Add linting on pull request

.ansible-lint.yml

@@ -0,0 +1,7 @@
+---
+skip_list:
+  - var-naming[no-role-prefix]
+exclude_paths:
+  - .github
+  - ui-meta/
+  - assets/

.checkov.yml

@@ -0,0 +1,11 @@
+---
+skip-check:
+  # Requires all urls used with ansible.builtin.uri to be HTTPS
+  # Redirection to HTTPS is handled by the Kubernetes ingress
+  - CKV2_ANSIBLE_1
+  # Requires all blocks to have rescue: - not considered appropriate
+  - CKV2_ANSIBLE_3
+  - CKV2_GHA_1
+skip-path:
+  - vendor/
+  - collections/

.editorconfig

@@ -0,0 +1,8 @@
+# The is primarily used to alter the behaviour of linters executed by super-linter.
+# See https://editorconfig.org/
+
+# shfmt will default to indenting shell scripts with tabs,
+# define the indent as 2 spaces
+[bin/*]
+indent_style = space
+indent_size = 2

.github/linters/.checkov.yml

@@ -0,0 +1 @@
+../../.checkov.yml

.github/linters/actionlint.yml

@@ -0,0 +1 @@
+../../actionlint.yml

.github/workflows/lint.yml

@@ -0,0 +1,47 @@
+---
+name: Lint
+
+on:  # yamllint disable-line rule:truthy
+  workflow_call:
+
+permissions:
+  contents: read
+  packages: read
+  # To report GitHub Actions status checks
+  statuses: write
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # super-linter needs the full git history to get the
+          # list of files that changed across commits
+          fetch-depth: 0
+          submodules: true
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@v25.4.0
+
+      - name: Load super-linter configuration
+        # Use grep inverse matching to exclude eventual comments in the .env file
+        # because the GitHub Actions command to set environment variables doesn't
+        # support comments.
+        # yamllint disable-line rule:line-length
+        # Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable
+        run: grep -v '^#' super-linter.env >> "$GITHUB_ENV"
+        if: always()
+
+      - name: Run super-linter
+        uses: super-linter/super-linter@v7.3.0
+        if: always()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr.yml

@@ -0,0 +1,26 @@
+---
+    name: Build and test PR
+
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write
+
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+
+    on:
+      pull_request:
+        types:
+          - opened
+          - synchronize
+          - ready_for_review
+          - reopened
+        branches:
+          - main
+
+    jobs:
+      lint:
+        uses: ./.github/workflows/lint.yml

.yamllint.yml

@@ -0,0 +1,24 @@
+---
+extends: default
+
+rules:
+  brackets:
+    forbid: non-empty
+  comments:
+    # https://github.com/prettier/prettier/issues/6780
+    min-spaces-from-content: 1
+  # https://github.com/adrienverge/yamllint/issues/384
+  comments-indentation: false
+  document-start: disable
+  # 160 chars was the default used by old E204 rule, but
+  # you can easily change it or disable in your .yamllint file.
+  line-length:
+    max: 160
+  # We are adding an extra space inside braces as that's how prettier does it
+  # and we are trying not to fight other linters.
+  braces:
+    min-spaces-inside: 0 # yamllint defaults to 0
+    max-spaces-inside: 1 # yamllint defaults to 0
+  octal-values:
+    forbid-implicit-octal: true # yamllint defaults to false
+    forbid-explicit-octal: true # yamllint defaults to false

README.md

@@ -1 +1,17 @@
 # caas-workstation
+
+## Developing locally
+
+To run the GitHub Actions linters locally, use:
+
+```sh
+docker run --rm \
+    -e RUN_LOCAL=true \
+    --env-file "super-linter.env" \
+    -v "$(pwd)":/tmp/lint \
+    ghcr.io/super-linter/super-linter:v7.3.0
+```
+
+```sh
+ansible-lint -c .ansible-lint.yml
+```

actionlint.yml

@@ -0,0 +1 @@
+---

roles/cluster_infra/tasks/main.yml

@@ -1,39 +1,41 @@
 ---
 
-# Convert the floating IP id to an address for Terraform
-- block:
+- name: Convert the floating IP id to an address for Terraform
+  when:
+    - cluster_floating_ip is defined
+    - cluster_floating_ip
+  block:
     - name: Look up floating ip
       azimuth_cloud.terraform.os_floating_ip_info:
         floating_ip: "{{ cluster_floating_ip }}"
       register: cluster_floating_ip_info
 
     - name: Set floating IP address fact
-      set_fact:
+      ansible.builtin.set_fact:
         cluster_floating_ip_address: "{{ cluster_floating_ip_info.floating_ip.floating_ip_address }}"
-  when:
-    - cluster_floating_ip is defined
-    - cluster_floating_ip
 
 - name: Install Terraform binary
-  include_role:
+  ansible.builtin.include_role:
     name: azimuth_cloud.terraform.install
 
 - name: Make Terraform project directory
-  file:
+  ansible.builtin.file:
     path: "{{ terraform_project_path }}"
     state: directory
+    mode: "0755"
 
 - name: Template Terraform files into project directory
-  template:
+  ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ terraform_project_path }}/{{ item }}"
+    mode: "0644"
   loop:
     - outputs.tf
     - providers.tf
     - resources.tf
 
 - name: Provision infrastructure
-  include_role:
+  ansible.builtin.include_role:
     name: azimuth_cloud.terraform.infra
   vars:
     terraform_rebuild_nodes: "{{ azimuth_update_reason == 'patch' }}"

super-linter.env

@@ -0,0 +1,14 @@
+# Detect that default branch is main when running locally
+DEFAULT_BRANCH=main
+
+# Don't validate JSCPD
+VALIDATE_JSCPD=false
+
+# Don't validate JS standard because it conflicts with JS prettier
+VALIDATE_JAVASCRIPT_STANDARD=false
+
+# Don't validate Ansible because ansible-lint is more flexible
+VALIDATE_ANSIBLE=false
+
+# Don't validate YAML prettier because yamllint is sufficient
+VALIDATE_YAML_PRETTIER=false

ui-meta/workstation-external-ssh-fast-volume-type.yml

@@ -1,3 +1,4 @@
+---
 name: "workstation-external-ssh"
 label: "Linux Workstation (with SSH access)"
 description: Linux workstation (Ubuntu 22.04) accessible via a web browser and by SSH.
@@ -28,7 +29,7 @@ parameters:
   - name: cluster_volume_size
     label: "Data volume size (GB)"
     description: |-
-      The size of the data volume for the workstation.  
+      The size of the data volume for the workstation.
       The data volume will be available at `/data`.
     kind: cloud.volume_size
     default: 10
@@ -40,7 +41,7 @@ parameters:
     label: Provision high-performance storage for the data volume
     description: |
       If a high-performance storage type is available, use it for for the data
-      volume. If no high-performance storage type is available, this option has 
+      volume. If no high-performance storage type is available, this option has
       no effect and a standard cloud volume will be provisioned for data.
     kind: boolean
     required: false

ui-meta/workstation-external-ssh.yml

@@ -1,3 +1,4 @@
+---
 name: "workstation-external-ssh"
 label: "Linux Workstation (with SSH access)"
 description: Linux workstation (Ubuntu 22.04) accessible via a web browser and by SSH.
@@ -28,7 +29,7 @@ parameters:
   - name: cluster_volume_size
     label: "Data volume size (GB)"
     description: |-
-      The size of the data volume for the workstation.  
+      The size of the data volume for the workstation.
       The data volume will be available at `/data`.
     kind: cloud.volume_size
     default: 10

ui-meta/workstation-fast-volume-type.yml

@@ -1,3 +1,4 @@
+---
 name: "workstation"
 label: "Linux Workstation"
 description: Linux workstation (Ubuntu 22.04) accessible via a web browser.
@@ -20,19 +21,19 @@ parameters:
   - name: cluster_volume_size
     label: "Data volume size (GB)"
     description: |-
-      The size of the data volume for the workstation.  
+      The size of the data volume for the workstation.
       The data volume will be available at `/data`.
     kind: cloud.volume_size
     default: 10
     options:
       min: 10
     immutable: true
-  
+
   - name: use_cluster_volume_type_fast
     label: Provision high-performance storage for the data volume
     description: |
       If a high-performance storage type is available, use it for for the data
-      volume. If no high-performance storage type is available, this option has 
+      volume. If no high-performance storage type is available, this option has
       no effect and a standard cloud volume will be provisioned for data.
     kind: boolean
     required: false

ui-meta/workstation.yml

@@ -1,3 +1,4 @@
+---
 name: "workstation"
 label: "Linux Workstation"
 description: Linux workstation (Ubuntu 22.04) accessible via a web browser.
@@ -20,7 +21,7 @@ parameters:
   - name: cluster_volume_size
     label: "Data volume size (GB)"
     description: |-
-      The size of the data volume for the workstation.  
+      The size of the data volume for the workstation.
       The data volume will be available at `/data`.
     kind: cloud.volume_size
     default: 10

workstation.yml

@@ -7,8 +7,8 @@
 
 - name: Configure project share
   hosts: workstation
-  gather_facts: no
-  become: yes
+  gather_facts: false
+  become: true
   vars:
     os_manila_mount_shares:
       - share_name: "{{ cluster_project_manila_share_name | default('azimuth-project-share') }}"
@@ -19,15 +19,15 @@
         mount_mode: ugo=rwX
   tasks:
     - name: Configure Manila project share
-      include_role:
+      ansible.builtin.include_role:
         name: stackhpc.os-manila-mount
       when: cluster_project_manila_share | default(false) | bool
 
 - name: Wait for Zenith services
   hosts: openstack
   tasks:
     - name: Wait for Monitoring to become available
-      uri:
+      ansible.builtin.uri:
         url: "http://{{ zenith_fqdn_monitoring }}"
         method: GET
         follow_redirects: safe
@@ -44,9 +44,9 @@
       delay: 10
       until: "monitoring_uri is not failed"
       when: (cluster_state | default('present')) == 'present'
-    
+
     - name: Wait for webconsole to become available
-      uri:
+      ansible.builtin.uri:
         url: "http://{{ zenith_fqdn_webconsole }}"
         method: GET
         follow_redirects: safe
@@ -64,10 +64,11 @@
       until: "webconsole_uri is not failed"
       when: (cluster_state | default('present')) == 'present'
 
-# Write the outputs as the final task
-- hosts: localhost
+- name: Write the outputs as the final task
+  hosts: localhost
   tasks:
-    - debug: 
+    - name: Print cluster access ip
+      ansible.builtin.debug:
         var: outputs
       vars:
         fip_address: "{{ hostvars[groups['openstack'][0]].cluster_floating_ip_address }}"