jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

test: molecule scenarios for crowdsec and forgejo_runner_native #13

Merged
jfraeys merged 1 commit from test/molecule-crowdsec-runner into main 2026-10-02 21:16:53 -04:00
Conversation 0 Commits 1 Files changed 8 +208 -1
jfraeys commented 2026-10-02 20:59:27 -04:00
Owner
Copy link

Adds scenarios for the two roles that changed most recently and had no coverage. Both run only the image_bake subset (--tags via ansible_args) on a Debian 13 container.

  • crowdsec: pinned repo key checksum, sources file, old binary key removed, package resolves from packagecloud.
  • forgejo_runner_native: NodeSource key checksum, Node major, OpenTofu version, runner binary checksum, runner user, baked tools.

Role changes (molecule-only guards, no production behavior change): crowdsec package installs skipped under molecule_test (postinst needs live systemd); /etc/hosts lineinfile uses unsafe_writes under molecule_test (container bind mount).

Verify plays are tagged always: with --tags image_bake on every molecule playbook, untagged verify tasks are skipped silently, which made a first 'passing' run meaningless.

Tested locally: both scenarios pass (converge, idempotence, verify with real assertions). Not wired into CI yet.

🤖 Generated with Claude Code

Adds scenarios for the two roles that changed most recently and had no coverage. Both run only the image_bake subset (--tags via ansible_args) on a Debian 13 container. - crowdsec: pinned repo key checksum, sources file, old binary key removed, package resolves from packagecloud. - forgejo_runner_native: NodeSource key checksum, Node major, OpenTofu version, runner binary checksum, runner user, baked tools. Role changes (molecule-only guards, no production behavior change): crowdsec package installs skipped under molecule_test (postinst needs live systemd); /etc/hosts lineinfile uses unsafe_writes under molecule_test (container bind mount). Verify plays are tagged always: with --tags image_bake on every molecule playbook, untagged verify tasks are skipped silently, which made a first 'passing' run meaningless. Tested locally: both scenarios pass (converge, idempotence, verify with real assertions). Not wired into CI yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
test: molecule scenarios for crowdsec and forgejo_runner_native
All checks were successful
Lint / lint (pull_request) Successful in 1m38s
Details
4e5847de1c
 
Both run only the image_bake subset (--tags via ansible_args) on a Debian 13 container: crowdsec
checks the pinned repo key, sources file, removal of the old key, and package resolution;
forgejo_runner_native checks the NodeSource key checksum, Node major, OpenTofu version, runner
binary checksum, user and baked tools. Package installs needing live systemd are skipped under
molecule_test; /etc/hosts uses unsafe_writes there (bind mount). Verify plays are tagged always:
ansible_args --tags would otherwise skip every assertion silently.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!13
No description provided.