chore(ci): run the molecule scenario on every push and pull request

The scenario was only runnable by hand so far, which defeats its purpose. Podman is already installed and
configured on the runners, so the job only has to add molecule itself.

The repository is named ansible-role-certificate-authority while the role is named certificate_authority. Since the
scenario includes the role by its name and uses the parent of the project directory as roles path, the checkout has
to happen into a directory matching the role.

The collections are declared in molecule/default/collections.yml instead of being installed by an explicit step.
That is the path the collections invoker of molecule looks at by default, so the dependency action of the test
sequence installs them for the workflow and for local runs alike.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/molecule.yaml

@@ -0,0 +1,30 @@
+name: Molecule
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+
+permissions:
+  contents: read
+
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    steps:
+    # The scenario includes the role by its name, so the directory must be named like the role and not like the
+    # repository. Its parent is used as roles path.
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        path: certificate_authority
+    - name: Install molecule
+      run: |
+        apt update --yes
+        apt install --yes python3-pip
+        pip3 install --break-system-packages molecule
+    - name: Run molecule
+      run: molecule test
+      working-directory: certificate_authority

README.md

@@ -25,12 +25,11 @@ container per supported distribution family, applies the role, asserts that a se
 verifies the issued certificates with `openssl verify`, their file permissions and the anchor in the systems trust
 store.
 
-Molecule ships only its `default` driver, therefore `podman` and the collection `containers.podman` are required
-besides molecule itself.
+Molecule ships only its `default` driver, therefore `podman` is required besides molecule itself. The collections are
+declared in `molecule/default/collections.yml` and installed by molecule.
 
 ```bash
 pip install molecule
-ansible-galaxy collection install community.crypto containers.podman
 ```
 
 The complete sequence creates the containers, tests them and removes them afterwards.

molecule/default/collections.yml

@@ -0,0 +1,5 @@
+---
+
+collections:
+- name: community.crypto
+- name: containers.podman