jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(runner): ansible-core comes from a venv matching requirements.txt, not Debian's 2.14 #290

Open
jfraeys wants to merge 1 commit from jfraeys/fix/runner-ansible-core into main
pull from: jfraeys/fix/runner-ansible-core
merge into: jfraeys:main
Conversation 0 Commits 1 Files changed 4 +31
jfraeys commented 2026-10-19 17:19:12 -04:00
Owner
Copy link

Summary

 forgejo_runner_native (tags base, image_bake)
   apt: ansible-core            # Debian 12: 2.14
+  pip: ansible-core>=2.16,<2.20 into /opt/ansible   # same range as requirements.txt
+  link ansible, ansible-playbook, ansible-galaxy, ansible-vault -> /usr/local/bin (ahead of /usr/bin on PATH)

The apt package is kept (other packages depend on it); the venv's binaries shadow it. The version spec is a role default, noted as "keep in step with requirements.txt" (<2.20: 2.20 needs Python 3.12, the runner has 3.11).

Evidence

  • Before: staging-validate run #865 (app path) — runner ansible [core 2.14.18], then
    ERROR! couldn't resolve module/action 'ansible.builtin.deb822_repository' from the coaching-site role's packages.yml line 49 (module needs 2.15+).
    After: not run on a runner. Checked: YAML parses, yamllint and ansible-lint pass on the role, and the new molecule assertion
    ansible_version.stdout is regex('core 2\.(1[6-9])\.') matches ansible-playbook [core 2.19.4]. Molecule itself needs Docker (run via Colima).

Merge Danger

Door: two-way

Blast Radius: CI runners

Every ephemeral CI runner VM (and the persistent native runner) gets a different ansible-playbook than before, so a 2.16-to-2.19 behaviour change could affect any workflow that shells out to ansible, including infra's own staging-validate. There is no baked image yet, so it takes effect when a VM runs the base tasks from the provisioner's checkout of main. Revert by reverting the commit; new VMs pick up the old tasks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

## Summary ```diff forgejo_runner_native (tags base, image_bake) apt: ansible-core # Debian 12: 2.14 + pip: ansible-core>=2.16,<2.20 into /opt/ansible # same range as requirements.txt + link ansible, ansible-playbook, ansible-galaxy, ansible-vault -> /usr/local/bin (ahead of /usr/bin on PATH) ``` The apt package is kept (other packages depend on it); the venv's binaries shadow it. The version spec is a role default, noted as "keep in step with requirements.txt" (`<2.20`: 2.20 needs Python 3.12, the runner has 3.11). ## Evidence - **Before:** staging-validate run #865 (app path) — runner `ansible [core 2.14.18]`, then `ERROR! couldn't resolve module/action 'ansible.builtin.deb822_repository'` from the coaching-site role's `packages.yml` line 49 (module needs 2.15+). **After:** not run on a runner. Checked: YAML parses, yamllint and ansible-lint pass on the role, and the new molecule assertion `ansible_version.stdout is regex('core 2\.(1[6-9])\.')` matches `ansible-playbook [core 2.19.4]`. Molecule itself needs Docker (run via Colima). ## Merge Danger **Door:** two-way **Blast Radius:** CI runners Every ephemeral CI runner VM (and the persistent native runner) gets a different `ansible-playbook` than before, so a 2.16-to-2.19 behaviour change could affect any workflow that shells out to ansible, including infra's own staging-validate. There is no baked image yet, so it takes effect when a VM runs the `base` tasks from the provisioner's checkout of `main`. Revert by reverting the commit; new VMs pick up the old tasks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
fix(runner): ansible-core comes from a venv matching requirements.txt, not Debian's 2.14
All checks were successful
Lint / lint (pull_request) Successful in 3m1s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
165465e1d4
 
Run #865: the app step failed with "couldn't resolve module/action 'ansible.builtin.deb822_repository'"
(2.15+). requirements.txt already asks for >=2.16,<2.20; the runner's apt package is 2.14.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
All checks were successful
Lint / lint (pull_request) Successful in 3m1s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin jfraeys/fix/runner-ansible-core:jfraeys/fix/runner-ansible-core
git switch jfraeys/fix/runner-ansible-core

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff jfraeys/fix/runner-ansible-core
git switch jfraeys/fix/runner-ansible-core
git rebase main
git switch main
git merge --ff-only jfraeys/fix/runner-ansible-core
git switch jfraeys/fix/runner-ansible-core
git rebase main
git switch main
git merge --no-ff jfraeys/fix/runner-ansible-core
git switch main
git merge --squash jfraeys/fix/runner-ansible-core
git switch main
git merge --ff-only jfraeys/fix/runner-ansible-core
git switch main
git merge jfraeys/fix/runner-ansible-core
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!290
No description provided.