kevinveenbirkenbachandClaude Opus 4.7 15de5afced test(lint/ansible/services): warn-only check for non-semver image and ref pins ...

Adds `test_semver_pinning.py` under `tests/lint/ansible/services/`.
Recursively walks every `roles/*/meta/services.yml`, surfaces a
warning for every `image:`+`version:` pair and every `repository:`+`ref:`
pair whose value is not semver-compatible. Output via the shared
annotations helper (GitHub Actions `::warning::` plus pytest's
`warnings.warn`), with a single trailing suppression hint when any
finding fires. Never fails the test session.

Suppression reuses the existing markers:
  - `# nocheck: docker-version` for `version:` pins
  - `# nocheck: repository-version` for `ref:` pins
Both accept same-line or line-above placement. The existing external
update checks (`utils/update/docker.suppressed_services` and
`utils/update/repository.suppressed_ref_lines`) are loosened from
strict `line-above` to the default `same-or-above` for consistent
marker semantics across all three consumers.

Updates `docs/contributing/actions/testing/suppression.md` so the
catalog lists both consumers per marker and adds the previously
missing `repository-version` row.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 20:12:07 +02:00

..

__init__.py

refactor(update): unify version bumpers under utils/update + cli/contributing/update + scripts/github/update

2026-05-15 20:12:07 +02:00

base.py

refactor(update): unify version bumpers under utils/update + cli/contributing/update + scripts/github/update

2026-05-15 20:12:07 +02:00

docker.py

test(lint/ansible/services): warn-only check for non-semver image and ref pins

2026-05-15 20:12:07 +02:00

repository.py

test(lint/ansible/services): warn-only check for non-semver image and ref pins

2026-05-15 20:12:07 +02:00