feat(workflows): add reusable ansible-lint and ansible-molecule workflows#243
Merged
Conversation
…lows Add two reusable workflows for Ansible role repos, mirroring the inline jobs currently duplicated across them: - ansible-lint.yml: checkout + setup-python + pip install + optional ansible-galaxy install + ansible-lint, with a soft-fail toggle. - ansible-molecule.yml: checkout + setup-python + pip install + optional ansible-galaxy install + molecule <command> [-s <scenario>], with a molecule-env passthrough, destroy-after cleanup, and an assert-output-absent guard for no_log credential-leak scenarios. Both pin the same action SHAs already used across this repo (checkout v7, setup-python v6.3.0, harden-runner v2.20.0), so Renovate bumps them once here instead of per consumer repo. Index them in the reusable-workflow permissions table (contents: read). Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation in docs/reusable-workflow-permissions.md to include ansible-lint.yml and ansible-molecule.yml in the list of reusable workflows that require contents: read permissions. There are no review comments, so there is no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
This was referenced Jul 20, 2026
setup-python errors with 'no file matched **/requirements.txt or **/pyproject.toml' when cache: pip is set but the repo ships no pip lockfile — which Ansible role repos generally do not. Default cache to empty (disabled); callers with a lockfile opt in via cache + cache-dependency-path. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
|
CybotTM
added a commit
to netresearch/ansible-role-monitoring-server
that referenced
this pull request
Jul 20, 2026
netresearch/.github#243 merged, so the reusable now exists on main. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
CybotTM
added a commit
to netresearch/ansible_role_docker_containers
that referenced
this pull request
Jul 20, 2026
netresearch/.github#243 merged, so the reusables now exist on main. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
CybotTM
added a commit
to netresearch/coding_agent_cli_toolset
that referenced
this pull request
Jul 20, 2026
…ity job (#116) ## What Continues moving this repo's CI onto the shared `netresearch/.github` reusables (the `test` and `security.yml` jobs already use them): - **`lint`** → folds the inline flake8 + mypy job into **`python-ci.yml@main`** (`run-lint` + `run-type-check`, tests off), mirroring how the `test` job already calls it. flake8 keeps both passes (blocking select + `--exit-zero` complexity); mypy stays non-blocking (`|| true`). - **`security`** → **removed.** It duplicated `security.yml`, which already runs bandit + pip-audit via the shared `python-audit.yml` reusable on push/PR/schedule. Removes this workflow's inline `checkout` + `setup-python` for both jobs (`-55 / +22`). ## Why `actions/setup-python` was pinned inline in every job, so Renovate opened a per-repo bump PR (#115 was the latest). Routing jobs through reusables maintains those pins once in `netresearch/.github`. ## Not centralized (bespoke — no reusable fits) `build` (wheel + twine), `docs` (README/YAML checks), `integration-e2e` (CLI e2e), and `shell-tests` keep their inline steps — `python-ci.yml` can't express them without misusing its lint/type/test toggles. Their `setup-python` stays inline, so Renovate will still bump those. Centralizing them would need a new generic "python-command" reusable in `netresearch/.github` — happy to author one as a follow-up if wanted. ## Independent Uses `python-ci.yml@main`, already live — no dependency on netresearch/.github#243.
CybotTM
added a commit
to netresearch/ansible_role_docker_containers
that referenced
this pull request
Jul 20, 2026
## What Routes all three CI jobs through the org's shared reusable workflows in `netresearch/.github` instead of maintaining inline `checkout` + `setup-python` + tooling steps: - `molecule` → **`ansible-molecule.yml`** (`molecule test`) - `lint` → **`ansible-lint.yml`** (Galaxy `requirements.yml` + `ansible ansible-lint yamllint`) - `no-log-leak` → **`ansible-molecule.yml`** (`converge -s no-log-leak`, `destroy-after`, and `assert-output-absent: CANARY_DEPLOY_TOKEN_must_not_appear`) The `no-log-leak` guard is preserved: the reusable captures molecule output, fails if the canary appears, **and** fails if the converge didn't actually run (so it can't pass vacuously). The `requests<2.32.0` pin and the `ANSIBLE_*` env vars carry over via inputs. Net: `-59 / +36` lines; no inline external-action pins left. ## Why `actions/setup-python` (and `checkout`) were pinned inline here, so Renovate opened a per-repo bump PR (#24). With the jobs routed through reusables, those SHAs are maintained once in `netresearch/.github`. ## Supersedes **#24** (the per-repo `setup-python` v7 bump) — this removes the inline `setup-python` steps entirely, so #24 becomes moot and can be closed once this merges. ## Depends on netresearch/.github#243 (adds `ansible-molecule.yml` + `ansible-lint.yml`). The `uses:` refs point at that PR's branch `@feat/ansible-reusables` for validation and **flip to `@main` before merge**, once #243 lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds two reusable workflows for the org's Ansible role repos, centralizing the inline CI jobs currently copied into each role:
ansible-lint.yml— checkout +setup-python(pip cache) +pip install+ optionalansible-galaxy install -r+ansible-lint, with asoft-failtoggle (mirrors a per-repocontinue-on-error: true).ansible-molecule.yml— checkout +setup-python(pip cache) +pip install+ optionalansible-galaxy install -r+molecule <command> [-s <scenario>], with:molecule-envpassthrough (e.g.ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true),destroy-aftercleanup for non-self-destroying commands (converge),assert-output-absentguard: capture output, fail if a given fixed string appears and if the run didn't actually succeed (so ano_logcredential-leak assertion can't pass vacuously). The secret string stays in the consumer.Both are indexed in
docs/reusable-workflow-permissions.md(contents: read).Why
actions/setup-python(andcheckout) are pinned inline in every Ansible role repo, so Renovate opens a bump PR per repo (e.g. the three that prompted this). Routing those jobs through reusables here means the pinned SHAs are bumped once in.githuband every consumer inherits it via@main.Version pinning
Both files pin the same SHAs already used across this repo —
checkout@…9c091bb # v7,setup-python@…ece7cb06 # v6.3.0,harden-runner@…bf7454d0 # v2.20.0— to avoid version skew; Renovate then bumps all setup-python refs in this repo together.Consumers (follow-up PRs)
netresearch/ansible-role-monitoring-server→ansible-lint.yml(soft-fail: true) + existinglint-yaml.ymlnetresearch/ansible_role_docker_containers→ansible-molecule.yml(molecule + no-log-leak) +ansible-lint.ymlThose PRs reference this branch for validation and flip to
@mainonce this merges.Verification
Local
actionlint(+ shellcheck),yamllint(repo config),zizmor— all clean. All caller input routed throughenv:; nogithub.event.*;persist-credentials: false.