ci: Use generalized action to test against different distributions#2
Closed
spetrosi wants to merge 1 commit into
Closed
ci: Use generalized action to test against different distributions#2spetrosi wants to merge 1 commit into
spetrosi wants to merge 1 commit into
Conversation
Enhancement: Use single GH action to test on container images Reason: The fleet of GH actions testing against different container images was not maintainable. Result: On this role side, all code is in one workflow file. Issue Tracker Tickets (Jira or BZ if any): - Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR consolidates Ansible CI testing into a single matrix-based workflow, adds support for two new SSH configuration options, and extends the role to support Alpine Linux and Ubuntu 26 with distribution-specific variables and test adaptations. ChangesSSH Config Enhancements
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
Comment |
Owner
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ansible-check.yml:
- Around line 31-35: The workflow currently references mutable tags/refs
(actions/checkout@v6 and Jakuje/check-ansible-action@main); replace those uses
entries with the exact commit SHAs resolved for the versions you want to lock
(e.g., actions/checkout@<commit-sha> and
Jakuje/check-ansible-action@<commit-sha>) so the CI cannot change
unexpectedly—locate the two uses lines for actions/checkout and
Jakuje/check-ansible-action in the ansible-check.yml and substitute the tag/ref
with the corresponding immutable commit SHAs.
In `@tests/tasks/setup.yml`:
- Around line 44-48: The bootstrap package selection includes Alpine in the
OS-family conditional but still references the package name openssh-client;
update the Alpine-specific branch so the resolver uses the Alpine-default
variable name openssh-client-default (or map openssh-client to
openssh-client-default for Alpine) to match vars/Alpine.yml; specifically adjust
the conditional that handles ansible_facts['distribution'] == 'Alpine' so the
chosen package string matches the declared variable openssh-client-default used
by the Alpine role.
In `@tests/tests_no_skip_defaults.yml`:
- Around line 16-17: Update the Alpine expectation in the test to match the
role's Alpine default: replace the literal "Include /etc/ssh/ssh_config.d/"
expectation with the globbed form "Include: /etc/ssh/ssh_config.d/*.conf" so it
aligns with the value defined in vars/Alpine.yml (ensure the test assertion that
checks the SSH config content uses the same "Include:
/etc/ssh/ssh_config.d/*.conf" string).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e1bd1e8e-c332-497c-a8f8-a006d22850d0
📒 Files selected for processing (13)
.dev-tools/options_body.github/workflows/ansible-centos.yml.github/workflows/ansible-check.yml.github/workflows/ansible-debian.yml.github/workflows/ansible-fedora.yml.github/workflows/ansible-ubuntu.ymltemplates/ssh_config.j2tests/tasks/setup.ymltests/tests_additional_packages.ymltests/tests_all_options.ymltests/tests_no_skip_defaults.ymlvars/Alpine.ymlvars/Ubuntu_26.yml
💤 Files with no reviewable changes (4)
- .github/workflows/ansible-ubuntu.yml
- .github/workflows/ansible-debian.yml
- .github/workflows/ansible-centos.yml
- .github/workflows/ansible-fedora.yml
Comment on lines
+31
to
+35
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Test Ansible SSH Role | ||
| uses: Jakuje/check-ansible-action@main | ||
| with: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "actions/checkout v6 SHA:"
git ls-remote https://github.com/actions/checkout refs/tags/v6
echo
echo "Jakuje/check-ansible-action main SHA:"
git ls-remote https://github.com/Jakuje/check-ansible-action refs/heads/mainRepository: spetrosi/ssh
Length of output: 231
🏁 Script executed:
sed -n '31,35p' .github/workflows/ansible-check.ymlRepository: spetrosi/ssh
Length of output: 188
Pin GitHub Actions to immutable commit SHAs instead of moving refs.
uses: ...@v6 and uses: ...@main allow upstream changes to alter CI behavior without any PR in this repo. Pin both actions to their resolved commit SHAs:
🔒 Suggested fix
- - name: Checkout code
- uses: actions/checkout@v6
+ - name: Checkout code
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- - name: Test Ansible SSH Role
- uses: Jakuje/check-ansible-action@main
+ - name: Test Ansible SSH Role
+ uses: Jakuje/check-ansible-action@f64d87a5598747f49294b37d7302083afbc15c76📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| uses: actions/checkout@v6 | |
| - name: Test Ansible SSH Role | |
| uses: Jakuje/check-ansible-action@main | |
| with: | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Test Ansible SSH Role | |
| uses: Jakuje/check-ansible-action@f64d87a5598747f49294b37d7302083afbc15c76 | |
| with: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ansible-check.yml around lines 31 - 35, The workflow
currently references mutable tags/refs (actions/checkout@v6 and
Jakuje/check-ansible-action@main); replace those uses entries with the exact
commit SHAs resolved for the versions you want to lock (e.g.,
actions/checkout@<commit-sha> and Jakuje/check-ansible-action@<commit-sha>) so
the CI cannot change unexpectedly—locate the two uses lines for actions/checkout
and Jakuje/check-ansible-action in the ansible-check.yml and substitute the
tag/ref with the corresponding immutable commit SHAs.
Comment on lines
44
to
+48
| - (ansible_facts['os_family'] in ['RedHat', 'Suse'] | ||
| and ansible_facts['distribution_major_version'] | int >= 8) or | ||
| (ansible_facts['distribution'] == 'Ubuntu' | ||
| and ansible_facts['distribution_major_version'] | int >= 20) | ||
| and ansible_facts['distribution_major_version'] | int >= 20) or | ||
| ansible_facts['distribution'] == 'Alpine' |
There was a problem hiding this comment.
Align Alpine bootstrap package with the new Alpine role defaults.
Line 48 opts Alpine into the Alpine-specific path, but the bootstrap package resolver still falls through to openssh-client (Line 24) while this PR’s vars/Alpine.yml declares openssh-client-default. This mismatch can fail setup before role execution on Alpine.
Suggested fix
- name: Make sure openssh is installed before creating backup
vars:
__ssh_test_packages: >-
{{
"openssh-clients" if ansible_facts['os_family'] in ['RedHat', 'Suse']
- else "openssh-client"
+ else ("openssh-client-default"
+ if ansible_facts['distribution'] == 'Alpine'
+ else "openssh-client")
}}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/tasks/setup.yml` around lines 44 - 48, The bootstrap package selection
includes Alpine in the OS-family conditional but still references the package
name openssh-client; update the Alpine-specific branch so the resolver uses the
Alpine-default variable name openssh-client-default (or map openssh-client to
openssh-client-default for Alpine) to match vars/Alpine.yml; specifically adjust
the conditional that handles ansible_facts['distribution'] == 'Alpine' so the
chosen package string matches the declared variable openssh-client-default used
by the Alpine role.
Comment on lines
+16
to
+17
| {% elif ansible_facts['os_family'] == 'Alpine' %} | ||
| Include /etc/ssh/ssh_config.d/ |
There was a problem hiding this comment.
Fix Alpine expectation to match the role’s Alpine defaults.
Line 17 expects Include /etc/ssh/ssh_config.d/, but this PR’s vars/Alpine.yml sets Include: /etc/ssh/ssh_config.d/*.conf. Keep these aligned to avoid false failures in the assertion.
Suggested fix
{% elif ansible_facts['os_family'] == 'Alpine' %}
- Include /etc/ssh/ssh_config.d/
+ Include /etc/ssh/ssh_config.d/*.conf📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| {% elif ansible_facts['os_family'] == 'Alpine' %} | |
| Include /etc/ssh/ssh_config.d/ | |
| {% elif ansible_facts['os_family'] == 'Alpine' %} | |
| Include /etc/ssh/ssh_config.d/*.conf |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/tests_no_skip_defaults.yml` around lines 16 - 17, Update the Alpine
expectation in the test to match the role's Alpine default: replace the literal
"Include /etc/ssh/ssh_config.d/" expectation with the globbed form "Include:
/etc/ssh/ssh_config.d/*.conf" so it aligns with the value defined in
vars/Alpine.yml (ensure the test assertion that checks the SSH config content
uses the same "Include: /etc/ssh/ssh_config.d/*.conf" string).
This was referenced May 15, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enhancement: Use single GH action to test on container images
Reason: The fleet of GH actions testing against different container images was not maintainable.
Result: On this role side, all code is in one workflow file.
Issue Tracker Tickets (Jira or BZ if any): -
Forked from linux-system-roles#239
Summary by CodeRabbit
New Features
RefuseConnectionandWarnWeakCryptoSSH configuration options.Chores