5 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	28d4ea523d	fix: declare the dependency on the collection community.general ... On Archlinux ansible.builtin.package resolves to the module pacman, which is shipped by community.general and not by ansible-core. Without the collection the role fails with "Could not find a matching action for the pacman package manager", which surfaced in the molecule scenario as soon as only the explicitly declared collections were installed. Co-authored-by: Copilot <copilot@github.com>	2026-09-08 11:18:29 +02:00
volker.raschek	8da7062c13	fix(ci): runs-on ubuntu-latest-amd64	2026-09-08 10:51:38 +02:00
volker.raschekandCopilot	a6e8555e13	refactor(molecule): use docker instead of podman ... The scenario now starts its containers with community.docker instead of containers.podman, because docker is the container runtime available on the CI runner. The connection plugin, the login command and the declared collections were adjusted accordingly and the docker SDK for python is installed in the workflow, since the module requires it. Co-authored-by: Copilot <copilot@github.com>	2026-09-08 10:14:20 +02:00
volker.raschekandCopilot	206c057247	chore(ci): run the molecule scenario on every push and pull request ... The scenario was only runnable by hand so far, which defeats its purpose. Podman is already installed and configured on the runners, so the job only has to add molecule itself. The repository is named ansible-role-certificate-authority while the role is named certificate_authority. Since the scenario includes the role by its name and uses the parent of the project directory as roles path, the checkout has to happen into a directory matching the role. The collections are declared in molecule/default/collections.yml instead of being installed by an explicit step. That is the path the collections invoker of molecule looks at by default, so the dependency action of the test sequence installs them for the workflow and for local runs alike. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:59 +02:00
volker.raschekandCopilot	b72fba0924	test: add a molecule scenario covering three distribution families ... The role was only linted statically so far, which is why every bug of the recent analysis passed the ci unnoticed. The scenario converges the role in podman containers of Archlinux, Debian and Fedora, checks idempotence and then verifies the result. Verification covers the chain via openssl verify, the file modes of keys, certificates and directories, the number of certificates in the fullchain of the client, its subject alternative names and the anchor in the systems trust store. Root and intermediate use a passphrase so the protected code paths are exercised as well. Molecule ships only the default driver, so create and destroy are provided as playbooks. Three details were needed to make it work. The connection has to be declared in the instance config, since molecule ignores ansible_connection_options of the driver. Raw commands are passed through sh explicitly, because the podman connection plugin splits them instead of using a shell. And the roles path has to point at the parent of the project directory, which is the role itself. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00