From fa847bd2dceb30810a7224c57063560bee017da3 Mon Sep 17 00:00:00 2001 From: David Demlow Date: Mon, 2 Nov 2026 07:25:52 -0500 Subject: [PATCH] fix: integ-run/integ-seq-run used stale PUB5 SMB secret + floating ansible-core z_ansible-test.yml (the reusable workflow integ-run/integ-seq-run actually dispatch to) was missed by the 2026-10-29 Indy-lab repoint: it still passed CI_CONFIG_HC_IP50_SMB_PASSWORD to make-integ-config, which sends that password against the hardcoded 10.6.42.5 server -- a real access failure independent of the missing export/import directories (fixed separately, directly on the share). Also pin ansible-core to 2.16.0 instead of floating to latest (2.17.4 on the current container), matching examples-run's existing pin and Red Hat's partner-certification-checker v3.0.0 floor (#373). 2.17 enforces strict boolean conditionals and breaks ~15 targets using this collection's bare-truthy-string idiom (#387); 2.16 doesn't enforce it. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/z_ansible-test.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/z_ansible-test.yml b/.github/workflows/z_ansible-test.yml index a361ed30..a76d88b5 100644 --- a/.github/workflows/z_ansible-test.yml +++ b/.github/workflows/z_ansible-test.yml @@ -63,7 +63,13 @@ jobs: shell: bash run: | [ "$X_GITHUB_SKIP_TEST" == "1" ] && exit 0 - pip install -U ansible-core # ~=2.16.0 + # Pinned to 2.16.0 (2026-11-02): matches examples-run's pin and Red Hat's + # partner-certification-checker v3.0.0 floor (>=2.16.0, #373). The prior + # "pip install -U ansible-core" silently floated to whatever's newest -- 2.17.4 + # on this container -- which enforces strict boolean conditionals and broke ~15 + # targets that use the bare-truthy-string idiom (#387). The comment here said + # "~=2.16.0" already; the command just never matched it. + pip install ansible-core~=2.16.0 ansible-galaxy collection install community.general community.crypto --force ansible-galaxy collection list # ${{ env.WORKDIR }} cannot be used in "uses:" @@ -71,7 +77,12 @@ jobs: with: sc_host: ${{ inputs.sc_host }} sc_password_50: ${{ secrets.CI_CONFIG_HC_IP50_SC_PASSWORD }} - smb_password: ${{ secrets.CI_CONFIG_HC_IP50_SMB_PASSWORD }} + # 10.5.11.39's secret, CI_CONFIG_HC_IP50_SMB_PASSWORD, is kept for when PUB5/XLab + # returns. This call site was missed by the 2026-10-29 Indy-lab repoint (which only + # touched integ-test.yml's own make-integ-config calls) -- it was still sending the + # old PUB5 password against the new 10.6.42.5 server, which make-integ-config/action.yml + # hardcodes regardless of caller. + smb_password: ${{ secrets.CI_CONFIG_INDY_SMB_PASSWORD }} oidc_client_secret: ${{ secrets.OIDC_CLIENT_SECRET }} oidc_users_0_password: ${{ secrets.OIDC_USERS_0_PASSWORD }} working_directory: ${{ env.WORKDIR }}