Public Access
Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Emil Simeonov
|
85a36d42cd | ||
|
Emil Simeonov
|
454fbaf56a |
@@ -21,9 +21,6 @@ name: Post-merge
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
# Implements: REQ-1 — manual recovery when a [skip ci] squash title
|
||||
# suppresses the push-triggered post-merge run.
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: post-merge-${{ github.ref }}
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 Joseph Kato
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -1,38 +0,0 @@
|
||||
# The words behind a SMOG or Gunning fog score: each one of three or more
|
||||
# syllables. The scores say a paragraph reads hard; this says which words
|
||||
# made it so. Syllables are counted by vowel groups, with the silent e and
|
||||
# the -ed and -es endings taken off, which agrees with the scores' count on
|
||||
# nearly every word and errs on the long side for the rest.
|
||||
#
|
||||
# A suggestion, since a paragraph can carry a few. Turn it on while bringing
|
||||
# a score down, and off again after. See issue 8.
|
||||
extends: script
|
||||
message: "'%s' has three or more syllables. It counts toward the SMOG and Gunning fog scores."
|
||||
link: https://en.wikipedia.org/wiki/SMOG
|
||||
level: suggestion
|
||||
scope: paragraph
|
||||
script: |
|
||||
text := import("text")
|
||||
|
||||
matches := []
|
||||
for m in text.re_find(`[A-Za-z]+(?:'[A-Za-z]+)?`, scope, -1) {
|
||||
w := text.to_lower(m[0].text)
|
||||
if len(w) < 5 {
|
||||
continue
|
||||
}
|
||||
groups := text.re_find(`[aeiouy]+`, w, -1)
|
||||
n := groups == undefined ? 0 : len(groups)
|
||||
if text.has_suffix(w, "e") && !text.has_suffix(w, "le") && !text.has_suffix(w, "ee") {
|
||||
n--
|
||||
}
|
||||
if text.has_suffix(w, "ed") && !text.re_match(`[td]ed$`, w) {
|
||||
n--
|
||||
}
|
||||
if text.has_suffix(w, "es") && !text.re_match(`[sxz]es$|[cs]hes$`, w) {
|
||||
n--
|
||||
}
|
||||
if n >= 3 {
|
||||
matches = append(matches, {begin: m[0].begin, end: m[0].end})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,7 +1,4 @@
|
||||
{
|
||||
"feed": "https://github.com/vale-cli/readability/releases.atom",
|
||||
"vale_version": ">=2.13.0",
|
||||
"license_files": [
|
||||
"LICENSE"
|
||||
]
|
||||
}
|
||||
"feed": "https://github.com/errata-ai/Readability/releases.atom",
|
||||
"vale_version": ">=2.13.0"
|
||||
}
|
||||
@@ -172,7 +172,7 @@ Every change starts with a spec. No spec, no code.
|
||||
**CI gates (pre-merge):**
|
||||
- `devx.ci.validate_spec` — checks spec exists, has required sections, REQ-IDs, all ACs checked
|
||||
- `devx.ci.check_pr_size` — max 500 lines / 10 files (excludes CHANGELOG, badges, locks)
|
||||
- `devx.ci.fast_molecule` — full `molecule test` for changed roles only (scoped, single platform)
|
||||
- `devx.ci.fast_molecule` — converge+verify only for changed roles, single platform
|
||||
|
||||
**Nightly (infra only):**
|
||||
- Full molecule suite (all scenarios, all platforms) + staging deploy + integration tests
|
||||
|
||||
@@ -2,18 +2,6 @@
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [0.55.4] - 2026-09-23
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Fail-open molecule selection and honest fast-path contract
|
||||
|
||||
## [0.55.3] - 2026-09-21
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Honor repo bandit config in badge quality check
|
||||
|
||||
## [0.55.2] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.4",
|
||||
"devx>=0.55.2",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
@@ -101,8 +101,8 @@ pip install -e .
|
||||
```
|
||||
|
||||
> **Note:** If your project requires a specific devx version, pin it in
|
||||
> `dependencies` (for example, `"devx==0.55.4"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.4,<0.56"`).
|
||||
> `dependencies` (for example, `"devx==0.55.2"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.2,<0.56"`).
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
+8
-8
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.4",
|
||||
"devx>=0.55.2",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
|
||||
```
|
||||
|
||||
Pin a specific version if needed: `"devx==0.55.4"` or `"devx>=0.55.4,<0.56"`.
|
||||
Pin a specific version if needed: `"devx==0.55.2"` or `"devx>=0.55.2,<0.56"`.
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
# DEVX-177: Honest molecule selection — fail-open coverage and real command contract
|
||||
|
||||
## Problem
|
||||
|
||||
`devx.molecule.molecule_changed` and `devx.ci.fast_molecule` violate the
|
||||
S09/REQ-9 honesty contract in three ways:
|
||||
|
||||
1. **Silent skips.** `detect_changed_roles` only knows four playbooks and
|
||||
`ansible/roles/`. Changes to `restore.yml`, `deploy-sso-bridge.yml`,
|
||||
`upgrade-postgres.yml`, `rolling-update-gitea.yml`,
|
||||
`update-alertmanager.yml`, `build-image.yml`, `playbooks/_tasks/`,
|
||||
`playbooks/tasks/`, or `ansible/group_vars/` trigger zero molecule
|
||||
coverage — the fast path passes by skipping work.
|
||||
2. **Phantom targets.** `ROLE_TARGET_MAP` includes `sso_config` (role
|
||||
moved to the sso-bridge repo) and emits `molecule-crowdsec` /
|
||||
`molecule-disk-cleanup` targets that do not exist in infra's Makefile.
|
||||
Playbook mappings also inject absent roles, so `make molecule-changed`
|
||||
can select nonexistent targets.
|
||||
3. **Dishonest contract.** `fast_molecule` documents "converge + verify
|
||||
only, no idempotence" and builds `molecule test -s X --destroy=never
|
||||
--platform-name=...` commands that nothing executes — CI actually runs
|
||||
full `molecule test -s X` via `run_molecule_scenario.py` (which does
|
||||
include idempotence where the scenario defines it).
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Fail-open coverage in `detect_changed_roles` — add the missing
|
||||
playbook→role mappings; `ansible/group_vars/**` and any other
|
||||
`ansible/playbooks/**` file (including `_tasks/`/`tasks/`) not explicitly
|
||||
mapped select all molecule-covered roles. `ansible/environments/` stays
|
||||
unmapped (env data is covered by unit/deploy tests, not molecule) and is
|
||||
documented as such.
|
||||
|
||||
REQ-2: Selection only emits roles that exist — `detect_changed_roles`
|
||||
gains a `roles_dir` parameter; role names from file paths and playbook
|
||||
maps are kept only when `<roles_dir>/<role>` exists. Shared-path and
|
||||
fail-open "all roles" resolution returns only directories under
|
||||
`roles_dir` containing a `molecule/` dir (untestable roles select
|
||||
nothing rather than phantom targets).
|
||||
|
||||
REQ-3: Honest fast-molecule contract — `build_molecule_commands` emits
|
||||
exactly what the CI runner executes (`molecule test -s <scenario>`);
|
||||
docstrings state the real sequence (full `molecule test` per scenario on
|
||||
changed roles, single platform as configured by the scenario) instead of
|
||||
the old "converge + verify only" claim.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Update `test_molecule_changed.py`: unmapped playbook → all present
|
||||
roles; `group_vars` change → all; mapped playbook → mapped roles only;
|
||||
role absent from `roles_dir` → filtered out; shared path → only roles
|
||||
with `molecule/` dirs.
|
||||
- Update `test_fast_molecule.py`: emitted commands are `molecule test -s
|
||||
<scenario>` with no `--destroy`/`--platform-name` flags.
|
||||
- `make pytest-cov` (100% gate), `make lint-all`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Merge → devx release publishes automatically → infra dep-PR bumps the
|
||||
pin; the honest selection takes effect on the next infra CI run.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the squash commit; previous (under-covering) selection returns —
|
||||
acceptable short-term because coverage only widens with this change.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: All `ansible/playbooks/**` and `ansible/group_vars/**`
|
||||
changes select molecule coverage; unmapped files fail open to all
|
||||
testable roles.
|
||||
- [x] REQ-2: No nonexistent roles or make targets are emitted; `sso_config`
|
||||
no longer appears when absent from `roles_dir`.
|
||||
- [x] REQ-3: `build_molecule_commands` output matches the executed CI
|
||||
command shape; module docstrings describe the real sequence.
|
||||
- [x] Unit tests cover every new behavior; 100% coverage maintained.
|
||||
@@ -1,38 +0,0 @@
|
||||
# DEVX-178: PLAYBOOK_ROLE_MAP entry for deploy-controller playbook
|
||||
|
||||
## Problem
|
||||
|
||||
OBL-INFRA-655 adds the `deploy-controller.yml` playbook in the infra repo to the infra
|
||||
repo (drives the new `deploy_controller` role). The infra molecule
|
||||
coverage guard (`test_every_playbook_is_mapped`) requires every playbook
|
||||
under `ansible/playbooks/` to appear in `PLAYBOOK_ROLE_MAP`. Without the
|
||||
entry, the guard fails and unmapped playbooks fail open to all testable
|
||||
roles — correct but wasteful.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Add a `deploy-controller.yml` → `['deploy_controller']` entry
|
||||
to `PLAYBOOK_ROLE_MAP` in `src/devx/molecule/molecule_changed.py` so
|
||||
changes to the playbook select the `deploy_controller` molecule scenario.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Existing `test_molecule_changed.py` mapping tests cover new entries
|
||||
generically; add an explicit assertion that the deploy-controller
|
||||
playbook maps to `deploy_controller`.
|
||||
- `make pytest-cov` (100% gate), `make lint-all`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Merge → devx release publishes automatically → infra dep-PR bumps the
|
||||
pin; the mapping takes effect on the next infra CI run.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the squash commit; infra playbook falls back to fail-open all-role
|
||||
selection (safe, slower).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: the deploy-controller playbook key maps to `["deploy_controller"]` in `PLAYBOOK_ROLE_MAP`.
|
||||
- [x] Unit test pins the mapping; 100% coverage maintained.
|
||||
@@ -1,49 +0,0 @@
|
||||
# DEVX-179: auto-merge must never select `[skip ci]` squash titles
|
||||
|
||||
## Problem
|
||||
|
||||
PR #351 squash-merged as `DEVX-178: chore: update badge URLs to commit
|
||||
4422c70b [skip ci]`. `extract_conventional_msg` picked a commit subject
|
||||
carrying `[skip ci]` — a master badge commit surfaced in the PR's commit
|
||||
list after force-push/amend rewrote branch history. The resulting merge
|
||||
commit suppressed the post-merge push run: no release, no publish, no
|
||||
wiki sync, no Vikunja close.
|
||||
|
||||
PR #352 shows the secondary defect: two `ci:` commits on the branch and
|
||||
the older one won the tie, so the squash title described a throwaway
|
||||
retrigger commit instead of the real change.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Subjects containing `[skip ci]`, `[ci skip]`, or `[skip actions]`
|
||||
(case-insensitive) are ineligible merge titles. They are excluded before
|
||||
priority scoring, so a badge/chore/`[skip ci]` commit can never suppress
|
||||
the post-merge pipeline again.
|
||||
|
||||
REQ-2: Equal-priority ties resolve to the newest commit in the returned
|
||||
list (Gitea returns PR commits newest-first; iterate in returned order
|
||||
and keep the first best candidate).
|
||||
|
||||
## Test Plan
|
||||
|
||||
- `test_auto_merge.py`: commits `[ci retrigger, badge-chore-skipci]` →
|
||||
the `ci` subject wins; commits `[older-ci, newer-ci]` → newest wins;
|
||||
all commits `[skip ci]` → falls back to newest non-skipped subject.
|
||||
- `make pytest-cov` (100% gate), `make lint-all`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Merge as `fix:` → post-merge cuts a release that also ships DEVX-178's
|
||||
PLAYBOOK_ROLE_MAP entry.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the squash commit; extract behavior returns to the previous
|
||||
(unhardened) selection.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: `[skip ci]`/`[ci skip]`/`[skip actions]` subjects are never
|
||||
selected.
|
||||
- [x] REQ-2: Equal-priority ties pick the newest commit.
|
||||
- [x] Unit tests cover both; 100% coverage maintained.
|
||||
@@ -1,35 +0,0 @@
|
||||
# DEVX-180: Add workflow_dispatch trigger to post-merge workflow
|
||||
|
||||
## Problem
|
||||
|
||||
When auto-merge produces a `[skip ci]` squash title (DEVX-179), the
|
||||
post-merge push run is suppressed — release, publish, wiki sync, Vikunja
|
||||
close, and badges are all skipped with no manual recovery path, because
|
||||
`post-merge.yml` only triggers on `push`.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Add `workflow_dispatch:` to the `on:` block of
|
||||
`.gitea/workflows/post-merge.yml` so a missed or skipped post-merge run
|
||||
can be dispatched manually on master.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- `make workflow-check` (actionlint + act_runner dryrun) validates the
|
||||
trigger syntax.
|
||||
- Post-merge: dispatch the workflow manually once and confirm it runs
|
||||
on master.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
Merge → post-merge push run fires normally → then dispatch
|
||||
`post-merge.yml` on master to recover the suppressed DEVX-178 release.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the one-line trigger addition.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: `workflow_dispatch` present in `post-merge.yml` `on:` block;
|
||||
actionlint and act_runner dryrun pass.
|
||||
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.4",
|
||||
"devx>=0.55.2",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"devx>=0.55.4",
|
||||
"devx>=0.55.2",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
|
||||
molecule testing helpers for Ansible projects.
|
||||
"""
|
||||
|
||||
__version__ = "0.55.4"
|
||||
__version__ = "0.55.2"
|
||||
|
||||
@@ -184,31 +184,22 @@ def validate_pr_title_matches_vikunja(pr_title: str, task_id: str) -> None:
|
||||
)
|
||||
|
||||
|
||||
# Subjects carrying these tokens suppress post-merge CI entirely — strip them
|
||||
# before a commit message can become the squash title (see DEVX-179).
|
||||
_SKIP_CI_RE = re.compile(r"\s*\[(?:ci skip|skip ci|skip actions|actions skip|skip)\]", re.IGNORECASE)
|
||||
|
||||
|
||||
def extract_conventional_msg(commits: list[dict[str, Any]]) -> str:
|
||||
"""Extract the conventional commit message from PR commits.
|
||||
|
||||
Picks the highest-priority conventional commit message from the PR.
|
||||
Priority: feat > fix > refactor > docs > chore > other. The Gitea
|
||||
``/pulls/{n}/commits`` endpoint returns commits newest-first, so the
|
||||
first best-scoring subject wins equal-priority ties.
|
||||
``[skip ci]``-style tokens are stripped from every candidate so the
|
||||
merge title can never suppress the post-merge release pipeline.
|
||||
Priority: feat > fix > refactor > docs > chore > other.
|
||||
Falls back to the newest commit message if none match.
|
||||
"""
|
||||
priority = {"feat": 5, "fix": 4, "refactor": 3, "docs": 2, "chore": 1, "ci": 1, "style": 1, "test": 1}
|
||||
best_msg = ""
|
||||
best_score = 0
|
||||
for commit in commits:
|
||||
for commit in reversed(commits):
|
||||
commit_info = commit.get("commit", {})
|
||||
message = str(commit_info.get("message", "") if isinstance(commit_info, dict) else "").split("\n")[0]
|
||||
# Strip any leading task ID prefix (e.g. "OBL-INFRA-364: fix: ...") so
|
||||
# conventional commit matching works on the remainder; drop CI-skip
|
||||
# tokens so they never reach the merge title.
|
||||
stripped = _SKIP_CI_RE.sub("", _TASK_ID_PREFIX_RE.sub("", message)).strip()
|
||||
# conventional commit matching works on the remainder.
|
||||
stripped = _TASK_ID_PREFIX_RE.sub("", message)
|
||||
m = CONVENTIONAL_RE.match(stripped)
|
||||
if m:
|
||||
prefix = m.group(1).split("(")[0].strip() # e.g. "feat" from "feat(scope)"
|
||||
@@ -218,11 +209,11 @@ def extract_conventional_msg(commits: list[dict[str, Any]]) -> str:
|
||||
best_msg = stripped
|
||||
if best_msg:
|
||||
return best_msg
|
||||
# Fallback: the newest commit's first line (newest-first API order).
|
||||
# Fallback: use the newest commit's first line (strip task ID prefix if present)
|
||||
if commits:
|
||||
commit_info = commits[0].get("commit", {})
|
||||
commit_info = commits[-1].get("commit", {})
|
||||
raw = str(commit_info.get("message", "") if isinstance(commit_info, dict) else "").split("\n")[0]
|
||||
return _SKIP_CI_RE.sub("", _TASK_ID_PREFIX_RE.sub("", raw)).strip()
|
||||
return _TASK_ID_PREFIX_RE.sub("", raw)
|
||||
return ""
|
||||
|
||||
|
||||
|
||||
@@ -5,19 +5,14 @@
|
||||
Reuses ``devx.molecule.molecule_changed`` for role detection (which handles
|
||||
playbook→role mapping and shared infrastructure paths).
|
||||
|
||||
Fast molecule = full ``molecule test`` for every scenario of each changed
|
||||
role, on the scenario's configured platform. "Fast" means *scoped* (only
|
||||
affected roles, single platform) — never skipped phases: create, converge,
|
||||
idempotence (when the scenario defines it), verify, and destroy all run,
|
||||
exactly as ``scripts/run_molecule_scenario.py`` executes them in CI.
|
||||
|
||||
Used in pre-merge CI to get quick feedback on Ansible changes without
|
||||
running the full all-roles/all-platforms suite (which runs nightly).
|
||||
Fast molecule = converge + verify only, single platform, no idempotence
|
||||
check. Used in pre-merge CI to get quick feedback on Ansible changes
|
||||
without running the full molecule suite (which runs nightly).
|
||||
|
||||
Usage:
|
||||
python -m devx.ci.fast_molecule --base origin/master --head HEAD
|
||||
|
||||
Outputs the list of changed roles and the molecule commands CI runs.
|
||||
Outputs the list of changed roles and the molecule commands to run.
|
||||
In CI, pass ``--github-output`` to set ``fast-molecule-roles`` (space-
|
||||
separated) and ``fast-molecule-needed`` (true/false) for downstream steps.
|
||||
"""
|
||||
@@ -53,19 +48,19 @@ def build_molecule_commands(
|
||||
roles_dir: str = "ansible/roles",
|
||||
platform: str = "ubuntu-2604",
|
||||
) -> list[str]:
|
||||
"""Build the molecule commands CI executes for changed roles.
|
||||
"""Build molecule test commands for changed roles.
|
||||
|
||||
Emits exactly what ``scripts/run_molecule_scenario.py`` runs:
|
||||
``molecule test -s <scenario>`` — the full sequence (create, converge,
|
||||
idempotence, verify, destroy). The ``platform`` argument is accepted
|
||||
for interface stability but is informational: the scenario's
|
||||
``molecule.yml`` selects the platform, and CI distributes scenarios so
|
||||
each runs on a single platform.
|
||||
For each role, runs each scenario with converge + verify only
|
||||
(skip create/destroy between scenarios, skip idempotence).
|
||||
"""
|
||||
commands: list[str] = []
|
||||
for role in sorted(roles):
|
||||
for scenario in get_molecule_scenarios(role, roles_dir):
|
||||
commands.append(f"molecule test -s {scenario}")
|
||||
scenarios = get_molecule_scenarios(role, roles_dir)
|
||||
if not scenarios:
|
||||
continue
|
||||
for scenario in scenarios:
|
||||
cmd = f"molecule test -s {scenario} --destroy=never --platform-name={platform}"
|
||||
commands.append(cmd)
|
||||
return commands
|
||||
|
||||
|
||||
@@ -98,7 +93,7 @@ def cli(
|
||||
write_github_output("fast-molecule-roles", "")
|
||||
return
|
||||
|
||||
roles = detect_changed_roles(files, roles_dir)
|
||||
roles = detect_changed_roles(files)
|
||||
if not roles:
|
||||
click.echo("[fast-molecule] No Ansible roles changed.")
|
||||
if github_output:
|
||||
|
||||
@@ -17,13 +17,8 @@ nextcloud, postgres-upgrade, simple-app), the base target runs all
|
||||
scenarios for that role.
|
||||
|
||||
Playbooks that change also trigger molecule for the roles they include.
|
||||
Shared infrastructure changes (ansible.cfg, requirements.yml, molecule/,
|
||||
group_vars/) trigger all scenarios. Any ``ansible/playbooks/**`` file not
|
||||
in the explicit map fails open to all testable roles — targeted selection
|
||||
must never silently skip coverage.
|
||||
|
||||
Only roles that exist on disk and contain a ``molecule/`` directory are
|
||||
selected, so emitted make targets always resolve.
|
||||
Shared infrastructure changes (ansible.cfg, requirements.yml, molecule/)
|
||||
trigger all scenarios.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
@@ -35,29 +30,26 @@ import click
|
||||
|
||||
REPO_ROOT = Path.cwd()
|
||||
|
||||
|
||||
def role_to_target(role: str) -> str:
|
||||
"""Make target for a role: docker_base -> molecule-docker-base."""
|
||||
return f"molecule-{role.replace('_', '-')}"
|
||||
|
||||
# Map role names to make targets.
|
||||
ROLE_TARGET_MAP: dict[str, str] = {
|
||||
"app_container": "molecule-app-container",
|
||||
"app_hardening": "molecule-app-hardening",
|
||||
"crowdsec": "molecule-crowdsec",
|
||||
"disk_cleanup": "molecule-disk-cleanup",
|
||||
"docker_base": "molecule-docker-base",
|
||||
"observability": "molecule-observability",
|
||||
"restore": "molecule-restore",
|
||||
"sso_config": "molecule-sso-config",
|
||||
"storage": "molecule-storage",
|
||||
"zitadel": "molecule-zitadel",
|
||||
}
|
||||
|
||||
# Playbooks that map to molecule scenarios (via roles they include).
|
||||
# Any ansible/playbooks/** file NOT listed here fails open to all testable
|
||||
# roles (REQ-1) — a missing entry must never mean "no coverage".
|
||||
PLAYBOOK_ROLE_MAP: dict[str, list[str]] = {
|
||||
"ansible/playbooks/deploy-observability.yml": ["observability", "docker_base", "zitadel", "crowdsec"],
|
||||
"ansible/playbooks/deploy-customer.yml": ["app_container", "docker_base", "app_hardening"],
|
||||
"ansible/playbooks/deploy-controller.yml": ["deploy_controller"],
|
||||
"ansible/playbooks/deploy-customer.yml": ["app_container", "docker_base", "app_hardening", "sso_config"],
|
||||
"ansible/playbooks/configure-oidc.yml": ["sso_config", "app_container"],
|
||||
"ansible/playbooks/prepare-vms.yml": ["docker_base", "app_hardening", "storage", "disk_cleanup", "crowdsec"],
|
||||
"ansible/playbooks/restore.yml": ["restore"],
|
||||
"ansible/playbooks/upgrade-postgres.yml": ["app_container"],
|
||||
"ansible/playbooks/rolling-update-gitea.yml": ["app_container"],
|
||||
"ansible/playbooks/update-alertmanager.yml": ["observability"],
|
||||
"ansible/playbooks/build-image.yml": ["docker_base", "crowdsec", "disk_cleanup"],
|
||||
# sso_bridge role is checked out from the sso-bridge repo at deploy
|
||||
# time — no molecule coverage exists in the consuming repo, so the
|
||||
# explicit empty list documents "mapped, nothing local to test".
|
||||
"ansible/playbooks/deploy-sso-bridge.yml": [],
|
||||
}
|
||||
|
||||
# Shared infrastructure that affects all molecule tests.
|
||||
@@ -65,7 +57,6 @@ SHARED_PATHS = (
|
||||
"ansible/ansible.cfg",
|
||||
"ansible/requirements.yml",
|
||||
"ansible/molecule/",
|
||||
"ansible/group_vars/",
|
||||
)
|
||||
|
||||
# Minimum path parts for a role file: ansible/roles/<role> (3 parts).
|
||||
@@ -94,30 +85,8 @@ def get_changed_files(base: str) -> list[str]:
|
||||
return []
|
||||
|
||||
|
||||
def _testable_roles(roles_dir: Path) -> set[str]:
|
||||
"""Roles present on disk that carry a molecule/ dir (i.e. have scenarios)."""
|
||||
if not roles_dir.is_dir():
|
||||
return set()
|
||||
return {d.name for d in roles_dir.iterdir() if d.is_dir() and (d / "molecule").is_dir()}
|
||||
|
||||
|
||||
def _is_playbook_file(filepath: str) -> bool:
|
||||
"""True for any file under ansible/playbooks/ (yml tasks included)."""
|
||||
return filepath.startswith("ansible/playbooks/")
|
||||
|
||||
|
||||
def detect_changed_roles(
|
||||
changed_files: list[str],
|
||||
roles_dir: str | Path = "ansible/roles",
|
||||
) -> set[str]:
|
||||
"""Detect which roles have changed files.
|
||||
|
||||
Implements: REQ-1, REQ-2 — fail open on unmapped ansible playbook or
|
||||
shared-path changes; only roles that exist under ``roles_dir`` are
|
||||
returned, so emitted targets always resolve.
|
||||
"""
|
||||
roles_path = Path(roles_dir)
|
||||
all_roles = _testable_roles(roles_path)
|
||||
def detect_changed_roles(changed_files: list[str]) -> set[str]:
|
||||
"""Detect which roles have changed files."""
|
||||
roles: set[str] = set()
|
||||
|
||||
for filepath in changed_files:
|
||||
@@ -130,23 +99,23 @@ def detect_changed_roles(
|
||||
# Check if file is a playbook that maps to roles
|
||||
if filepath in PLAYBOOK_ROLE_MAP:
|
||||
roles.update(PLAYBOOK_ROLE_MAP[filepath])
|
||||
elif _is_playbook_file(filepath):
|
||||
# Unmapped playbook/_tasks file — fail open to all testable roles.
|
||||
return set(all_roles)
|
||||
|
||||
# Check shared infrastructure — triggers all roles
|
||||
for shared in SHARED_PATHS:
|
||||
if filepath.startswith(shared):
|
||||
return set(all_roles)
|
||||
return set(ROLE_TARGET_MAP.keys())
|
||||
|
||||
# REQ-2: drop roles that don't exist on disk (e.g. sso_config after the
|
||||
# role moved to the sso-bridge repo) so targets always resolve.
|
||||
return {r for r in roles if (roles_path / r).is_dir()}
|
||||
return roles
|
||||
|
||||
|
||||
def roles_to_targets(roles: set[str]) -> list[str]:
|
||||
"""Convert role names to make targets (conventional molecule-<role>)."""
|
||||
return [role_to_target(role) for role in sorted(roles)]
|
||||
"""Convert role names to make targets."""
|
||||
targets = []
|
||||
for role in sorted(roles):
|
||||
target = ROLE_TARGET_MAP.get(role)
|
||||
if target:
|
||||
targets.append(target)
|
||||
return targets
|
||||
|
||||
|
||||
@click.command()
|
||||
@@ -165,19 +134,14 @@ def roles_to_targets(roles: set[str]) -> list[str]:
|
||||
is_flag=True,
|
||||
help="Print role names (default if no --print-targets).",
|
||||
)
|
||||
@click.option(
|
||||
"--roles-dir",
|
||||
default="ansible/roles",
|
||||
help="Directory containing Ansible roles (default: ansible/roles).",
|
||||
)
|
||||
def main(base: str, print_targets: bool, print_roles: bool, roles_dir: str) -> None:
|
||||
def main(base: str, print_targets: bool, print_roles: bool) -> None:
|
||||
"""Detect which Ansible roles changed and output molecule scenarios."""
|
||||
changed_files = get_changed_files(base)
|
||||
if not changed_files:
|
||||
click.echo("No changed files detected.", err=True)
|
||||
return
|
||||
|
||||
roles = detect_changed_roles(changed_files, roles_dir)
|
||||
roles = detect_changed_roles(changed_files)
|
||||
if not roles:
|
||||
click.echo("No molecule scenarios affected by changes.", err=True)
|
||||
return
|
||||
|
||||
@@ -232,40 +232,6 @@ class TestExtractConventionalMsg:
|
||||
]
|
||||
assert extract_conventional_msg(commits) == "random message"
|
||||
|
||||
def test_skip_ci_subjects_are_ineligible(self) -> None:
|
||||
"""[skip ci] commits must never become the merge title (REQ-1)."""
|
||||
commits = [
|
||||
{"commit": {"message": "ci: retrigger validation"}},
|
||||
{"commit": {"message": "chore: update badge URLs to commit abc123 [skip ci]"}},
|
||||
]
|
||||
assert extract_conventional_msg(commits) == "ci: retrigger validation"
|
||||
|
||||
def test_skip_ci_variants_excluded(self) -> None:
|
||||
"""All skip-token spellings are ineligible."""
|
||||
for token in ("[skip ci]", "[ci skip]", "[skip actions]", "[actions skip]", "[SKIP CI]"):
|
||||
commits = [
|
||||
{"commit": {"message": "feat: real change"}},
|
||||
{"commit": {"message": f"chore: noise {token}"}},
|
||||
]
|
||||
assert extract_conventional_msg(commits) == "feat: real change"
|
||||
|
||||
def test_tie_prefers_newest_commit(self) -> None:
|
||||
"""Equal-priority ties resolve to the newest commit (REQ-2); the
|
||||
API returns commits newest-first."""
|
||||
commits = [
|
||||
{"commit": {"message": "ci: add workflow_dispatch trigger"}},
|
||||
{"commit": {"message": "ci: retrigger validation"}},
|
||||
]
|
||||
assert extract_conventional_msg(commits) == "ci: add workflow_dispatch trigger"
|
||||
|
||||
def test_all_skip_ci_fallback_strips_token(self) -> None:
|
||||
"""When every commit carries [skip ci], the token is stripped so
|
||||
the merge still triggers post-merge."""
|
||||
commits = [
|
||||
{"commit": {"message": "chore: noise [skip ci]"}},
|
||||
]
|
||||
assert extract_conventional_msg(commits) == "chore: noise"
|
||||
|
||||
|
||||
# -- run_cmd --
|
||||
|
||||
|
||||
@@ -40,10 +40,9 @@ class TestBuildMoleculeCommands:
|
||||
|
||||
commands = build_molecule_commands({"role_a", "role_b"}, str(roles_dir))
|
||||
assert len(commands) == 2
|
||||
# REQ-3: emitted commands are exactly what run_molecule_scenario
|
||||
# executes — full `molecule test -s <scenario>`, no synthetic flags.
|
||||
assert commands == ["molecule test -s default", "molecule test -s default"]
|
||||
assert all("--destroy" not in c and "--platform-name" not in c for c in commands)
|
||||
assert all("molecule test -s default" in c for c in commands)
|
||||
assert all("--destroy=never" in c for c in commands)
|
||||
assert all("ubuntu-2604" in c for c in commands)
|
||||
|
||||
def test_empty_when_no_scenarios(self, tmp_path: Path) -> None:
|
||||
commands = build_molecule_commands({"nonexistent"}, str(tmp_path / "ansible" / "roles"))
|
||||
|
||||
@@ -1,195 +1,107 @@
|
||||
"""Unit tests for devx.molecule.molecule_changed.
|
||||
|
||||
Verifies that the script correctly detects changed roles, fails open on
|
||||
unmapped ansible paths, and only emits roles that exist on disk.
|
||||
Verifies that the script correctly detects changed roles and maps
|
||||
them to make targets.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
from unittest.mock import patch
|
||||
|
||||
import pytest
|
||||
from click.testing import CliRunner
|
||||
|
||||
from devx.molecule.molecule_changed import (
|
||||
PLAYBOOK_ROLE_MAP,
|
||||
detect_changed_roles,
|
||||
get_changed_files,
|
||||
main,
|
||||
role_to_target,
|
||||
roles_to_targets,
|
||||
)
|
||||
|
||||
TESTABLE_ROLES = ("docker_base", "app_container", "restore", "observability")
|
||||
|
||||
|
||||
@pytest.fixture()
|
||||
def roles_dir(tmp_path: Path) -> Path:
|
||||
"""Fake roles dir: 4 testable roles (molecule/ present) + 1 untestable."""
|
||||
for role in TESTABLE_ROLES:
|
||||
(tmp_path / role / "molecule" / "default").mkdir(parents=True)
|
||||
(tmp_path / "untested_role").mkdir() # exists but no molecule/ dir
|
||||
return tmp_path
|
||||
|
||||
|
||||
def test_detect_role_change(roles_dir: Path):
|
||||
def test_detect_role_change():
|
||||
"""A file in ansible/roles/<role>/ maps to that role."""
|
||||
roles = detect_changed_roles(["ansible/roles/docker_base/tasks/main.yml"], roles_dir)
|
||||
assert roles == {"docker_base"}
|
||||
files = ["ansible/roles/docker_base/tasks/main.yml"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert "docker_base" in roles
|
||||
|
||||
|
||||
def test_detect_role_not_on_disk_is_dropped(roles_dir: Path):
|
||||
"""Changed role absent from roles_dir selects nothing (REQ-2)."""
|
||||
roles = detect_changed_roles(["ansible/roles/sso_config/tasks/main.yml"], roles_dir)
|
||||
assert roles == set()
|
||||
|
||||
|
||||
def test_detect_playbook_change(roles_dir: Path):
|
||||
"""A mapped playbook maps to its included roles, filtered to disk."""
|
||||
def test_detect_playbook_change():
|
||||
"""A playbook change maps to its included roles."""
|
||||
files = ["ansible/playbooks/deploy-observability.yml"]
|
||||
roles = detect_changed_roles(files, roles_dir)
|
||||
# zitadel + crowdsec are mapped but absent from the fake roles dir.
|
||||
assert roles == {"observability", "docker_base"}
|
||||
roles = detect_changed_roles(files)
|
||||
assert "observability" in roles
|
||||
assert "docker_base" in roles
|
||||
assert "zitadel" in roles
|
||||
|
||||
|
||||
def test_detect_deploy_controller_playbook(roles_dir: Path):
|
||||
"""The deploy-controller playbook maps to the deploy_controller role."""
|
||||
assert PLAYBOOK_ROLE_MAP["ansible/playbooks/deploy-controller.yml"] == ["deploy_controller"]
|
||||
(roles_dir / "deploy_controller" / "molecule" / "default").mkdir(parents=True)
|
||||
roles = detect_changed_roles(["ansible/playbooks/deploy-controller.yml"], roles_dir)
|
||||
assert roles == {"deploy_controller"}
|
||||
def test_detect_shared_infra_triggers_all():
|
||||
"""ansible.cfg change triggers all roles."""
|
||||
files = ["ansible/ansible.cfg"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert len(roles) == 10 # all roles
|
||||
|
||||
|
||||
def test_detect_shared_infra_triggers_all(roles_dir: Path):
|
||||
"""ansible.cfg change triggers all testable roles only."""
|
||||
roles = detect_changed_roles(["ansible/ansible.cfg"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_detect_molecule_shared_path(roles_dir: Path):
|
||||
"""ansible/molecule/ change triggers all testable roles."""
|
||||
roles = detect_changed_roles(["ansible/molecule/Dockerfile"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_detect_requirements_yml_triggers_all(roles_dir: Path):
|
||||
"""ansible/requirements.yml change triggers all testable roles."""
|
||||
roles = detect_changed_roles(["ansible/requirements.yml"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_detect_group_vars_triggers_all(roles_dir: Path):
|
||||
"""ansible/group_vars/ change triggers all testable roles (REQ-1)."""
|
||||
roles = detect_changed_roles(["ansible/group_vars/all/images.yml"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_unmapped_playbook_fails_open(roles_dir: Path):
|
||||
"""An unmapped playbook selects all testable roles (REQ-1)."""
|
||||
roles = detect_changed_roles(["ansible/playbooks/new-deploy.yml"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_playbook_tasks_dir_fails_open(roles_dir: Path):
|
||||
"""Shared playbook task files select all testable roles (REQ-1)."""
|
||||
roles = detect_changed_roles(["ansible/playbooks/_tasks/upgrade-postgres-database.yml"], roles_dir)
|
||||
assert roles == set(TESTABLE_ROLES)
|
||||
|
||||
|
||||
def test_mapped_playbooks(roles_dir: Path):
|
||||
"""Each newly mapped playbook selects its roles (REQ-1)."""
|
||||
expectations = {
|
||||
"ansible/playbooks/restore.yml": {"restore"},
|
||||
"ansible/playbooks/upgrade-postgres.yml": {"app_container"},
|
||||
"ansible/playbooks/rolling-update-gitea.yml": {"app_container"},
|
||||
"ansible/playbooks/update-alertmanager.yml": {"observability"},
|
||||
"ansible/playbooks/build-image.yml": {"docker_base"},
|
||||
"ansible/playbooks/deploy-sso-bridge.yml": set(),
|
||||
}
|
||||
for playbook, expected in expectations.items():
|
||||
assert detect_changed_roles([playbook], roles_dir) == expected, playbook
|
||||
|
||||
|
||||
def test_detect_prepare_vms_playbook(roles_dir: Path):
|
||||
"""prepare-vms.yml maps to all base roles present on disk."""
|
||||
roles = detect_changed_roles(["ansible/playbooks/prepare-vms.yml"], roles_dir)
|
||||
assert roles == {"docker_base"}
|
||||
|
||||
|
||||
def test_detect_deploy_customer_playbook(roles_dir: Path):
|
||||
"""deploy-customer.yml maps to its roles present on disk."""
|
||||
roles = detect_changed_roles(["ansible/playbooks/deploy-customer.yml"], roles_dir)
|
||||
assert roles == {"app_container", "docker_base"}
|
||||
|
||||
|
||||
def test_detect_no_ansible_changes(roles_dir: Path):
|
||||
def test_detect_no_ansible_changes():
|
||||
"""Non-Ansible files don't trigger any roles."""
|
||||
roles = detect_changed_roles(["scripts/x.py", "Makefile"], roles_dir)
|
||||
assert roles == set()
|
||||
|
||||
|
||||
def test_detect_environments_not_molecule_covered(roles_dir: Path):
|
||||
"""ansible/environments/ data is not molecule-covered (documented)."""
|
||||
roles = detect_changed_roles(["ansible/environments/staging/customers.yml"], roles_dir)
|
||||
assert roles == set()
|
||||
|
||||
|
||||
def test_detect_missing_roles_dir():
|
||||
"""A nonexistent roles_dir yields no roles (honest: nothing testable)."""
|
||||
roles = detect_changed_roles(["ansible/roles/docker_base/tasks/main.yml"], "/nonexistent")
|
||||
assert roles == set()
|
||||
|
||||
|
||||
def test_role_to_target():
|
||||
"""Role names map to conventional make targets."""
|
||||
assert role_to_target("docker_base") == "molecule-docker-base"
|
||||
assert role_to_target("app_hardening") == "molecule-app-hardening"
|
||||
files = ["scripts/molecule_changed.py", "Makefile"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert len(roles) == 0
|
||||
|
||||
|
||||
def test_roles_to_targets():
|
||||
"""Role names map to make targets."""
|
||||
targets = roles_to_targets({"docker_base", "zitadel"})
|
||||
assert targets == ["molecule-docker-base", "molecule-zitadel"]
|
||||
assert "molecule-docker-base" in targets
|
||||
assert "molecule-zitadel" in targets
|
||||
|
||||
|
||||
def test_roles_to_targets_unknown_role():
|
||||
"""Unknown roles are silently skipped."""
|
||||
targets = roles_to_targets({"docker_base", "unknown_role"})
|
||||
assert targets == ["molecule-docker-base"]
|
||||
|
||||
|
||||
def test_main_no_changes():
|
||||
"""When no files changed, outputs message to stderr."""
|
||||
with patch("devx.molecule.molecule_changed.get_changed_files", return_value=[]):
|
||||
result = CliRunner().invoke(main, ["--print-targets"])
|
||||
runner = CliRunner()
|
||||
result = runner.invoke(main, ["--print-targets"])
|
||||
assert result.exit_code == 0
|
||||
assert "No changed files" in result.output
|
||||
|
||||
|
||||
def test_main_print_targets(roles_dir: Path):
|
||||
"""--print-targets outputs make targets for existing roles."""
|
||||
def test_main_print_targets():
|
||||
"""--print-targets outputs make targets."""
|
||||
with patch(
|
||||
"devx.molecule.molecule_changed.get_changed_files",
|
||||
return_value=["ansible/roles/docker_base/tasks/main.yml"],
|
||||
):
|
||||
result = CliRunner().invoke(main, ["--print-targets", "--roles-dir", str(roles_dir)])
|
||||
runner = CliRunner()
|
||||
result = runner.invoke(main, ["--print-targets"])
|
||||
assert result.exit_code == 0
|
||||
assert "molecule-docker-base" in result.output
|
||||
|
||||
|
||||
def test_main_print_roles(roles_dir: Path):
|
||||
def test_main_print_roles():
|
||||
"""--print-roles outputs role names."""
|
||||
with patch(
|
||||
"devx.molecule.molecule_changed.get_changed_files",
|
||||
return_value=["ansible/roles/restore/tasks/main.yml"],
|
||||
return_value=["ansible/roles/zitadel/tasks/main.yml"],
|
||||
):
|
||||
result = CliRunner().invoke(main, ["--print-roles", "--roles-dir", str(roles_dir)])
|
||||
runner = CliRunner()
|
||||
result = runner.invoke(main, ["--print-roles"])
|
||||
assert result.exit_code == 0
|
||||
assert "restore" in result.output
|
||||
assert "zitadel" in result.output
|
||||
|
||||
|
||||
def test_main_no_ansible_changes(roles_dir: Path):
|
||||
def test_main_no_ansible_changes():
|
||||
"""When only non-Ansible files changed, outputs no scenarios message."""
|
||||
with patch(
|
||||
"devx.molecule.molecule_changed.get_changed_files",
|
||||
return_value=["scripts/molecule_changed.py"],
|
||||
):
|
||||
result = CliRunner().invoke(main, ["--print-targets", "--roles-dir", str(roles_dir)])
|
||||
runner = CliRunner()
|
||||
result = runner.invoke(main, ["--print-targets"])
|
||||
assert result.exit_code == 0
|
||||
assert "No molecule scenarios" in result.output
|
||||
|
||||
@@ -207,6 +119,7 @@ def test_get_changed_files_falls_back_to_master():
|
||||
|
||||
def mock_git(args):
|
||||
calls.append(args)
|
||||
# First call (origin/master) returns empty, second (master) returns files
|
||||
if "origin/master...HEAD" in args[2]:
|
||||
return ""
|
||||
return "ansible/roles/docker_base/tasks/main.yml\n"
|
||||
@@ -224,12 +137,56 @@ def test_get_changed_files_empty():
|
||||
assert files == []
|
||||
|
||||
|
||||
def test_main_default_base(roles_dir: Path):
|
||||
def test_detect_molecule_shared_path():
|
||||
"""ansible/molecule/ change triggers all roles."""
|
||||
files = ["ansible/molecule/Dockerfile"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert len(roles) == 10
|
||||
|
||||
|
||||
def test_detect_requirements_yml_triggers_all():
|
||||
"""ansible/requirements.yml change triggers all roles."""
|
||||
files = ["ansible/requirements.yml"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert len(roles) == 10
|
||||
|
||||
|
||||
def test_detect_configure_oidc_playbook():
|
||||
"""configure-oidc.yml maps to sso_config and app_container."""
|
||||
files = ["ansible/playbooks/configure-oidc.yml"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert "sso_config" in roles
|
||||
assert "app_container" in roles
|
||||
|
||||
|
||||
def test_detect_prepare_vms_playbook():
|
||||
"""prepare-vms.yml maps to all base roles."""
|
||||
files = ["ansible/playbooks/prepare-vms.yml"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert "docker_base" in roles
|
||||
assert "app_hardening" in roles
|
||||
assert "storage" in roles
|
||||
assert "disk_cleanup" in roles
|
||||
assert "crowdsec" in roles
|
||||
|
||||
|
||||
def test_detect_deploy_customer_playbook():
|
||||
"""deploy-customer.yml maps to its roles."""
|
||||
files = ["ansible/playbooks/deploy-customer.yml"]
|
||||
roles = detect_changed_roles(files)
|
||||
assert "app_container" in roles
|
||||
assert "docker_base" in roles
|
||||
assert "app_hardening" in roles
|
||||
assert "sso_config" in roles
|
||||
|
||||
|
||||
def test_main_default_base():
|
||||
"""main() with no --base uses origin/master."""
|
||||
with patch(
|
||||
"devx.molecule.molecule_changed.get_changed_files",
|
||||
return_value=["ansible/roles/restore/tasks/main.yml"],
|
||||
return_value=["ansible/roles/zitadel/tasks/main.yml"],
|
||||
) as mock:
|
||||
result = CliRunner().invoke(main, ["--print-roles", "--roles-dir", str(roles_dir)])
|
||||
runner = CliRunner()
|
||||
result = runner.invoke(main, ["--print-roles"])
|
||||
assert result.exit_code == 0
|
||||
mock.assert_called_once_with("origin/master")
|
||||
|
||||
Reference in New Issue
Block a user