaluated - the var might be referenced when the facts have been cleared, and
will issue an error like `ansible_facts["distribution"] is undefined`. This is
typically done for blocks that have a `when` condition that uses `ansible_facts`
and the block has a role invocation using run_role_with_clear_facts.yml
These have been rewritten to define the `when` condition using `set_fact`. This
is because the `when` condition is evaluated every time a task is invoked in the
block, and if the facts are cleared, this will raise an undefined variable error.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.1 has a fix for the broken container tests
There was one shell function for both setting up the callback plugins and the connection plugin.
When this function was skipped, the ANSIBLE_CONNECTION_PLUGINS environment variable was not
set, so all subsequent tests failed. The connection plugin must be present and the env. var.
must be set in order to run any container tests. The code was fixed to ensure that there is
always a connection plugin installed in the correct location and that ANSIBLE_CONNECTION_PLUGINS
is always set and contains this path.
Also, setting up the callback plugins and the connection plugin is already idempotent, so no
reason to skip them.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.0 has some container test improvements - better output, faster runs
Use Ansible 2.20 for qemu/container tests on fedora 43
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
the latest version of tox 4.49 has a strange issue - it thinks that a tox testenv
like `[qemu-ansible-core-2.20]` is specifying python 2.20 which conflicts with the
testenv basepython of python 3.latest. There appears to be no way to workaround this.
So, rename all of the testenvs to use `major-minor` instead of `major.minor` e.g.
`[qemu-ansible-core-2-20]`
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The ansible version is specified as a YAML floating point number. This causes
`2.20` to be converted to `2.2` which breaks platforms that use ansible 2.20.
Ensure it and similar version numbers are specified in YAML as strings.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The new ansible-lint@v26 does not like it when there is a .collection directory
with a galaxy.yml in the converted collection, so remove it, since it is not
needed for ansible-lint.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Ansible 2.20 has deprecated the use of Ansible facts as variables. For
example, `ansible_distribution` is now deprecated in favor of
`ansible_facts["distribution"]`. This is due to making the default
setting `INJECT_FACTS_AS_VARS=false`. For now, this will create WARNING
messages, but in Ansible 2.24 it will be an error.
In order to ensure that commits and PRs conform to this, use
ANSIBLE_INJECT_FACT_VARS=false by default in our CI testing.
Update README-ostree.md if needed.
See https://docs.ansible.com/projects/ansible/latest/porting_guides/porting_guide_core_2.20.html#inject-facts-as-vars
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Cause: The aide role custom config test is using the old configuration options
on newer EL9 systems which use AIDE version 0.17 and later.
Consequence: The test gives errors like "ERROR: /etc/aide.conf:12: unexpected character"
and the test fails.
Fix: The role will now determine the AIDE version, set the new aide_version variable,
and use this variable to determine the old or new style configuration.
Result: The aide system role can process custom config on all supported AIDE
versions.
See https://github.com/aide/aide/blob/master/ChangeLog#L241
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
community.general version 12 has dropped support for py27 and py36 - ensure that
the roles do not install/use this version - see
https://github.com/ansible-collections/community.general/issues/582
By default, installation will get the latest 11.x version. The lower bound
`6.6.0` is an older version, but I don't want to restrict the ability of a user
of a particular role to use an old version, rather than forcing them to use
`11.x` or later. Some roles like `rhc` explicitly require `6.6.0` or later - I
think this is a reasonable lower bound for all roles.If a role needs a different
version, the role can define its own `community_general_version` in the role's
`host_vars` file in .github.
Standardize file format across all roles for consistency and ease of updating
This update may remove the SPDX license information from the file - this is ok -
the role/project already has a license, this file is trivial, and many
requirements files do not have the license header anyway.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Previously, CI would download the standard-inventory-qcow2 script from pagure. However,
the pagure download url is now being protected by Anubis which by default
will check the User-Agent header and deny attempts from clients that look
like scrapers or hackers. Rather than trying to play arms race with setting
headers, etc. - just move this script to tox-lsr. If we really need to sync
with the upstream development, we can do that manually.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
use versioned upload-artifact instead of master
bump codeql-action from v3 to v4
bump upload-artifact from v4 to v5
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
On some versions of ansible/jinja, the YAML format does not work, so use
the JSON format to pass in __bootc_validation
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
* Pass in a YAML true value as `__bootc_validation: true` using
the --extra-vars option to ensure that `__bootc_validation` is
treated as a boolean and not a string value.
`-e "__bootc_validation: true"`
You can also use JSON format:
`-e '{"__bootc_validation": true}'`
but YAML is simpler in this case.
* Use tox-lsr version 3.11.1
* Ensure the citest bad comment works when the test was cancelled in
addition to the failure case.
* Update contributing.md documentation
* Update number of nodes to use in testing farm, if needed
* remove unnecessary ansible-lint skips
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
NOTE: This also requires upgrading to tox-lsr 3.11.0
Ansible 2.19 will be released soon and has some changes which will
require fixes in system roles. This adds 2.19 to our testing matrix
on fedora 42 so that we can start addressing these issues.
python 3.13 is now being used on some platforms.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
NOTE: This also requires upgrading to tox-lsr 3.10.0, and some
hacks to workaround a podman issue in ubuntu.
These tests run the role during a bootc container image build, deploy
the container into a QEMU VM, boot that, and validate the expected
configuration there. They run in two different tox environments, and
thus have to be run in two steps (preparation in buildah, validation in
QEMU). The preparation is expected to output a qcow2 image in
`tests/tmp/TESTNAME/qcow2/disk.qcow2`, i.e. the output structure of
<https://github.com/osbuild/bootc-image-builder>.
There are two possibilities:
* Have separate bootc end-to-end tests. These are tagged with
`tests::bootc-e2` and are skipped in the normal qemu-* scenarios.
They run as part of the container-* ones.
* Modify an existing test: These need to build a qcow2 image exactly
*once* (via calling `bootc-buildah-qcow.sh`) and skip setup/cleanup
and role invocations in validation mode, i.e. when
`__bootc_validation` is true.
In the container scenario, run the QEMU validation as a separate step in
the workflow.
See https://issues.redhat.com/browse/RHEL-88396
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
