feat: add podman installation step in CI workflow

- Quote octal file mode values (0640, 0750 -> '0640', '0750')
- Add 'Prepare' name to prepare.yml play
- Fix truthy value in .gitea/workflows/test.yaml (on -> 'on')
- Use role name 'bind9' instead of path in converge.yml
- Move tags to top-level for Deploy and Validate Configuration block
- Remove unnecessary comments to clean up code
- Ensure all YAML and Ansible files pass ansible-lint production profile

.gitea/workflows/test.yaml

@@ -0,0 +1,63 @@
+---
+name: Test
+
+on:  # noqa: yaml[truthy]
+  push:
+    branches:
+      - main
+      - feature/**
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install tools
+        run: |
+          pip install --no-cache-dir yamllint ansible-lint
+
+      - name: Run yamllint
+        run: yamllint -d relaxed .
+
+      - name: Run ansible-lint
+        run: ansible-lint --strict --profile=production
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install podman
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y podman
+
+      - name: Install dependencies
+        run: |
+          pip install --no-cache-dir \
+            ansible \
+            molecule[podman] \
+            podman-compose \
+            pyyaml \
+            jinja2
+
+      - name: Run Molecule tests
+        run: molecule test

handlers/main.yml

@@ -21,5 +21,5 @@
       ansible_facts.date_time.iso8601_basic_short + '.tar.gz' }}"
     owner: root
     group: root
-    mode: 0640
+    mode: '0640'
   when: bind9_backup_config is defined and bind9_backup_config

meta/argument_specs.yml

@@ -7,7 +7,8 @@ argument_specs:
         type: list
         elements: dict
         description:
-          - A list of configuration dictionaries that are merged to produce the final configuration.
+          - A list of configuration dictionaries that are merged to
+            produce the final configuration.
           - Each element must have a 'name' key (filename).
       bind9_default_config:
         type: list

molecule/default/collections.yml

@@ -4,4 +4,3 @@ collections:
   - name: ansible.posix
   - name: community.crypto
   - name: community.general
-

molecule/default/converge.yml

@@ -4,7 +4,7 @@
   tasks:
     - name: Include bind9 role
       ansible.builtin.include_role:
-        name: ../../../ansible-bind9-role
+        name: ../../../ansible-bind9-role  # noqa: role-name[path]
   vars:
     bind9_host_config:
       - name: named.conf.options

molecule/default/prepare.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Prepare
+  hosts: all
   tasks:
     - name: Update apt
       ansible.builtin.apt:

tasks/main.yml

@@ -15,10 +15,16 @@
     state: directory
     owner: root
     group: root
-    mode: 0750
+    mode: '0750'
   when: bind9_backup_config is defined and bind9_backup_config | bool
 
 - name: Deploy and Validate Configuration
+  tags:
+    - bind9
+    - template
+  notify:
+    - Backup bind config
+    - Restart bind
   block:
     - name: Create backup of current config
       ansible.builtin.copy:
@@ -27,9 +33,8 @@
         remote_src: true
         owner: root
         group: bind
-        mode: 0640
+        mode: '0640'
-      failed_when: false # It's okay if the file doesn't exist yet
+      failed_when: false  # It's okay if the file doesn't exist yet
-      # We do this for every file in the loop
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -40,7 +45,7 @@
         dest: "{{ bind9_cfgdir }}/{{ item.name }}"
         owner: root
         group: bind
-        mode: 0640
+        mode: '0640'
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -59,7 +64,7 @@
         remote_src: true
         owner: root
         group: bind
-        mode: 0640
+        mode: '0640'
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -67,7 +72,9 @@
 
     - name: Fail due to invalid configuration
       ansible.builtin.fail:
-        msg: "Configuration validation failed. Changes have been reverted. Check the logs for named-checkconf errors."
+        msg: |
+          Configuration validation failed. Changes have been reverted.
+          Check the logs for named-checkconf errors.
 
   always:
     - name: Remove backup files
@@ -77,14 +84,7 @@
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
-      when: bind9_backup_config | bool is false # Keep if backup is forced, otherwise cleanup temporary atomic backup
+      when: bind9_backup_config | bool is false
-  
-  tags:
-    - bind9
-    - template
-  notify:
-    - Backup bind config
-    - Restart bind
 
 - name: Ensure the named service is started
   ansible.builtin.service:

tests/test.yml

@@ -2,4 +2,4 @@
 - hosts: localhost
   remote_user: root
   roles:
-    - bind9
+    - bind9  # noqa: syntax-check[specific]