os_hardening.yml

---
name: "devsec.os_hardening"
on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
      - 'requirements.txt'
  pull_request:
    branches: [master]
    paths:
      - 'roles/os_hardening/**'
      - 'molecule/os_hardening/**'
      - '.github/workflows/os_hardening.yml'
      - 'requirements.txt'
  schedule:
    - cron: '0 6 * * 3'

concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      PY_COLORS: 1
      ANSIBLE_FORCE_COLOR: 1
    strategy:
      fail-fast: false
      matrix:
        include:
          - molecule_distro: opensuse_tumbleweed
            molecule_docker_command: "/usr/lib/systemd/systemd"
        molecule_distro:
          - centosstream9
          - rocky8
          - rocky9
          - fedora39
          - fedora40
          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
          - debian11
          - debian12
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
        with:
          python-version: 3.12
          cache: 'pip'

      - name: Install dependencies
        run: pip install -r requirements.txt
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
        run: pip install "ansible-core<2.17"
        working-directory: ansible_collections/devsec/hardening
        if: matrix.molecule_distro == 'rocky8'

      - name: Test with molecule
        run: molecule test -s os_hardening
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
          MOLECULE_DOCKER_COMMAND: ${{ matrix.molecule_docker_command }}
        working-directory: ansible_collections/devsec/hardening