CLI tests are discovered by group membership alone, so a test that builds
its own fixtures from the controller's checkout ran on every host carrying
its role. The meshed swarm arm puts svc-net-wireguard on every node, and run
38864400393 failed Pretix#2, Magento and Matrix#2 with
"cd: /home/runner/work/infinito.nexus/infinito.nexus: No such file or
directory" on each node.
A role now declares cli.controller_only in meta/tests.yml, read through the
role_tests lookup like cli.timeout and cli.container_service_key, and its
test runs only on a host reached over a local connection. Every other role
runs exactly as before. Checked against a local-connection host and a
docker-connection host: svc-net-wireguard ran on the first and was skipped
on the second, and svc-net-tor ran on both.
Ansible warns that the name is already in use and carries on. Carrying on is the problem: inside the loop the original value is gone, so every lookup, template and nested include reading that name sees the loop item instead, and the task still reports success. The damage lands in a log nobody greps.
The lint collects every key declared in group_vars and in each role's vars or defaults, then reports any loop_var matching one. A denylist of known-bad names would have found application_id and missed domain, which is the same class in four more places.
All seven existing sites are marked, each with the reason read at the source rather than inferred. The three application_id loops pass the role id as the item, and the include_vars that follows loads that role's own application_id with the same value, so both meanings coincide by construction. The four domain loops hand the vhost to sys-stk-front-proxy, whose tasks read front_proxy_domain from exactly that name, so the shadowing is the interface.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
test.sh spawns its SOCKS forwarders with the bare python3 from PATH -
the baked /opt/venvs/infinito venv on swarm nodes - which neither
sys-pip-install (targets ansible_python_interpreter) nor the system pip
reaches. python3 -m pip hits exactly the interpreter test.sh sees;
--break-system-packages keeps the compose CI system python accepting it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
test-e2e-cli renders test.env at 0600 in a 0700 stage dir and always removes the stage tree (it holds base64 DB credentials). test-e2e-playwright + the e2e scripts resolve the node SOCKS from the single spot: playwright via lookup('tor_socks', 'host.docker.internal'), onion.sh takes it as a required arg, rerun-spec.sh composes it from INFINITO_TOR_SOCKS_PORT — no 9050 literal or backup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
evangelostsak
kevinveenbirkenbachandClaude Opus 5
Alejandro Roman