From 6f1354e52ee9fa14046089db8a5ace7ae98b48bc Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Fri, 21 Nov 2025 16:15:00 +0000
Subject: [PATCH 1/2] Rewrite pulp_container_content for updated sqeezer

---
 .github/workflows/pull_request.yml            |   2 +-
 galaxy.yml                                    |   5 +-
 plugins/modules/pulp_container_content.py     | 223 ------------------
 roles/pulp_container_content/tasks/main.yml   |  37 +--
 .../tasks/process_content.yml                 | 128 ++++++++++
 tests/pulp-in-one.sh                          |   2 +-
 tests/test_container_content.yml              |  12 +-
 7 files changed, 150 insertions(+), 259 deletions(-)
 delete mode 100644 plugins/modules/pulp_container_content.py
 create mode 100644 roles/pulp_container_content/tasks/process_content.yml

diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index ac4afa4..72edcce 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -16,8 +16,8 @@ jobs:
       fail-fast: false
       matrix:
         pulp:
-          - "3.21"
           - "3.45"
+          - "3.81"
     steps:
       # Checks-out the repository under $GITHUB_WORKSPACE, so it's accessible to the job
       - uses: actions/checkout@v3
diff --git a/galaxy.yml b/galaxy.yml
index f69ae2a..0cc7dd6 100644
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -2,14 +2,15 @@ namespace: stackhpc
 name: pulp
 description: >
   Roles and plugins Pulp repository server configuration
-version: "0.5.5"
+version: "0.6.0"
 readme: "README.md"
 authors:
   - "Piotr Parczewski"
   - "Michał Nasiadka"
   - "Mark Goddard"
+  - "Alex Welsh"
 dependencies:
-  "pulp.squeezer": "*"
+  "pulp.squeezer": ">=0.20.0"
 license:
   - "Apache-2.0"
 tags:
diff --git a/plugins/modules/pulp_container_content.py b/plugins/modules/pulp_container_content.py
deleted file mode 100644
index 9bf1887..0000000
--- a/plugins/modules/pulp_container_content.py
+++ /dev/null
@@ -1,223 +0,0 @@
-#!/usr/bin/python
-# -*- coding: utf-8 -*-
-
-# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-
-DOCUMENTATION = r"""
----
-module: pulp_container_content
-short_description: Manage container content of a pulp api server instance
-description:
-  - "This performs CRUD operations on container content in a pulp api server instance."
-options:
-  allow_missing:
-    description:
-      - Whether to allow missing tags when state is present.
-    type: bool
-    default: false
-  is_push:
-    description:
-      - Whether repository is a container-push repository.
-    type: bool
-    default: false
-  src_repo:
-    description:
-      - Name of the repository to copy content from when state is present.
-    type: str
-  src_is_push:
-    description:
-      - Whether src_repo is a container-push repository.
-    type: bool
-    default: false
-  repository:
-    description:
-      - Name of the repository to add or remove content
-    type: str
-    required: true
-  state:
-    description:
-      - State the entity should be in
-    type: str
-    default: present
-    choices:
-      - present
-      - absent
-      - read
-  tags:
-    description:
-      - List of tags to add or remove
-    type: list
-    elements: str
-    required: true
-  wait:
-    description:
-      - Whether to wait for completion of the operation
-    type: bool
-    default: true
-extends_documentation_fragment:
-  - pulp.squeezer.pulp
-  - pulp.squeezer.pulp.entity_state
-author:
-  - Mark Goddard (@markgoddard)
-"""
-
-EXAMPLES = r"""
-- name: Copy tag1 and tag2 from repo1 to repo2
-  pulp_container_content:
-    pulp_url: https://pulp.example.org
-    username: admin
-    password: password
-    repository: repo2
-    src_repo: repo1
-    tags:
-      - tag1
-      - tag2
-
-- name: Remove tag3 from repo3
-  pulp_container_content:
-    pulp_url: https://pulp.example.org
-    username: admin
-    password: password
-    repository: repo3
-    tags:
-      - tag3
-    state: absent
-"""
-
-RETURN = r"""
-  repository_version:
-    description: Created container repository version
-    type: dict
-    returned: when content is added or removed
-"""
-
-
-from ansible_collections.pulp.squeezer.plugins.module_utils.pulp import (
-    PAGE_LIMIT,
-    PulpContainerRepository,
-    PulpEntityAnsibleModule,
-    PulpTask,
-    SqueezerException,
-)
-
-
-class PulpContainerRepositoryContent(PulpContainerRepository):
-    _add_id = "repositories_container_container_add"
-    _remove_id = "repositories_container_container_remove"
-    _container_tags_list_id = "content_container_tags_list"
-
-    _name_singular = "repository_version"
-
-    def get_src_repo(self):
-        # Query source repository.
-        natural_key = {"name": self.module.params["src_repo"]}
-        repo = PulpContainerRepository(self.module, natural_key)
-        if self.module.params["state"] == "present" and self.module.params["src_is_push"]:
-            repo._list_id = "repositories_container_container_push_list"
-        # find populates repo.entity.
-        repo.find(failsafe=False)
-        return repo
-
-    def get_content_units(self, repo):
-        # Query container tags with matching names in repo.
-        # Pagination code adapted from PulpEntity.list().
-        tags = []
-        offset = 0
-        search_result = {"next": True}
-        while search_result["next"]:
-            parameters = {
-                "limit": PAGE_LIMIT,
-                "offset": offset,
-                "name__in": ",".join(self.module.params["tags"]),
-                "repository_version": repo.entity["latest_version_href"]
-            }
-            search_result = self.module.pulp_api.call(
-                self._container_tags_list_id, parameters=parameters
-            )
-            tags.extend(search_result["results"])
-            offset += PAGE_LIMIT
-
-        tag_names = [tag["name"] for tag in tags]
-        if (self.module.params["state"] in ["present", "read"] and
-                not self.module.params["allow_missing"] and
-                len(tag_names) != len(self.module.params["tags"])):
-            missing = ", ".join(set(self.module.params["tags"]) - set(tag_names))
-            raise SqueezerException(f"Some tags not found in source repository: {missing}")
-        return [result["pulp_href"] for result in tags]
-
-    def add_or_remove(self, add_or_remove_id, content_units):
-        body = {"content_units": content_units}
-        if not self.module.check_mode:
-            parameters = {"container_container_repository_href": self.entity["pulp_href"]}
-            response = self.module.pulp_api.call(
-                add_or_remove_id, body=body, uploads=self.uploads, parameters=parameters
-            )
-            if response and "task" in response:
-                if self.module.params["wait"]:
-                    task = PulpTask(self.module, {"pulp_href": response["task"]}).wait_for()
-                    # Adding or removing content results in creation of a new repository version
-                    if task["created_resources"]:
-                        self.entity = {"pulp_href": task["created_resources"][0]}
-                        self.module.set_changed()
-                    else:
-                        self.entity = None
-                else:
-                    self._name_singular = "task"
-                    self.entity = {"pulp_href": response["task"]}
-            else:
-                self.entity = response
-        else:
-            # Assume changed in check mode
-            self.module.set_changed()
-
-    def add(self):
-        src_repo = self.get_src_repo()
-        self.add_or_remove(self._add_id, self.get_content_units(src_repo))
-
-    def remove(self):
-        self.add_or_remove(self._remove_id, self.get_content_units(self))
-
-    def read(self):
-        self.get_content_units(self)
-
-    def process(self):
-        if self.module.params["state"] == "read" and self.module.params["is_push"]:
-            self._list_id = "repositories_container_container_push_list"
-        # Populate self.entity.
-        self.find(failsafe=False)
-        if self.module.params["state"] == "present":
-            self.add()
-        elif self.module.params["state"] == "absent":
-            self.remove()
-        elif self.module.params["state"] == "read":
-            self.read()
-        else:
-            raise SqueezerException("Unexpected state")
-        self.module.set_result(self._name_singular, self.presentation(self.entity))
-
-
-def main():
-    with PulpEntityAnsibleModule(
-        argument_spec=dict(
-            allow_missing={"type": "bool", "default": False},
-            is_push={"type": "bool", "default": False},
-            repository={"required": True},
-            src_repo={},
-            src_is_push={"type": "bool", "default": False},
-            state={"default": "present", "choices": ["present", "absent", "read"]},
-            tags={"type": "list", "elements": "str", "required": True},
-            wait={"type": "bool", "default": True},
-        ),
-        required_if=[("state", "present", ["src_repo"])],
-    ) as module:
-        natural_key = {"name": module.params["repository"]}
-        PulpContainerRepositoryContent(module, natural_key).process()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/roles/pulp_container_content/tasks/main.yml b/roles/pulp_container_content/tasks/main.yml
index 6f91868..5c958c8 100644
--- a/roles/pulp_container_content/tasks/main.yml
+++ b/roles/pulp_container_content/tasks/main.yml
@@ -1,20 +1,13 @@
 ---
+- name: Initialise active tasks list
+  set_fact:
+    pulp_container_active_tasks: []
+
 - name: Add or remove content units
-  stackhpc.pulp.pulp_container_content:
-    pulp_url: "{{ pulp_url }}"
-    username: "{{ pulp_username }}"
-    password: "{{ pulp_password }}"
-    validate_certs: "{{ pulp_validate_certs | bool }}"
-    allow_missing: "{{ item.allow_missing | default(omit) }}"
-    is_push: "{{ item.is_push | default(omit) }}"
-    src_repo: "{{ item.src_repo | default(omit) }}"
-    src_is_push: "{{ item.src_is_push | default(omit) }}"
-    repository: "{{ item.repository }}"
-    tags: "{{ item.tags }}"
-    state: "{{ item.state | default(omit) }}"
-    wait: "{{ pulp_container_content_wait | bool }}"
+  include_tasks: process_content.yml
   loop: "{{ pulp_container_content }}"
-  register: pulp_container_content_result
+  loop_control:
+    loop_var: content_item
 
 - name: Wait for tasks to complete
   pulp.squeezer.task:
@@ -22,15 +15,7 @@
     username: "{{ pulp_username }}"
     password: "{{ pulp_password }}"
     validate_certs: "{{ pulp_validate_certs | bool }}"
-    pulp_href: "{{ content_result.task.pulp_href }}"
-    state: "completed"
-  loop: "{{ pulp_container_content }}"
-  when:
-    - not pulp_container_content_wait | bool
-    - "'task' in content_result"
-  changed_when: pulp_container_content_wait_result.task.created_resources | default([]) | length > 0
-  register: pulp_container_content_wait_result
-  loop_control:
-    index_var: result_index
-  vars:
-    content_result: "{{ pulp_container_content_result.results[result_index] }}"
+    pulp_href: "{{ item }}"
+    state: completed
+  loop: "{{ pulp_container_active_tasks }}"
+  when: pulp_container_content_wait | bool
diff --git a/roles/pulp_container_content/tasks/process_content.yml b/roles/pulp_container_content/tasks/process_content.yml
new file mode 100644
index 0000000..9845609
--- /dev/null
+++ b/roles/pulp_container_content/tasks/process_content.yml
@@ -0,0 +1,128 @@
+---
+- name: Get destination repository href
+  pulp.squeezer.api_call:
+    pulp_url: "{{ pulp_url }}"
+    username: "{{ pulp_username }}"
+    password: "{{ pulp_password }}"
+    validate_certs: "{{ pulp_validate_certs | bool }}"
+    operation_id: repositories_container_container_list
+    parameters:
+      name: "{{ content_item.repository }}"
+  register: dest_repo_result
+
+- name: Fail if destination repository not found
+  fail:
+    msg: "Destination repository '{{ content_item.repository }}' not found."
+  when: dest_repo_result.response.count == 0
+
+- name: Set destination repo href and ID
+  set_fact:
+    dest_repo_href: "{{ dest_repo_result.response.results[0].pulp_href }}"
+    # Extract the UUID from the HREF (assuming standard format .../uuid/)
+    dest_repo_id: "{{ dest_repo_result.response.results[0].pulp_href.strip('/').split('/')[-1] }}"
+
+- name: Get source repository info
+  pulp.squeezer.api_call:
+    pulp_url: "{{ pulp_url }}"
+    username: "{{ pulp_username }}"
+    password: "{{ pulp_password }}"
+    validate_certs: "{{ pulp_validate_certs | bool }}"
+    operation_id: "{{ 'repositories_container_container_push_list' if content_item.src_is_push | default(false) else 'repositories_container_container_list' }}"
+    parameters:
+      name: "{{ content_item.src_repo }}"
+  register: src_repo_result
+  when:
+    - content_item.state | default('present') == 'present'
+    - content_item.src_repo is defined
+
+- name: Fail if source repository not found
+  fail:
+    msg: "Source repository '{{ content_item.src_repo }}' not found."
+  when:
+    - content_item.state | default('present') == 'present'
+    - content_item.src_repo is defined
+    - src_repo_result.response.count == 0
+
+- name: Determine reference repository version
+  set_fact:
+    ref_repo_version: >-
+      {% if content_item.state | default('present') == 'present' %}
+        {{ src_repo_result.response.results[0].latest_version_href }}
+      {% else %}
+        {{ dest_repo_result.response.results[0].latest_version_href }}
+      {% endif %}
+  when:
+    - content_item.state | default('present') != 'present' or content_item.src_repo is defined
+
+- name: Resolve tags
+  block:
+    - name: List tags from reference repository
+      pulp.squeezer.api_call:
+        pulp_url: "{{ pulp_url }}"
+        username: "{{ pulp_username }}"
+        password: "{{ pulp_password }}"
+        validate_certs: "{{ pulp_validate_certs | bool }}"
+        operation_id: content_container_tags_list
+        parameters:
+          name__in: "{{ content_item.tags }}"
+          repository_version: "{{ ref_repo_version }}"
+      register: tags_result
+
+    - name: Check for missing tags
+      vars:
+        found_tags: "{{ tags_result.response.results | map(attribute='name') | list }}"
+        missing_tags: "{{ content_item.tags | difference(found_tags) }}"
+      fail:
+        msg: "Some tags not found in source repository: {{ missing_tags | join(', ') }}"
+      when:
+        - content_item.state | default('present') in ['present', 'read']
+        - not content_item.allow_missing | default(false)
+        - missing_tags | length > 0
+
+    - name: Set content units to process
+      set_fact:
+        content_units: "{{ tags_result.response.results | map(attribute='pulp_href') | list }}"
+  when: ref_repo_version is defined
+
+- name: Add content to repository
+  pulp.squeezer.api_call:
+    pulp_url: "{{ pulp_url }}"
+    username: "{{ pulp_username }}"
+    password: "{{ pulp_password }}"
+    validate_certs: "{{ pulp_validate_certs | bool }}"
+    operation_id: repositories_container_container_add
+    parameters:
+      container_container_repository_href: "{{ dest_repo_href }}"
+    body:
+      content_units: "{{ content_units }}"
+  register: add_result
+  when:
+    - content_item.state | default('present') == 'present'
+    - content_units | length > 0
+  changed_when: true
+
+- name: Remove content from repository
+  pulp.squeezer.api_call:
+    pulp_url: "{{ pulp_url }}"
+    username: "{{ pulp_username }}"
+    password: "{{ pulp_password }}"
+    validate_certs: "{{ pulp_validate_certs | bool }}"
+    operation_id: repositories_container_container_remove
+    parameters:
+      container_container_repository_href: "{{ dest_repo_href }}"
+    body:
+      content_units: "{{ content_units }}"
+  register: remove_result
+  when:
+    - content_item.state | default('present') == 'absent'
+    - content_units | length > 0
+  changed_when: true
+
+- name: Register active tasks
+  set_fact:
+    pulp_container_active_tasks: "{{ pulp_container_active_tasks + [item.response.pulp_href] }}"
+  loop: "{{ [add_result, remove_result] }}"
+  when:
+    - item is defined
+    - item.changed | default(false)
+    - item.response.pulp_href is defined
diff --git a/tests/pulp-in-one.sh b/tests/pulp-in-one.sh
index be985c0..abc2db8 100755
--- a/tests/pulp-in-one.sh
+++ b/tests/pulp-in-one.sh
@@ -8,7 +8,7 @@ set -o pipefail
 
 mkdir -p settings
 
-PULP_TAG=${PULP_TAG:-"3.45"}
+PULP_TAG=${PULP_TAG:-"3.81"}
 
 cat << EOF > settings/settings.py
 CONTENT_ORIGIN='http://$(hostname):8080'
diff --git a/tests/test_container_content.yml b/tests/test_container_content.yml
index 47ed5fe..cc36ca5 100644
--- a/tests/test_container_content.yml
+++ b/tests/test_container_content.yml
@@ -182,14 +182,14 @@
                 state: present
       rescue:
         - set_fact:
-            failed_task: "{{ ansible_failed_task }}"
+            failed_msg: "{{ ansible_failed_result.msg }}"
       always:
         - name: Assert that adding a missing tag failed
           assert:
             that:
-              - failed_task.name == "Add or remove content units"
+              - failed_msg is search("Some tags not found in source repository")
         - set_fact:
-            failed_task:
+            failed_msg:
 
     # Repeat the above test with state=read
     - block:
@@ -203,14 +203,14 @@
                 state: read
       rescue:
         - set_fact:
-            failed_task: "{{ ansible_failed_task }}"
+            failed_msg: "{{ ansible_failed_result.msg }}"
       always:
         - name: Assert that querying a missing tag failed
           assert:
             that:
-              - failed_task.name == "Add or remove content units"
+              - failed_msg is search("Some tags not found in source repository")
         - set_fact:
-            failed_task:
+            failed_msg:
 
     - include_role:
         name: pulp_repository

From a2a4fc46b3503bc5192fbece0856a8ff0cb717df Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Wed, 26 Nov 2025 17:11:08 +0000
Subject: [PATCH 2/2] Fix various CI issues

---
 .ansible-lint                                 |  4 ++
 .github/workflows/pull_request.yml            |  2 +-
 README.md                                     |  5 +-
 galaxy.yml                                    |  2 +-
 .../tasks/process_content.yml                 |  2 +-
 tests/test_container_distribution.yml         |  4 +-
 tests/test_container_repository.yml           |  8 +--
 tests/test_content_guard_rbac.yml             | 50 +++++++++----------
 tests/test_group.yml                          |  4 +-
 tests/test_user.yml                           |  4 +-
 10 files changed, 46 insertions(+), 39 deletions(-)

diff --git a/.ansible-lint b/.ansible-lint
index e697c81..0fbcd38 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -6,3 +6,7 @@ skip_list:
   - galaxy[version-incorrect]
   - meta-runtime[unsupported-version]
   - fqcn[action-core]
+
+# Ensure dependent collections are not linted
+exclude_paths:
+  - .ansible/
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 72edcce..ce22402 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ansible==5.* jmespath pulp-glue==0.21.*
+          pip install ansible==11.* jmespath pulp-glue==0.33.* pulp-glue-deb==0.3.*
           ansible-galaxy collection install git+file://$(pwd)
 
       - name: Run Pulp in one
diff --git a/README.md b/README.md
index 2e3d63b..4dd0fb1 100644
--- a/README.md
+++ b/README.md
@@ -7,12 +7,15 @@ Note: Pulp server installation is out of this collection's scope - for this purp
 
 ## Tested with Ansible
 
-Tested with the current Ansible 2.9-2.10 releases.
+Tested with the current Ansible 11 release.
 
 ## Included content
 
 pulp_contentguard role
 pulp_repository role
+pulp_distribution role
+pulp_django_user role
+pulp_group role
 
 ## Using this collection
 
diff --git a/galaxy.yml b/galaxy.yml
index 0cc7dd6..1d1c5ff 100644
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -10,7 +10,7 @@ authors:
   - "Mark Goddard"
   - "Alex Welsh"
 dependencies:
-  "pulp.squeezer": ">=0.20.0"
+  "pulp.squeezer": "0.2.3"
 license:
   - "Apache-2.0"
 tags:
diff --git a/roles/pulp_container_content/tasks/process_content.yml b/roles/pulp_container_content/tasks/process_content.yml
index 9845609..81b5bdc 100644
--- a/roles/pulp_container_content/tasks/process_content.yml
+++ b/roles/pulp_container_content/tasks/process_content.yml
@@ -55,6 +55,7 @@
     - content_item.state | default('present') != 'present' or content_item.src_repo is defined
 
 - name: Resolve tags
+  when: ref_repo_version is defined
   block:
     - name: List tags from reference repository
       pulp.squeezer.api_call:
@@ -82,7 +83,6 @@
     - name: Set content units to process
       set_fact:
         content_units: "{{ tags_result.response.results | map(attribute='pulp_href') | list }}"
-  when: ref_repo_version is defined
 
 - name: Add content to repository
   pulp.squeezer.api_call:
diff --git a/tests/test_container_distribution.yml b/tests/test_container_distribution.yml
index fc8fef0..69101d0 100644
--- a/tests/test_container_distribution.yml
+++ b/tests/test_container_distribution.yml
@@ -65,14 +65,14 @@
           - dist_result.distribution.name == "test_container_distribution"
           - dist_result.distribution.base_path == "test_container_distribution"
           - dist_result.distribution.repository == repo_result.repository.pulp_href
-          - dist_result.distribution.repository_version is none
+          - dist_result.distribution.repository_version == ""
 
     - name: Verify distribution creation
       assert:
         that:
           - dist_version_1_result.distribution.name == "test_container_distribution_version_1"
           - dist_version_1_result.distribution.base_path == "test_container_distribution_version_1"
-          - dist_version_1_result.distribution.repository is none
+          - dist_version_1_result.distribution.repository == ""
           - dist_version_1_result.distribution.repository_version == repo_result.repository.latest_version_href
 
     - include_role:
diff --git a/tests/test_container_repository.yml b/tests/test_container_repository.yml
index bb0af06..f6d7aba 100644
--- a/tests/test_container_repository.yml
+++ b/tests/test_container_repository.yml
@@ -94,22 +94,22 @@
 
       rescue:
         - set_fact:
-            failed_task: "{{ ansible_failed_task }}"
+            failed_result: "{{ ansible_failed_result }}"
 
       always:
         - name: Assert that syncing from a URL that returns 404 fails
           assert:
             that:
-              - failed_task.name == "Sync container remotes into repositories"
+              - failed_result.msg is search("One or more items failed")
 
         - name: Assert that syncing from a URL that returns 404 is retried the correct number of times
           assert:
             that:
-              - pulp_repository_container_repos_sync.results[0].attempts == pulp_repository_container_repos_sync_retries
+              - failed_result.results[0].attempts == pulp_repository_container_repos_sync_retries
 
         - include_role:
             name: pulp_repository
           vars:
-            pulp_repository_deb_repos:
+            pulp_repository_container_repos:
               - name: test_container_repo_bad_url
                 state: absent
diff --git a/tests/test_content_guard_rbac.yml b/tests/test_content_guard_rbac.yml
index 681b1af..82f5704 100644
--- a/tests/test_content_guard_rbac.yml
+++ b/tests/test_content_guard_rbac.yml
@@ -23,8 +23,8 @@
     - name: Exit if version < 3.17
       meta: end_play
       vars:
-        query: "[?component=='core'].version"
-      when: status_result.json.versions | json_query(query) | first is version('3.17', '<')
+        query_string: "[?component=='core'].version"
+      when: status_result.json.versions | json_query(query_string) | first is version('3.17', '<')
 
     - name: Query groups
       uri:
@@ -84,31 +84,31 @@
 
     - name: Evaluate results for test-rbac_cg-1
       vars:
-        query: "[?name=='test-rbac_cg-1']"
+        query_string: "[?name=='test-rbac_cg-1']"
       assert:
         that:
-          - rbac_cg_list.json.results | json_query(query) | length == 1
-          - (rbac_cg_list.json.results | json_query(query) | first).name == 'test-rbac_cg-1'
-          - (rbac_cg_list.json.results | json_query(query) | first).groups | length == 2
-          - (rbac_cg_list.json.results | json_query(query) | first).groups[0].name in ['test_group1', 'test_group2']
-          - (rbac_cg_list.json.results | json_query(query) | first).groups[1].name in ['test_group1', 'test_group2']
+          - rbac_cg_list.json.results | json_query(query_string) | length == 1
+          - (rbac_cg_list.json.results | json_query(query_string) | first).name == 'test-rbac_cg-1'
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups | length == 2
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups[0].name in ['test_group1', 'test_group2']
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups[1].name in ['test_group1', 'test_group2']
           - >
-              (rbac_cg_list.json.results | json_query(query) | first).groups[0].name !=
-              (rbac_cg_list.json.results | json_query(query) | first).groups[1].name
+              (rbac_cg_list.json.results | json_query(query_string) | first).groups[0].name !=
+              (rbac_cg_list.json.results | json_query(query_string) | first).groups[1].name
 
     - name: Evaluate results for test-rbac_cg-2
       vars:
-        query: "[?name=='test-rbac_cg-2']"
+        query_string: "[?name=='test-rbac_cg-2']"
       assert:
         that:
-          - rbac_cg_list.json.results | json_query(query) | length == 1
-          - (rbac_cg_list.json.results | json_query(query) | first).name == 'test-rbac_cg-2'
-          - (rbac_cg_list.json.results | json_query(query) | first).groups | length == 2
-          - (rbac_cg_list.json.results | json_query(query) | first).groups[0].name in ['test_group1', 'test_group2']
-          - (rbac_cg_list.json.results | json_query(query) | first).groups[1].name in ['test_group1', 'test_group2']
+          - rbac_cg_list.json.results | json_query(query_string) | length == 1
+          - (rbac_cg_list.json.results | json_query(query_string) | first).name == 'test-rbac_cg-2'
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups | length == 2
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups[0].name in ['test_group1', 'test_group2']
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups[1].name in ['test_group1', 'test_group2']
           - >
-              (rbac_cg_list.json.results | json_query(query) | first).groups[0].name !=
-              (rbac_cg_list.json.results | json_query(query) | first).groups[1].name
+              (rbac_cg_list.json.results | json_query(query_string) | first).groups[0].name !=
+              (rbac_cg_list.json.results | json_query(query_string) | first).groups[1].name
 
     # update content guards
     - include_role:
@@ -136,21 +136,21 @@
 
     - name: Evaluate results for test-rbac_cg-1
       vars:
-        query: "[?name=='test-rbac_cg-1']"
+        query_string: "[?name=='test-rbac_cg-1']"
       assert:
         that:
-          - rbac_cg_list.json.results | json_query(query) | length == 1
-          - (rbac_cg_list.json.results | json_query(query) | first).name == 'test-rbac_cg-1'
-          - (rbac_cg_list.json.results | json_query(query) | first).groups | length == 1
-          - (rbac_cg_list.json.results | json_query(query) | first).groups[0].name == 'test_group1'
+          - rbac_cg_list.json.results | json_query(query_string) | length == 1
+          - (rbac_cg_list.json.results | json_query(query_string) | first).name == 'test-rbac_cg-1'
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups | length == 1
+          - (rbac_cg_list.json.results | json_query(query_string) | first).groups[0].name == 'test_group1'
 
 
     - name: Evaluate results for test-rbac_cg-2
       vars:
-        query: "[?name=='test-rbac_cg-2']"
+        query_string: "[?name=='test-rbac_cg-2']"
       assert:
         that:
-          - rbac_cg_list.json.results | json_query(query) | length == 0
+          - rbac_cg_list.json.results | json_query(query_string) | length == 0
 
     - name: Cleanup
       include_role:
diff --git a/tests/test_group.yml b/tests/test_group.yml
index 3b8a379..5ccf77b 100644
--- a/tests/test_group.yml
+++ b/tests/test_group.yml
@@ -21,8 +21,8 @@
     - name: Exit if version < 3.17
       meta: end_play
       vars:
-        query: "[?component=='core'].version"
-      when: status_result.json.versions | json_query(query) | first is version('3.17', '<')
+        query_string: "[?component=='core'].version"
+      when: status_result.json.versions | json_query(query_string) | first is version('3.17', '<')
 
     - name: Query groups
       uri:
diff --git a/tests/test_user.yml b/tests/test_user.yml
index 54d28f2..73586f8 100644
--- a/tests/test_user.yml
+++ b/tests/test_user.yml
@@ -22,8 +22,8 @@
     - name: Exit if version < 3.17
       meta: end_play
       vars:
-        query: "[?component=='core'].version"
-      when: status_result.json.versions | json_query(query) | first is version('3.17', '<')
+        query_string: "[?component=='core'].version"
+      when: status_result.json.versions | json_query(query_string) | first is version('3.17', '<')
 
     - name: Query groups
       uri: