The scenario was only runnable by hand so far, which defeats its purpose. Podman is already installed and
configured on the runners, so the job only has to add molecule itself.
The repository is named ansible-role-certificate-authority while the role is named certificate_authority. Since the
scenario includes the role by its name and uses the parent of the project directory as roles path, the checkout has
to happen into a directory matching the role.
The collections are declared in molecule/default/collections.yml instead of being installed by an explicit step.
That is the path the collections invoker of molecule looks at by default, so the dependency action of the test
sequence installs them for the workflow and for local runs alike.
Co-authored-by: Copilot <copilot@github.com>
The role was only linted statically so far, which is why every bug of the recent analysis passed the ci
unnoticed. The scenario converges the role in podman containers of Archlinux, Debian and Fedora, checks
idempotence and then verifies the result.
Verification covers the chain via openssl verify, the file modes of keys, certificates and directories,
the number of certificates in the fullchain of the client, its subject alternative names and the anchor in
the systems trust store. Root and intermediate use a passphrase so the protected code paths are exercised
as well.
Molecule ships only the default driver, so create and destroy are provided as playbooks. Three details
were needed to make it work. The connection has to be declared in the instance config, since molecule
ignores ansible_connection_options of the driver. Raw commands are passed through sh explicitly, because
the podman connection plugin splits them instead of using a shell. And the roles path has to point at the
parent of the project directory, which is the role itself.
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot