⚠️ CONFLICT! Lineage pull request for: skeleton #9

cisagovbot · 2024-06-02T08:30:25Z

Lineage Pull Request: CONFLICT

Lineage has created this pull request to incorporate new changes found in an
upstream repository:

Upstream repository: https://github.com/cisagov/skeleton-ansible-role.git
Remote branch: HEAD

Check the changes in this pull request to ensure they won't cause issues with
your project.

The lineage/skeleton branch has one or more unresolved merge conflicts
that you must resolve before merging this pull request!

How to resolve the conflicts

Take ownership of this pull request by removing any other assignees.

Clone the repository locally, and reapply the merge:

git clone git@github.com:cisagov/ansible-role-systemd-resolved.git ansible-role-systemd-resolved
cd ansible-role-systemd-resolved
git remote add skeleton https://github.com/cisagov/skeleton-ansible-role.git
git remote set-url --push skeleton no_push
git switch develop
git switch --create lineage/skeleton --track origin/develop
git pull skeleton HEAD
git status

Review the changes displayed by the status command. Fix any conflicts and
possibly incorrect auto-merges.
After resolving each of the conflicts, add your changes to the
branch, commit, and push your changes:
```
git add .github/dependabot.yml .pre-commit-config.yaml meta/main.yml molecule/default/molecule.yml molecule/default/prepare.yml 
git commit
git push --force --set-upstream origin lineage/skeleton
```
Note that you may append to the default merge commit message
that git creates for you, but please do not delete the existing
content. It provides useful information about the merge that is
being performed.
Wait for all the automated tests to pass.
Confirm each item in the "Pre-approval checklist" below.
Remove any of the checklist items that do not apply.
Ensure every remaining checkbox has been checked.
Mark this draft pull request "Ready for review".

✅ Pre-approval checklist

Remove any of the following that do not apply. If you're unsure about
any of these, don't hesitate to ask. We're here to help!

✌️ The conflicts in this pull request have been resolved.
All future TODOs are captured in issues, which are referenced in code comments.
All relevant type-of-change labels have been added.
Tests have been added and/or modified to cover the changes in this PR.
All new and existing tests pass.

Note

You are seeing this because one of this repository's maintainers has
configured Lineage to open pull requests.

For more information:

🛠 Lineage configurations for this project are stored in .github/lineage.yml

📚 Read more about Lineage

We removed the systemd_enabled scenario in cisagov/skeleton-ansible-role#175 but we missed updating the `exclude` directive for the `bandit` hook. Instead of just removing the unused scenario the regex is instead updated to match the `tests` subdirectory for any molecule scenario.

This is what is expected by Ansible Galaxy: https://docs.ansible.com/ansible/latest/dev_guide/collections_galaxy_meta.html

New versions of ansible-core (2.16.7 and 2.17.0) have been released that do not suffer from the bug discussed in ansible/ansible#82702. This bug broke any symlinked files in vars, tasks, etc. for any Ansible role installed via ansible-galaxy. All versions later than ansible-core 2.16.7 and 2.17.0 should function as expected. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

The line is not only unnecessary, it was commented out to boot!

…lint On its own ansible-lint does not pull in ansible, only ansible-core. Therefore, if an Ansible module lives in ansible instead of ansible-core, the linter will complain that the module is unknown. In these cases it is necessary to add the ansible package itself as an additional dependency, with the same pinning as is done in requirements-test.txt of cisagov/skeleton-ansible-role.

We explicitly add the `community.docker` collection with a minimum version as a requirement to the molecule configuration. This will allow us to ensure that a version of this collection that is compatible with 2.32.0 and newer of the Python requests library is installed.

…equirement Add `community.docker` as a requirement for molecule testing

We can do this because new versions of ansible-core (2.16.7 and 2.17.0) have been released that do not suffer from the bug discussed in ansible/ansible#82702. This bug broke any symlinked files in vars, tasks, etc. for any Ansible role installed via ansible-galaxy. All versions later than ansible-core 2.16.7 and 2.17.0 should function as expected.

With the updated ansible-core pin we can support ansible 9. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

In SystemD-enabled Docker images sources from geerlingguy he has made the decision to remove the indicator for an externally managed Python environment if the host is configured with one. This impacts Debian Bookworm and Trixie, as well as Ubuntu 24.04 (Noble Numbat), and as far as we know any future versions of these distributions. This will help ensure that our Ansible role testing is done against images that reflect how a host will be configured when used to create AMIs.

Remove the hard-coded values used in to restore the externally managed Python environment file. Instead check that Python 3 is installed and derive the major.minor version of the Python 3 package that is on the host. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov> Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

In the playbook that restores the externally managed Python environment file we can just check for supported distributions instead of checking for Debian-based and then excluding distributions (like Kali).

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Improve the comment that explains the backslash usage in a YAML multiline string used to define a regex pattern. Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Remove support for Fedora 38 as it is now EOL.

Update version pin on `ansible-core` Python package

…anage_python_file Restore externally managed Python environment indicator if necessary

…tu_2404 Add support for Ubuntu 24.04 (Noble Numbat)

…ra-40 Add support for Fedora 40

Change the license so that it is an SPDX string

…ion_to_remove_scenario Update the `bandit` hook configuration for pre-commit

This idea was stolen from felddy/reusable-workflows.

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

…2023 These platforms can now be included because the following PRs have been merged: - geerlingguy/docker-fedora39-ansible#2 - geerlingguy/docker-fedora40-ansible#1 - geerlingguy/docker-amazonlinux2023-ansible#4

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This helps keep the job name in line with the molecule configuration. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Adjust the script to pull down platform specific images instead of just the image of the running system's platform. This will ensure that all images needed by the molecule configuration are retrieved regardless of the system platform.

Adds commented out ignore statements for the following new Action dependencies added to the `test` job: - docker/setup-buildx-action - docker/setup-qemu-action Once uncommented in downstream repositories this will ensure that these dependencies are managed in a centralized place.

This updates it to support arm64 inline with the changes to the default scenario as well as the necessary files to fix the externally managed Python configuration on certain Debian versions.

These platforms do not provide systemd-resolved so we do not test on them.

jsf9k · 2024-06-04T20:19:35Z

I think systemd/systemd#21511 and related are hurting us here. This may harpoon our attempts to test anything that actually uses systemd under qemu.

Note from cisagov/ansible-role-chrony-aws#41 that this only necessarily applies to systemd-specific services; other services can still behave as expected despite the systemd failures under qemu.

This is done automatically with the `pre-commit autoupdate` command. The pre-commit/mirrors-prettier was manually held back because the latest tags are for alpha releases of the next major version.

Use the latest v3 release available from NPM.

The pin now agrees with what is in cisagov/skeleton-ansible-role. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Update `pre-commit` hooks

…ible-lint Pin packages for `ansible-lint`

Lineage pull request for: skeleton

…eage/skeleton

We require ansible when running the ansible-lint linter because this role uses an Ansible module that is included as part of ansible, not ansible-core.

jsf9k · 2024-06-12T20:28:31Z

I created this table by running each ARM64 Docker image and checking what version of systemctl was available:

Platform	Version
Amazon Linux 2023	252
Debian 12	252
Debian 13	256
Fedora 39	254
Fedora 40	255
Ubuntu 24.04	255

Clearly something changed in systemd 253 or 254 that now breaks when emulated under QEMU.

TODO: Starting with systemd version 253 or 254 (I'm not sure which) it is no longer possible to start systemd-resolved.service under QEMU emulation. We support this case, but we cannot test it until we have native ARM64 runners. See issue #10 for more details.

mcdonnnj and others added 30 commits April 21, 2024 05:11

Change the license so that it is an SPDX string

33947a6

This is what is expected by Ansible Galaxy: https://docs.ansible.com/ansible/latest/dev_guide/collections_galaxy_meta.html

Remove unnecessary line

c74e5db

The line is not only unnecessary, it was commented out to boot!

Merge pull request #196 from cisagov/bug/specify_collection_version_r…

82e9264

…equirement Add `community.docker` as a requirement for molecule testing

Update ansible pin

db61055

With the updated ansible-core pin we can support ansible 9. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Streamline logic checking for applicable host platforms

4e1659e

In the playbook that restores the externally managed Python environment file we can just check for supported distributions instead of checking for Debian-based and then excluding distributions (like Kali).

Fix typo in comment

b967e9d

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Improve explanatory comment

b25f1fc

Improve the comment that explains the backslash usage in a YAML multiline string used to define a regex pattern. Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Add support for Ubuntu 24.04 (Noble Numbat)

706151e

Add support for Fedora 40

e7d3969

Remove support for Fedora 38 as it is now EOL.

Merge pull request #193 from cisagov/improvement/remove-ansible-core-pin

5c97685

Update version pin on `ansible-core` Python package

Merge pull request #190 from cisagov/improvement/restore_externally_m…

14e069b

…anage_python_file Restore externally managed Python environment indicator if necessary

Merge pull request #189 from cisagov/improvement/add_support_for_ubun…

ec431ef

…tu_2404 Add support for Ubuntu 24.04 (Noble Numbat)

Merge pull request #188 from cisagov/improvement/add-support-for-fedo…

59d8cd6

…ra-40 Add support for Fedora 40

Merge pull request #187 from cisagov/improvement/make-license-entry-spdx

5689f30

Change the license so that it is an SPDX string

Merge pull request #185 from cisagov/bug/update_pre-commit_configurat…

81839d9

…ion_to_remove_scenario Update the `bandit` hook configuration for pre-commit

Add GH actions to setup QEMU and buildx

581a55c

This idea was stolen from felddy/reusable-workflows.

Add Molecule testing support for aarch where possible

5759b77

Alphabetize platforms

234ac03

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Prefer the name arm64 to aarch64

6158bae

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Assign a name to the test job in the build GHA workflow

357a701

This helps keep the job name in line with the molecule configuration. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Update the update_molecule_images.sh helper script

4d2653d

Adjust the script to pull down platform specific images instead of just the image of the running system's platform. This will ensure that all images needed by the molecule configuration are retrieved regardless of the system platform.

jsf9k added 2 commits June 4, 2024 11:11

Update the configuration of the specify_resolv_conf scenario

82df912

This updates it to support arm64 inline with the changes to the default scenario as well as the necessary files to fix the externally managed Python configuration on certain Debian versions.

Remove unsupported platforms

c1a69a9

These platforms do not provide systemd-resolved so we do not test on them.

jsf9k force-pushed the lineage/skeleton branch from 8c87135 to c1a69a9 Compare June 4, 2024 15:16

mcdonnnj and others added 9 commits June 6, 2024 13:55

Update pre-commit hook versions

f51fe62

This is done automatically with the `pre-commit autoupdate` command. The pre-commit/mirrors-prettier was manually held back because the latest tags are for alpha releases of the next major version.

Manually update the prettier hook

8e55b8e

Use the latest v3 release available from NPM.

Correct commented-out ansible pin

c617bb9

The pin now agrees with what is in cisagov/skeleton-ansible-role. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Merge pull request #183 from cisagov/maintenance/update_pre-commit_hooks

de92c3c

Update `pre-commit` hooks

Merge pull request #182 from cisagov/improvement/pin-packages-for-ans…

7ddea47

…ible-lint Pin packages for `ansible-lint`

Merge https://github.com/cisagov/skeleton-generic into lineage/skeleton

92a2ef7

Merge pull request #198 from cisagov/lineage/skeleton

bcdf7a8

Lineage pull request for: skeleton

Merge remote-tracking branch 'skeleton-ansible-role/develop' into lin…

a5b9b58

…eage/skeleton

Uncomment ansible pin in ansible-lint linter configuration

f0f2485

We require ansible when running the ansible-lint linter because this role uses an Ansible module that is included as part of ansible, not ansible-core.

jsf9k force-pushed the lineage/skeleton branch from c8c1c7f to f0f2485 Compare June 8, 2024 01:14

jsf9k force-pushed the lineage/skeleton branch from 5a3a08c to 702d94d Compare June 18, 2024 16:11

jsf9k requested a review from a team June 18, 2024 16:42

jsf9k marked this pull request as ready for review June 18, 2024 16:42

jsf9k requested review from dav3r, felddy, jasonodoom, jsf9k and mcdonnnj as code owners June 18, 2024 16:42

jsf9k enabled auto-merge June 18, 2024 16:42

dv4harr10 approved these changes Jun 18, 2024

View reviewed changes

jsf9k mentioned this pull request Jun 24, 2024

Uncomment assertion #8

Merged

7 tasks

mcdonnnj approved these changes Jun 25, 2024

View reviewed changes

jsf9k merged commit 00700d3 into develop Jun 25, 2024
63 checks passed

jsf9k deleted the lineage/skeleton branch June 25, 2024 06:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

⚠️ CONFLICT! Lineage pull request for: skeleton #9

⚠️ CONFLICT! Lineage pull request for: skeleton #9

cisagovbot commented Jun 2, 2024 •

edited by jsf9k

Loading

jsf9k commented Jun 4, 2024 •

edited

Loading

jsf9k commented Jun 12, 2024

⚠️ CONFLICT! Lineage pull request for: skeleton #9

⚠️ CONFLICT! Lineage pull request for: skeleton #9

Conversation

cisagovbot commented Jun 2, 2024 • edited by jsf9k Loading

Lineage Pull Request: CONFLICT

How to resolve the conflicts

✅ Pre-approval checklist

jsf9k commented Jun 4, 2024 • edited Loading

jsf9k commented Jun 12, 2024

cisagovbot commented Jun 2, 2024 •

edited by jsf9k

Loading

jsf9k commented Jun 4, 2024 •

edited

Loading