fix(ci): pin + cache

This reverts commit a840571733.

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,3 +12,4 @@
 - [ ] Ran `reset.yml` playbook
 - [ ] Did not add any unnecessary changes
 - [ ] 🚀
+- [ ] Ran pre-commit install at least once before committing

.github/download-boxes.sh

@@ -5,10 +5,15 @@
 # already present on the system.
 
 set -euo pipefail
-
+YQ_VERSION=v4.29.2
+YQ_BINARY=yq_linux_amd64
 GIT_ROOT=$(git rev-parse --show-toplevel)
 PROVIDER=virtualbox
 
+# get yq used for filtering
+sudo wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/${YQ_BINARY} -O /usr/bin/yq &&\
+    sudo chmod +x /usr/bin/yq
+
 # Read all boxes for all platforms from the "molecule.yml" files
 all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
     yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"

.github/workflows/lint.yml

@@ -5,20 +5,42 @@ on:
   push:
     branches:
       - master
-
+    paths-ignore:
+      - '**/README.md'
 jobs:
-  ansible-lint:
-    name: YAML Lint + Ansible Lint
-    runs-on: ubuntu-latest
+  pre-commit-ci:
+    name: Pre-Commit
+    runs-on: self-hosted
+    env:
+      PYTHON_VERSION: "3.10"
 
     steps:
       - name: Check out the codebase
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
-
-      - name: Set up Python 3.x
-        uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5 #4.0.2
         with:
-          python-version: "3.x"
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
+
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Ansible
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.ansible/collections
+          key: ${{ runner.os }}-ansible-${{ hashFiles('collections/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-ansible-
 
       - name: Install dependencies
         run: |
@@ -34,8 +56,18 @@ jobs:
           ansible-galaxy install -r collections/requirements.yml
           echo "::endgroup::"
 
-      - name: Run yamllint
-        run: yamllint .
+      - name: Run pre-commit
+        uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
 
-      - name: Run ansible-lint
-        run: ansible-lint
+  ensure-pinned-actions:
+    name: Ensure SHA Pinned Actions
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@6ca5574367befbc9efdb2fa25978084159c5902d # 1.3.0
+        with:
+          allowlist: |
+            aws-actions/
+            docker/login-action

.github/workflows/test.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   molecule:
     name: Molecule
-    runs-on: macos-12
+    runs-on: self-hosted
 
     strategy:
       matrix:
@@ -21,10 +21,39 @@ jobs:
       fail-fast: false
     env:
       PYTHON_VERSION: "3.10"
+      VAGRANT_DEFAULT_PROVIDER: virtualbox
 
     steps:
       - name: Check out the codebase
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Install Virtual Box from Oracle
+        run: |
+          echo "::group::Virtual Box"
+          wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --dearmor --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg
+          echo "deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian $(lsb_release -cs) contrib" | sudo tee -a /etc/apt/sources.list.d/virtualbox.list
+          sudo apt update && sudo apt install -y linux-headers-generic linux-headers-5.15.0-52-generic build-essential dkms virtualbox-dkms virtualbox-6.1
+          echo "::endgroup::"
+          echo "::group::Virtual Box Test"
+          vboxmanage --version
+          sudo /sbin/vboxconfig
+          sudo modprobe vboxdrv
+          vboxmanage --version
+          echo "::endgroup::"
+
+      - name: Install Vagrant
+        run: |
+          echo "::group::Install Vagrant"
+          wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update && sudo apt install -y vagrant
+          vagrant version
+          vagrant plugin list
+          vagrant plugin install vagrant-vbguest
+          vagrant plugin list
+          echo "::endgroup::"
 
       - name: Configure VirtualBox
         run: |-
@@ -34,8 +63,16 @@ jobs:
           * fdad:bad:ba55::/64
           EOF
 
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
       - name: Cache Vagrant boxes
-        uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77 # 3.0.8
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
         with:
           path: |
             ~/.vagrant.d/boxes
@@ -50,14 +87,20 @@ jobs:
         run: ./.github/download-boxes.sh
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
 
       - name: Install dependencies
-        run: >-
-          python3 -m pip install --upgrade pip &&
+        run: |
+          echo "::group::Upgrade pip"
+          python3 -m pip install --upgrade pip
+          echo "::endgroup::"
+
+          echo "::group::Install Python requirements from requirements.txt"
           python3 -m pip install -r requirements.txt
+          echo "::endgroup::"
 
       - name: Test with molecule
         run: molecule test --scenario-name ${{ matrix.scenario }}
@@ -70,7 +113,7 @@ jobs:
 
       - name: Upload log files
         if: always() # do this even if a step before has failed
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # 3.1.0
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
         with:
           name: logs
           path: |

.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+---
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.3.0
+    hooks:
+      - id: requirements-txt-fixer
+      - id: sort-simple-yaml
+      - id: detect-private-key
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.28.0
+    hooks:
+      - id: yamllint
+        args: [-c=.yamllint]
+  - repo: https://github.com/ansible-community/ansible-lint.git
+    rev: v6.8.2
+    hooks:
+      - id: ansible-lint
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.8.0.4
+    hooks:
+      - id: shellcheck

requirements.txt

@@ -1,6 +1,6 @@
 ansible-compat==2.2.1
 ansible-core==2.13.5
-ansible-lint==6.8.2
+ansible-lint==6.8.4
 arrow==1.2.3
 attrs==22.1.0
 binaryornot==0.4.4
@@ -20,7 +20,7 @@ cryptography==38.0.1
 distro==1.8.0
 enrich==1.2.7
 filelock==3.8.0
-google-auth==2.12.0
+google-auth==2.13.0
 idna==3.4
 importlib-resources==5.10.0
 Jinja2==3.1.2
@@ -35,12 +35,13 @@ molecule==4.0.1
 molecule-vagrant==1.0.0
 mypy-extensions==0.4.3
 netaddr==0.8.0
-oauthlib==3.2.1
+oauthlib==3.2.2
 packaging==21.3
 pathspec==0.10.1
 pkgutil-resolve-name==1.3.10
 platformdirs==2.5.2
 pluggy==1.0.0
+pre-commit==2.20.0
 pyasn1==0.4.8
 pyasn1-modules==0.2.8
 pycparser==2.21
@@ -57,7 +58,7 @@ resolvelib==0.8.1
 rich==12.6.0
 rsa==4.9
 ruamel.yaml==0.17.21
-ruamel.yaml.clib==0.2.6
+ruamel.yaml.clib==0.2.7
 selinux==0.2.1
 six==1.16.0
 subprocess-tee==0.3.5
@@ -68,4 +69,4 @@ urllib3==1.26.12
 wcmatch==8.4.1
 websocket-client==1.4.1
 yamllint==1.28.0
-zipp==3.9.0
+zipp==3.10.0