feat: modernise cookbook structure and ChefSpec

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
 ---
-name: Dokken Integration Tests
+name: ci
 
 "on":
   pull_request:
@@ -15,138 +15,118 @@ jobs:
       pull-requests: write
       statuses: write
       issues: write
+    secrets: inherit
 
   integration:
     needs: lint-unit
     runs-on: ubuntu-latest
     strategy:
-      matrix:
-        os:
-          - "debian-11"
-          - "debian-12"
-          - "ubuntu-2004"
-          - "ubuntu-2204"
-          - "centos-stream-9"
-          - "centos-stream-10"
-          - "fedora-latest"
-        suite:
-          - config-2
-          # - config-3
-          - config-acl
-          - config-array
-          - config-backend-search
-          - config-custom-template
-          - config-fastcgi
-          - config-resolver
-          - config-ssl-redirect
-          - "package"
-          - "source-24"
-          - "source-26"
-          - "source-28"
-          - "source-lua"
-          - "source-default"
-          # - "source-openssl"
-          # OpenSSSL libraries are not currently compiling correctly
-          # see https://github.com/sous-chefs/haproxy/issues/503
       fail-fast: false
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@main
-      - name: Dokken
-        uses: actionshub/test-kitchen@main
-        env:
-          CHEF_LICENSE: accept-no-persist
-          KITCHEN_LOCAL_YAML: kitchen.dokken.yml
-        with:
-          suite: ${{ matrix.suite }}
-          os: ${{ matrix.os }}
-
-  integration-amazonlinux:
-    needs: lint-unit
-    runs-on: ubuntu-24.04
-    strategy:
+      max-parallel: 4
       matrix:
         os:
-          - "amazonlinux-2023"
+          - almalinux-8
+          - almalinux-9
+          - almalinux-10
+          - amazonlinux-2023
+          - centos-stream-9
+          - centos-stream-10
+          - debian-11
+          - debian-12
+          - debian-13
+          - fedora-latest
+          - opensuse-leap-15
+          - oraclelinux-8
+          - oraclelinux-9
+          - rockylinux-8
+          - rockylinux-9
+          - rockylinux-10
+          - ubuntu-2204
+          - ubuntu-2404
         suite:
-          - "package"
-          - "source-24"
-          - "source-26"
-          - "source-28"
-          - "source-default"
-      fail-fast: false
-
+          - default
+          - package
+          - source-32
+          - source-default
+          - source-lua
+          - source-openssl
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+        uses: actionshub/test-kitchen@main
         env:
           CHEF_LICENSE: accept-no-persist
+          CHEF_VERSION: latest
           KITCHEN_LOCAL_YAML: kitchen.dokken.yml
+          KITCHEN_PRODUCT_NAME: cinc
         with:
           suite: ${{ matrix.suite }}
           os: ${{ matrix.os }}
 
-  lua_test:
+  config-test:
     needs: lint-unit
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
+      max-parallel: 4
       matrix:
         os:
-          - "centos-stream-9"
+          - almalinux-8
+          - almalinux-9
+          - almalinux-10
+          - amazonlinux-2023
+          - centos-stream-9
+          - centos-stream-10
+          - debian-11
+          - debian-12
+          - debian-13
+          - fedora-latest
+          - opensuse-leap-15
+          - oraclelinux-8
+          - oraclelinux-9
+          - rockylinux-8
+          - rockylinux-9
+          - rockylinux-10
+          - ubuntu-2204
+          - ubuntu-2404
         suite:
-          - "source-lua"
-      fail-fast: false
-
+          - config-2
+          - config-3
+          - config-acl
+          - config-array
+          - config-backend-search
+          - config-custom-template
+          - config-fastcgi
+          - config-resolver
+          - config-ssl-redirect
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+        uses: actionshub/test-kitchen@main
         env:
           CHEF_LICENSE: accept-no-persist
+          CHEF_VERSION: latest
           KITCHEN_LOCAL_YAML: kitchen.dokken.yml
+          KITCHEN_PRODUCT_NAME: cinc
         with:
           suite: ${{ matrix.suite }}
           os: ${{ matrix.os }}
 
-  configtest:
-    needs: lint-unit
+  final:
+    if: always()
+    needs: [integration, config-test]
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        os:
-          - "centos-stream-9"
-        suite:
-          - "config-2"
-          # - "config-3"
-          - "config-backend-search"
-          - "config-acl"
-          - "config-resolver"
-          - "config-ssl-redirect"
-          - "config-custom-template"
-          - "config-array"
-          - "config-fastcgi"
-      fail-fast: false
-
     steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
-      - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+      - name: Check integration results
         env:
-          CHEF_LICENSE: accept-no-persist
-          KITCHEN_LOCAL_YAML: kitchen.dokken.yml
-        with:
-          suite: ${{ matrix.suite }}
-          os: ${{ matrix.os }}
+          CONFIG_RESULT: ${{ needs.config-test.result }}
+          INTEGRATION_RESULT: ${{ needs.integration.result }}
+        run: |
+          test "$CONFIG_RESULT" = success
+          test "$INTEGRATION_RESULT" = success

.github/workflows/conventional-commits.yml

@@ -9,6 +9,9 @@ name: conventional-commits
       - edited
       - synchronize
 
+permissions:
+  pull-requests: read
+
 jobs:
   conventional-commits:
     uses: sous-chefs/.github/.github/workflows/conventional-commits.yml@9.0.0

.github/workflows/copilot-setup-steps.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@main
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Install cookbooks
         run: chef install Policyfile.rb

.github/workflows/prevent-file-change.yml

@@ -12,5 +12,8 @@ name: prevent-file-change
 jobs:
   prevent-file-change:
     uses: sous-chefs/.github/.github/workflows/prevent-file-change.yml@9.0.0
+    permissions:
+      contents: read
+      pull-requests: write
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}

LIMITATIONS.md

@@ -0,0 +1,86 @@
+# Limitations
+
+This cookbook manages HAProxy from distribution packages or from an upstream
+source archive. It does not configure the HAProxy Technologies Enterprise
+repositories.
+
+## Upstream lifecycle
+
+HAProxy publishes both stable and long-term-support branches. The source
+installer defaults to the 3.2 LTS branch; exact patch releases are tracked in
+`resources/install.rb` and the integration test recipes.
+
+See the [HAProxy release table](https://www.haproxy.org/) for current branch
+support dates and patch releases.
+
+## Package availability
+
+The `package` installation path uses the package named `haproxy` from the
+configured operating-system repositories. The version and architecture
+therefore depend on the distribution release and enabled repositories.
+
+### APT (Debian and Ubuntu)
+
+* Debian and Ubuntu publish HAProxy in their normal archives.
+* The Debian HAProxy packaging team publishes newer supported branches through
+  [haproxy.debian.net](https://haproxy.debian.net/).
+* Vincent Bernat's Ubuntu PPAs publish branch-specific builds where available.
+  The cookbook does not add these APT repositories automatically.
+* Debian 12 and 13 and Ubuntu 22.04 and 24.04 provide HAProxy packages for
+  multiple architectures through their distribution archives.
+
+### DNF and YUM (RHEL family, Fedora, and Amazon Linux)
+
+* RHEL-family, Fedora, and Amazon Linux installations use the package available
+  from their configured distribution repositories.
+* `enable_epel_repo true` enables EPEL through the `yum-epel` cookbook before
+  package installation on RHEL-family and Amazon platforms.
+* The legacy IUS path only applies to RHEL 6 and 7. Those releases are
+  unsupported, so `enable_ius_repo` is retained only for compatibility and
+  should not be used for current deployments.
+* Package versions and architectures vary by distribution and repository; use
+  source installation when a specific HAProxy release is required.
+
+### Zypper (openSUSE Leap)
+
+* openSUSE Leap installations use the package from configured distribution
+  repositories.
+* The cookbook does not add an HAProxy-specific Zypper repository.
+
+## Architecture limitations
+
+* Source installation uses `node['kernel']['machine']` as HAProxy's `CPU` value
+  unless `source_target_cpu` is overridden.
+* Distribution package architecture coverage is controlled by each
+  distribution repository.
+* The cookbook's integration matrix primarily exercises x86_64 containers;
+  other architectures require separate validation.
+
+## Source installation
+
+HAProxy source archives are downloaded from
+`https://www.haproxy.org/download/<branch>/src/`.
+
+### Build dependencies
+
+| Platform family | Required packages |
+| --- | --- |
+| Debian | `build-essential`, OpenSSL, zlib, systemd, and PCRE development packages |
+| RHEL, Fedora, Amazon | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages |
+| SUSE | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages |
+
+Optional Lua and custom OpenSSL builds require the matching development headers
+and libraries. HAProxy build flags such as `USE_OPENSSL`, `USE_LUA`,
+`USE_SYSTEMD`, `USE_PCRE` or `USE_PCRE2`, and `USE_PROMEX` are exposed through
+resource properties.
+
+## Known constraints
+
+* PCRE1 packages are unavailable on newer platform releases. The cookbook
+  selects PCRE2 for Debian 13 and RHEL-family version 10 or newer.
+* The default source checksum is coupled to the default source version; custom
+  versions must supply their matching checksum.
+* Source installation compiles in Chef's file cache and installs under
+  `bin_prefix`. Removal must account for those installed artifacts.
+* The source installer supports systemd only; SysV and Upstart service
+  management are outside the supported migration scope.