ansible-collection-hardening/.github/workflows/os_hardening_vm.yml

---
name: "devsec.os_hardening VM"
on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
      - 'requirements-vm.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
      - 'requirements-vm.txt'
  schedule:
    - cron: '0 6 * * 2'

concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: self-hosted
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        molecule_distro:
          - almalinux/8
          - almalinux/9
          # - almalinux/10  # boot loop
          - generic/centos9s
          - generic/rocky8
          - generic/rocky9
          - fedora/39-cloud-base
          - fedora/40-cloud-base
          - generic/ubuntu2004
          - generic/ubuntu2204
          - alvistack/ubuntu-24.04
          - generic/debian11
          - generic/debian12
          - generic/opensuse15
          - generic/arch
    steps:
      - name: Checkout repo
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Install dependencies
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
          python -m pip install --no-cache-dir --upgrade pip
          pip install -r requirements.txt
          pip install -r requirements-vm.txt
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
          pip install "ansible-core<2.17"
          ansible-galaxy collection install 'community.crypto:<3.0.0'
          ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
        if: >
          matrix.molecule_distro == 'generic/rocky8' ||
          matrix.molecule_distro == 'almalinux/8' ||
          matrix.molecule_distro == 'generic/opensuse15'

      - name: Update Vagrant Box
        run: |
          vagrant box update --box ${{ matrix.molecule_distro }} || true

      - name: Test with molecule
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
          molecule test -s os_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
        working-directory: ansible_collections/devsec/hardening