Reconcile the pupmod baseline templates with the deployed fleet and re-assert it (#88)

data/sync/configs/20260813-baseline-refresh.yaml

@@ -0,0 +1,70 @@
+---
+# Re-assert the reconciled pupmod baseline fleet-wide (PR #42, closes #88).
+#
+# This is the first blanket apply_puppet_role session since the enforce-
+# strategy templates were reconciled with deployed reality. Expected
+# per-repo changes:
+#
+#   - spec/spec_helper.rb: normalized to the fleet-majority voxpupuli-test
+#     variant (~49 repos get the one-line manifest_dir/heredoc stragglers
+#     fixed; 20 are already identical)
+#   - .puppet-lint.rc: gains --no-strict_indent-check (the workaround 16
+#     repos already carry; strict_indent 5.0.0 crashes puppet-lint)
+#   - .gitignore/.pdkignore: only the 3-7 repos off the majority variant
+#   - Gemfile + workflow files are bootstrap-strategy: untouched where
+#     they exist (Renovate manages their values)
+#
+# Repos already matching the baseline everywhere come out "unchanged"
+# and get no PR.
+#
+# Dynamic-inventory session: run with `repolist=github-org` (or point
+# the repolists latest.yaml there).
+puppetsync::plan_config:
+  puppetsync:
+    permitted_project_types:
+      - pupmod
+      - pupmod_skeleton
+    plans:
+      sync:
+        github_api_delay_seconds: 1
+        stages:
+          - install_gems
+          - checkout_git_feature_branch_in_each_repo
+          - apply_puppet_role
+          - git_commit_changes
+          - ensure_github_fork
+          - ensure_git_remote
+          - git_push_to_remote
+          - ensure_github_pr
+
+      approve_github_prs:
+        stages:
+          - approve_github_pr_for_each_repo
+
+      merge_github_prs:
+        stages:
+          - merge_github_pr_for_each_repo
+
+  git:
+    feature_branch: puppetsync/20260813-baseline-refresh
+    commit_message: |
+      [puppetsync] Re-assert the refreshed pupmod baseline
+
+      This patch re-asserts the puppetsync-managed baseline files after
+      reconciling the templates with the deployed fleet (the templates
+      now describe the OpenVox-era reality — voxpupuli-test spec_helper,
+      current dotfiles):
+
+      - spec/spec_helper.rb: normalized to the fleet-majority variant
+      - .puppet-lint.rc: disable the strict_indent check fleet-wide
+        (puppet-lint-strict_indent-check 5.0.0 crashes on some valid
+        manifests; 16 repos already carried this workaround)
+      - .gitignore/.pdkignore/.gitattributes/.rspec: majority variants
+
+      Gemfiles and workflow files are bootstrap-strategy and are not
+      touched by this sync (Renovate manages their versions in place).
+
+  github:
+    pr_user: silug  # This should be the account that *submitted* the PRs
+                    # (Used by idempotency checks when approving/merging PRs)
+    approval_message: ':+1: :ghost:'

data/sync/configs/latest.yaml

@@ -1 +1 @@
-20260813-create-release-tag.yaml
+20260813-baseline-refresh.yaml

modules/profile/files/_github/workflows/add_new_issue_to_triage_project.yml

@@ -15,7 +15,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@v2
         with:
           project-url: https://github.com/orgs/simp/projects/11
           github-token: ${{ secrets.AUTO_TRIAGE_TOKEN }}

modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml

@@ -38,7 +38,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
 
 jobs:
   create-github-release:

modules/profile/files/_github/workflows/tag_deploy_rubygem.yml

@@ -48,7 +48,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
   LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json
 
 jobs:

modules/profile/files/_github/workflows/tag_deploy_rubygem__github-only.yml

@@ -35,7 +35,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
   LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json
 
 jobs:

modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml

@@ -49,7 +49,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
   LOCAL_WORKFLOW_CONFIG_FILE: .github/workflows.local.json
 
 jobs:

modules/profile/files/_gitignore

@@ -11,7 +11,9 @@ dist
 /pkg
 # Read everything in fixtures
 /spec/fixtures/*
-# Un-ignore hieradata
+# Un-ignore hieradata. The directory itself must be re-included first, otherwise
+# `/spec/fixtures/*` above excludes it and git cannot re-include files within it.
+!/spec/fixtures/hieradata/
 !/spec/fixtures/hieradata/*
 # Except this one, which is auto-generated
 /spec/fixtures/hieradata/hiera.yaml
@@ -25,3 +27,22 @@ dist
 /log
 /doc
 /Gemfile.lock
+/Gemfile.local
+
+## AI coding assistant-specific configuration
+## The standard is AGENTS.md
+# Claude Code
+/CLAUDE.md
+/.claude/
+# GitHub Copilot
+/.github/copilot-instructions.md
+# Cursor
+/.cursor/
+/.cursorrules
+# Windsurf
+/.windsurf/
+/.windsurfrules
+# Gemini CLI
+/GEMINI.md
+# Cline
+/.clinerules/

modules/profile/files/pupmod/Gemfile

@@ -6,26 +6,32 @@
 # ------------------------------------------------------------------------------
 gem_sources = ENV.fetch('GEM_SERVERS', 'https://rubygems.org').split(%r{[, ]+})
 
-ENV['PDK_DISABLE_ANALYTICS'] ||= 'true'
-
 gem_sources.each { |gem_source| source gem_source }
 
-group :test do
-  puppet_version = ENV.fetch('PUPPET_VERSION', ['>= 7', '< 9'])
-  major_puppet_version = Array(puppet_version).first.scan(%r{(\d+)(?:\.|\Z)}).flatten.first.to_i
-  gem 'hiera-puppet-helper'
+group :syntax do
   gem 'metadata-json-lint'
-  gem 'pathspec', '~> 2.0' if Gem::Requirement.create('< 2.6').satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
-  gem('pdk', ENV.fetch('PDK_VERSION', ['>= 2.0', '< 4.0']), require: false) if major_puppet_version > 5
-  gem 'puppet', puppet_version
-  gem 'puppetlabs_spec_helper'
   gem 'puppet-lint-trailing_comma-check', require: false
-  gem 'puppet-strings'
+  # rubocop, rubocop-rake, and rubocop-rspec are pulled in and version-pinned by
+  # voxpupuli-test (via simp-rake-helpers); pinning them here conflicts with its
+  # constraints. rubocop-performance is not a voxpupuli-test dependency, so it
+  # stays explicit.
+  gem 'rubocop-performance', '~> 1.26.0'
+end
+
+group :test do
+  puppet_version = ENV.fetch('PUPPET_VERSION', ['>= 8', '< 9'])
+  openvox_version = ENV.fetch('OPENVOX_VERSION', puppet_version)
+  gem 'hiera-puppet-helper'
+  gem 'openvox', openvox_version
+  gem 'openvox-strings'
   gem 'rake'
   gem 'rspec'
   gem 'rspec-puppet'
-  gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.21.0', '< 6'])
-  gem 'simp-rspec-puppet-facts', ENV.fetch('SIMP_RSPEC_PUPPET_FACTS_VERSION', '~> 3.7')
+  # renovate: datasource=rubygems versioning=ruby
+  gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 6.0')
+  # renovate: datasource=rubygems versioning=ruby
+  gem 'simp-rspec-puppet-facts', ENV.fetch('SIMP_RSPEC_PUPPET_FACTS_VERSION', '~> 4.0.0')
+  gem 'syslog', require: false
 end
 
 group :development do
@@ -38,7 +44,8 @@ group :system_tests do
   gem 'bcrypt_pbkdf'
   gem 'beaker'
   gem 'beaker-rspec'
-  gem 'simp-beaker-helpers', ENV.fetch('SIMP_BEAKER_HELPERS_VERSION', ['>= 1.32.1', '< 2'])
+  # renovate: datasource=rubygems versioning=ruby
+  gem 'simp-beaker-helpers', ENV.fetch('SIMP_BEAKER_HELPERS_VERSION', '~> 3.1')
 end
 
 # Evaluate extra gemfiles if they exist

modules/profile/files/pupmod/_pdkignore

@@ -55,3 +55,4 @@
 /spec/
 /.vscode/
 /tests/
+/AGENTS.md

modules/profile/files/pupmod/_puppet-lint.rc

@@ -13,3 +13,6 @@
 # This is here because the code can't handle lookups in parameters and SIMP
 # modules have a LOT of those
 --no-parameter_order-check
+# puppet-lint-strict_indent-check 5.0.0 crashes on some valid manifests
+# (remove when the plugin is fixed upstream)
+--no-strict_indent-check

modules/profile/templates/pupmod/spec/spec_helper.rb.epp

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #
 # ------------------------------------------------------------------------------
 #         NOTICE: **This file is maintained with puppetsync**
@@ -7,7 +8,7 @@
 # The next baseline sync will overwrite any local changes made to this file.
 # ------------------------------------------------------------------------------
 
-require 'puppetlabs_spec_helper/module_spec_helper'
+require 'voxpupuli/test/spec_helper'
 require 'rspec-puppet'
 require 'simp/rspec-puppet-facts'
 include Simp::RspecPuppetFacts
@@ -29,18 +30,18 @@ if ENV['PUPPET_DEBUG']
 end
 
 default_hiera_config = <<~HIERA_CONFIG
----
-version: 5
-hierarchy:
-  - name: Custom Test Hiera
-    path: "%{custom_hiera}.yaml"
-  - name: "%{module_name}"
-    path: "%{module_name}.yaml"
-  - name: Common
-    path: default.yaml
-defaults:
-  data_hash: yaml_data
-  datadir: "stub"
+  ---
+  version: 5
+  hierarchy:
+    - name: Custom Test Hiera
+      path: "%{custom_hiera}.yaml"
+    - name: "%{module_name}"
+      path: "%{module_name}.yaml"
+    - name: Common
+      path: default.yaml
+  defaults:
+    data_hash: yaml_data
+    datadir: "stub"
 HIERA_CONFIG
 
 # This can be used from inside your spec tests to set the testable environment.
@@ -91,16 +92,17 @@ RSpec.configure do |c|
   # If nothing else...
   c.default_facts = {
     production: {
-      #:fqdn           => 'production.rspec.test.localdomain',
+      # :fqdn           => 'production.rspec.test.localdomain',
       path: '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
-      concat_basedir: '/tmp'
-    }
+      concat_basedir: '/tmp',
+    },
   }
 
   c.mock_framework = :rspec
   c.mock_with :rspec
 
   c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests') if c.respond_to?(:manifest_dir)
 
   c.hiera_config = File.join(fixture_path, 'hieradata', 'hiera.yaml')
 
@@ -151,9 +153,9 @@ RSpec.configure do |c|
 
     # sanitize hieradata
     if defined?(hieradata)
-      set_hieradata(hieradata.gsub(':', '_'))
+      set_hieradata(hieradata.tr(':', '_'))
     elsif defined?(class_name)
-      set_hieradata(class_name.gsub(':', '_'))
+      set_hieradata(class_name.tr(':', '_'))
     end
   end
 
@@ -165,9 +167,7 @@ RSpec.configure do |c|
 end
 
 Dir.glob("#{RSpec.configuration.module_path}/*").each do |dir|
-  begin
-    Pathname.new(dir).realpath
-  rescue StandardError
-    raise "ERROR: The module '#{dir}' is not installed. Tests cannot continue."
-  end
+  Pathname.new(dir).realpath
+rescue StandardError
+  raise "ERROR: The module '#{dir}' is not installed. Tests cannot continue."
 end

spec/tasks/merge_gemfile_spec.rb

@@ -42,8 +42,8 @@ def run_merge(template:, remove_gems: nil)
     it 'never touches an existing gem version constraint' do
       # Simulate Renovate having bumped a pinned constraint
       munged = real_template.sub(
-        "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.21.0', '< 6'])",
-        "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', ['>= 5.24.0', '< 7'])",
+        "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 6.0')",
+        "gem 'simp-rake-helpers', ENV.fetch('SIMP_RAKE_HELPERS_VERSION', '~> 7.0')",
       )
       raise 'munge failed' if munged == real_template
       File.write(@gemfile, munged)
@@ -52,7 +52,7 @@ def run_merge(template:, remove_gems: nil)
 
       expect(status).to be_success, stderr
       expect(JSON.parse(stdout)['changed']).to be false
-      expect(File.read(@gemfile)).to include("['>= 5.24.0', '< 7']")
+      expect(File.read(@gemfile)).to include("'~> 7.0'")
     end
 
     it 'adds a template gem missing from its group, at the end of that group' do
@@ -150,13 +150,13 @@ def run_merge(template:, remove_gems: nil)
       stdout, stderr, status = run_merge(template: real_template)
 
       expect(status).to be_success, stderr
-      expect(JSON.parse(stdout)['added']).to include('puppet', 'pdk')
+      expect(JSON.parse(stdout)['added']).to include('openvox')
       content = File.read(@gemfile)
       test_group = content[/^group :test do.*?^end/m]
-      # `gem 'puppet', puppet_version` requires puppet_version; the pdk line
-      # requires major_puppet_version, which itself requires puppet_version
-      expect(test_group.index('puppet_version =')).to be < test_group.index('major_puppet_version =')
-      expect(test_group.index('major_puppet_version =')).to be < test_group.index("gem 'puppet'")
+      # `gem 'openvox', openvox_version` requires openvox_version, which
+      # itself requires puppet_version
+      expect(test_group.index('puppet_version =')).to be < test_group.index('openvox_version =')
+      expect(test_group.index('openvox_version =')).to be < test_group.index("gem 'openvox'")
 
       # The merged result must actually evaluate (undefined locals raise)
       evaluator = <<~RUBY