- Add info about .coderabbit.yam for AI assistants to contributing.md
- Note that CodeRabbit uses config from the main branch so this change will apply
after this PR is merged.
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
The recently released ansible.posix 2.2.0 does not work on EL7.
Pin the version of ansible.posix to 2.1.X.
NOTE: Even though this role might not support EL7, this update
is applied to all system roles for consistency. Plus, when this
role is part of the system roles collection, all roles must use
the same version of ansible.posix - there is no way for a role
which is part of a collection to use a different version of a
dependency than the version used by the other roles.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Sourcery that we currently use cannot read documentation files and best
practices, it's rather a refactoring tool.
So I want to introduce CodeRabbit that allows creating .coderabbit.yaml with
custom rules and conventions.
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
- Replace no_log: true with no_log: "{{ ansible_verbosity < 3 }}"
in all tasks (setup, service_facts, package_facts, and service tasks)
- This allows output to be shown when running with -vvv or higher verbosity
- The no_log was used for verbosity control, not security purposes
In the network role, no_log: true was used to reduce verbose output,
not to protect sensitive information. Using ansible_verbosity allows
users to see the output when debugging with increased verbosity flags.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
If you set __network_debug_flags=log-to-syslog then the internal trace messages which
are returned by the module will also be logged to syslog. This is useful for when
the network role hangs and times out and is killed before those messages can
be returned. The trace messages printed to syslog can help debug problems.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Refactor the common code in tests_unit.yml and the integration pytest
into a single block of code.
The tests/ directory has a library sub-directory with a symlink to the
network_connections.py module. This was causing problems because the logic
in get_modules_and_utils_paths.yml really wants the real files and
directories, not the symlinks, and for some reason the bash `-f` test
is returning `true` for the symlink. Instead, ensure that we do not use
the link by using `-L` to screen it out.
Also added the collection paths to the search.
Make the path arrays have unique values.
Use the `realpath` filter to see the full actual path.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Feature: Add a fingerprint string to the system log to indicate when the role began
successfully, and when the role finished successfully. The fingerprint string indicates
the role name, a timestamp, and the platform.
Reason: Users can see when the role was used and if it was used successfully. This
information from the system log can be collected by log scanners and aggregators
for further analysis.
Result: The role logs fingerprints to the system log.
This also adds a test to check if the fingerprints were written upon a successful
role invocation.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
ansible-lint requires the dependencies in meta/collection-requirements.yml
and tests/collection-requirements.yml to be installed. tox-lsr 3.18.1
will ensure they are installed.
Refactor the tests somewhat so that the collection and test steps are separate.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
https://github.com/ansible-collections/partner-certification-checker/blob/main/README.md
Unfortunately we cannot use the checkers provided by their team because they assume
the git repo is in collection format - you cannot convert to collection format first
then point the checkers at that collection. Instead, implement our own checkers that
do the same (and more) - check with multiple versions of ansible-lint and ansible-test
to ensure we cover:
* all supported versions of EL
* Automation Hub gating
* the latest versions of Ansible, including the latest milestone version
This requires the latest version of tox-lsr
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Ansible modules should use module.run_command instead of subprocess.
This is flagged by the latest ansible-test
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Some of the older Testing Farm machines refer to the old site name in the yum repos.
Ensure that they use the correct site name.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Previously, the role used to install customly-built hostapd package with
OWE enabled. Currently, hostapd in Fedora and RHEL have OWE enabled by
default, so there is no need to use custom build.
Signed-off-by: Sergei Petrosian <spetrosi@redhat.com>
The role gathers the facts it uses. For example, if the user uses
`ANSIBLE_GATHERING=explicit`, the role uses the `setup` module with the
facts and subsets it requires.
This change allows us to test this. Before every role invocation, the test
will use `meta: clear_facts` so that the role starts with no facts.
Create a task file tests/tasks/run_role_with_clear_facts.yml to do the tasks
to clear the facts and run the role. Note that this means we don't need to
use `gather_facts` for the tests.
Some vars defined using `ansible_facts` have been changed to be defined with
`set_fact` instead. This is because of the fact that `vars` are lazily
evaluated - the var might be referenced when the facts have been cleared, and
will issue an error like `ansible_facts["distribution"] is undefined`. This is
typically done for blocks that have a `when` condition that uses `ansible_facts`
and the block has a role invocation using run_role_with_clear_facts.yml
These have been rewritten to define the `when` condition using `set_fact`. This
is because the `when` condition is evaluated every time a task is invoked in the
block, and if the facts are cleared, this will raise an undefined variable error.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.1 has a fix for the broken container tests
There was one shell function for both setting up the callback plugins and the connection plugin.
When this function was skipped, the ANSIBLE_CONNECTION_PLUGINS environment variable was not
set, so all subsequent tests failed. The connection plugin must be present and the env. var.
must be set in order to run any container tests. The code was fixed to ensure that there is
always a connection plugin installed in the correct location and that ANSIBLE_CONNECTION_PLUGINS
is always set and contains this path.
Also, setting up the callback plugins and the connection plugin is already idempotent, so no
reason to skip them.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
tox-lsr 3.17.0 has some container test improvements - better output, faster runs
Use Ansible 2.20 for qemu/container tests on fedora 43
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
the latest version of tox 4.49 has a strange issue - it thinks that a tox testenv
like `[qemu-ansible-core-2.20]` is specifying python 2.20 which conflicts with the
testenv basepython of python 3.latest. There appears to be no way to workaround this.
So, rename all of the testenvs to use `major-minor` instead of `major.minor` e.g.
`[qemu-ansible-core-2-20]`
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The ansible version is specified as a YAML floating point number. This causes
`2.20` to be converted to `2.2` which breaks platforms that use ansible 2.20.
Ensure it and similar version numbers are specified in YAML as strings.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
The new ansible-lint@v26 does not like it when there is a .collection directory
with a galaxy.yml in the converted collection, so remove it, since it is not
needed for ansible-lint.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
When we submit a PR for a CI update or docs, we do not want to start CI checking
for ansible-lint, qemu, etc. When we are doing CI updates to 30 or more
roles, this fires off a lot of unnecessary tests, which sometimes causes the
linux-system-roles org in github to be throttled.
When submitting a PR that can skip ci, use "[citest_skip]" in the PR title.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Ansible 2.20 has deprecated the use of Ansible facts as variables. For
example, `ansible_distribution` is now deprecated in favor of
`ansible_facts["distribution"]`. This is due to making the default
setting `INJECT_FACTS_AS_VARS=false`. For now, this will create WARNING
messages, but in Ansible 2.24 it will be an error.
In order to ensure that commits and PRs conform to this, use
ANSIBLE_INJECT_FACT_VARS=false by default in our CI testing.
Update README-ostree.md if needed.
See https://docs.ansible.com/projects/ansible/latest/porting_guides/porting_guide_core_2.20.html#inject-facts-as-vars
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Starting with Ansible 2.20, modules should not return the `warnings` key in the module
return. Instead, modules should use the `warn` method to specify the warnings.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Ansible 2.20 has deprecated the use of Ansible facts as variables. For
example, `ansible_distribution` is now deprecated in favor of
`ansible_facts["distribution"]`. This is due to making the default
setting `INJECT_FACTS_AS_VARS=false`. For now, this will create WARNING
messages, but in Ansible 2.24 it will be an error.
See https://docs.ansible.com/projects/ansible/latest/porting_guides/porting_guide_core_2.20.html#inject-facts-as-vars
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
community.general version 12 has dropped support for py27 and py36 - ensure that
the roles do not install/use this version - see
https://github.com/ansible-collections/community.general/issues/582
By default, installation will get the latest 11.x version. The lower bound
`6.6.0` is an older version, but I don't want to restrict the ability of a user
of a particular role to use an old version, rather than forcing them to use
`11.x` or later. Some roles like `rhc` explicitly require `6.6.0` or later - I
think this is a reasonable lower bound for all roles.If a role needs a different
version, the role can define its own `community_general_version` in the role's
`host_vars` file in .github.
Standardize file format across all roles for consistency and ease of updating
This update may remove the SPDX license information from the file - this is ok -
the role/project already has a license, this file is trivial, and many
requirements files do not have the license header anyway.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Previously, CI would download the standard-inventory-qcow2 script from pagure. However,
the pagure download url is now being protected by Anubis which by default
will check the User-Agent header and deny attempts from clients that look
like scrapers or hackers. Rather than trying to play arms race with setting
headers, etc. - just move this script to tox-lsr. If we really need to sync
with the upstream development, we can do that manually.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
use versioned upload-artifact instead of master
bump codeql-action from v3 to v4
bump upload-artifact from v4 to v5
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
