From 80d26ca0683d34f5d8d6bcd2361034a69d843050 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Fri, 11 Jul 2025 01:53:38 +0200
Subject: [PATCH] Validated use of correct applications in group_names

---
 ...2_personal-computer.yml => 02_desktop.yml} |  1 -
 tasks/stages/02_server.yml                    |  1 -
 tests/integration/test_group_applications.py  | 47 +++++++++++++++++++
 3 files changed, 47 insertions(+), 2 deletions(-)
 rename tasks/stages/{02_personal-computer.yml => 02_desktop.yml} (88%)
 create mode 100644 tests/integration/test_group_applications.py

diff --git a/tasks/stages/02_personal-computer.yml b/tasks/stages/02_desktop.yml
similarity index 88%
rename from tasks/stages/02_personal-computer.yml
rename to tasks/stages/02_desktop.yml
index 508b8a7f..b3f090b1 100644
--- a/tasks/stages/02_personal-computer.yml
+++ b/tasks/stages/02_desktop.yml
@@ -8,7 +8,6 @@
     label: "{{ item }}-roles.yml"
 
 - name: general host setup
-  when: ("personal_computers" in group_names)
   include_role:
     name: "{{ item }}"
   loop:
diff --git a/tasks/stages/02_server.yml b/tasks/stages/02_server.yml
index 497c19d3..68fac91e 100644
--- a/tasks/stages/02_server.yml
+++ b/tasks/stages/02_server.yml
@@ -1,6 +1,5 @@
 ---
 - name: Setup server base
-  when: ("servers" in group_names)
   include_role:
     name: "{{ item }}"
   loop:
diff --git a/tests/integration/test_group_applications.py b/tests/integration/test_group_applications.py
new file mode 100644
index 00000000..6620b72f
--- /dev/null
+++ b/tests/integration/test_group_applications.py
@@ -0,0 +1,47 @@
+import os
+import sys
+import re
+import unittest
+from cli.meta.applications import find_application_ids
+
+# ensure project root is on PYTHONPATH so we can import your CLI code
+ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir, os.pardir))
+sys.path.insert(0, ROOT)
+
+class TestGroupApplications(unittest.TestCase):
+    # regex to capture any literal check in group_names: 'name' in/not in group_names
+    GROUP_CHECK_RE = re.compile(r"['\"](?P<name>[^'\"]+)['\"]\s*(?:in|not in)\s*group_names")
+
+    def test_group_name_checks_use_valid_application_ids(self):
+        """
+        Ensures that any string checked against group_names corresponds to a valid application ID.
+        """
+        valid_apps = find_application_ids()
+
+        # walk the entire project tree
+        for dirpath, _, filenames in os.walk(ROOT):
+            for filename in filenames:
+                if not filename.lower().endswith(('.yml', '.yaml')):
+                    continue
+                filepath = os.path.join(dirpath, filename)
+                try:
+                    with open(filepath, 'r', encoding='utf-8') as f:
+                        text = f.read()
+                except Exception:
+                    continue
+
+                # find all group_names checks in the file
+                for match in self.GROUP_CHECK_RE.finditer(text):
+                    name = match.group('name')
+                    # the checked name must be one of the valid application IDs
+                    self.assertIn(
+                        name,
+                        valid_apps,
+                        msg=(
+                            f"{filepath}: group_names check uses '{name}', "
+                            f"which is not a known application ID {valid_apps}"
+                        )
+                    )
+
+if __name__ == '__main__':
+    unittest.main()