diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml new file mode 100644 index 0000000..2ab1298 --- /dev/null +++ b/.gitea/workflows/test.yml @@ -0,0 +1,52 @@ +--- +name: test +on: [push] + +jobs: + lint: + name: Linting + runs-on: ubuntu-latest + container: + image: git.ednz.fr/container-factory/ansible-runner:act-latest + credentials: + username: ${{ secrets.ACTIONS_USER }} + password: ${{ secrets.ACTIONS_TOKEN }} + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: "Ansible lint" + run: ansible-lint --force-color + working-directory: ${{ gitea.workspace }} + + - name: "YAML lint" + run: yamllint . -f colored -c .yamllint + working-directory: ${{ gitea.workspace }} + + molecule-test: + name: Molecule tests + runs-on: ubuntu-latest + needs: lint + container: + image: git.ednz.fr/container-factory/ansible-runner:act-latest + credentials: + username: ${{ secrets.ACTIONS_USER }} + password: ${{ secrets.ACTIONS_TOKEN }} + strategy: + matrix: + test_os: [debian11, debian12, ubuntu2004, ubuntu2204] + scenario: [default, with_ssh_keys] + env: + ANSIBLE_HOST_KEY_CHECKING: 'false' + ANSIBLE_FORCE_COLOR: 'true' + ANSIBLE_PYTHON_INTERPRETER: /usr/bin/python3 + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: "Molecule test" + run: molecule test -s ${{ matrix.scenario }} + shell: bash + working-directory: ${{ gitea.workspace }} + env: + MOLECULE_TEST_OS: ${{ matrix.test_os }} diff --git a/molecule/with_ssh_keys/molecule.yml b/molecule/with_ssh_keys/molecule.yml index 758cfbb..817ac08 100644 --- a/molecule/with_ssh_keys/molecule.yml +++ b/molecule/with_ssh_keys/molecule.yml @@ -20,7 +20,7 @@ provisioner: defaults: remote_tmp: /tmp/.ansible verifier: - name: testinfra + name: ansible scenario: name: with_ssh_keys test_sequence: diff --git a/molecule/with_ssh_keys/verify.yml b/molecule/with_ssh_keys/verify.yml index 355e164..1d8fc02 100644 --- a/molecule/with_ssh_keys/verify.yml +++ b/molecule/with_ssh_keys/verify.yml @@ -18,70 +18,70 @@ - stat_etc_hosts.stat.pw_name == 'root' - stat_etc_hosts.stat.gr_name == 'root' - - name: "Test: ansible user and group" + - name: "Test: ubuntu user and group" block: - name: "Getent user ansible" ansible.builtin.getent: database: passwd - key: ansible - register: ednxzu_ansible_user + key: ubuntu + register: ednxzu_management_user - - name: "Getent group ansible" + - name: "Getent group ubuntu" ansible.builtin.getent: database: group - key: ansible - register: ednxzu_ansible_group + key: ubuntu + register: ednxzu_management_group - - name: "Verify ansible user and group" + - name: "Verify ubuntu user and group" ansible.builtin.assert: that: - - not ednxzu_ansible_user.failed - - not ednxzu_ansible_group.failed - - "'ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd.keys()" - - "'/opt/ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" - - "'/bin/bash' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" - - "'ansible' in ednxzu_ansible_group.ansible_facts.getent_group.keys()" + - not ednxzu_management_user.failed + - not ednxzu_management_group.failed + - "'ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd.keys()" + - "'/home/ubuntu' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']" + - "'/bin/bash' in ednxzu_management_user.ansible_facts.getent_passwd['ubuntu']" + - "'ubuntu' in ednxzu_management_group.ansible_facts.getent_group.keys()" - - name: "Test: ansible sudo permissions" + - name: "Test: ubuntu sudo permissions" block: - - name: "Stat file /etc/sudoers.d/ansible" + - name: "Stat file /etc/sudoers.d/ubuntu" ansible.builtin.stat: - path: "/etc/sudoers.d/ansible" - register: stat_etc_sudoers_d_ansible + path: "/etc/sudoers.d/ubuntu" + register: stat_etc_sudoers_d_ubuntu - - name: "Slurp file /etc/sudoers.d/ansible" + - name: "Slurp file /etc/sudoers.d/ubuntu" ansible.builtin.slurp: - src: "/etc/sudoers.d/ansible" - register: slurp_etc_sudoers_d_ansible + src: "/etc/sudoers.d/ubuntu" + register: slurp_etc_sudoers_d_ubuntu - - name: "Verify file /etc/sudoers.d/ansible" + - name: "Verify file /etc/sudoers.d/ubuntu" ansible.builtin.assert: that: - - stat_etc_sudoers_d_ansible.stat.exists - - stat_etc_sudoers_d_ansible.stat.isreg - - stat_etc_sudoers_d_ansible.stat.pw_name == 'root' - - stat_etc_sudoers_d_ansible.stat.gr_name == 'root' - - stat_etc_sudoers_d_ansible.stat.mode == '0440' - - "'ansible ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ansible.content|b64decode)" + - stat_etc_sudoers_d_ubuntu.stat.exists + - stat_etc_sudoers_d_ubuntu.stat.isreg + - stat_etc_sudoers_d_ubuntu.stat.pw_name == 'root' + - stat_etc_sudoers_d_ubuntu.stat.gr_name == 'root' + - stat_etc_sudoers_d_ubuntu.stat.mode == '0440' + - "'ubuntu ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ubuntu.content|b64decode)" - - name: "Test: ansible authorized_keys" + - name: "Test: ubuntu authorized_keys" block: - - name: "Stat file /opt/ansible/.ssh/authorized_keys" + - name: "Stat file /home/ubuntu/.ssh/authorized_keys" ansible.builtin.stat: - path: "/opt/ansible/.ssh/authorized_keys" - register: stat_opt_ansible_ssh_authorized_keys + path: "/home/ubuntu/.ssh/authorized_keys" + register: stat_home_ubuntu_ssh_authorized_keys - - name: "Slurp file /opt/ansible/.ssh/authorized_keys" + - name: "Slurp file /home/ubuntu/.ssh/authorized_keys" ansible.builtin.slurp: - src: "/opt/ansible/.ssh/authorized_keys" - register: slurp_opt_ansible_ssh_authorized_keys + src: "/home/ubuntu/.ssh/authorized_keys" + register: slurp_home_ubuntu_ssh_authorized_keys - - name: "Verify file /opt/ansible/.ssh/authorized_keys" + - name: "Verify file /home/ubuntu/.ssh/authorized_keys" ansible.builtin.assert: that: - - stat_opt_ansible_ssh_authorized_keys.stat.exists - - stat_opt_ansible_ssh_authorized_keys.stat.isreg - - stat_opt_ansible_ssh_authorized_keys.stat.pw_name == 'ansible' - - stat_opt_ansible_ssh_authorized_keys.stat.gr_name == 'ansible' - - stat_opt_ansible_ssh_authorized_keys.stat.mode == '0600' - - "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ansible@instance' in (slurp_opt_ansible_ssh_authorized_keys.content|b64decode)" + - stat_home_ubuntu_ssh_authorized_keys.stat.exists + - stat_home_ubuntu_ssh_authorized_keys.stat.isreg + - stat_home_ubuntu_ssh_authorized_keys.stat.pw_name == 'ubuntu' + - stat_home_ubuntu_ssh_authorized_keys.stat.gr_name == 'ubuntu' + - stat_home_ubuntu_ssh_authorized_keys.stat.mode == '0600' + - "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ubuntu@instance' in (slurp_home_ubuntu_ssh_authorized_keys.content|b64decode)"