ci/guards-and-drift #6

Merged

jfraeys merged 3 commits from ci/guards-and-drift into main 2026-10-02 18:30:48 -04:00

Conversation 0 Commits 3 Files changed 18 +292 -34

jfraeys commented 2026-10-02 18:30:43 -04:00

Owner

Copy link

No description provided.

jfraeys added 3 commits 2026-10-02 18:30:43 -04:00

ci: add download-hygiene guard, lint workflow and weekly pin-drift check; fix molecule hardening ... 64a6d430c7

- scripts/check-downloads.py: hygiene (pipe-to-shell, get_url checksum, pip pin) and drift (key hashes, yq, release URLs)
- lint.yml: hygiene + shellcheck block; ansible-lint/yamllint advisory
- pin-drift.yml: weekly upstream comparison
- hardening: skip reboot-required timer start under molecule (no systemd)
- config.sh: detect Colima's ~/.config socket path

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(lint): clean ansible-lint, align Python/tooling versions ... 5c22521ae1

- fqcn fixes (include_vars, apt, ufw, posix.mount), play name, comment spacing
- .ansible-lint: skip stylistic rules, exclude molecule scaffolding
- lint.yml: install pinned tooling from requirements.txt, dummy vault file; all steps block
- requirements.txt: add ansible-lint, yamllint
- .python-version 3.13 (newest supported by ansible-core 2.19); molecule-test.sh builds .venv to match

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(molecule-test): fall back to system python3 when .python-version isn't installable ... c624e8e63e

The Debian 12 CI runner has no uv or python3.13; --setup must not abort there.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit aac80235f2 into main 2026-10-02 18:30:48 -04:00

jfraeys referenced this pull request from a commit 2026-10-02 18:30:50 -04:00

Merge pull request 'ci/guards-and-drift' (#6) from ci/guards-and-drift into main

jfraeys referenced this pull request 2026-10-14 12:00:53 -04:00

Roadmap: remaining infra and secrets work (tracker) #122

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!6

No description provided.