diff --git a/.github/actions/ansible.ansible-lint/action.yaml b/.github/actions/ansible.ansible-lint/action.yaml new file mode 100644 index 0000000..c65f9c9 --- /dev/null +++ b/.github/actions/ansible.ansible-lint/action.yaml @@ -0,0 +1,142 @@ +name: Ansible - ansible-lint +description: Lint Ansible playbooks and roles with `ansible-lint`. On failure, the findings are added to the job summary. Requires the `ansible-lint` CLI on the `PATH`. + + +inputs: + target_dir: + required: false + default: ./ + description: "(Optional) The Ansible project directory to lint, where `.ansible-lint` and `ansible.cfg` live. Defaults to `./`." + requirements_file: + required: false + description: "(Optional) The path to a Galaxy requirements file, relative to the repository root (e.g. `ansible/requirements.yaml`). When set, its collections are installed outside the checkout and exposed to `ansible-lint` through `ANSIBLE_COLLECTIONS_PATH`, so they are resolvable but never linted. When omitted, `ansible-lint` installs a `requirements.yml` found in the project directory on its own." + annotations_enabled: + required: false + default: "true" + description: "(Optional) Whether to annotate the reported lines in the pull request when `ansible-lint` fails, by re-running it with `-f json` and turning each finding into a workflow error, warning, or notice. Defaults to `true`." + +outputs: + skipped: + value: ${{ steps.target.outputs.skipped }} + description: "`true` when `target_dir` holds no YAML files and `ansible-lint` was not run. Empty otherwise." + # When the collection install fails, `ansible-lint` does not run, so the outputs come from the command that failed. + stdout: + value: ${{ steps.install-collections.outcome == 'failure' && steps.install-collections.outputs.stdout || steps.ansible-lint.outputs.stdout }} + description: "The STDOUT stream of the call to `ansible-lint`, or to `ansible-galaxy collection install` when it failed. Empty when skipped." + stderr: + value: ${{ steps.install-collections.outcome == 'failure' && steps.install-collections.outputs.stderr || steps.ansible-lint.outputs.stderr }} + description: "The STDERR stream of the call to `ansible-lint`, or to `ansible-galaxy collection install` when it failed. Empty when skipped." + exitcode: + value: ${{ steps.install-collections.outcome == 'failure' && steps.install-collections.outputs.exitcode || steps.ansible-lint.outputs.exitcode }} + description: "The exit code of the call to `ansible-lint`, or to `ansible-galaxy collection install` when it failed. Empty when skipped. The action still fails on a non-zero exit code, so use `continue-on-error: true` to inspect it." + + +runs: + using: composite + + steps: + - name: Resolve Target + id: target + shell: bash + env: + TARGET_DIR: ${{ inputs.target_dir }} + REQUIREMENTS_FILE: ${{ inputs.requirements_file }} + run: | + target_dir="${TARGET_DIR%/}" + target_dir="${target_dir:-.}" + echo "target_dir=$target_dir" >> "$GITHUB_OUTPUT" + + # `ansible-lint` exits 0 on a directory without YAML files, which would report a vacuous pass. + if [ -z "$(find "$target_dir" -path '*/.git' -prune -o -type f \( -name '*.yml' -o -name '*.yaml' \) -print -quit)" ]; then + echo "::notice::Skipping ansible-lint: no YAML files in $target_dir." + echo "skipped=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + # Collections go outside the checkout, so they resolve for linting but are never linted themselves. + if [ -n "$REQUIREMENTS_FILE" ]; then + echo "collections_path=$RUNNER_TEMP/ansible/collections" >> "$GITHUB_OUTPUT" + fi + + ansible-lint --version + + - name: Install Galaxy Collections + id: install-collections + if: steps.target.outputs.skipped != 'true' && inputs.requirements_file != '' + uses: tedilabs/github-actions/.github/actions/shell.run@main + env: + REQUIREMENTS_FILE: ${{ inputs.requirements_file }} + COLLECTIONS_PATH: ${{ steps.target.outputs.collections_path }} + with: + run: | + # Restrict the search path so collections already present elsewhere on the runner are not skipped. + ANSIBLE_COLLECTIONS_PATH="$COLLECTIONS_PATH" \ + ansible-galaxy collection install -r "$REQUIREMENTS_FILE" -p "$COLLECTIONS_PATH" + + - name: Add Failure Details to Job Summary + id: install-collections-summary + if: always() && steps.install-collections.outcome == 'failure' + uses: tedilabs/github-actions/.github/actions/github.step-summary@main + with: + title: "❌ ansible-galaxy collection install · ${{ inputs.requirements_file }}" + file: ${{ steps.install-collections.outputs.log_file }} + lang: text + + - name: Run ansible-lint + id: ansible-lint + if: steps.target.outputs.skipped != 'true' + uses: tedilabs/github-actions/.github/actions/shell.run@main + env: + COLLECTIONS_PATH: ${{ steps.target.outputs.collections_path }} + with: + # Run inside the project so `.ansible-lint`, `ansible.cfg`, and relative `roles_path` resolve against it. + working_directory: ${{ steps.target.outputs.target_dir }} + run: | + if [ -n "$COLLECTIONS_PATH" ]; then + export ANSIBLE_COLLECTIONS_PATH="$COLLECTIONS_PATH" + fi + + # Under GitHub Actions, `ansible-lint` emits annotations on its own, with paths relative to this directory + # rather than the repository and without the tool in the title, so they are turned off here and produced + # from its JSON output in the next step instead. + GITHUB_ACTIONS=false ansible-lint --nocolor + + # GitHub only renders annotations from `::error` lines, so the findings are re-read as JSON. Paths are relative + # to the project directory, so `target_dir` is prefixed. + - name: Annotate Findings + id: ansible-lint-annotate + if: always() && inputs.annotations_enabled == 'true' && steps.ansible-lint.outcome == 'failure' + shell: bash + env: + TARGET_DIR: ${{ steps.target.outputs.target_dir }} + COLLECTIONS_PATH: ${{ steps.target.outputs.collections_path }} + run: | + if [ -n "$COLLECTIONS_PATH" ]; then + export ANSIBLE_COLLECTIONS_PATH="$COLLECTIONS_PATH" + fi + + prefix="" + if [ "$TARGET_DIR" != "." ]; then + prefix="$TARGET_DIR/" + fi + + # A workflow command takes one line, so newlines and the property separators are percent-encoded the way + # the runner decodes them. + cd "$TARGET_DIR" + GITHUB_ACTIONS=false ansible-lint --nocolor -f json 2>/dev/null | jq -r --arg prefix "$prefix" ' + def esc: gsub("%"; "%25") | gsub("\r"; "%0D") | gsub("\n"; "%0A"); + def prop: esc | gsub(":"; "%3A") | gsub(","; "%2C"); + .[] + | (if .severity == "minor" then "warning" elif .severity == "info" then "notice" else "error" end) as $severity + | (if (.location.lines.begin // 0) > 0 then ",line=\(.location.lines.begin)" else "" end) as $line + | "::\($severity) file=\($prefix + .location.path)\($line),title=\("ansible-lint · " + .check_name | prop)::\(.description | esc)" + ' || true + + - name: Add Failure Details to Job Summary + id: ansible-lint-summary + if: always() && steps.ansible-lint.outcome == 'failure' + uses: tedilabs/github-actions/.github/actions/github.step-summary@main + with: + title: "❌ ansible-lint · ${{ steps.target.outputs.target_dir }}" + file: ${{ steps.ansible-lint.outputs.log_file }} + lang: text diff --git a/.github/actions/packer.fmt/action.yaml b/.github/actions/packer.fmt/action.yaml new file mode 100644 index 0000000..fe0597e --- /dev/null +++ b/.github/actions/packer.fmt/action.yaml @@ -0,0 +1,98 @@ +name: Packer - Format +description: Check that Packer HCL templates are formatted with `packer fmt`. On failure, the diff is added to the job summary. Requires the `packer` CLI on the `PATH`. + + +inputs: + target_dir: + required: false + default: ./ + description: "(Optional) The directory to check formatting in. Defaults to `./`." + recursive: + required: false + default: "true" + description: "(Optional) Whether to also check subdirectories. Defaults to `true`." + annotations_enabled: + required: false + default: "true" + description: "(Optional) Whether to annotate the unformatted lines in the pull request when `packer fmt` fails, from the hunks of the diff it printed. Defaults to `true`." + +outputs: + skipped: + value: ${{ steps.target.outputs.skipped }} + description: "`true` when `target_dir` holds no Packer HCL files and `packer fmt` was not run. Empty otherwise." + stdout: + value: ${{ steps.fmt.outputs.stdout }} + description: "The STDOUT stream of the call to `packer fmt`. Empty when skipped." + stderr: + value: ${{ steps.fmt.outputs.stderr }} + description: "The STDERR stream of the call to `packer fmt`. Empty when skipped." + exitcode: + value: ${{ steps.fmt.outputs.exitcode }} + description: "The exit code of the call to `packer fmt`. Empty when skipped. The action still fails on a non-zero exit code, so use `continue-on-error: true` to inspect it." + + +runs: + using: composite + + steps: + - name: Resolve Target + id: target + shell: bash + env: + TARGET_DIR: ${{ inputs.target_dir }} + RECURSIVE: ${{ inputs.recursive }} + run: | + target_dir="${TARGET_DIR%/}" + target_dir="${target_dir:-.}" + echo "target_dir=$target_dir" >> "$GITHUB_OUTPUT" + + # `packer fmt` exits 0 on a directory without Packer HCL files, which would report a vacuous pass. + depth_args=() + [ "$RECURSIVE" = "true" ] || depth_args=(-maxdepth 1) + if [ -z "$(find "$target_dir" "${depth_args[@]}" -type f \( -name '*.pkr.hcl' -o -name '*.pkrvars.hcl' \) -print -quit)" ]; then + echo "::notice::Skipping packer fmt: no Packer HCL files in $target_dir." + echo "skipped=true" >> "$GITHUB_OUTPUT" + fi + + - name: Check Packer Format + id: fmt + if: steps.target.outputs.skipped != 'true' + uses: tedilabs/github-actions/.github/actions/shell.run@main + env: + TARGET_DIR: ${{ steps.target.outputs.target_dir }} + RECURSIVE: ${{ inputs.recursive }} + with: + run: | + args=(-check -diff) + if [ "$RECURSIVE" = "true" ]; then + args+=(-recursive) + fi + + packer fmt "${args[@]}" "$TARGET_DIR" + + # The diff already names each file (`+++ new/`) and the first line of every hunk (`@@ -a,b +c,d @@`), so + # the annotations are read from the captured output. `packer fmt` prints the paths as given, relative to the + # repository. + - name: Annotate Findings + id: fmt-annotate + if: always() && inputs.annotations_enabled == 'true' && steps.fmt.outcome == 'failure' + shell: bash + env: + LOG_FILE: ${{ steps.fmt.outputs.log_file }} + run: | + awk ' + /^\+\+\+ new\// { file = substr($0, 9); next } + /^@@ / && file != "" { + line = $3; sub(/^\+/, "", line); sub(/,.*/, "", line) + printf "::error file=%s,line=%s,title=packer fmt · Not formatted::Run `packer fmt` to format this file.\n", file, line + } + ' "$LOG_FILE" + + - name: Add Failure Details to Job Summary + id: fmt-summary + if: always() && steps.fmt.outcome == 'failure' + uses: tedilabs/github-actions/.github/actions/github.step-summary@main + with: + title: "❌ packer fmt · ${{ steps.target.outputs.target_dir }}" + file: ${{ steps.fmt.outputs.log_file }} + lang: diff diff --git a/.github/actions/packer.validate/action.yaml b/.github/actions/packer.validate/action.yaml new file mode 100644 index 0000000..4e834fc --- /dev/null +++ b/.github/actions/packer.validate/action.yaml @@ -0,0 +1,114 @@ +name: Packer - Validate +description: Install the required plugins of a Packer template directory with `packer init` and validate it with `packer validate`. On failure, the output is added to the job summary. Requires the `packer` CLI on the `PATH`. + + +inputs: + target_dir: + required: false + default: ./ + description: "(Optional) The Packer template directory to initialize and validate. Defaults to `./`." + github_token: + required: false + default: ${{ github.token }} + description: "(Optional) The GitHub token used by `packer init` to download plugins from GitHub without hitting the anonymous rate limit, exported as `PACKER_GITHUB_API_TOKEN`. Defaults to the automatically generated `github.token`." + annotations_enabled: + required: false + default: "true" + description: "(Optional) Whether to annotate the failing lines in the pull request when `packer validate` fails, from the `Error:` and `on line ` lines it printed. Defaults to `true`." + +outputs: + skipped: + value: ${{ steps.target.outputs.skipped }} + description: "`true` when `target_dir` holds no Packer template files and neither `packer init` nor `packer validate` was run. Empty otherwise." + # When `packer init` fails, `packer validate` does not run, so the outputs come from the command that failed. + stdout: + value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.stdout || steps.validate.outputs.stdout }} + description: "The STDOUT stream of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped." + stderr: + value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.stderr || steps.validate.outputs.stderr }} + description: "The STDERR stream of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped." + exitcode: + value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.exitcode || steps.validate.outputs.exitcode }} + description: "The exit code of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped. The action still fails on a non-zero exit code, so use `continue-on-error: true` to inspect it." + + +runs: + using: composite + + steps: + - name: Resolve Target + id: target + shell: bash + env: + TARGET_DIR: ${{ inputs.target_dir }} + run: | + target_dir="${TARGET_DIR%/}" + target_dir="${target_dir:-.}" + echo "target_dir=$target_dir" >> "$GITHUB_OUTPUT" + + # `packer validate` fails on a directory without templates, which would report a failure for an empty target. + if [ -z "$(find "$target_dir" -maxdepth 1 -type f \( -name '*.pkr.hcl' -o -name '*.pkr.json' \) -print -quit)" ]; then + echo "::notice::Skipping packer validate: no Packer template files in $target_dir." + echo "skipped=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + packer version + + - name: Packer Init + id: init + if: steps.target.outputs.skipped != 'true' + uses: tedilabs/github-actions/.github/actions/shell.run@main + env: + PACKER_GITHUB_API_TOKEN: ${{ inputs.github_token }} + TARGET_DIR: ${{ steps.target.outputs.target_dir }} + with: + run: | + packer init "$TARGET_DIR" + + - name: Add Failure Details to Job Summary + id: init-summary + if: always() && steps.init.outcome == 'failure' + uses: tedilabs/github-actions/.github/actions/github.step-summary@main + with: + title: "❌ packer init · ${{ steps.target.outputs.target_dir }}" + file: ${{ steps.init.outputs.log_file }} + lang: text + + - name: Packer Validate + id: validate + if: steps.target.outputs.skipped != 'true' + uses: tedilabs/github-actions/.github/actions/shell.run@main + env: + TARGET_DIR: ${{ steps.target.outputs.target_dir }} + with: + run: | + packer validate "$TARGET_DIR" + + # `packer validate` has no machine-readable output, but each diagnostic prints `Error: ` followed by + # `on line :` with the path as given, relative to the repository. + - name: Annotate Findings + id: validate-annotate + if: always() && inputs.annotations_enabled == 'true' && steps.validate.outcome == 'failure' + shell: bash + env: + LOG_FILE: ${{ steps.validate.outputs.log_file }} + run: | + awk ' + /^(Error|Warning): / { severity = tolower($1); sub(/:$/, "", severity); summary = substr($0, index($0, ": ") + 2); next } + /^[[:space:]]+on .+ line [0-9]+/ && summary != "" { + file = $2; line = $4; sub(/[:,].*$/, "", line) + gsub(/%/, "%25", summary) + printf "::%s file=%s,line=%s,title=packer validate · %s::%s\n", severity, file, line, summary, summary + summary = "" + } + ' "$LOG_FILE" + + - name: Add Failure Details to Job Summary + id: validate-summary + if: always() && steps.validate.outcome == 'failure' + uses: tedilabs/github-actions/.github/actions/github.step-summary@main + with: + title: "❌ packer validate · ${{ steps.target.outputs.target_dir }}" + file: ${{ steps.validate.outputs.log_file }} + lang: text diff --git a/.github/workflows/ansible.integration.yaml b/.github/workflows/ansible.integration.yaml new file mode 100644 index 0000000..0c49ed1 --- /dev/null +++ b/.github/workflows/ansible.integration.yaml @@ -0,0 +1,86 @@ +name: Ansible - Integration + + +on: + workflow_call: + inputs: + runs_on: + description: > + JSON-encoded runs-on value. + Examples: + - '"ubuntu-latest"' + - '["self-hosted","linux","x64"]' + required: false + type: string + default: '"ubuntu-latest"' + + target_dir: + type: string + required: false + default: ./ + description: "(Optional) The Ansible project directory to lint, where `.ansible-lint` and `ansible.cfg` live. Defaults to `./`." + requirements_file: + type: string + required: false + description: "(Optional) The path to a Galaxy requirements file, relative to the repository root (e.g. `ansible/requirements.yaml`). When set, its collections are installed so `ansible-lint` can resolve them. When omitted, `ansible-lint` installs a `requirements.yml` found in the project directory on its own." + + python_version: + type: string + required: false + default: latest + description: "(Optional) The version of `python` to install when the repository does not pin one in `mise.toml` or `.tool-versions`. `ansible-lint` is installed into it with `pip`. Defaults to `latest`." + ansible_lint_version: + type: string + required: false + default: latest + description: "(Optional) The version of `ansible-lint` to install with `pip` (e.g. `25.1.3`). Defaults to `latest`." + + +jobs: + lint: + name: Lint (ansible-lint) + runs-on: ${{ fromJson(inputs.runs_on) }} + + steps: + - name: Checkout + id: checkout + uses: actions/checkout@v7 + + # Written to a throwaway global mise config, so the repository's own `mise.toml` / `.tool-versions` + # still take precedence while a self-hosted runner's real global config is left untouched. + - name: Set Default Tool Versions + id: default-tools + env: + PYTHON_VERSION: ${{ inputs.python_version }} + run: | + config_file="$RUNNER_TEMP/mise-defaults.toml" + cat > "$config_file" <> "$GITHUB_ENV" + + - name: Set up tools + id: setup-tools + uses: tedilabs/github-actions/.github/actions/mise.setup-tools@main + + - name: Install ansible-lint + id: install-ansible-lint + env: + ANSIBLE_LINT_VERSION: ${{ inputs.ansible_lint_version }} + run: | + package="ansible-lint" + if [ "$ANSIBLE_LINT_VERSION" != "latest" ]; then + package="ansible-lint==$ANSIBLE_LINT_VERSION" + fi + + python -m pip install --upgrade pip + python -m pip install "$package" + + - name: Lint (ansible-lint) + id: ansible-lint + uses: tedilabs/github-actions/.github/actions/ansible.ansible-lint@main + with: + target_dir: ${{ inputs.target_dir }} + requirements_file: ${{ inputs.requirements_file }} diff --git a/.github/workflows/packer.templates.integration.yaml b/.github/workflows/packer.templates.integration.yaml new file mode 100644 index 0000000..d54ec54 --- /dev/null +++ b/.github/workflows/packer.templates.integration.yaml @@ -0,0 +1,174 @@ +name: Packer Templates - Integration + + +on: + workflow_call: + inputs: + runs_on: + description: > + JSON-encoded runs-on value. + Examples: + - '"ubuntu-latest"' + - '["self-hosted","linux","x64"]' + required: false + type: string + default: '"ubuntu-latest"' + + paths: + type: string + required: false + default: | + builds/** + description: "(Optional) File and directory patterns used to detect changed Packer template directories, one per line. Defaults to `builds/**`." + paths_max_depth: + type: string + required: false + default: "2" + description: "(Optional) The maximum depth of the changed directories to check. For example, `builds/foo/source.pkr.hcl` with a max depth of `2` is checked as `builds/foo`. Defaults to `2`." + + packer_version: + type: string + required: false + default: latest + description: "(Optional) The version of `packer` to install when the repository does not pin one in `mise.toml` or `.tool-versions`. Defaults to `latest`." + aws_region: + type: string + required: false + default: us-east-1 + description: "(Optional) The region exported as `AWS_DEFAULT_REGION` so that Amazon builders without an explicit `region` pass `packer validate` on a runner with no AWS configuration. No credentials are needed. Defaults to `us-east-1`." + + fmt_enabled: + type: boolean + required: false + default: true + description: "(Optional) Whether to check formatting with `packer fmt`. Defaults to `true`." + validate_enabled: + type: boolean + required: false + default: true + description: "(Optional) Whether to run `packer init` and `packer validate`. Defaults to `true`." + + pr_comment_enabled: + type: boolean + required: false + default: true + description: "(Optional) Whether to post the integration report as a single sticky comment on pull requests. Requires the `pull-requests: write` permission on the caller. The report is always written to the job summary. Defaults to `true`." + + +jobs: + changed: + name: Detect Changed Directories + runs-on: ${{ fromJson(inputs.runs_on) }} + + outputs: + has_directories: ${{ steps.changed-dirs.outputs.has_directories }} + directories: ${{ steps.changed-dirs.outputs.directories }} + + steps: + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Get Changed Directories + id: changed-dirs + uses: tedilabs/github-actions/.github/actions/git.changed-dirs@main + with: + paths: ${{ inputs.paths }} + max_depth: ${{ inputs.paths_max_depth }} + + + lint: + name: Lint (${{ matrix.path }}) + needs: + - changed + if: needs.changed.outputs.has_directories == 'true' + runs-on: ${{ fromJson(inputs.runs_on) }} + + strategy: + fail-fast: false + matrix: + path: ${{ fromJson(needs.changed.outputs.directories) }} + + env: + AWS_DEFAULT_REGION: ${{ inputs.aws_region }} + + steps: + - name: Checkout + id: checkout + uses: actions/checkout@v7 + + # Written to a throwaway global mise config, so the repository's own `mise.toml` / `.tool-versions` + # still take precedence while a self-hosted runner's real global config is left untouched. + - name: Set Default Tool Versions + id: default-tools + env: + PACKER_VERSION: ${{ inputs.packer_version }} + run: | + config_file="$RUNNER_TEMP/mise-defaults.toml" + cat > "$config_file" <> "$GITHUB_ENV" + + - name: Set up tools + id: setup-tools + uses: tedilabs/github-actions/.github/actions/mise.setup-tools@main + + - name: Check Format + id: fmt + if: inputs.fmt_enabled + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/packer.fmt@main + with: + target_dir: ${{ matrix.path }} + + - name: Validate + id: validate + if: inputs.validate_enabled + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/packer.validate@main + with: + target_dir: ${{ matrix.path }} + + - name: Collect Results + id: results + if: always() + uses: tedilabs/github-actions/.github/actions/github.matrix-report@main + with: + mode: collect + id: ${{ matrix.path }} + id_label: Directory + artifact_prefix: packer-integration + job_status: ${{ job.status }} + # An empty value keeps a check that is turned off out of the report; a check that ran but had + # nothing to do reports `skipped`. + results: | + { + "fmt": "${{ inputs.fmt_enabled && (steps.fmt.outputs.skipped == 'true' && 'skipped' || steps.fmt.outcome) || '' }}", + "validate": "${{ inputs.validate_enabled && (steps.validate.outputs.skipped == 'true' && 'skipped' || steps.validate.outcome) || '' }}" + } + + + report: + name: Report + needs: + - changed + - lint + if: always() && needs.changed.outputs.has_directories == 'true' + runs-on: ${{ fromJson(inputs.runs_on) }} + + steps: + - name: Publish Report + id: report + uses: tedilabs/github-actions/.github/actions/github.matrix-report@main + with: + mode: publish + id_label: Directory + artifact_prefix: packer-integration + title: Packer Integration + pr_comment_enabled: ${{ inputs.pr_comment_enabled }} + pr_comment_marker: packer-integration diff --git a/.github/workflows/test.packer-ansible-annotations.yaml b/.github/workflows/test.packer-ansible-annotations.yaml new file mode 100644 index 0000000..7ff84a6 --- /dev/null +++ b/.github/workflows/test.packer-ansible-annotations.yaml @@ -0,0 +1,70 @@ +name: Test - Packer and Ansible annotations + + +on: + pull_request: + branches: + - "**" + + +jobs: + test: + name: Test + runs-on: ubuntu-latest + + steps: + - name: Checkout + id: checkout + uses: actions/checkout@v7 + + - name: Set up tools + id: setup-tools + uses: tedilabs/github-actions/.github/actions/mise.setup-tools@main + with: + mise_toml: | + [tools] + packer = "latest" + "pipx:ansible-lint" = "latest" + + - name: packer fmt (annotated) + id: fmt + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/packer.fmt@feat/packer-workflows + with: + target_dir: fixtures/annotations3/pk-fmt + + - name: packer validate (annotated) + id: validate + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/packer.validate@feat/packer-workflows + with: + target_dir: fixtures/annotations3/pk-validate + + - name: ansible-lint (annotated) + id: lint + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/ansible.ansible-lint@feat/packer-workflows + with: + target_dir: fixtures/annotations3/ansible + + - name: ansible-lint (annotations disabled, for comparison) + id: lint-off + continue-on-error: true + uses: tedilabs/github-actions/.github/actions/ansible.ansible-lint@feat/packer-workflows + with: + target_dir: fixtures/annotations3/ansible + annotations_enabled: "false" + + - name: Outcomes + id: outcomes + env: + FMT: ${{ steps.fmt.outcome }}/${{ steps.fmt.outputs.exitcode }} + VALIDATE: ${{ steps.validate.outcome }}/${{ steps.validate.outputs.exitcode }} + LINT: ${{ steps.lint.outcome }}/${{ steps.lint.outputs.exitcode }} + LINT_OFF: ${{ steps.lint-off.outcome }}/${{ steps.lint-off.outputs.exitcode }} + LINT_STDOUT: ${{ steps.lint.outputs.stdout }} + run: | + for v in FMT VALIDATE LINT LINT_OFF; do printf '%s=<%s>\n' "$v" "${!v}"; done + for v in FMT VALIDATE LINT LINT_OFF; do [ "${!v%%/*}" = "failure" ] || { echo "FAIL $v should fail on the fixtures"; exit 1; }; done + case "$LINT_STDOUT" in *"::error"*) echo "FAIL ansible-lint's own annotations leaked into stdout"; exit 1;; esac + echo "All four checks failed as intended, and ansible-lint's own annotations were suppressed." diff --git a/fixtures/annotations3/ansible/playbook.yml b/fixtures/annotations3/ansible/playbook.yml new file mode 100644 index 0000000..1e3fe92 --- /dev/null +++ b/fixtures/annotations3/ansible/playbook.yml @@ -0,0 +1,4 @@ +--- +- hosts: localhost + tasks: + - debug: msg=hello diff --git a/fixtures/annotations3/pk-fmt/build.pkr.hcl b/fixtures/annotations3/pk-fmt/build.pkr.hcl new file mode 100644 index 0000000..63a6c26 --- /dev/null +++ b/fixtures/annotations3/pk-fmt/build.pkr.hcl @@ -0,0 +1,7 @@ +source "null" "example" { + communicator = "none" +} + +build { + sources = ["source.null.example"] +} diff --git a/fixtures/annotations3/pk-validate/build.pkr.hcl b/fixtures/annotations3/pk-validate/build.pkr.hcl new file mode 100644 index 0000000..7e5df1d --- /dev/null +++ b/fixtures/annotations3/pk-validate/build.pkr.hcl @@ -0,0 +1,8 @@ +source "null" "example" { + communicator = "none" + nope = 1 +} + +build { + sources = ["source.null.example"] +}