GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — bootloader/.coderabbit.yaml at main · linux-system-roles/bootloader Expand file tree/ Copy path.coderabbit.yamlMore file actions 285 lines (244 loc) · 12.5 KB / Copy path.coderabbit.yamlFile metadata and controls285 lines (244 loc) · 12.5 KB 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json # CodeRabbit configuration for linux-system-roles # Based on conventions from https://linux-system-roles.github.io/contribute.html # This file is managed from https://github.com/linux-system-roles/.github, # any manual edits will be overwritten. --- chat: art: false allow_non_org_members: false reviews: auto_review: enabled: false # to conserve resources, reviews are done manually # Disable fun features poem: false in_progress_fortune: false # Disable auto-features auto_apply_labels: false auto_assign_reviewers: false request_changes_workflow: false # Disable additional review features sequence_diagrams: false estimate_code_review_effort: false suggested_labels: false high_level_summary_in_walkthrough: false # Disable finishing touches finishing_touches: unit_tests: enabled: false # Enforce PR title and description requirements pre_merge_checks: title: mode: "warning" requirements: | PR title MUST follow Conventional Commits format: - Format: <required type><optional (scope)><optional !>: <required description> - Valid types: Refer to https://github.com/linux-system-roles/auto-maintenance/blob/main/pr_title_lint.py#L23 - Examples: - "feat: Add backup functionality" - "fix: Correct OSTree package installation" - "fix!: Remove deprecated variable (breaking change)" - "chore(formatting): Fix indentation in my_module.py" - "refactor(python)!: Use new python library thispy which has breaking api changes" custom_checks: - mode: "warning" name: "Description Format" instructions: | PR description MUST follow the template structure from .github/pull_request_template.md: - Must contain "Enhancement:" or "Feature:" section describing what changed - Must contain "Reason:" section explaining why the change was needed - Must contain "Result:" section describing the outcome or impact - Can contain optional "Issue Tracker Tickets (Jira or BZ if any):" section - Must contain "Signed-off-by:" section with your name and email address - use git commit -s - Can contain optional "Assisted-by:" section with name of the AI coding assistant and models used Example: ``` Feature: Introduce the bootloader_secure_logging variable Reason: Currently, all sensitive tasks use hard-coded no_log: true, which makes debugging difficult. Result: Users can now set bootloader_secure_logging: false for debugging while maintaining secure defaults. Issue Tracker Tickets (Jira or BZ if any): RHEL-12345 Signed-off-by: John Doe [email protected] Assisted-by: Fish 4.3 using model Swim 6.2 ``` For PRs that are bug fixes, you can use the following template: - Must contain "Cause:" section explaining the root cause of the bug - Must contain "Consequences:" section explaining the impact of the bug and how it appears to users - Must contain "Fix:" section explaining the fix for the bug and how it fixes the bug - Must contain "Result:" section describing the outcome or impact of the fix - Can contain optional "Issue Tracker Tickets (Jira or BZ if any):" section - Must contain "Signed-off-by:" section with your name and email address - use git commit -s - Can contain optional "Assisted-by:" section with name of the AI coding assistant and models used Example: ``` Cause: The variable rolename_user_name was being checked for a `none` value but was not being checked for string length greater than 0 if a string. Consequences: The role allowed empty user names to be configured which caused the daemon to report "User not found". Fix: The variable rolename_user_name is now checked for string length if not `none`, and will report an error in that case if the length is 0. Result: The role will not allow the user to provide an empty user name and will report an error if the rolename_user_name length is 0. Signed-off-by: John Doe [email protected] Assisted-by: Fish 4.3 using model Swim 6.2 ``` - mode: "warning" name: "AI Agent Attribution" instructions: | If the added code was substantially generated by AI, the generated code should contain a comment in-line or at the top of the file after the SPDX line (if any). The attribution comment should look like this: ``` # Assisted by <name of agent> using model(s) <name and version of model>[, <name and version of another model>] ``` The git commit message/PR body should also contain an attribution line like the following: ``` Assisted-by: <name of agent> using model(s) <name and version of model>[, <name and version of another model>] ``` path_instructions: # ======================================== # Ansible Tasks - Core role logic # ======================================== - path: "tasks/**/*.yml" instructions: | **no_log patterns:** - For sensitive data (credentials, secrets, passwords, keys): ```yaml - name: Task with sensitive data ansible.builtin.command: sensitive command no_log: "{{ bootloader_secure_logging }}" ``` Ensure `bootloader_secure_logging: true` is defined in defaults/main.yml - For facts modules (package_facts, service_facts): ```yaml - name: Gather package facts ansible.builtin.package_facts: no_log: "{{ ansible_verbosity < 3 }}" ``` This hides verbose facts output unless running with -vvv or higher verbosity - NEVER use hardcoded `no_log: true` - always parametrize **Package installation (OSTree compatibility):** - ALWAYS use `ansible.builtin.package` module (NEVER yum, dnf, or apt) - For Red Hat family systems: MUST include `use:` parameter for OSTree compatibility - For other systems (apt, etc.): OSTree `use:` parameter NOT needed **Red Hat family pattern (rpm/dnf/yum based):** ```yaml - name: Install packages ansible.builtin.package: name: "{{ __bootloader_packages }}" state: present use: "{{ (__bootloader_is_ostree | d(false)) | ternary('ansible.posix.rhel_rpm_ostree', omit) }}" ``` **Non-Red Hat systems (apt based) - no OSTree handling needed:** ```yaml - name: Install packages ansible.builtin.package: name: "{{ __bootloader_packages }}" state: present when: ansible_facts["pkg_mgr"] == 'apt' ``` **Pattern explanation:** - `__bootloader_is_ostree` detects OSTree/rpm-ostree systems (RHEL/CentOS/Fedora variants) - This variable should already exist in vars/main.yml - do NOT suggest adding it - `| d(false)` provides safe default if variable undefined - `ternary()` selects `ansible.posix.rhel_rpm_ostree` for OSTree, `omit` otherwise - `omit` removes the parameter entirely on non-OSTree Red Hat systems **Third-party collections:** - Avoid using third-party collections (community.general, community.crypto, etc.) - Use ansible.builtin modules or command module instead **Referencing other system roles:** - Use FQCN: `fedora.linux_system_roles.bootloader` **Idempotency:** - Tasks must be idempotent - safe to run multiple times without unintended changes - Use proper state parameters (present/absent, started/stopped, etc.) - Command/shell tasks should use creates/removes or changed_when to avoid false changes - Example: ```yaml - name: Initialize database ansible.builtin.command: /usr/bin/initialize-db args: creates: /var/lib/db/initialized.flag ``` **Check mode support:** - Critical tasks should support check mode (--check flag) - Use check_mode: false only when absolutely necessary (e.g., fact gathering) - Test that role works with --check --diff **Test coverage requirement:** - When adding new tasks to tasks/main.yml or creating new task files, verify that corresponding test coverage exists in tests/ - New functionality MUST include test files (tests/tests_*.yml) that exercise the new code paths - Tests should verify both success scenarios and failure/edge cases - If this PR adds new tasks but does not include new or updated tests, flag it and request test coverage # ======================================== # Handlers # ======================================== - path: "handlers/**/*.yml" instructions: | - Handlers with sensitive data must use `no_log: "{{ bootloader_secure_logging }}"` # ======================================== # Test Playbooks # ======================================== - path: "tests/tests_*.yml" instructions: | **CRITICAL: Role invocation pattern:** - NEVER use `ansible.builtin.include_role` directly - NEVER use `ansible.builtin.import_role` directly - NEVER use `roles:` keyword - ALMOST ALWAYS use the centrally managed wrapper: ```yaml - name: Run role ansible.builtin.include_tasks: tasks/run_role_with_clear_facts.yml vars: bootloader_<parameter>: <value> ``` The only exception to this rule is in tests_invalid_inputs.yml where we need to use the include_role directly to test the invalid inputs. **Test quality requirements:** - Tests should verify both success and failure scenarios - Use assert module to verify expected state after role execution - Include cleanup tasks to ensure tests are rerunnable - Tests should be run in a block with an always section that runs the test cleanup to ensure that the cleanup is always run. - The cleanup tasks should be tagged with `tests::cleanup` so that the cleanup can be skipped for debug purposes. - Tests should be idempotent - running twice should not cause failures - Example verification: ```yaml - name: Verify service is running ansible.builtin.assert: that: - ansible_facts.services['mssql-server.service'].state == 'running' fail_msg: "SQL Server service is not running" ``` # ======================================== # Templates # ======================================== - path: "templates/**/*.j2" instructions: | **Required headers (in this order):** 1. ansible_managed header: `{{ ansible_managed | comment }}` 2. Role fingerprint: `{{ "system_role:bootloader" | comment(prefix="", postfix="") }}` # ======================================== # Variable Definitions - defaults/ # ======================================== - path: "defaults/**/*.yml" instructions: | - All variables MUST be prefixed with `bootloader_` - All variables MUST be stored in the file defaults/main.yml, Ansible doesn't include variables from other files. - These are user-facing API variables - For every new variable introduced in this file, verify that it is documented in README.md with a description and a usage example. If it is missing from README.md, flag it and request that it be added. # ======================================== # Variable Definitions - vars/ # ======================================== - path: "vars/**/*.yml" instructions: | - Internal variables MUST be prefixed with `__bootloader_` - User-facing variables belong in defaults/main.yml, not here # ======================================== # Python Code # ======================================== - path: "**/*.py" instructions: | - Must follow PEP 8 and be formatted with Python Black - Run `tox -e black,flake8` before committing # ======================================== # Documentation # ======================================== - path: "README.md" instructions: | - Document all new user-facing variables - Include usage examples for new functionality |
| You are visitor 01402520 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |