The requirements named seven collections without versions, so every
install re-resolved them against galaxy.ansible.com and --force-with-deps
redownloaded all 37 MB even when nothing had changed. Exact pins make the
installed set checkable, and the check short-circuits the whole roundtrip:
make install-ansible drops from 8m24s to 0.077s, and a Galaxy outage stops
mattering once the pinned set is present.
The git fallback is pinned to the same versions so it installs what the
Galaxy file declares rather than whatever the branches currently hold.
kewlfft.aur pins a commit because its tags carry no galaxy.yml and master
has moved past the released version.
The lint installer kept a second, weaker truth about the same directory,
guessing from directory presence for three hardcoded collections; it now
shares the version-exact check.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove the [DEPRECATION WARNING] entries the compose/swarm deploys emitted:
- apt_repository (removed in ansible-core 2.25): write docker.list via copy +
an explicit apt update. deb822_repository is unusable here because
apt_repo.sh's sanitize_sources deletes .sources every run.
- INJECT_FACTS_AS_VARS (default deprecated in 2.24): use ansible_facts['<name>']
instead of the auto-injected top-level ansible_os_family / virtualization_* /
default_ipv4 vars.
- community.mysql.* (removed in community.mysql 6.0.0): switch to ansible.mysql
and pin the collection in requirements.galaxy.yml.
Add a compose deploy gate (assert_no_deprecation_warnings.sh + workflow step +
test) that fails on [DEPRECATION WARNING] in the deploy log, and a lint test
(test_no_deprecated_ansible_patterns) that forbids the three patterns above so
they cannot return.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The lint-ansible workflow runs ansible-lint with INFINITO_LINT_RUNNER=host
(outside the compose stack container). roles/svc-storage-nfs-client uses
ansible.posix.mount for the NFS probe-mount; the host runner could not
resolve the module so the syntax-check failed CI while local make lint
passed (the container already had the collection via galaxy bootstrap).
Adding ansible.posix to requirements.galaxy.yml installs it everywhere
the existing ansible-galaxy install step runs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two fixes for the lint-ansible CI job (failing run 25604499233):
1. Add `community.docker` to requirements/requirements.galaxy.yml so
`ansible-galaxy collection install -r ...` pulls it in CI. The
collection is referenced in 9+ files (web-app-discourse handlers,
svc-db-mariadb/openldap, sys-svc-compose/container, web-app-keycloak/
decidim) but was missing from the requirements list, so syntax-check
could not resolve `community.docker.docker_container`.
2. Add a "Generate role include files" step to .github/workflows/
lint-ansible.yml. `tasks/groups/*-roles.yml` are gitignored generated
artefacts (per tasks/groups/.gitignore: `*-roles.yml`) referenced
from tasks/stages/*.yml; without them ansible-lint reports a fatal
load-failure on tasks/groups/desk-roles.yml. The new step runs
`PYTHON=python3 bash scripts/setup.sh` (same path the local `make
setup` target invokes); pyyaml added to the pip install line as
that's the only non-stdlib dep the setup script needs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* scripts/lint/autoformat.sh:
- rename run_sort_claude_settings worker to run_claude (matches the
renamed scripts/lint/claude.sh).
- drop the EXIT trap that wiped status_dir; cleanup happens explicitly
after `wait` returns, so a parallel worker that interrupts the
parent never races a vanished status dir.
- each worker now captures its tool's exit code and writes one of
OK / SKIP / FAIL. Tolerated `expected violations remain`-style exits
(markdownlint-cli2 rc≤1, ansible-lint rc≤2) still count as OK; only
real failures count as FAIL.
- all workers run to completion regardless of individual tool failures
(so the user always sees the full picture); after the summary, the
script exits 1 if any worker reported FAIL.
* scripts/lint/sort_claude_settings.sh -> scripts/lint/claude.sh
(history preserved via git mv); update test_claude_settings_sorted.py
fix-hint accordingly.
Plus working-tree drift across roles/, group_vars/, inventories/,
requirements/, and .pre-commit-config.yaml accumulated from the
make-test setup phase regenerating generated artefacts during recent
test runs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Split collection requirements into Galaxy and Git sources and
introduce retry logic with Git fallback to harden CI against
transient Ansible Galaxy API failures.
infinito-nexus-updater[bot]
kevinveenbirkenbachandClaude Opus 5
Alejandro Roman