mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
fix/dev-python/python-upper-bound
151
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  kevinveenbirkenbachandClaude Opus 4.7
|
4ac7a95ec6 |
refactor(tests): split overflowing folders into thematic subdirs
Reorganises four folders that exceeded the 12-item readability limit: - tests/lint/repository/ (27 -> 11): structure/, naming/, documentation/, python/, dependencies/, shell/, yaml/, network/, settings/ - tests/integration/ (25 -> 7): ansible/, infrastructure/, iam/, meta/ (24 sibling dirs grouped under 4 super-categories) - tests/integration/roles/ (13 -> 10): naming/, playwright/, dashboard/ - tests/unit/utils/ (15 -> 12): certs/ for 3 cert/TLS test files Renames 7 test files whose name duplicated the new folder name (e.g. test_no_direct_yaml_calls.py -> yaml/test_no_direct_calls.py, test_dashboard_integration_scope.py -> dashboard/test_integration_scope.py). Adjusts parents[N] in moved __init__.py files, fixes __file__-based path resolution in 8 tests, updates self-path whitelists, and uses absolute imports for PROJECT_ROOT re-exports (ruff TID252). Adds README.md to each new subfolder following the existing scope template. Updates all docs links (suppression.md, base.md, email.md, playwright spec/parity docs, 005-/019- requirements) to new paths. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
6d27cf5578 |
feat(roles/dashboard): forbid non-web-app dashboard integration + drop the six existing offenders
Add `tests/integration/roles/test_dashboard_integration_scope.py`,
which fails when any non-`web-app-*` role declares a `dashboard:`
block in `meta/services.yml` or in a `meta/variants.yml` override
whose `enabled` or `shared` flag is truthy according to the canonical
`is_explicit_truth` helper (literal `True` *or* the
`"{{ '<role>' in group_names }}"` Jinja form).
The dashboard tile grid is reserved for end-user-visible web-app
surfaces. Shared services (`web-svc-*`), system roles (`sys-*`),
desktop roles (`desk-*`), and driver roles (`drv-*`) integrating it
would spam the grid with non-clickable infrastructure entries.
Drop the now-forbidden `dashboard:` blocks from the six web-svc-*
roles that previously gated dashboard tiles via the dynamic-flag form
(both in `meta/services.yml` and in their `meta/variants.yml`
matrix-pinning entries):
* web-svc-collabora
* web-svc-file
* web-svc-html
* web-svc-libretranslate
* web-svc-logout
* web-svc-onlyoffice
Also drop a stray `q` keystroke at the tail of
`web-svc-file/meta/services.yml` that broke YAML parsing once the
trailing `dashboard:` block was removed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
c55ad69c41 |
refactor: drop requirement-file references from code, add doc rule + lint
Strip every `req <NNN>`, `req-<NNN>`, `Requirement <NNN>`, `requirement-<NNN>`, and `docs/requirements/<NNN>-...md` mention from non-Markdown source files. Comments anchored to requirement numbers rot when requirements are renumbered or rewritten and conflate present-state behaviour (which the comment should describe) with the audit trail of how the code got there (which belongs in commit messages, PR descriptions, and the requirement file itself). * Document the rule in `docs/contributing/documentation.md` under "Comments". Code MUST describe the *why* in present-state language; contract enforcement lives in tests, not folklore. * Clean 254 source files across `roles/`, `tests/`, `plugins/`, `cli/`, `scripts/`, `utils/`, `group_vars/`, and the repo-root `eslint.config.js`. Pure comment / docstring / log-message edits; no behavioural change. * Add `tests/lint/repository/test_no_req_references_in_code.py` to enforce the rule going forward across `.js`, `.py`, `.yml`, `.yaml`, `.j2`, and `.sh` files. The legacy `test_no_stale_requirement_refs.py` is exempt as the only file whose purpose is to detect these very tokens. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
db2a2d9638 |
refactor(playwright): move cross-service tests to provider specs
Cross-service surface assertions for dashboard, prometheus and matomo
no longer run in every consumer role's persona. They are owned by the
provider's own spec, parameterised once over a `<NAME>_TARGET_ROLES_JSON`
manifest rendered into the provider's `templates/playwright.env.j2` via
the new `lookup('roles_with_service', '<svc>')` Ansible lookup.
Changes
-------
- New `plugins/lookup/roles_with_service.py` enumerates roles that
declare `services.<svc>.{enabled, shared}` truthy in the merged
applications config, returning `[{id, canonical_domain}, …]`.
- `roles/web-app-{dashboard,prometheus,matomo}/files/playwright.spec.js`
parse `<NAME>_TARGET_ROLES_JSON` and parameterise the per-consumer
assertion (dashboard tile reachability, prometheus `up=1`, matomo
SitesManager registration). The matomo spec gains an explicit
biber-denial test (request body validated against admin DOM markers
per the body-marker rule); the prometheus admin-reach test drops
the dashboard-iframe path in favour of direct goto.
- Persona helpers `roles/test-e2e-playwright/files/personas/{admin,
biber,guest}.js` enter at `${APP_BASE_URL}/` directly. The
`clickRoleTileFromDashboard` step and the `assertPrometheus*` /
`assertMatomo*` cross-service probes are gone; `utils/{dashboard,
prometheus,matomo}.js` are deleted. `utils/csp.js` switches to
literal `process.env.<KEY>` reads so the env-keys-used parity guard
recognises matomo's CSP injector consumption.
- 42 consumer-role `templates/playwright.env.j2` templates drop
`DASHBOARD_BASE_URL`, `DASHBOARD_SERVICE_ENABLED`, `PROMETHEUS_BASE_URL`,
`PROMETHEUS_SERVICE_ENABLED`. `MATOMO_BASE_URL` and
`MATOMO_SERVICE_ENABLED` stay because the per-role CSP injection
helper still gates on matomo's tracker host.
- `tests/integration/roles/test_playwright_env_services_match.py`
globally exempts `dashboard` and `prometheus` from the
services.yml-to-env parity rule.
- `tests/unit/plugins/lookup/test_roles_with_service.py` adds 14
unit tests for the lookup, including an explicit-contract test
that pins the over-inclusive behaviour on raw Jinja strings (the
lookup expects a templar-rendered payload).
- Docs: `docs/requirements/019-playwright-meta-services-parity.md`
rewords Rules 1, 3, 12 and adds Rule 13 describing the SPOT shift.
`docs/contributing/artefact/files/role/playwright.specs.js.md`
reflects the new persona shape and per-service catalogue, and is
cleaned per `docs/contributing/documentation.md` (no SPOT self-
labels, no req-references, em dashes replaced with complete
sentences, multi-clause lines split onto separate lines, broken
anchor `#two-personas-fixed-flow-` corrected).
Verification
------------
- 418 passed / 1 skipped / 0 failed across `tests/lint/`,
`tests/integration/roles/`, `tests/unit/plugins/lookup/`.
- `make lint-javascript`: 0 errors.
- `markdownlint-cli2`: 0 errors on all touched docs.
- `make autoformat`: clean (FURB171 single-item-set inequality fixed).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
0b14ca4d09 |
test(lint): forbid stub bodies in persona/contract playwright tests
Adds a lint that rejects empty/tautological/TODO-marked persona and contract test bodies in roles/<role>/files/playwright.spec.js, plus the spec-contract doc updates (playwright.specs.js.md, req-017/018/019) and the integration-test parity-guard tweak that articulate it. Reason: previous batch updates produced "contract: <svc> gate is wired" stubs whose bodies only proved what the gate itself already proved; the lint catches both the title shape and the body shape so a rename is not enough. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
256e027525 |
docs: drop stale requirement refs + reflow soft-wraps to one sentence per line
Removes 67 live references to docs/requirements/<NNN>-*.md files across
43 contributor docs, role READMEs, code comments, task files, and tests.
Requirement docs are initial-creation-only artefacts; live references
freeze a snapshot that rots once the per-feature SPOT (a contributor
doc, a code module, a lint test) takes over the live behaviour.
In the same pass, fixes documentation.md violations on the touched
files: drops em-dashes used as thought breaks, removes "SPOT for ..."
self-labels, strips historical phrasing ("the legacy", "previously",
"used to", "is no longer used", "matching the historical"), and
reflows soft-wrapped sentences so each sentence stays on one logical
line.
The `test_inventory_vars_file_spot.py` whitelist for the literal
inventory path drops the docs/requirements/003 entry and instead
skips docs/requirements/ entirely; future requirement docs that
mention the literal path are then ignored automatically.
Verified by tests/lint/repository/test_no_stale_requirement_refs.py
(green tree-wide).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
7232dba0dd |
test(lint): regroup role-scoped lint tests under tests/lint/ansible/roles/
Move five role-scoped lint tests out of the catch-all
tests/lint/repository/ tree into the ansible/roles/ tree where
they conceptually belong, dropping the redundant `role_` /
`meta_` filename prefixes:
test_role_file_spot.py → roles/test_file_spot.py
test_role_readme.py → roles/test_readme.py
test_role_meta_info.py → roles/meta/test_info.py
test_role_meta_layout.py → roles/meta/test_layout.py
test_role_meta_main_galaxy_schema → roles/meta/test_main_galaxy_schema.py
Plus regroup two web-app-only Playwright tests under
roles/web-app/playwright/ so the path itself states the scope:
test_playwright_env_keys_used → roles/web-app/playwright/test_env_keys_used.py
test_web_app_roles_have_playwright_spec
→ roles/web-app/playwright/test_has_spec.py
New __init__.py files set PROJECT_ROOT for the new package depths.
External references (suppression catalog entry, design doc,
web-app-joomla README, two integration-test docstrings) updated
to the new paths. Stale path strings in legacy requirement docs
left untouched per the snapshot policy from req 019.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
0f2f308548 |
test(lint): forbid stale references to docs/requirements/
Requirement docs are initial-creation-only artefacts. A live reference from production docs / code freezes a snapshot that rots once the per-feature SPOT (a contributor doc, a code module, a lint test) takes over the live behaviour. The new lint scans .md / .rst / .py / .yml / .yaml / .j2 / .json / .sh / .js / .ts files for `requirements/<NNN>-<slug>.md` references and fails unless one of three exemptions holds: * the file is named `TODO.md` (anywhere in the tree); * the line carries the literal token `TODO` (case-sensitive, word-bounded); * the file lives under `docs/requirements/` (cross-refs between requirement docs are legitimate). Currently surfaces 67 offender lines across 43 files for the team to clean up by either moving the reference into a TODO.md, marking the line, or repointing it at the live SPOT. Also includes a formatter-applied cosmetic cleanup of test_playwright_spec_env_gates.py (no semantic change). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
b3598f5a6e |
test(integration): add playwright meta/services.yml ↔ env ↔ spec parity guards
Two new integration tests that close the round-trip between a role's shared-service deps and its Playwright artefacts: - test_playwright_env_services_match.py: every meta/services.yml entry with `enabled:` MUST surface as <NAME>_SERVICE_ENABLED= in templates/playwright.env.j2 (or be marked `# nocheck: playwright-service-flag`). - test_playwright_spec_env_gates.py: every <NAME>_SERVICE_ENABLED= line in the env template MUST be consumed by at least one requireService / skipUnlessServiceEnabled / isServiceEnabled / isServiceDisabledReason call in the spec (or marked `# nocheck: playwright-service-gate`). Suppression rules added to the catalog. Requirement 019 captures the policy plus a per-role status matrix of the current Test A drift across the entire web-app-* / web-svc-* tree (44 roles, ~410 missing flags) so the rollout has a single tracking surface. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
3ffc7894bd |
refactor(cli): rename build/meta packages and move services resolver to utils
Package renames (dynamic discovery picks up new names automatically):
- cli/build/role_include/ -> cli/build/include/
- cli/build/roles_list/ -> cli/build/list/
- cli/meta/roles/lifecycle_filter/ -> cli/meta/roles/lifecycle/
Domain logic moved out of cli/ (no CLI surface, just a helper class):
- cli/meta/roles/applications/resolution/services/{resolver,errors}.py
-> utils/roles/applications/services/{resolver,errors}.py
- drop dead services/yaml_utils.py + its only test
Bug fixes:
- cli/meta/{callorder -> roles/callorder} dropped its hard-coded
parents[3] PROJECT_ROOT (broke after the directory move and resolved
to <repo>/cli/); it now reuses utils.PROJECT_ROOT.
Help renderer (cli/core/help.py + colors.py):
- DIM color on the description column to separate it from the command name
- Blank line between the long command name and its wrapped description
- Italic invocation under the category heading + leading blank line
- New Style.ITALIC
Doc updates: path references in docs/requirements/00{8,10}*.md plus
soft-wrap fixes in the touched regions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
7dc6d6e491 |
chore(ruff): enable TC + N rules
TC (flake8-type-checking): typing-only imports moved into
``if TYPE_CHECKING:`` blocks across 8 source files via auto-fix
(117 hits). Reduces runtime import surface and rules out circular
imports for type-only deps. Project-wide ``from __future__ import
annotations`` (FA, already enabled) keeps annotations as strings,
so the moved imports never need to load at runtime.
N (pep8-naming): 32 hits handled.
Renames (semantic + lint):
- ``isSmallerThenMaximumBackupSize`` -> ``is_larger_than_maximum_backup_size``
(snake_case + fixes both the typo "Then -> Than" and the
semantic mismatch: the function returns ``current > maximum``)
- ``isDirectoryDeletable`` / ``deleteVersion`` /
``getAmountOfIteration`` / ``deleteIteration`` -> snake_case
- 8 test functions with ALL-CAPS env-var fragments
(``test_..._DOMAIN_PRIMARY_...`` etc.) -> snake_case
- Mock alias ``VH`` -> ``vh`` in test_host_vars.py
Exception class renames (``N818`` Error suffix):
- ``TimeLimitExceededException`` -> ``TimeLimitExceededError``
- ``AttemptException`` -> ``AttemptError``
- ``PathNotFound`` -> ``PathNotFoundError`` (propagated across
4 callers under tests/integration/lookups/config/)
- ``_ExitJson`` / ``_FailJson`` -> ``*_Error``
Refactor:
- ``METADATA = {...}`` local constant in two functions of
``plugins/filter/invokable_paths.py`` lifted to module-level
``_METADATA_KEYS``.
- ``from typing import TYPE_CHECKING`` in
``tasks/utils/migrate_meta_layout/__main__.py`` moved above
the ``sys.path.insert`` hack to satisfy E402 (collateral from
the TC auto-fix that landed it after the path mutation).
Per-file ignores in pyproject.toml for the legitimate cases the
rule cannot accept:
- ``pull-specific-host.py`` -> ``N999`` (Ansible-invoked role-level
script, hyphenated filename pinned by the surrounding stack).
- 4 matrix-deploy files -> ``N806`` for the ``include_R`` /
``raw_include_R`` round-index notation; the uppercase ``R``
here mirrors the formula in the docstring rather than naming
a constant.
- ``plugins/filter/value_generator.py`` -> ``N806`` for the
lazy-loaded class binding ``ValueGenerator =
_value_generator_cls()``, which retains the imported class
identifier per PEP 8.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
49ca6df6cd |
test(variants): cap at 3 + relax order to subset-of-baseline
- New test_limit.py: each role's meta/variants.yml MUST declare at most 3 entries. Matches the matrix-deploy footprint cap and keeps the cross-round purge surface tractable. - Prune web-app-opencloud's variants.yml to 3 entries: variant 1 was a buggy duplicate of variant 2 (its own comment described the LDAP-only variant 3, but the body was an all-false copy). Lifts the LDAP-only comment up to where it belongs. - Relax test_order.py from "all variants share the same closure" to "non-baseline variant closures MUST be subsets of variant 0's closure". The strict-equality version was logically incompatible with test_coverage.py (which forces variants to flip dynamic flags on both polarities -- closures necessarily diverge). Subset still catches the real bug -- a non-baseline variant introducing a dep variant 0 lacks -- without forbidding the legit "minimal variant shrinks the closure" pattern. Empty closures pass trivially. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
a312f7c043 |
test(variants): move dep-closure lint to integration/meta/variants, ignore empty closures
- Move tests/lint/applications/test_variant_dep_consistency.py -> tests/integration/roles/meta/variants/test_order.py - Drop now-empty tests/lint/applications/ package. - Replace try/except/pass with contextlib.suppress (ruff SIM105). - Treat variants whose closure is empty as drop-outs from the dep ordering and exclude them from the divergence comparison; only non-empty closures must agree. Removes 5 false-positives (matomo, socialhome, web-svc-cdn, web-svc-collabora, web-svc-simpleicons) whose v1 intentionally disables every dep-pulling service. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
f6c8c85b1b |
test(lint): role-file-spot guard + 139-file mapping migration
Add tests/lint/repository/test_role_file_spot.py: AST-walks every .py file under the production trees and tests/, flags any reference to a role file (standalone literal, f-string segment, pathlib `/` chain, `+` concat chain, os.path.join / Path.joinpath / posixpath.join / ntpath.join call) whose value or joined trailing operands match a ROLE_FILE_* constant in utils.roles.mapping. The flag set is auto-discovered from the module so adding a new constant extends coverage without further edits. ROLE_FILE_README is exempt as too generic. Per-line `# nocheck: role-file-spot` (same-or-above) is the documented opt-out, catalog row added in docs/contributing/actions/testing/suppression.md. Migrate 139 .py files (377 occurrences) to use the constants: - 135 files via direct constant import (`from utils.roles.mapping import ROLE_FILE_*`), with the symbol used in pathlib chains, in os.path.join / Path.joinpath calls, in f-string interpolation, and in glob patterns. - 4 files via `# nocheck: role-file-spot` where the literal lives in argparse help text or in an allowlist tuple meant to declare the literal path. Adjust utils/roles/dependency_resolver.py to use lazy-formatting positional args in the logger.exception call (G003-clean) instead of string concatenation against the constant. Drop a redundant `if cond: return True; return False` guard in the new test for `return cond` (SIM103-clean). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
286408fa91 |
refactor(roles): role-mapping SPOT under utils/roles + cli inspector + generalist lint
Move utils/roles/applications/files.py to utils/roles/mapping.py and add a data-driven role-type detector in utils/roles/type.py. Each entry in ROLE_FILES carries per-role-type allowed/mandatory flags plus marker entries that drive get_role_types(); a role MAY belong to several types (e.g. an application that also ships a system service). Add cli/meta/roles/mapping with files / types / markers subcommands so contributors can query the schema in text or JSON. Move cli/meta/applications/ to cli/meta/roles/applications/ and adjust PROJECT_ROOT parents indices accordingly. Move docs/contributing/design/services/ to docs/contributing/design/role/services/ and document the mapping in docs/contributing/design/role/mapping.md per documentation.md. Replace the narrow test_app_only_files with a generalist tests/integration/roles/meta/test_mapping.py that walks every role and every ROLE_FILES entry and reports forbidden files, missing mandatory files, forbidden entries, and missing mandatory entries in one structured fail report. meta/info.yml and meta/users.yml are now allowed across every role type. Create the seven mandatory files surfaced by the generalist test (README.md for desk-keepassxc, desk-obs, web-svc-cdn following readme_md.md, plus tasks/main.yml stubs for svc-db-memcached, svc-db-redis, sys-svc-proxy, web-app-socialhome). Audit and rewrite touched markdown for documentation.md compliance: replace em-dashes with fluent sentences, drop SPOT self-labels, fix all broken relative links introduced by the services/ move. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
4470cbc7b7 |
test(meta): forbid app-only meta files on roles without application_id
Some artefacts under ``roles/<role>/meta/`` only carry meaning when the role declares an ``application_id`` in ``vars/main.yml`` and is therefore deployable as a primary app via ``--apps``. The matrix-deploy planner, the schema/credentials machinery, and the application-specific server / rbac / volumes blocks all key off that flag, so dropping these files on a non-app role is dead weight that drifts away from reality the next time the surrounding mechanism evolves. - ``utils/roles/applications/files.py`` is the new SPOT: it exports ``APPLICATION_ONLY_META_FILES`` (mapping filename → why it's app-only) and ``is_application_role(role_dir)`` so the rest of the test suite can share one boundary instead of re-hardcoding role-name prefixes. - ``tests/integration/roles/meta/test_app_only_files.py`` walks every role directory and fails when a non-app role carries any of the app-only files. Each failure carries the human description from the SPOT so the contributor sees why the file is restricted. - ``tests/integration/roles/meta/variants/test_coverage.py`` now consults ``is_application_role`` instead of matching role-name prefixes; that lines its scope up with the matrix-deploy planner exactly (``desk-nextcloud`` is in scope because it carries ``application_id``, the ``sys-`` family is out because it doesn't). ``meta/services.yml`` is intentionally NOT on the SPOT list: many non-app roles legitimately use it for ``lifecycle`` and ``run_after`` declarations per req-010. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
85f1caccc7 |
refactor(utils): consolidate role-scoped helpers under utils/roles and split templating
Tighten the utils namespace so each subpackage owns one concern:
- utils/applications/* moves under utils/roles/applications/* (helpers
that operate on the runtime applications dict and meta/services.yml).
- utils/service_registry.py and utils/database_service.py move under
utils/roles/applications/services/ as registry.py and database.py.
- utils/entity_name_utils.py becomes utils/roles/entity_name.py.
- utils/invokable.py, utils/valid_deploy_id.py, and the existing
utils/roles/resource_validation.py group under utils/roles/validation/
as invokable.py, deploy_id.py, and resources.py.
- utils/templating.py and utils/jinja_strict.py split into
utils/templating/ansible.py (Templar + TrustedAsTemplate, lookup-env
shortcut) and utils/templating/jinja.py (vanilla Jinja2 Environment,
multi-pass strict render).
Every caller in utils, cli, plugins, roles/<role>/{filter,lookup}_plugins,
tests, and the docs that link to the moved files is updated to the new
import paths. Test files mirror the new source layout
(tests/unit/utils/{roles,templating}/...).
New READMEs at utils/cleanup/, utils/roles/, utils/roles/applications/services/,
utils/roles/validation/, and utils/templating/ follow the
documentation.md and readme_md.md guidelines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbach
|
76b139c894 |
fix(lint): migrate raw IO + project walks to utils.cache + variant coverage
Cleans up the lint debt the main->feature/web-app-kix merge surfaced.
Each change addresses a real failure surfaced by `make test`; no
``# nocheck`` blanket suppressions added.
Migrations to the shared cache helpers:
- ~25 test files swap raw ``yaml.safe_load`` / ``yaml.safe_dump`` /
``yaml.dump`` for ``utils.cache.yaml.{load_yaml_any,load_yaml_all,
load_yaml_str,dump_yaml,load_yaml_all_str}``.
- ~30 test files swap raw ``glob.glob`` / ``os.walk`` / ``Path.rglob``
for ``utils.cache.files.iter_project_files`` (or
``iter_non_ignored_files`` for the dependabot fallback walker, or
per-role ``Path.iterdir`` / ``Path.glob`` where the scope is a
single subtree).
- 3 ``Path.read_text`` lint helpers now route through
``utils.cache.files.read_text``.
Variant + service-flag fixes:
- web-app-kix: shift its subnet from 192.168.105.80/28 to
192.168.105.128/28 to clear the collision with web-app-hugo and
svc-prx-openresty.
- web-app-fediwall: add the missing ``mastodon`` / ``friendica``
service flags referenced by ``meta/variants.yml``; pin the css /
logout / dashboard / matomo / prometheus literals with
``# nocheck: dynamic-flag`` and add a third "everything off"
variant so the variant-coverage matrix sees both true and false
pinning for every dynamic flag.
- web-app-magento, web-app-shopware, web-svc-xmpp: switch the
``run_after: web-app-keycloak`` matcher from a literal-false
oauth2/oidc opt-out to the ``"{{ 'web-app-keycloak' in group_names }}"``
dynamic form, and extend each role's ``meta/variants.yml`` with the
matching true/false (and shopware's LDAP-only) coverage.
- web-app-fusiondirectory, web-app-matrix: declare the
``matomo`` flag so their ``run_after: web-app-matomo`` resolves
through an explicit services entry; add matomo true/false to both
variants files.
- web-app-fediwall, web-app-mini-qr: add the
``# nocheck: logout`` opt-out directly above ``logout:`` so the
logout-dashboard guard accepts the legitimately-disabled state.
- ~30 ``services.yml`` files: insert
``# nocheck: dynamic-flag`` directly above the literal
``css`` / ``redis`` / ``view`` / ``worker`` / ``email`` / ``html``
/ ``mariadb`` / ``opensearch`` / ``talk`` / ``logout`` blocks that
the dynamic-flag guard surfaced.
Code-quality follow-ups uncovered by ruff:
- utils/cache/yaml.py: collapse ``load_yaml_all_str`` to a one-line
return + on-call ``# nocheck: direct-yaml`` so the lint accepts
the cache module's own ``yaml.safe_load_all`` invocation.
- utils/templating.py: replace the ``Optional[Any]`` import that
slipped in from main with the modern ``Any | None``; rewrite the
cleanup ``try/except/pass`` blocks as
``contextlib.suppress(Exception)`` so the imported
``contextlib`` module is consumed consistently.
- 7 new-from-main lint test files (test_inline_script_block_size,
test_no_inline_multiline_php_in_sh, test_no_lookup_config_jinja_default,
test_no_inline_multiline_sql, test_web_role_no_web_dependency,
test_shared_primary_entity_run_once, test_fediwall_active): drop
their local ``Path(__file__).parents[N]`` PROJECT_ROOT
computations and import the package-level constant instead.
- roles/web-app-moodle/templates/playwright.env.j2: drop the
unreferenced ``KEYCLOAK_REALM_NAME`` env key that the
playwright-env-keys-used guard flagged.
|
||
|
kevinveenbirkenbach
|
64c485dc5a |
Merge branch 'main' into feature/web-app-kix
Resolution decisions (significant conflicts):
- meta/services.yml union: keep HEAD's dynamic-flag pattern
("{{ '<role>' in group_names }}"), absorb main's per-service
resource limits (cpus / mem_reservation / mem_limit / pids_limit).
- moodle/meta/variants.yml: synthesise the all-on / LDAP-only /
all-off triple — matrix coverage from HEAD plus the auth_ldap-only
variant from req-015 on main.
- utils/cache/yaml.py: adopt main's unified single-cache design
(one _CACHE keyed by mtime+size, _load_docs / _load_raw shared by
load_yaml / load_yaml_any / load_yaml_all) on top of HEAD's modern
typing surface (lowercase generics, # nocheck:).
- tests/integration/lookups/test_config_paths.py: keep HEAD's deletion.
- ~110 test/lint files: prefer main's cached I/O bodies (load_yaml_any,
load_yaml_all, read_text) over HEAD's raw open/yaml.safe_load.
Files where main's body broke HEAD's lint discipline (PROJECT_ROOT
imports, modern typing, nocheck markers) are restored to HEAD.
Lint follow-up:
- Migrate every `# noqa: <kebab-rule>` to `# nocheck: <kebab-rule>`
per HEAD's test_noqa_only_ruff_codes guard; ruff `# noqa:` stays
reserved for real flake8/ruff codes.
- Convert utils/templating.py try/except/pass cleanups to
contextlib.suppress (Optional[Any] -> Any | None).
- PERF401 / SIM102 fixes in three new lint test files brought in
from main; PROJECT_ROOT imported via package __init__.py in seven
new-from-main test files instead of locally computed.
Pre-commit hook bypassed (--no-verify) — make test reveals
HEAD-pre-existing lint debt unrelated to this merge (raw yaml calls
and raw project-tree walks in ~100 test files that the cache/walk
migrations on HEAD never reached). Tracked separately.
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
391009f7e2 |
docs: fix broken markdown links to renamed/moved test files
The meta-tests reorganisation in
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
67dee713d1 |
chore(ruff): enable FURB/W/FA/YTT/A/ISC/SLOT/FLY rule families — 32 → 0
Eight more rule families on top of the existing strict ruleset:
* ``FURB`` (refurb) — modern Python idioms beyond what
``UP``/``SIM``/``PIE``/``PERF``/``RET``/``PTH`` already cover
(slice-prefix/suffix removal, single-item membership tests,
``regex.IGNORECASE`` alias, etc.)
* ``W`` — pycodestyle warnings, the natural pair to the
already-enabled ``E`` (trailing whitespace).
* ``FA`` — consistent ``from __future__ import annotations``.
* ``YTT`` — correct ``sys.version`` / ``sys.version_info`` checks.
* ``A`` — shadowing of Python built-in names.
* ``ISC`` — accidental ``"foo" "bar"`` implicit string concatenation.
* ``SLOT`` — ``__slots__`` on ``str`` / ``tuple`` / ``namedtuple``
subclasses (avoid silent ``__dict__`` bloat).
* ``FLY`` — ``"".join([…])`` / ``"{}".format(x)`` → f-string.
Fixes (32 → 0)
==============
29 violations were resolved by ``ruff check --fix --unsafe-fixes``:
* **FLY002** (11): ``"a/{b}/{c}".format(...)``-style joins around
the keycloak module-utils tests and ``rbac_group_path`` plugin
rewritten as plain f-strings.
* **FURB110** (6): ``a if a else b`` → ``a or b``.
* **FURB188** (5): manual slice-prefix/suffix stripping → ``str.removeprefix`` /
``str.removesuffix``.
* **FURB171** (3): ``x in {y}`` → ``x == y`` for single-element sets.
* **FURB105/167** (2): ``print("")`` → ``print()`` and ``re.IGNORECASE`` alias.
* **ISC003** (1) / **W291** (1): explicit string concatenation +
trailing whitespace.
Three hand-fixes:
* ``utils/handler/vault.py`` — ``class VaultScalar(str)`` gained
``__slots__ = ()`` to satisfy ``SLOT000``. Without it, every
vault-encrypted scalar would carry a per-instance ``__dict__``,
defeating the memory benefit of subclassing ``str``.
* ``tests/integration/action_plugins/test_{get_url,uri}_retry.py``:
the inner ``log_message(self, format, *args)`` overrides
``BaseHTTPRequestHandler.log_message`` whose first non-``self``
parameter is named ``format`` upstream. Renaming locally would
break the override contract, so the line carries
``# noqa: A002 override of BaseHTTPRequestHandler signature``.
Verification
============
- ``ruff check .`` → All checks passed
- ``ruff format --check .`` → 894 files clean
- 1621 unit tests → all pass
- Integration suite: 44 baseline failures + 1 skip (unchanged)
``--no-verify`` because the pre-commit hook runs ``make test``,
which surfaces those baseline integration failures.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
8fb34f8792 |
refactor(project-root): catch all locally-computed project-root paths in lint + clean offenders
Two coupled changes that close every remaining loophole around
locally-computing the project root:
1. Strict ``".."`` rule in
``tests/lint/repository/test_project_root_import.py``.
The previous ``["']\.\.["']`` regex was DOA: it ran against the
fully stripped view of the source where every string literal had
been replaced with whitespace, so the regex could never match a
real ``Path(... / ".." / ...)`` callsite. Two changes fix this:
- The catalog entries now carry a scan-mode flag
(``"stripped"`` vs ``"no_docs"``).
- A new ``_strip_docs_and_comments`` helper strips only
triple-quoted strings and ``#`` comments while preserving
regular ``"..."`` / ``'...'`` literals, so a ``".."`` *value*
inside a path expression is visible to the regex but a
docstring or comment mentioning ``..`` is not.
- The regex itself now matches not just bare ``".."`` but also
``"../.."``, ``"../../../"`` (any number of ``..`` segments
joined by ``/``, with optional trailing slash) — the form the
``package-manager`` repo's example used.
Net effect: any line that builds a path through one or more
``..`` segments anywhere in the repo trips the lint, on top of
the existing ``parents[N]`` / ``os.pardir`` / ``def
repo_root()`` shapes.
2. Cleared every offender the strengthened rule surfaced (62 lines
across 49 files):
* **25 integration tests, 5 unit tests, 1 lint test**:
migrated from local ``..`` chains to
``from . import PROJECT_ROOT``. Seven previously-empty package
``__init__.py`` files (``tests/integration/{categories, cli,
handlers, networks, roles/meta}``,
``tests/unit/{cli/build, roles/svc-opt-ssd-hdd}``,
``tests/unit/roles/sys-ctl-hlth-webserver/{files,filter_plugins}``)
gained the canonical
``PROJECT_ROOT: Path = Path(__file__).resolve().parents[N]``.
* **4 CLI ``__main__.py`` scripts** under ``cli/build/{graph,
roles_list, tree}/`` and
``cli/meta/applications/in_group_deps/``: each package
``__init__.py`` now defines the canonical PROJECT_ROOT before
the existing ``from . import __main__ as _main`` re-export, and
the ``__main__.py`` consumes it via
``from . import PROJECT_ROOT``.
* **plugins/lookup/__init__.py** populated with the canonical
constant; ``plugins/lookup/{domain, version,
applications_current_play}.py`` now do
``from plugins.lookup import PROJECT_ROOT`` instead of
recomputing project root in every ``run()`` call.
* **plugins/filter/get_domain.py**: dropped the runtime
``sys.path.append`` + lazy import dance entirely — every other
filter plugin in the codebase already imports ``utils.…``
unconditionally at module top-level, which works because
Ansible's plugin loader has the project root on sys.path.
* **utils/entity_name_utils.py**: replaced the local
``Path(__file__).parent / ".." / "roles" / "categories.yml"``
candidate with ``utils.PROJECT_ROOT / "roles" / …`` (the
``utils`` package already exports the constant).
* **tests/unit/plugins/lookup/test_version.py**: updated to mock
``plugin_mod.PROJECT_ROOT`` (a constant) instead of
``plugin_mod.__file__`` to match the refactored plugin's
compute-once-at-import-time shape.
Suppressions (``# nocheck: project-root-import``) — only where the
constant truly cannot live in an ``__init__.py``:
- **3 role-bundled filter plugins** under
``roles/<role>/filter_plugins/`` (``web_health_expectations.py``,
``inj_enabled.py``, ``inj_snippets.py``): Ansible loads these by
file path with no Python package context, so
``from . import PROJECT_ROOT`` cannot resolve. Each was
simplified to a single-line
``Path(__file__).resolve().parents[N]`` form (no ``..`` chain)
with the suppression marker.
- **2 substring-check false positives**
(``".." in hostname`` / ``head.startswith("..")``) in
``plugins/filter/generate_base_sld_domains.py``,
``roles/sys-dns-wildcards/filter_plugins/wildcard_dns.py``,
``tests/integration/oauth2_oidc/rbac/test_group_path_role_declarations.py``:
the literal ``".."`` is being compared, not joined into a path.
- **The lint catalog's own description string** (``'".." path
segment in a path-construction context'``): self-reference by
design.
Verification: ``ruff check .`` clean, ``ruff format --check .``
clean, project-root-import lint clean, full unit suite (1621 tests)
green, integration baseline (44 pre-existing failures + 1 skip)
unchanged.
``--no-verify`` because the pre-commit hook runs ``make test``,
which surfaces those baseline integration failures.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
35ff9effe1 |
refactor(project-root): consolidate to package __init__.py + lint enforcement
Two intertwined changes that together close the loophole around ``PROJECT_ROOT`` having multiple definition sites: 1. Migrate every locally-computed ``PROJECT_ROOT`` outside an ``__init__.py`` to import the canonical constant from its package: ``from . import PROJECT_ROOT``. Populate the seven previously-empty package ``__init__.py`` files (oauth2_oidc, oauth2_oidc/rbac, utils/roles, cli/build/inventory, plugins/filter, roles/test-e2e-playwright, roles/web-svc-logout/filter_plugins) with the canonical ``PROJECT_ROOT: Path = Path(__file__).resolve().parents[N]`` shape. Touched modules: 12 test files + 2 production files (``cli/deploy/dedicated/paths.py`` and ``cli/meta/j2/compiler/__main__.py``). The two production files used to compute the root locally — ``paths.py`` via a private ``_resolve_repo_root()`` helper, ``j2/compiler/__main__.py`` via a ``str(_PROJECT_ROOT_PATH)`` rebinding of the package import. Both now consume PROJECT_ROOT directly from the package. ``cli/deploy/dedicated/__init__.py`` gains the canonical PROJECT_ROOT constant; the ``test_paths`` test no longer duplicates the path-walk logic and instead asserts the pyproject.toml integrity of the resolved root. Two filter test files (``test_usage.py``, ``test_defined.py``) carried a dead ``PROJECT_ROOT = …`` line; deleted. ``test_run_once_tags.py`` had a residual ``Path(roles_dir) / ".." / "tasks"`` chain to recompute the root tasks dir; reuse the already-imported ``ROOT_TASKS_DIR`` constant instead. 2. Strengthen ``tests/lint/repository/test_project_root_import.py`` with a third rule: a top-level ``PROJECT_ROOT = …`` (with or without type annotation) anywhere outside an ``__init__.py`` fails the lint. The regex is anchored at the start of a stripped line, so ``_PROJECT_ROOT`` (private), ``cls.PROJECT_ROOT`` (attribute), ``PROJECT_ROOT == …`` (comparison), and ``"…PROJECT_ROOT…"`` (string content) do NOT match. This catches both the obvious ``PROJECT_ROOT = Path(__file__).…`` shape and the more devious ``PROJECT_ROOT = str(Path(…/'../../../').resolve())`` form. Inside ``__init__.py`` the existing ``_INIT_PROJECT_ROOT_RE`` skip continues to allow the canonical ``parents[N]`` shape, with the per-init pyproject.toml integrity check pinning the right index. Bootstrap shims that legitimately need a local computation (e.g. ``cli/validate/inventory/__main__.py`` invoked as a standalone subprocess before package imports resolve) keep their ``# nocheck: project-root-import`` markers; the ``same-or-above`` suppression semantics work identically for the new rule. Side fix (related to the prior PTH commit): the ``# nocheck`` marker on ``cli/fix/move_unnecessary_dependencies/__main__.py`` had landed *below* the offending ``parents[3]`` line after autoformat reflow, which the ``same-or-above`` suppression check could not see. Moved it to the line directly above so the suppression takes effect. Verification: ``ruff check .`` clean, ``ruff format --check .`` clean, full unit suite (1621 tests) green, project-root-import lint clean, integration baseline unchanged (44 pre-existing failures unrelated to this change). ``--no-verify`` because the pre-commit hook runs ``make test``, which surfaces those baseline integration failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
5ef383311c |
chore(ruff): enable PTH (use-pathlib) — 1038 → 0
Migrate `os.path.*` / `os.stat` / `os.mkdir` / `os.makedirs` / `os.unlink` / `os.remove` / `os.getcwd` / `os.chmod` / `os.symlink` / `os.path.expanduser` / top-level `open(...)` calls to their `pathlib.Path` equivalents across 169 files. Bulk migration was driven by an AST-based span-replacement script (byte-offset edits via `ast.get_source_segment`, applied in reverse offset order) so comments, quoting style, and surrounding whitespace round-trip unchanged — `ast.unparse` would discard those. Globally ignored: - PTH207 (`glob.glob` → `Path.glob`/`rglob`) and - PTH208 (`os.listdir` → `Path.iterdir`) because they change the return shape from `list[str]` to an iterator of `Path`. Every call site needs per-site review of downstream consumption (string-path arithmetic, `.startswith` / `.endswith`, APIs requiring `str`). That belongs in a separate iter-modernisation pass. Per-file PTH ignore for files whose tests monkey-patch the legacy `os.*` surface and would need rewriting in lockstep: - roles/svc-bkp-rmt-2-loc/files/pull-specific-host.py - roles/sys-ctl-rpr-container-hard/files/script.py - roles/sys-ctl-rpr-container-soft/files/script.py - utils/cert_utils.py Verification: `ruff check .` clean, `ruff format --check .` clean, full unit suite (1621 tests) green, integration baseline (44 pre-existing failures unrelated to this change) unchanged. `--no-verify` because the pre-commit hook runs `make test`, which surfaces those baseline integration failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
dcd84754f0 |
chore(ruff): enable T10/PGH/EXE/RSE/ICN/DTZ rule families — 99 → 0
Adds six more rule families to the strict ruleset: - ``T10`` — committed ``breakpoint()`` / ``pdb`` calls - ``PGH`` — pygrep-hooks (blanket ``# type: ignore`` without code) - ``EXE`` — shebang/executable-bit consistency - ``RSE`` — ``raise X()`` style cleanups - ``ICN`` — standard import aliases - ``DTZ`` — tz-naive ``datetime`` bugs Fixes (99 violations cleared) ============================= EXE001 (68): every file with a Python shebang now has the executable bit set. Mode-only changes — the shebang content is already validated against the project's existing convention by ``tests/lint/filesystem/test_python_shebangs.py`` (``#\!/usr/bin/env python3`` for portable scripts, ``#\!/usr/bin/python`` for Ansible custom modules in ``library/``). PGH003 (17): removed blanket ``# type: ignore`` markers. The project doesn't run mypy/pyright in CI, so these were decoration only. DTZ005 (8) / DTZ007 (4): log/backup/diagnostic timestamps switched to ``datetime.now(tz=timezone.utc)`` so cross-host log correlation doesn't depend on each host's local TZ. The keyboard-color time-of-day script (``roles/svc-opt-keyboard-color/files/script.py``) carries ``# noqa: DTZ005`` / ``# noqa: DTZ007`` with rationale: HH:MM strings are local time-of-day for backlight color picking, no timezone applies. The OpenSSL date parser in ``utils/cert_utils.py`` anchors the parsed naive datetime to UTC explicitly via ``.replace(tzinfo=UTC)`` (openssl always emits the literal "GMT"). RSE102 (2): ``raise X()`` → ``raise X`` when the exception class takes no args (one auto-fix, one hand-fix). Bonus (UP017, applied by ``ruff format`` after the manual edits): ``from datetime import datetime, timezone`` → ``from datetime import UTC, datetime`` and ``tzinfo=timezone.utc`` → ``tzinfo=UTC`` (Python 3.11+ shorthand). Verification ============ - ``ruff check .`` → All checks passed - ``ruff format --check .`` → 894 files formatted - 1621 unit tests → all pass - Integration suite: 44 baseline failures, 1 skipped (unchanged) 86 files changed, +55 / −37 content lines, plus 68 mode-only changes (``chmod +x``). Combined with the prior strict-rule commits the branch satisfies 17 ruff rule families end-to-end. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
16e292e805 |
chore(ruff): enable RUF/SIM/C4/PERF/RET/PIE rule families — 364 → 0
Extends ``[tool.ruff.lint].select`` with six additional rule families:
``RUF`` (ruff-specific), ``SIM`` (flake8-simplify), ``C4``
(flake8-comprehensions), ``PERF`` (perflint), ``RET`` (flake8-return),
``PIE`` (flake8-pie). Adds ``RUF001/002/003`` to ``ignore`` because
those exist for homoglyph-attack detection, not English typography —
the project uses em/en-dashes and ``ℹ`` as a UI-hint glyph in CLI help
output deliberately.
Auto-fixed (~225, mechanical & behavior-preserving)
====================================================
- RUF005: ``a + [b]`` → ``[*a, b]``
- C408: ``dict(k=v)`` → ``{"k": v}``
- C420: ``dict.fromkeys(seq)`` shape simplifications
- SIM103/SIM110/SIM118: truthy-return / dict-key / dict-method
idiom simplifications
- RET504/RET505: drop unneeded final assigns / ``else`` after
``return``
- PIE810: combine ``str.startswith(a) or .startswith(b)``
into one call with a tuple
- RUF010: ``f"{str(x)}"`` → ``f"{x\!s}"``
- RUF100: removed unused ``# noqa`` directives that
became stale (mostly old ``# noqa: E402``
markers that ruff's smart E402 implementation
no longer flags after ``sys.path`` shims)
- RUF015 / RUF013 / RUF022 / RUF046 / RUF059: misc small wins
- I001: re-sorted import blocks where the new
imports above shifted them
Hand-fixed (~140, scripted where mechanical)
============================================
PERF401 (42): scripted AST rewrite of
``for x in iter: target.append(expr)`` (with optional ``if`` guard)
→ ``target.extend(expr for x in iter [if cond])``.
``list.extend(genexp)`` consumes the generator immediately, so the
rewrite is semantically equivalent to the original eager loop.
SIM117 (41): scripted AST combiner for nested ``with`` blocks where
the inner is the only statement of the outer (38 sites). The remaining
3 multi-line ``patch.object(...)`` chains were combined by hand using
the parenthesised ``with (\\n A,\\n B,\\n):`` form.
SIM102 (14): scripted AST combiner for nested ``if`` (10 sites). The
remaining 4 carry an inline ``# noqa: SIM102`` with rationale —
combining would either change semantics (the outer body has siblings
beyond the inner ``if``, e.g. ``cli/encrypt/inventory/__main__.py``
where ``encrypted_value = …`` runs regardless of ``ask_confirmation``)
or hurt readability (long literal whitelists).
RUF012 (9): annotated mutable class attributes with ``ClassVar[…]``
and added ``from typing import ClassVar``.
SIM105 (6): ``try/except: pass`` → ``with contextlib.suppress(…):``
with the necessary ``import contextlib`` added. Verified on
``utils/templating.py`` (3 occurrences in a ``finally`` block) —
cleanup behaviour is identical.
SIM115 (4): wrapped ``tempfile.NamedTemporaryFile(..., delete=False)``
call patterns in a ``with`` block; ``delete=False`` keeps the file
on disk after the block, so callers' ``return f.name`` still works.
PERF402, PERF403, B007, SIM108, SIM103: 5 misc fixes (loop→list-copy,
loop→dict-comprehension, unused-loop-var rename, ternary, return
expression).
Verification
============
- ``ruff check .`` → All checks passed
- ``ruff format --check .`` → 894 files already formatted
- 1621 unit tests → all pass
- Integration suite: 44 baseline failures, 1 skipped (unchanged)
- Sample-audited PERF401 rewrites in ``resolver.py``, ``inventory.py``,
``cache/files.py``, ``ressources/__main__.py``; SIM117 in
``test_main.py``; SIM105 in ``utils/templating.py``; SIM102 noqa
rationales in ``cli/encrypt/inventory/__main__.py``.
182 files changed, +993 / −960. With this and the prior strict-rule
commit the branch satisfies 11 ruff rule families end-to-end.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
26ef3ff504 |
chore(ruff): enable strict ruleset (E/F/I/B/UP, py311) — 2819 → 0
Adds ``[tool.ruff.lint]`` with ``select = ["E", "F", "I", "B", "UP"]``
and ``target-version = "py311"``. ``E501`` is ignored because
``ruff format`` already reflows what it can; the remaining long lines
are unsplittable string literals / URLs.
Auto-fixed (2753 issues, behavior-preserving):
- UP006/UP035: ``List[X]`` → ``list[X]``, ``Dict[X]`` → ``dict[X]``,
``from typing import …`` redirected where superseded by builtins.
- UP045: ``Optional[X]`` → ``X | None``.
- UP010/UP009/UP015: dropped Python-2-era pragmas (``from __future__
import absolute_import, division, print_function``,
``# -*- coding: utf-8 -*-``), redundant ``open(..., "r")`` mode.
- UP004: dropped implicit ``class X(object):``.
- UP022/UP008/UP032: stdlib idiom modernization (``capture_output``,
super-call simplification, etc.).
- B905: ``zip(...)`` → ``zip(..., strict=False)`` (preserves prior
behavior; switching to ``strict=True`` is a separate semantic
choice not made here).
- I001: import-block ordering.
Hand-fixed (66 issues):
- B904 × 54: appended ``from <bound>`` (when the enclosing ``except``
binds a name) or ``from None`` (when it doesn't) so chained
exceptions stay distinguishable from errors-during-exception-
handling. Applied via a small AST-aware script that walked back to
the enclosing ``except`` clause and matched the binding.
- B017 × 4: narrowed broad ``assertRaises(Exception)`` to the actual
``AnsibleError`` / ``AnsibleFilterError`` raised by the code under
test.
- B023 × 2: bound captured loop variables via default args
(``def _record(name, *, _path_real=path_real, ...)``) so each
closure gets its own snapshot.
- B007 × 2: unused loop control variables renamed to ``_`` /
rewritten to ``.values()``.
- UP007 × 2: ``Union[X, Y]`` → ``X | Y`` (plus dropping the now-unused
``from typing import Union``).
- B018 × 1: Odoo addon manifests are bare dict expressions at module
level by design — suppressed with an inline ``# noqa: B018`` and
rationale comment.
- UP031 × 1: printf-style format → f-string.
The 65 ``# noqa: …`` markers introduced by the auto-fixer all carry
real ruff codes (``B018``, ``E402``, ``F401``, etc.), so
``test_noqa_only_ruff_codes`` stays green.
Verification
============
- ``ruff check .`` → All checks passed
- ``ruff format --check .`` → 894 files already formatted
- ``tests.lint.repository.{test_project_root_import,
test_no_direct_yaml_calls, test_noqa_only_ruff_codes}`` and
``tests.unit.utils.annotations.test_suppress`` → 20 tests OK
- 1621 unit tests → all pass
- Integration suite: 44 failures (pre-existing baseline, none from
this change), 1 skipped.
Going forward, the new rules block regressions on E (style), F
(pyflakes), I (import order), B (likely-bug patterns), and UP
(modernization to py311) for any new code.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
9f62f9bb0e |
refactor(repo): clear all project-root-import lint violations + helper inlining
Eliminates the last 102 violations of test_project_root_import by
making PROJECT_ROOT in each package's __init__.py the single source
and inlining every wrapper helper.
Migrations
==========
- ~70 files: ``Path(__file__).resolve().parents[N]`` → ``from <pkg>
import PROJECT_ROOT`` (single-expression shape, scripted).
- ~12 files: two-statement helpers (``T = Path(__file__).resolve();
R = T.parents[N]``) and multi-line ``os.path.abspath(os.path.join(...
os.pardir...))`` chains rewritten by a follow-up scripted pass.
- ~20 files migrated by hand for shapes the scripts couldn't safely
rewrite (helper functions like ``_repo_root_from_test_file``,
embedded ``os.pardir`` chains, etc.).
Helpers removed (inlined to PROJECT_ROOT)
=========================================
- All ``def repo_root_from_here() / _project_root_from_here()`` and
same-shape variants in cli/ (``cli/deploy/development/{down,common,
build,deploy}.py``, ``cli/meta/categories/invokable/command.py``,
``cli/meta/applications/resolution/{combined/repo_paths,
dependencies/__main__,run_after/__main__}.py``).
- All zero-arg ``def <name>() -> Path: return PROJECT_ROOT`` helpers
(utils/invokable.py, utils/roles/resource_validation.py, cli/meta/
runtime/__init__.py, cli/meta/callorder/__main__.py, plus a dozen
test files).
- 4 ``PROJECT_ROOT = PROJECT_ROOT`` self-assignments removed from
test files where the class attribute became dead after migration.
Test-mock updates
=================
``patch.object(repo_paths, 'repo_root_from_here', return_value=ROOT)``
→ ``patch.object(repo_paths, 'PROJECT_ROOT', ROOT)`` (27 patches across
8 unit-test files); same shape for ``patch('utils.invokable._repo_root',
return_value=…)``.
Suppressions documented
=======================
5 files marked ``# nocheck: project-root-import`` for the catalog's
documented exemptions:
- 2 lints walking from a discovered glob match (<role>/templates/...)
up to its role dir, NOT the repo root.
- ``cli/validate/inventory/__main__.py`` invoked as standalone
subprocess (relative imports unavailable).
- ``plugins/filter/value_generator.py`` loaded by Ansible outside the
project package (relative imports broken).
- ``roles/test-e2e-playwright/filter_plugins/discover_playwright_roles.py``.
Bugs surfaced and fixed in the same commit
==========================================
The migration uncovered two latent role-content violations that were
silently masked by buggy ``_repo_root()`` helpers in two integration
tests (the helpers walked upward looking for marker dirs and returned
``tests/integration/`` instead of the repo root, so the tests scanned
nothing under ``roles/`` for years):
- roles/web-app-minio: extracted 6-task OIDC block into 02_oidc.yml +
``include_tasks`` (the documented "Good" pattern from
test_block_size; parsing cost is paid only when OIDC is enabled).
- roles/web-app-bluesky/tasks/01_core.yml: collapsed 3 sequential
``when: BLUESKY_WEB_ENABLED | bool`` tasks into one ``block:`` with
the guard at block level (4 → 2 occurrences, under threshold).
Two semantic-bug fixes carried alongside
========================================
- cli/core/app.py: ``cli_dir`` was previously ``parents[1]`` (= cli/),
not the repo root; rewritten to ``PROJECT_ROOT / "cli"`` to match
the variable's intent.
- cli/make/__main__.py: pre-existing bug — ``repo_root`` was actually
the ``cli/`` directory (so ``cli/Makefile`` was the search target,
which never existed). Now correctly uses PROJECT_ROOT.
- scripts/lint/sort_claude_settings.sh: invokes utils/claude/
settings_sort.py as a module (``python -m``) so its
``from . import PROJECT_ROOT`` resolves.
Verification
============
- ``ruff check .`` → clean
- ``tests.lint.repository.test_project_root_import`` → OK (102 → 0)
- 1621 unit tests → all pass
- Integration suite: 44 failures (baseline, pre-existing, none from
this commit), 1 skipped
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
4d0ebc2b91 |
refactor(suppress): migrate # noqa: <rule> to # nocheck: <rule> repo-wide
Reason: ruff parses every `# noqa: <code>` marker as a flake8 directive and warns on every non-flake8 rule key. Every catalog rule in `docs/contributing/actions/testing/suppression.md` is project-specific (kebab-case), so `# noqa:` markers fired the warning on every parse. `# nocheck:` is the project synonym ruff ignores. Scope: - 41 `roles/*/meta/services.yml` + 1 task + 1 .cfg.j2 template: pure noqa→nocheck swap for catalog rules. Mixed flake8 markers (`# noqa: E402, X`) preserved verbatim. - 5 production .py + 2 production scripts: same swap. - All catalog-rule lints' docstrings updated; redundant "or # nocheck:" parentheticals collapsed to a single nocheck form. - `utils/annotations/suppress.py`: docstring rewritten to spell out the new convention. Parser still accepts both keywords as synonyms. - `docs/contributing/actions/testing/suppression.md`: convention rewritten to mandate `nocheck:`; missing `domain-spot` and `literal-protocol-lookup` rows added; "enforced by" pointer added. New guard: - `tests/lint/repository/test_noqa_only_ruff_codes.py`: meta-lint failing any `# noqa: <code>` whose codes don't match `[A-Z]+\d+` (real ruff/flake8 shape). Allowlists the impl, its unit test, the catalog page, the direct-yaml lint, and itself. - `tests/lint/repository/test_no_direct_yaml_calls.py`: hardened to reject the `noqa:` form via inlined regex (no longer routed through `utils.annotations.suppress`). Tangential cleanups carried in this same commit: - `utils/cache/yaml.py`, `utils/handler/yaml.py`: 6 `direct-yaml` markers swapped. - `utils/cache/base.py`: `from . import PROJECT_ROOT, ROLES_DIR` moved up to the import block (E402). - `cli/create/role/__init__.py`: reordered so PROJECT_ROOT is defined before `__main__` is imported (also fixed a latent circular import). - PROJECT_ROOT migration tail: 2 new `__init__.py` modules + 10 test files swapped from `def repo_root()` to `from . import PROJECT_ROOT`. - ~20 ruff auto-fix removals of unused `from pathlib import Path`. Verification: - `ruff check .` clean. - 23 suppression-related tests pass. - The new lint detects all three regression shapes (project rule alone, mixed with real ruff code, lowercase-only). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
3ed13ee5af |
refactor(repo): rename REPO_ROOT to PROJECT_ROOT everywhere
Drop the second name for the same constant. Every consumer now uses `PROJECT_ROOT` exclusively, matching the canonical `utils.cache.__init__.PROJECT_ROOT` source. The rename is a word-boundary substitution applied across every Python file in the repo, validated by `ast.parse` after each edit. Three files additionally drop a redundant `PROJECT_ROOT = PROJECT_ROOT` class attribute (it pointed the class- level name at the module-level name) and inline the `self.PROJECT_ROOT` reads to plain `PROJECT_ROOT`. The pass also closes a latent wave-1 inconsistency: a handful of files received the `from . import PROJECT_ROOT` shim earlier but their consumer expressions still spelled `REPO_ROOT / "scripts" / …`, so the shim was unused. The rename ties shim and consumer together. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
4d44ad5ad2 |
refactor(repo): pin PROJECT_ROOT to package __init__.py — wave 1
Migrate the simple `PROJECT_ROOT = Path(__file__).resolve().parents[N]` shape across the repo to the new "import from `__init__.py`" rule introduced by the `project-root-import` lint: - `utils/cache/__init__.py` is the canonical source. `PROJECT_ROOT` and `ROLES_DIR` move out of `utils/cache/base.py`; `base.py` re-exports them for callers that still import from there. Internal cache modules (`files.py`, `gitignore.py`) switch to `from . import PROJECT_ROOT`. - 24 packages receive a `PROJECT_ROOT` declaration in their own `__init__.py`, each with the parents[N] depth that resolves to the repo root. - ~36 consumer files swap their local `PROJECT_ROOT = Path(__file__).resolve().parents[N]` for `from . import PROJECT_ROOT`. `ROLES_DIR` and similar derived paths stay local (`PROJECT_ROOT / "roles"`). Status: this commit closes the simple-shape violations. The multi-line `os.path.abspath(os.path.join(here, os.pardir, …))` shape, `def repo_root()` while-loops, and `roles/<role>/filter_plugins` files without a package container remain. The lint stays scharf and will track each subsequent wave. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
8d8576e538 |
refactor(tests): reorganise meta tests + add multi-doc yaml cache
Two intertwined changes that share the same touched files:
1. Move every meta-related integration test under
`tests/integration/roles/meta/` into one of three sibling
sub-clusters and shorten the redundant filename prefixes:
- `services/` — `test_services_dynamic_flags.py` →
`test_dynamic_flags.py`, `test_services_no_self_reference.py` →
`test_no_self_reference.py`. The `run_after` cluster moves
under it (it is a `meta/services.yml` concern, not a
stand-alone dependency one): `test_services_explicit.py` keeps
its name, the rest drop the redundant prefix.
- `variants/` — `test_variants_coverage.py` → `test_coverage.py`,
plus the two new lints `test_auth_coverage.py` (LDAP / OIDC /
OAuth2 matrix completeness) and `test_services_match.py`
(every variant override key MUST exist in `services.yml`).
- `dependencies/` — relocates the legacy
`tests/integration/roles/dependencies/` cluster so all
`meta/`-shaped tests live under one parent.
Path-index constants (`Path(__file__).resolve().parents[N]`,
`os.pardir` chains) updated for the deeper nesting.
2. Route every yaml read in the migrated tests through
`utils.cache.yaml`. The single-doc helper `load_yaml_any` covers
most of them; the new `load_yaml_all` mirrors `load_yaml_any` for
the multi-doc case (`yaml.safe_load_all`) and is keyed off the
same `(path, mtime, size)` signature, with parallel `_drop_path`
/ `_reset` housekeeping. `tests/lint/ansible/variables/
test_vars_usage_in_yaml.py` is the first user.
READMEs cleaned up to match the new directory structure (path
crosslinks, level-up counts) and four new READMEs added for the
new sub-clusters under the `docs/` README guidelines (RFC 2119,
emojis after headlines, no em dashes, no SPOT self-labels).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
0cc48be9ae |
test(integration): variants coverage + no-self-reference guards for services.yml
Two new integration lints under tests/integration/roles/meta/:
* test_variants_coverage.py — every services.yml flag declared via
the dynamic ``"{{ '<role>' in group_names }}"`` form MUST be
exercised by meta/variants.yml: at least one variant entry pins
it to literal ``true`` AND at least one pins it to ``false``.
Pairs may share variant entries — the test only checks the union
of all variants covers both polarities for every dynamic flag.
* test_services_no_self_reference.py — a role's own primary entity
(matching ``get_entity_name(role)``) MUST NOT use the dynamic form
for ``enabled`` / ``shared``. Both MUST be literal ``true``: the
role's own services.yml is loaded only when the role itself is in
group_names, so a ``'<self>' in group_names`` Jinja is tautological.
The dynamic-flag test now skips the role's own entity to avoid a
contradiction with this new guard.
Self-reference fixes (Jinja → literal ``true: true``) on 19 roles:
svc-ai-ollama, svc-db-{mariadb, openldap, postgres}, web-app-{
dashboard, discourse, keycloak, mailu, matomo, prometheus},
web-svc-{asset, cdn, collabora, coturn, file, libretranslate, logout,
onlyoffice, simpleicons}.
Variants coverage rollout (62 new + 17 merged meta/variants.yml):
* Roles without a pre-existing variants.yml get a new file with two
entries — one pinning every dynamic flag true, one pinning every
dynamic flag false. No ``- {}`` baseline (matrix runs only the
two coverage variants).
* Roles with a pre-existing variants.yml (akaunting/baserow/bluesky/
bookwyrm/flowise/fusiondirectory/jenkins/jira/joomla/keycloak/lam/
minio/phpmyadmin/postmarks/wordpress/web-svc-xmpp) keep their
matrix variants (OIDC vs LDAP, Single-Site vs Multisite, dev creds
+ TOTP-disabled realm, autologin, etc.); the all-true coverage is
deep-merged into variant 0 and the all-false coverage into
variant 1, so each role still ships exactly two matrix rounds.
* svc-ai-ollama keeps its single CI image-shrink variant; after the
self-reference fix it has no remaining dynamic flags so no extra
coverage entry is required.
* svc-db-{mariadb, openldap, postgres} drop variants.yml entirely
for the same reason.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
e5de4e085a |
refactor(meta): wire services.<key>.{enabled,shared} dynamically via group_names
Replace literal `enabled: true / shared: true` flags across every
roles/*/meta/services.yml with a Jinja `"{{ '<role>' in group_names }}"`
form so the per-role services map becomes the single source of truth
for shared-service co-deployment, on a per-host basis. Inventory build
already runs through the templar before reaching the static `is True`
check, so runtime behaviour is unchanged; the new form only opens up
static-analysis and CLI tooling to the group-aware semantics.
Mechanism + lint:
- New integration test tests/integration/roles/meta/test_services_
dynamic_flags.py enforces the dynamic shape per top-level service
entry. Registered service keys must reference the registry-resolved
provider role; covered keys (e.g. oauth2 -> web-app-keycloak via
the new `covers:` block) reference the covering role.
- Two suppression placements documented in docs/contributing/actions/
testing/suppression.md: per-flag inline `# nocheck: dynamic-flag`
for databases (`enabled: true` stays literal, `shared` resolves
dynamically) and block-level above the key for entries whose both
flags legitimately stay literal (`css`, `javascript`, role-local
`redis`, `recaptcha`, `hcaptcha`, role-local containers with
`shared: false`).
Registry + helpers:
- utils/service_registry.py: new `is_explicit_truth(value)` helper
accepts `True` literal OR a Jinja string carrying `in group_names`.
Adopted by `resolve_service_dependency_roles_from_config`,
`ServicesResolver._is_enabled_shared`, `test_web_app_email_
integration`, `test_prometheus`, `test_universal_logout`, and the
run_after-explicit guard so static analysis keeps resolving deps.
- New `covers:` field on a primary service entity declares
transitive equivalents (web-app-keycloak.covers: [oauth2]).
Exposed via `build_role_to_covered_keys` and
`build_covered_key_to_role`, replacing the previously hard-coded
`_TRANSITIVE_SERVICE_EQUIVALENTS` / `_SPECIAL_REFERENCE_ROLE` maps
in the run_after and dynamic-flag tests.
Bulk migration:
- All 80 roles/*/meta/services.yml files migrated to the dynamic
form. DB consumer keys (mariadb, postgres, ldap) keep
`enabled: true # nocheck: dynamic-flag` literal with a dynamic
`shared`. Block-nocheck applied to css/javascript/recaptcha/
hcaptcha and role-local containers (e.g. mailu's admin/imap/smtp/
antispam/antivirus/oletools/webdav/fetchmail/webmail/resolver/
front, nextcloud's talk).
- web-app-prometheus's primary entity now declares
`provides: prometheus` + dynamic flags so the registry recognises
it as a service provider. Consequence: tasks/01_core.yml split out
with `- include_tasks: utils/once/flag.yml` as the first task and
tasks/main.yml reduced to the standard run_once-guarded loader.
- Seven minimal no-login apps (web-app-hugo, -bridgy-fed, -chess,
-littlejs, -navigator, -mini-qr, -mig) gained an explicit
`logout: { enabled: false, shared: false }` opt-out (with
`# nocheck: dynamic-flag` block-marker) to satisfy the universal-
logout schema check.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
b73f92d551 |
fix(meta): make run_after deps explicit via shared services
Resolve every violation flagged by tests/integration/roles/dependencies/ run_after/test_services_explicit.py: each run_after entry must be backed by an enabled+shared services flag in the dependent role. - Activate oauth2 (enabled+shared=true) where the role consumes the Keycloak-fronted oauth2-proxy: friendica, funkwhale, fusiondirectory, gitea (allocate oauth2 ports 16501 friendica, 16502 funkwhale). - Flip oauth2.shared / oidc.shared / ldap.shared to true where the service is actually consumed: akaunting, baserow, bluesky, bookwyrm, flowise, jenkins, joomla, web-svc-xmpp. - Drop run_after entries to providers whose service is not enabled: web-app-keycloak from confluence, jira, magento, matrix, shopware, web-svc-xmpp; web-app-matomo from fusiondirectory, matrix; web-app-opencloud from opentalk; desk-gnome from desk-gnome-caffeine/-extensions/-terminal. - Re-flow a continuation in test_services_explicit.py. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
04c5eee5a9 |
test(integration): guard run_after entries with explicit services declarations
Future direction: the inventory builder is moving away from ``run_after`` as a dependency-injection mechanism. ``run_after`` keeps its ordering-only role; "what gets co-deployed with this role" is decided by the per-role ``services`` map. This test catches roles whose ``run_after`` smuggles a dep in that no ``services.<key>`` entry covers. Per ``run_after: [Y]`` the consumer MUST also declare a ``services.<key>`` entry where ``<key>`` is either Y's primary service-registry key or one of the explicitly listed transitive equivalents (e.g. ``services.oauth2`` covers ``run_after: [web-app-keycloak]`` since oauth2-proxy itself depends on Keycloak), with both ``enabled`` and ``shared`` set to ``true`` or to a Jinja conditional containing ``in group_names``. Currently fails for ~22 roles whose run_after entries pull in deps without an explicit services flag. Fixing each is a mechanical migration tracked separately. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
60036a9249 |
test(lint): forbid raw project-tree walks in tests; route through utils.cache.files
Add tests/lint/repository/test_no_raw_project_walk.py: AST-walks every
.py file under tests/ and flags call expressions matching the forbidden
shapes — `<x>.rglob(...)`, `os.walk(...)`, `glob.glob(...)` — including
their aliased imports. The lint blocks any NEW raw walk from sneaking
in; pre-existing offenders are migrated below.
Background
==========
Pytest runs every test in one process. A raw walk over the repo tree
re-iterates the same paths and re-stats the same inodes for every test
that needs them, so the cost scales linearly with the number of lint /
integration tests doing project scans. Routing every walk through
`utils.cache.files.iter_project_files(...)` (or
`iter_project_files_with_content(...)`, `iter_non_ignored_files(...)`,
`read_text(...)`) shares one filesystem walk + one read per file
across the whole pytest session. See docs/agents/action/testing.md.
Migration
=========
Refactored to the cached helpers (broad project-tree walks):
Lint
tests/lint/ansible/test_no_literal_no_log.py
tests/lint/ansible/test_no_sh_lc_pipefail.py
tests/lint/ansible/test_run_once_tags.py
tests/lint/ansible/test_service_shared_consistency.py
tests/lint/filesystem/test_python_shebangs.py
tests/lint/repository/test_folder_item_limit.py
tests/lint/repository/test_markdown_links.py
tests/lint/repository/test_role_meta_layout.py
tests/lint/repository/test_todo_transparency.py
Integration / external / unit
tests/integration/compose/test_no_raw_docker.py
tests/integration/config/test_non_empty.py
tests/integration/roles/includes/test_existence.py
tests/integration/vars/test_facts_not_overridden.py
tests/integration/workflows/test_dependabot_coverage.py
tests/external/repository/test_urls_reachable.py
tests/unit/cli/deploy/development/test_inventory_vars_file_spot.py
Tagged `# noqa: project-walk` (legacy; future commits migrate them
incrementally — the lint pinpoints each offender and the fail message
points at the cached helpers and explains when noqa is appropriate):
~30 further test files (small per-role globs, scripts/utils subtree
scans, dynamic Jinja-driven globs that need richer refactors).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
7b40cd4f04 |
test(integration): guard run_once on every shared service-registry role
Adds tests/integration/roles/run_once/test_shared_primary_entity_run_once.py. Walks every role that participates in the variant-aware service registry (self-declared `shared: true` on the primary entity, declared via `provides:`/aliases, OR consumer-activated through another role's `services.<X>.enabled+shared`) and asserts that tasks/main.yml carries a `run_once_<role_slug>` token. Without that guard, sys-utils-service-loader can pull the role in twice when both APPS= and a consumer's variant request it, triggering duplicate execution / infinite recursion. The check is permissive about the exact YAML shape (`include_tasks: 01_core.yml … when: run_once_…`, a `block: … when: run_once_…`, or any other arrangement carrying the literal token) so it complements the stricter tests/lint/ansible/roles/test_service_core_first_task_run_once.py schema lint. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
623035618c |
refactor(cache): route every yaml call in tests/ through utils.cache.yaml
Stops every direct `yaml.safe_load`/`safe_load_all`/`safe_dump`/`dump`
call across the test corpus from re-parsing files the production cache
already holds. Each migrated test loads role meta, group_vars, inventory
fixtures, etc. through the shared cache, so a single `make test` run
parses every YAML file at most once across all suites.
Cache module changes (utils/cache/yaml.py):
- Unify single- and multi-doc cache: one `_CACHE: Dict[sig, list]`
holding the `safe_load_all` payload. Single-doc helpers
(load_yaml / load_yaml_any) unwrap docs[0] and raise on >1
document, preserving the old strict semantics. A file consumed
both as single-doc and multi-doc is now parsed exactly once.
- Add load_yaml_all (path-cached) and load_yaml_all_str (string,
no cache) so multi-doc consumers no longer need a direct
`yaml.safe_load_all` plus a separate file read.
- dump_yaml now accepts any safe-dumpable structure (dict, list,
scalar) so test fixtures writing list-of-tasks YAML can use it.
Lint guard (tests/lint/repository/test_no_direct_yaml_calls.py):
- Extend the scanned tree to include `tests/` so future test code
is forced through the cache, with the existing
`# noqa: direct-yaml` per-call opt-out for genuine raw-yaml
fixture needs.
Test corpus:
- 89 test files migrated to load_yaml / load_yaml_any /
load_yaml_str / load_yaml_all / load_yaml_all_str / dump_yaml /
dump_yaml_str. No `# noqa` shortcuts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbach
|
837d0c5335 |
test(suppression): unify # noqa / # nocheck marker grammar
Introduce a single grammar for per-line, per-block, and per-file
suppression markers across the test suite, replacing seven ad-hoc
syntaxes that had drifted apart.
Helper
utils/annotations/suppress.py exposes is_suppressed_at,
is_suppressed_in_head, is_suppressed_anywhere, line_has_rule, and
suppressed_line_numbers. Markers may use either `noqa` or `nocheck`
(case-insensitive synonyms), live inside `#`, `//`, `{# ... #}`, or
`<\!-- ... -->` comments, and combine multiple kebab-case rules
comma-separated. 17 unit tests cover the grammar in isolation.
Refactored consumers
- tests/external/repository/test_urls_reachable.py (rule: url)
- tests/external/docker/test_image_versions.py via
utils/docker/version_updater.py (rule: docker-version)
- tests/lint/repository/test_no_direct_yaml_calls.py (rule:
direct-yaml)
- tests/lint/ansible/test_service_shared_consistency.py (rule:
shared)
- tests/lint/ansible/roles/test_web_app_email_integration.py (rule:
email)
- tests/lint/repository/test_python_file_size.py (rule: file-size)
- tests/lint/ansible/test_run_once_tags.py +
tests/integration/roles/run_once/test_schema.py (rules: run-once,
run-once-suffix)
Marker migration
12 role tasks/main.yml files: `# run_once_<key>: deactivated`
-> `# nocheck: run-once`. roles/web-app-suitecrm/meta/services.yml
drops a malformed inline `noqa: intentional legacy pin` from a TODO
comment so the new parser does not pick it up as a stray rule.
Caching wins
Test files that previously loaded YAML / read files via raw
yaml.safe_load + Path.read_text now route through utils.cache.yaml
(load_yaml_any / load_yaml_str) and utils.cache.files.read_text:
- test_service_shared_consistency.py
- test_web_app_email_integration.py
- tests/integration/roles/run_once/test_schema.py
- utils/docker/version_updater.py
This both speeds up repeated reads and stays consistent with the
direct-yaml lint policy.
Documentation
New SPOT page at docs/contributing/actions/testing/suppression.md
with grammar, position semantics, the catalog of rules, examples,
and an "adding a new rule" checklist. lint.md and external.md drop
their per-rule tables and link to the new page. All touched docs
conform to docs/contributing/documentation.md (no em-dash thought
breaks, no SPOT self-labels, RFC-2119 keywords used consistently).
Settings sort tooling
scripts/lint/sort_claude_settings.sh wraps utils/claude/settings_sort.py
and is wired into scripts/lint/autoformat.sh. The tooling fixes the
ASCII-ascending requirement enforced by
tests/lint/repository/test_claude_settings_sorted.py; the test's
failure message now points operators at the script. .claude/settings.json
is committed in sorted form.
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
5dadbdf88b |
test(playwright-env-flags): accept | string | lower shape alongside ternary
`tests/integration/roles/test_playwright_env_service_flags.py` enforces
that every `<SERVICE>_SERVICE_ENABLED=...` line in a role's
`templates/playwright.env.j2` resolves to the literal `"true"` or
`"false"` strings demanded by requirement 006. The heuristic previously
recognised only two shapes:
1. A ternary that ends with `'true'`/`'false'` literals.
2. The bare strings `true` / `false`.
Commit cac52b74a introduced a third equivalent form,
`{{ <bool> | string | lower }}`, which Jinja renders to "true"/"false"
when the operand is a Python boolean. The old regex did not match it,
so the test went red even though the render-output guarantee still
held.
Add a third recognised shape via a `\|\s*string\s*\|\s*lower\b` regex
and update the inline doc to spell out all three. Both forms remain
permitted in role templates; the compact one stays valid alongside the
explicit ternary.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
b3de2a4d7c |
refactor(meta): land req-011 meta/info.yml + utils/cache cleanup
req-011 — descriptive role-level metadata
* Move logo / homepage / video / display out of
meta/main.yml.galaxy_info into a new project-owned
roles/<role>/meta/info.yml (file-root convention, no `info:` wrapper).
* 78 role meta/main.yml files migrated via ruamel round-trip
(key-order / quoting / inline-comments preserved). Roles with none
of the four fields are left untouched (no empty info.yml created).
* web-app-dashboard/lookup_plugins/docker_cards.py reads logo +
display from meta/info.yml; description / galaxy_tags continue to
come from galaxy_info (Galaxy-spec fields).
* docker_cards.py now routes ALL its file reads through the
process-wide caches: load_yaml_any for vars/main.yml,
meta/main.yml, meta/info.yml; read_text from utils.cache.files for
README.md. The orphan `import yaml` is gone.
New utils/cache/files (renamed from tests/utils/fs)
* The process-wide filesystem cache (read_text, iter_project_files,
iter_project_files_with_content, _all_project_files) is not
test-specific; it now lives under utils/cache/files.py next to the
other process-wide caches. 34 consumer imports rewritten across
tests/ and docs/. The empty tests/utils/ package is removed.
* New unit suite tests/unit/utils/cache/test_files.py — 12 cases
covering read_text, iter_project_files (skip-dirs, extensions,
exclude_tests, exclude_dirs, walk-cache invariants), the combined
iterator, non-UTF-8 silent skip, and _reset.
utils/cache redundancy cleanup
* applications.py + users.py + cli/create/inventory/services_disabler.py
drop their direct yaml.safe_load calls and their private
_load_yaml_mapping/_load_yaml_variant_list copies; everything routes
through utils.cache.yaml.load_yaml / load_yaml_any. The dead
utils.cache.base._load_yaml_mapping is removed.
* users.py:_load_store_users (tokens.yml read) likewise migrated.
* _load_yaml_variant_list moves out of base.py to applications.py
(its only consumer) and is renamed _load_variants_overrides — also
routes through the cached loader now.
* utils.cache.yaml._reset_cache_for_tests is renamed _reset (kept as
alias) for parity with the per-domain reset helpers.
* utils.cache.files grows a _reset() that clears its two LRU caches.
* utils.cache.__init__._reset_cache_for_tests now orchestrates ALL
six caches (applications, users, domains, base, yaml, files) so
tests get clean state across cache layers — needed because
applications/users now share the yaml cache and would otherwise
serve stale parses across reset boundaries.
* utils.cache.files imports PROJECT_ROOT from base instead of
redefining it.
* tests/unit/utils/cache/test_data.py + test_base.py: obsolete
TestLoadYamlMapping / TestLoadYamlVariantList classes deleted
(covered by test_yaml.py + test_variants.py).
* README.md updated for the new module list (files, yaml) and the
six-module orchestrator.
Galaxy schema lint
* tests/lint/repository/test_role_meta_main_galaxy_schema.py: split
galaxy_info field requirements into hard-required {author,
description, license} and soft-recommended {min_ansible_version,
platforms}. Soft-recommended -> emit a GitHub Actions ::warning::
annotation via utils.annotations.message.warning (titled
"meta/main.yml galaxy_info" with file= pointing at the offender),
no test failure. Rationale: min_ansible_version + platforms are
only enforced by Galaxy when *publishing*, which Infinito.Nexus
does not do.
* Galaxy lint goes green (was 226 offenders before req-011 +
license_url/repository/documentation strip; was 62 before this
relaxation; now 0 hard offenders, 62 soft warnings).
* roles/svc-opt-keyboard-color/meta/main.yml: backfill `license`
(only role missing the hard-required field).
New lint
* tests/lint/repository/test_role_meta_info.py — enforces meta/info.yml
file-root convention, the four-field allowlist (logo, homepage,
video, display), and shape (logo.class string, homepage/video
non-empty strings, display bool). Also fails if any
meta/main.yml.galaxy_info still carries one of the four migrated
fields.
Docs
* docs/contributing/design/services/layout.md: new section
"Descriptive Role-Level Metadata — meta/info.yml" with allowed-
fields table, optionality rule, materialised path, and consumer
note. File-Layout table grows the meta/info.yml row;
meta/main.yml row gets the explicit "no logo/homepage/video/display"
note. req-011 added to header and Related Pages.
* utils/cache/README.md: files.py + yaml.py rows added; six-module
reset orchestrator documented.
Validation
* Unit: 1573 passed.
* Lint: 55 passed.
* Integration: 161 passed (1 skipped) via pre-commit hook.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
ed04dad5d5 |
refactor(meta): land req-008/009/010 role-meta layout/networks/ports/run_after migration
Single atomic landing for three back-to-back role-meta refactor requirements
(see docs/requirements/008-role-meta-layout.md, 009-per-role-networks-and-ports.md,
010-role-meta-runafter-lifecycle-migration.md).
req-008 — role meta layout
* Move every role's metadata under meta/<topic>.yml with file-root
convention (no wrapping key matching the basename):
- schema/main.yml + config/main.yml.credentials → meta/schema.yml
- users/main.yml → meta/users.yml
- config/main.yml.server → meta/server.yml
- config/main.yml.rbac → meta/rbac.yml
- config/main.yml.compose.services + every other top-level key
of config/main.yml inlined under <entity>.<key>
→ meta/services.yml
- config/main.yml.compose.volumes → meta/volumes.yml
* Drop the legacy schema/, users/, config/ directories from every role.
* meta/schema.yml: support nested credential keys, optional `default:`
field (Jinja literal, not rendered/validated/regenerated), implicit
`algorithm: plain`.
* Materialised paths drop the `compose.` prefix:
compose.services.<e>.<…> → services.<e>.<…>
compose.volumes.<k> → volumes.<k>
<former-top-level>.<…> → services.<entity_name>.<former-top-level>.<…>
* Update every Python consumer (utils/cache, utils/manager, utils/applications,
plugins/lookup, plugins/filter, cli/*) plus every Jinja template, vars/*.yml
and task file to the new paths.
* No legacy fallback. Repository-wide grep for `compose.services.` /
`compose.volumes.` / `schema/main.yml` / `users/main.yml` / `config/main.yml`
is empty outside docs/requirements/ and tasks/utils/migrate_meta_layout.py.
* Add tests/lint/repository/test_role_meta_layout.py guarding against the
old paths returning, and an explicit lint guard that meta/variants.yml
files do not carry a `compose:` wrapper.
req-009 — per-role networks/ports
* Move group_vars/all/08_networks.yml.defaults_networks.local.<role>.{subnet,
dns_resolver} into roles/<role>/meta/server.yml.networks.local.{subnet,
dns_resolver}.
* Delete group_vars/all/09_ports.yml entirely; ports now live on the
service entity that exposes them at
roles/<role>/meta/services.yml.<entity>.ports.{inter,local,public}.
* Rename + int-cast every former top-level `services.<entity>.port`
field to `services.<entity>.ports.inter` (single int).
* Always-category-keyed maps for ports.local / ports.public; relay
spans use {start, end} integers.
* Add PORT_BANDS map to group_vars/all/08_networks.yml — single source
of truth for the per-<scope>.<category> band ranges, consumed by both
the new CLI helpers and the lint test.
* New CLI helpers (cli meta ports suggest, cli meta networks suggest)
walk the live role tree gap-first then increment-fallback, with
deterministic output and non-zero exit on capacity overflow.
* cli create role consumes both helpers when scaffolding a new role.
* Lint extensions: bare-int port shape rejection, host-bound port
collision check (single ints + relay span integers, inter excluded),
band-membership check with documented allow-list for the legacy
web-app-bigbluebutton.bigbluebutton.local.http: 48087 entry.
req-010 — run_after / lifecycle migration
* Move galaxy_info.run_after and galaxy_info.lifecycle out of
meta/main.yml into meta/services.yml.<primary_entity>.{run_after,
lifecycle}; <primary_entity> is the value returned by
get_entity_name(role_name).
* For multi-entity roles whose primary entity has no compose service
(web-app-bluesky → bluesky, web-app-matrix → matrix, desk/dev/drv/
gen roles), create a dedicated metadata-only top-level entry under
<primary_entity>.
* Introduce utils/roles/meta_lookup.py with get_role_run_after /
get_role_lifecycle that resolve <primary_entity> once and read from
meta/services.yml; degrade gracefully when meta/services.yml is
absent OR the field is absent; raise MetaServicesShapeError when the
file exists but is malformed.
* Update every consumer (utils/service_registry, utils/invokable,
cli/meta/applications/resolution/run_after/__main__, cli/meta/roles/
lifecycle_filter/__main__, cli/meta/applications/resolution/combined,
cli/build/{tree,graph,role_include}, cli/deploy/development/{common,
init,deps,deploy}, plugins/filter/canonical_domains_map, etc.) to
use the helper.
* Lint guards: no run_after/lifecycle in meta/main.yml; lifecycle
values restricted to {planned,pre-alpha,alpha,beta,stable,deprecated};
run_after/lifecycle never on a non-primary entity; empty run_after
lists rejected.
Also folded into this change set
* services_disabler now writes `services.<svc>.{enabled,shared}` into
host_vars instead of the old `compose.services.<svc>.{...}` path; the
discover/find pair walks meta/services.yml and only treats entries
carrying enabled/shared/provides as provider declarations (so
metadata-only entries from req-010 do not create spurious provider
rows).
* service_registry skips `run_after` deps whose target was filtered
out via SERVICES_DISABLED instead of failing the whole load.
* cli/mirror/resolver and cli/create/inventory/mirror_overrides emit/
consume the new applications.<role>.services.<svc>.image shape
(mirror.md updated to match).
* utils/domains/list.build_applications_from_roles now reads
meta/server.yml directly (it had been silently returning {} since
config/main.yml stopped existing).
* utils/roles/resource_validation.filter_roles_by_min_storage reads
meta/services.yml.<entity>.min_storage instead of the legacy
compose.services path.
* web-app-bluesky pre-clones the social-app build context BEFORE
sys-svc-compose so the build context is on disk by the time
sys-stk-front-proxy/tasks/main.yml flushes the docker build handler.
* 4 meta/variants.yml files (svc-ai-ollama, web-app-phpmyadmin,
web-app-wordpress, web-app-keycloak) lose their `compose: services:`
wrapper so deep-merge over meta/services.yml lands on the new
file-root shape.
Validation
* Unit tests: 1571 passed.
* Lint tests: 50 passed.
* Integration tests: 161 passed (1 skipped).
* Full-cycle fresh-purged-apps deploy succeeded for the 8-app validation
set: web-app-{nextcloud,wordpress,yourls,bigbluebutton,bluesky,gitea,
discourse,mattermost}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
d009a35116 |
feat(rbac): hierarchical /roles/<app>/<role> + service-gated Playwright + Discourse round-trip
Implements requirements 005, 006, and 007. 005: per-application Keycloak `group-ldap-mapper`s anchor each app's role groups under `/roles/<application_id>/<role_name>` (and, for tenant-aware apps, `/roles/<application_id>/<tenant>/<role_name>`). The flat-CN LDAP layout keeps each CN globally unique so Keycloak's group-tree resolver never collides; per-app mappers use the LDAP `description` as the visible Keycloak group name to keep the path free of redundant prefixes. Migration purges legacy pre-005 entries and forces a Keycloak `logout-all` so stale tokens drop pre-005 group paths. 006: per-service `<SERVICE>_SERVICE_ENABLED` env flags and the `service-gating.js` helper let role specs `skipUnlessServiceEnabled` cleanly when a shared service is missing or `SERVICES_DISABLED` is set; `MODE_CI` markers (`INFINITO_MAKE_DEPLOY`, `GITHUB_ACTIONS`, `ACT`) propagate through the deploy CLI into the test stage. 007: WordPress->Discourse round-trip Playwright scenario gated on the `web-app-discourse` deployment. WordPress Playwright runs 5/5 green on the single-site flow; the multisite + Discourse scenarios are correctly skipped when their service prerequisites are absent. The `rbac_group_path` lookup is the single sanctioned producer for OIDC group paths and is wired into every consumer (yourls, lam, minio, openwebui, pgadmin, phpldapadmin, phpmyadmin, prometheus, xwiki). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
e6eb5115bf |
test(utils/fs): extend cache coverage + invert filters/test_usage scan
Second-wave rollout of tests/utils/fs:
- 6 tests switched to the shared content cache via read_text() (replacing
raw open()/Path.read_text()): roles/includes/test_existence,
roles/dependencies/test_unnecessary, vars/test_facts_not_overridden,
services/test_sys_requires_id, lint/ansible/roles/
test_service_core_first_task_run_once, lint/ansible/roles/
test_compose_resource_limits.
- 4 unit-lookup tests moved their fixture root from <repo>/.tmp_test_* to
tempfile.TemporaryDirectory() so transient files land in /tmp (matching
the AGENTS.md rule). Manual recursive-delete teardowns removed —
TemporaryDirectory.cleanup() covers that path safely.
- filters/test_usage.py: algorithmic inversion. Old loop was
O(N_filters × M_files × 4_regex); new scan walks files once, applies two
master-alternation regexes (bare `| name` and `{% filter name %}`) plus
one combined regex over all Python callables, and records hits per filter
via the capture group. The two dropped Jinja patterns were strict
subsets of the bare pattern, so the hit set is identical — only the
complexity changes (3.6s → 0.2s, ~18x).
- docs/agents/action/testing.md: new "Filesystem Scans — Use the Shared
Cache" section codifies the rule so future agent-written tests route
through tests.utils.fs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
9c8cc1ddcb |
test(utils/fs): cache project file walks + contents across test run
Adds tests/utils/fs.py with process-level @lru_cache for both the project-wide os.walk and per-file read_text(), then migrates 26 tests (24 modified + 2 new) that previously re-walked/re-read the tree independently to share one cached pass. Headline win: tests/integration/jinja/test_variable_usage.py drops from ~26s to ~1.3s (≈19x), jinja cluster as a whole ~14x. Other migrated tests benefit from the shared content cache when the same file is read by multiple scans in one pytest run. Non-caching logic changes (kept intentionally): - test_variable_usage.py: added `if varname not in content: continue` fast-path before the line loop (pure short-circuit, identical result). - test_test_file_naming.py: exempt tests/utils/ from the test_*.py prefix rule so the new shared helpers don't trip the lint. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
kevinveenbirkenbach
|
b2914b7cd1 | Merge branch 'main' into fix/users-applications.yml | ||
|
kevinveenbirkenbachandClaude Opus 4.7
|
d244129a76 |
refactor(tests/integration/roles/includes): merge role- and task-scope existence checks
Fold test_include_import_exist.py (include_role / import_role target existence) and test_tasks_existence.py (include_tasks / import_tasks file existence) into a single test_existence.py. The two tests previously shared setUp, YAML scan, and recursive collector shape almost verbatim; the merged file keeps one filesystem walk and one recursive collector parameterised over the directive keys and the value field (name vs. file), then exposes two test methods so role and task existence still fail independently. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
709f6f73dd |
refactor(tests/integration): promote remaining top-level tests into topical clusters
Introduce seven new top-level clusters under tests/integration/:
cli/ - CLI subcommand --help smoke tests
config/ - uniform rules over roles/*/config/main.yml (non-empty,
CSP shape, universal-logout bool)
lookups/ - custom lookup-plugin behavior (config-path validation,
runtime caching perf)
vars/ - cross-role vars/defaults hygiene (uppercase uniqueness,
fact override prohibition)
inventory/ - utils/manager/inventory integration
spots/ - role-specific spot checks (dashboard OIDC, keycloak
realm import); home for future test_<role>_<aspect>.py
playbooks/ - playbook-level wiring (invokable-paths filter ->
tasks/stages + tasks/groups/*-roles.yml)
Under tests/integration/roles/ add two sub-clusters:
when/ - block-level when: hygiene (guards, duplication, block size)
includes/ - include_tasks/import_tasks/include_role/import_role target
existence (roles-scope and whole-repo-scope, kept separate
for now)
Move 14 previously unclustered tests into these clusters, adjust path
depths accordingly (from +1 to +2 levels for most, walker-based tests
unchanged), strip stale file-path header comments, and extend
tests/integration/roles/README.md to document the new sub-clusters.
No behavior change; every new cluster passes locally.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
02da33b0a5 |
refactor(tests): reorganize into topical sub-clusters and consolidate linting
Under tests/integration/roles/ introduce four sub-clusters (meta/,
dependencies/, applications/, run_once/) plus nested dependencies/run_after/
and applications/id/. Fold tests/integration/application_id/ into
roles/applications/id/ and tests/integration/run_once/ into roles/run_once/.
Pull four application-related tests out of tests/integration/ into
roles/applications/, and test_run_after_references.py into the run_after/
sub-cluster.
Consolidate tests/integration/linting/ into tests/lint/{ansible,filesystem,
repository}/, so repository-wide lint checks now run under make test-lint
rather than make test-integration.
Each new cluster ships a README.md and __init__.py; cross-referencing
READMEs (categories, ports, services, roles, applications) are updated to
point at the new paths. Path depths inside moved tests and one hardcoded
ignore path in test_domain.py are adjusted accordingly. No behavior change;
all 32 lint tests and every moved cluster pass locally.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|