diff --git a/data/sync/configs/20260813-baseline-refresh.yaml b/data/sync/configs/20260813-baseline-refresh.yaml new file mode 100644 index 0000000..52cdfed --- /dev/null +++ b/data/sync/configs/20260813-baseline-refresh.yaml @@ -0,0 +1,70 @@ +--- +# Re-assert the reconciled pupmod baseline fleet-wide (PR #42, closes #88). +# +# This is the first blanket apply_puppet_role session since the enforce- +# strategy templates were reconciled with deployed reality. Expected +# per-repo changes: +# +# - spec/spec_helper.rb: normalized to the fleet-majority voxpupuli-test +# variant (~49 repos get the one-line manifest_dir/heredoc stragglers +# fixed; 20 are already identical) +# - .puppet-lint.rc: gains --no-strict_indent-check (the workaround 16 +# repos already carry; strict_indent 5.0.0 crashes puppet-lint) +# - .gitignore/.pdkignore: only the 3-7 repos off the majority variant +# - Gemfile + workflow files are bootstrap-strategy: untouched where +# they exist (Renovate manages their values) +# +# Repos already matching the baseline everywhere come out "unchanged" +# and get no PR. +# +# Dynamic-inventory session: run with `repolist=github-org` (or point +# the repolists latest.yaml there). +puppetsync::plan_config: + puppetsync: + permitted_project_types: + - pupmod + - pupmod_skeleton + plans: + sync: + github_api_delay_seconds: 1 + stages: + - install_gems + - checkout_git_feature_branch_in_each_repo + - apply_puppet_role + - git_commit_changes + - ensure_github_fork + - ensure_git_remote + - git_push_to_remote + - ensure_github_pr + + approve_github_prs: + stages: + - approve_github_pr_for_each_repo + + merge_github_prs: + stages: + - merge_github_pr_for_each_repo + + git: + feature_branch: puppetsync/20260813-baseline-refresh + commit_message: | + [puppetsync] Re-assert the refreshed pupmod baseline + + This patch re-asserts the puppetsync-managed baseline files after + reconciling the templates with the deployed fleet (the templates + now describe the OpenVox-era reality — voxpupuli-test spec_helper, + current dotfiles): + + - spec/spec_helper.rb: normalized to the fleet-majority variant + - .puppet-lint.rc: disable the strict_indent check fleet-wide + (puppet-lint-strict_indent-check 5.0.0 crashes on some valid + manifests; 16 repos already carried this workaround) + - .gitignore/.pdkignore/.gitattributes/.rspec: majority variants + + Gemfiles and workflow files are bootstrap-strategy and are not + touched by this sync (Renovate manages their versions in place). + + github: + pr_user: silug # This should be the account that *submitted* the PRs + # (Used by idempotency checks when approving/merging PRs) + approval_message: ':+1: :ghost:' diff --git a/data/sync/configs/latest.yaml b/data/sync/configs/latest.yaml index f79432b..80132ff 120000 --- a/data/sync/configs/latest.yaml +++ b/data/sync/configs/latest.yaml @@ -1 +1 @@ -20260813-create-release-tag.yaml \ No newline at end of file +20260813-baseline-refresh.yaml \ No newline at end of file diff --git a/modules/profile/files/_github/workflows/add_new_issue_to_triage_project.yml b/modules/profile/files/_github/workflows/add_new_issue_to_triage_project.yml index fcc4d1c..62c1268 100644 --- a/modules/profile/files/_github/workflows/add_new_issue_to_triage_project.yml +++ b/modules/profile/files/_github/workflows/add_new_issue_to_triage_project.yml @@ -15,7 +15,7 @@ jobs: name: Add issue to project runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@v1.0.2 + - uses: actions/add-to-project@v2 with: project-url: https://github.com/orgs/simp/projects/11 github-token: ${{ secrets.AUTO_TRIAGE_TOKEN }} diff --git a/modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml b/modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml index ec1c090..6f73cff 100644 --- a/modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml +++ b/modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml @@ -38,7 +38,7 @@ on: - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+' env: - PUPPET_VERSION: '~> 7' + PUPPET_VERSION: '~> 8' jobs: create-github-release: diff --git a/modules/profile/files/_github/workflows/tag_deploy_rubygem.yml b/modules/profile/files/_github/workflows/tag_deploy_rubygem.yml index 3c2d4db..cdd3dfb 100644 --- a/modules/profile/files/_github/workflows/tag_deploy_rubygem.yml +++ b/modules/profile/files/_github/workflows/tag_deploy_rubygem.yml @@ -48,7 +48,7 @@ on: - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+' env: - PUPPET_VERSION: '~> 7' + PUPPET_VERSION: '~> 8' LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json jobs: diff --git a/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-only.yml b/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-only.yml index 2fed4e5..5df49f7 100644 --- a/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-only.yml +++ b/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-only.yml @@ -35,7 +35,7 @@ on: - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+' env: - PUPPET_VERSION: '~> 7' + PUPPET_VERSION: '~> 8' LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json jobs: diff --git a/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml b/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml index 6d3a6d9..8f525ee 100644 --- a/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml +++ b/modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml @@ -49,7 +49,7 @@ on: - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+' env: - PUPPET_VERSION: '~> 7' + PUPPET_VERSION: '~> 8' LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json jobs: diff --git a/modules/profile/files/_gitignore b/modules/profile/files/_gitignore index 410b067..bff5942 100644 --- a/modules/profile/files/_gitignore +++ b/modules/profile/files/_gitignore @@ -11,7 +11,9 @@ dist /pkg # Read everything in fixtures /spec/fixtures/* -# Un-ignore hieradata +# Un-ignore hieradata. The directory itself must be re-included first, otherwise +# `/spec/fixtures/*` above excludes it and git cannot re-include files within it. +!/spec/fixtures/hieradata/ !/spec/fixtures/hieradata/* # Except this one, which is auto-generated /spec/fixtures/hieradata/hiera.yaml @@ -25,3 +27,22 @@ dist /log /doc /Gemfile.lock +/Gemfile.local + +## AI coding assistant-specific configuration +## The standard is AGENTS.md +# Claude Code +/CLAUDE.md +/.claude/ +# GitHub Copilot +/.github/copilot-instructions.md +# Cursor +/.cursor/ +/.cursorrules +# Windsurf +/.windsurf/ +/.windsurfrules +# Gemini CLI +/GEMINI.md +# Cline +/.clinerules/ diff --git a/modules/profile/files/pupmod/Gemfile b/modules/profile/files/pupmod/Gemfile index 60dc00e..a6275a3 100644 --- a/modules/profile/files/pupmod/Gemfile +++ b/modules/profile/files/pupmod/Gemfile @@ -6,26 +6,32 @@ # ------------------------------------------------------------------------------ gem_sources = ENV.fetch('GEM_SERVERS', 'https://rubygems.org').split(%r{[, ]+}) -ENV['PDK_DISABLE_ANALYTICS'] ||= 'true' - gem_sources.each { |gem_source| source gem_source } -group :test do - puppet_version = ENV.fetch('PUPPET_VERSION', ['>= 7', '< 9']) - major_puppet_version = Array(puppet_version).first.scan(%r{(\d+)(?:\.|\Z)}).flatten.first.to_i - gem 'hiera-puppet-helper' +group :syntax do gem 'metadata-json-lint' - gem 'pathspec', '~> 2.0' if Gem::Requirement.create('< 2.6').satisfied_by?(Gem::Version.new(RUBY_VERSION.dup)) - gem('pdk', ENV.fetch('PDK_VERSION', ['>= 2.0', '< 4.0']), require: false) if major_puppet_version > 5 - gem 'puppet', puppet_version - gem 'puppetlabs_spec_helper' gem 'puppet-lint-trailing_comma-check', require: false - gem 'puppet-strings' + # rubocop, rubocop-rake, and rubocop-rspec are pulled in and version-pinned by + # voxpupuli-test (via simp-rake-helpers); pinning them here conflicts with its + # constraints. rubocop-performance is not a voxpupuli-test dependency, so it + # stays explicit. + gem 'rubocop-performance', '~> 1.26.0' +end + +group :test do + puppet_version = ENV.fetch('PUPPET_VERSION', ['>= 8', '< 9']) + openvox_version = ENV.fetch('OPENVOX_VERSION', puppet_version) + gem 'hiera-puppet-helper' + gem 'openvox', openvox_version + gem 'openvox-strings' gem 'rake' gem 'rspec' gem 'rspec-puppet' - gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.21.0', '< 6']) - gem 'simp-rspec-puppet-facts', ENV.fetch('SIMP_RSPEC_PUPPET_FACTS_VERSION', '~> 3.7') + # renovate: datasource=rubygems versioning=ruby + gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 6.0') + # renovate: datasource=rubygems versioning=ruby + gem 'simp-rspec-puppet-facts', ENV.fetch('SIMP_RSPEC_PUPPET_FACTS_VERSION', '~> 4.0.0') + gem 'syslog', require: false end group :development do @@ -38,7 +44,8 @@ group :system_tests do gem 'bcrypt_pbkdf' gem 'beaker' gem 'beaker-rspec' - gem 'simp-beaker-helpers', ENV.fetch('SIMP_BEAKER_HELPERS_VERSION', ['>= 1.32.1', '< 2']) + # renovate: datasource=rubygems versioning=ruby + gem 'simp-beaker-helpers', ENV.fetch('SIMP_BEAKER_HELPERS_VERSION', '~> 3.1') end # Evaluate extra gemfiles if they exist diff --git a/modules/profile/files/pupmod/_pdkignore b/modules/profile/files/pupmod/_pdkignore index 84caa42..3a56048 100644 --- a/modules/profile/files/pupmod/_pdkignore +++ b/modules/profile/files/pupmod/_pdkignore @@ -55,3 +55,4 @@ /spec/ /.vscode/ /tests/ +/AGENTS.md diff --git a/modules/profile/files/pupmod/_puppet-lint.rc b/modules/profile/files/pupmod/_puppet-lint.rc index eb56769..16eb616 100644 --- a/modules/profile/files/pupmod/_puppet-lint.rc +++ b/modules/profile/files/pupmod/_puppet-lint.rc @@ -13,3 +13,6 @@ # This is here because the code can't handle lookups in parameters and SIMP # modules have a LOT of those --no-parameter_order-check +# puppet-lint-strict_indent-check 5.0.0 crashes on some valid manifests +# (remove when the plugin is fixed upstream) +--no-strict_indent-check diff --git a/modules/profile/templates/pupmod/spec/spec_helper.rb.epp b/modules/profile/templates/pupmod/spec/spec_helper.rb.epp index 1cc3dee..f9ab869 100644 --- a/modules/profile/templates/pupmod/spec/spec_helper.rb.epp +++ b/modules/profile/templates/pupmod/spec/spec_helper.rb.epp @@ -1,4 +1,5 @@ # frozen_string_literal: true + # # ------------------------------------------------------------------------------ # NOTICE: **This file is maintained with puppetsync** @@ -7,7 +8,7 @@ # The next baseline sync will overwrite any local changes made to this file. # ------------------------------------------------------------------------------ -require 'puppetlabs_spec_helper/module_spec_helper' +require 'voxpupuli/test/spec_helper' require 'rspec-puppet' require 'simp/rspec-puppet-facts' include Simp::RspecPuppetFacts @@ -29,18 +30,18 @@ if ENV['PUPPET_DEBUG'] end default_hiera_config = <<~HIERA_CONFIG ---- -version: 5 -hierarchy: - - name: Custom Test Hiera - path: "%{custom_hiera}.yaml" - - name: "%{module_name}" - path: "%{module_name}.yaml" - - name: Common - path: default.yaml -defaults: - data_hash: yaml_data - datadir: "stub" + --- + version: 5 + hierarchy: + - name: Custom Test Hiera + path: "%{custom_hiera}.yaml" + - name: "%{module_name}" + path: "%{module_name}.yaml" + - name: Common + path: default.yaml + defaults: + data_hash: yaml_data + datadir: "stub" HIERA_CONFIG # This can be used from inside your spec tests to set the testable environment. @@ -91,16 +92,17 @@ RSpec.configure do |c| # If nothing else... c.default_facts = { production: { - #:fqdn => 'production.rspec.test.localdomain', + # :fqdn => 'production.rspec.test.localdomain', path: '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin', - concat_basedir: '/tmp' - } + concat_basedir: '/tmp', + }, } c.mock_framework = :rspec c.mock_with :rspec c.module_path = File.join(fixture_path, 'modules') + c.manifest_dir = File.join(fixture_path, 'manifests') if c.respond_to?(:manifest_dir) c.hiera_config = File.join(fixture_path, 'hieradata', 'hiera.yaml') @@ -151,9 +153,9 @@ RSpec.configure do |c| # sanitize hieradata if defined?(hieradata) - set_hieradata(hieradata.gsub(':', '_')) + set_hieradata(hieradata.tr(':', '_')) elsif defined?(class_name) - set_hieradata(class_name.gsub(':', '_')) + set_hieradata(class_name.tr(':', '_')) end end @@ -165,9 +167,7 @@ RSpec.configure do |c| end Dir.glob("#{RSpec.configuration.module_path}/*").each do |dir| - begin - Pathname.new(dir).realpath - rescue StandardError - raise "ERROR: The module '#{dir}' is not installed. Tests cannot continue." - end + Pathname.new(dir).realpath +rescue StandardError + raise "ERROR: The module '#{dir}' is not installed. Tests cannot continue." end diff --git a/spec/tasks/merge_gemfile_spec.rb b/spec/tasks/merge_gemfile_spec.rb index 744dba9..5a74753 100644 --- a/spec/tasks/merge_gemfile_spec.rb +++ b/spec/tasks/merge_gemfile_spec.rb @@ -42,8 +42,8 @@ def run_merge(template:, remove_gems: nil) it 'never touches an existing gem version constraint' do # Simulate Renovate having bumped a pinned constraint munged = real_template.sub( - "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.21.0', '< 6'])", - "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.24.0', '< 7'])", + "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 6.0')", + "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 7.0')", ) raise 'munge failed' if munged == real_template File.write(@gemfile, munged) @@ -52,7 +52,7 @@ def run_merge(template:, remove_gems: nil) expect(status).to be_success, stderr expect(JSON.parse(stdout)['changed']).to be false - expect(File.read(@gemfile)).to include("['>= 5.24.0', '< 7']") + expect(File.read(@gemfile)).to include("'~> 7.0'") end it 'adds a template gem missing from its group, at the end of that group' do @@ -150,13 +150,13 @@ def run_merge(template:, remove_gems: nil) stdout, stderr, status = run_merge(template: real_template) expect(status).to be_success, stderr - expect(JSON.parse(stdout)['added']).to include('puppet', 'pdk') + expect(JSON.parse(stdout)['added']).to include('openvox') content = File.read(@gemfile) test_group = content[/^group :test do.*?^end/m] - # `gem 'puppet', puppet_version` requires puppet_version; the pdk line - # requires major_puppet_version, which itself requires puppet_version - expect(test_group.index('puppet_version =')).to be < test_group.index('major_puppet_version =') - expect(test_group.index('major_puppet_version =')).to be < test_group.index("gem 'puppet'") + # `gem 'openvox', openvox_version` requires openvox_version, which + # itself requires puppet_version + expect(test_group.index('puppet_version =')).to be < test_group.index('openvox_version =') + expect(test_group.index('openvox_version =')).to be < test_group.index("gem 'openvox'") # The merged result must actually evaluate (undefined locals raise) evaluator = <<~RUBY