From 206c0572472a0a6bbd918ec2d3017880699fac20 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Mon, 7 Sep 2026 22:25:29 +0200
Subject: [PATCH] chore(ci): run the molecule scenario on every push and pull
 request

The scenario was only runnable by hand so far, which defeats its purpose. Podman is already installed and
configured on the runners, so the job only has to add molecule itself.

The repository is named ansible-role-certificate-authority while the role is named certificate_authority. Since the
scenario includes the role by its name and uses the parent of the project directory as roles path, the checkout has
to happen into a directory matching the role.

The collections are declared in molecule/default/collections.yml instead of being installed by an explicit step.
That is the path the collections invoker of molecule looks at by default, so the dependency action of the test
sequence installs them for the workflow and for local runs alike.

Co-authored-by: Copilot <copilot@github.com>
---
 .gitea/workflows/molecule.yaml   | 30 ++++++++++++++++++++++++++++++
 README.md                        |  5 ++---
 molecule/default/collections.yml |  5 +++++
 3 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 .gitea/workflows/molecule.yaml
 create mode 100644 molecule/default/collections.yml

diff --git a/.gitea/workflows/molecule.yaml b/.gitea/workflows/molecule.yaml
new file mode 100644
index 0000000..15e6832
--- /dev/null
+++ b/.gitea/workflows/molecule.yaml
@@ -0,0 +1,30 @@
+name: Molecule
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+
+permissions:
+  contents: read
+
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    steps:
+    # The scenario includes the role by its name, so the directory must be named like the role and not like the
+    # repository. Its parent is used as roles path.
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        path: certificate_authority
+    - name: Install molecule
+      run: |
+        apt update --yes
+        apt install --yes python3-pip
+        pip3 install --break-system-packages molecule
+    - name: Run molecule
+      run: molecule test
+      working-directory: certificate_authority
diff --git a/README.md b/README.md
index 6ff9fad..9460f33 100644
--- a/README.md
+++ b/README.md
@@ -25,12 +25,11 @@ container per supported distribution family, applies the role, asserts that a se
 verifies the issued certificates with `openssl verify`, their file permissions and the anchor in the systems trust
 store.
 
-Molecule ships only its `default` driver, therefore `podman` and the collection `containers.podman` are required
-besides molecule itself.
+Molecule ships only its `default` driver, therefore `podman` is required besides molecule itself. The collections are
+declared in `molecule/default/collections.yml` and installed by molecule.
 
 ```bash
 pip install molecule
-ansible-galaxy collection install community.crypto containers.podman
 ```
 
 The complete sequence creates the containers, tests them and removes them afterwards.
diff --git a/molecule/default/collections.yml b/molecule/default/collections.yml
new file mode 100644
index 0000000..74ba4b1
--- /dev/null
+++ b/molecule/default/collections.yml
@@ -0,0 +1,5 @@
+---
+
+collections:
+- name: community.crypto
+- name: containers.podman