deployments/.github/workflows/test.yml at fd5ef7d5a266bb0b616f5ea4c014d3ec135eb5f1 · Haidra-Org/deployments · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# CI for haidra.deployments collection
# Runs linting and integration tests on PRs and pushes to protected branches.
#
# Division of responsibility (see also: role-tests.yml):
#   - test.yml (this file): Collection-level lint, Ansible syntax-check,
#     and Docker-in-Docker integration tests (push only). Covers all roles
#     collectively.
#   - role-tests.yml: Per-suite render checks, policy-contract enforcement,
#     and per-role integration smoke tests. Owns the per-role test matrix.
#
# Security model:
#   - Lint and syntax-check jobs run on all triggers (no privileges needed).
#   - Integration tests use --privileged Docker containers (systemd-in-Docker)
#     and are restricted to push events only. Fork PRs cannot trigger them.
#   - The render-check job (PRs) performs Ansible --syntax-check only — no
#     Docker containers, no --privileged execution.
#   - Enable "Require approval for all outside collaborators" in repo
#     Settings → Actions for defense-in-depth.

name: CI

on:
  pull_request:
    paths:
      - "roles/**"
      - "tests/**"
      - "examples/**"
      - "galaxy.yml"
      - ".github/workflows/test.yml"
  push:
    branches: [main, prom-changes]
    paths:
      - "roles/**"
      - "tests/**"
      - "examples/**"
      - "galaxy.yml"
      - ".github/workflows/test.yml"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint (YAML + Ansible)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install linters
        run: pip install yamllint ansible-lint ansible

      - name: yamllint
        run: |
          yamllint -d '{extends: default, rules: {line-length: {max: 200}, truthy: {check-keys: false}}}' \
            $(find roles/ -name '*.yml' -not -path 'roles/geerlingguy.*/*') \
            tests/**/*.yml examples/

      - name: ansible-lint
        run: |
          shopt -s globstar
          ansible-lint roles/ tests/**/test_*.yml examples/

  integration:
    name: Integration tests
    # Only run on push (not fork PRs) — uses --privileged containers.
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Ansible
        run: pip install ansible

      - name: Install collection dependencies
        run: ansible-galaxy collection install -r requirements.yml --force

      - name: Log in to Docker Hub
        if: vars.DOCKERHUB_USERNAME != ''
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Cache test Docker image
        uses: actions/cache@v4
        with:
          path: /tmp/test-image.tar
          key: test-image-${{ hashFiles('tests/Dockerfile.systemd') }}

      - name: Load cached image (if available)
        run: |
          if [ -f /tmp/test-image.tar ]; then
            docker load -i /tmp/test-image.tar
          fi

      - name: Run integration tests
        run: bash tests/run_tests.sh

      - name: Save test image for cache
        if: always()
        run: |
          docker image inspect horde-test-systemd >/dev/null 2>&1 && \
            docker save horde-test-systemd -o /tmp/test-image.tar || true

  render-check:
    name: Render check (PR)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Ansible
        run: pip install ansible

      - name: Install collection dependencies
        run: ansible-galaxy collection install -r requirements.yml --force

      - name: Syntax check all test playbooks
        env:
          ANSIBLE_ROLES_PATH: ${{ github.workspace }}/roles
          ANSIBLE_HOST_KEY_CHECKING: "False"
        run: |
          shopt -s globstar
          for pb in tests/**/test_*.yml; do
            echo "--- Syntax-checking $pb ---"
            ansible-playbook --syntax-check "$pb" -i tests/inventory_docker.ini
          done