Various improvements to role - #62
Open
Zugschlus wants to merge 30 commits into
Open
Conversation
Add pyproject.toml with ansible-lint as a dev dependency, pin Python 3.14, and generate uv.lock. Update Makefile lint target to use uv run and exclude .venv from gitignore and ansible-lint. Add CLAUDE.md for Claude Code guidance. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove Makefile and add pre-commit with yamllint, ansible-lint, and flake8 hooks using uv run. Add .yamllint with ansible-lint recommended settings and .flake8 config. Update .ansible-lint to skip yaml rules (now handled by yamllint). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Set up GitHub Actions for linting (yamllint, ansible-lint, flake8) and Molecule integration testing with Docker (Ubuntu 22.04/24.04). Add Galaxy release workflow. Migrate Galaxy metadata to brianhartsock.users namespace and remove stale meta/readme.yml. Add Molecule default scenario with meaningful converge variables and TestInfra assertions. Update README and CLAUDE.md to reflect the fork from weareinteractive.users. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use FQCNs throughout all task files (ansible.builtin.*, ansible.posix.*)
- Fix implicit octal values to quoted strings ("0700", "0600", "0644")
- Fix truthy values (yes/no → true/false) in defaults and tests
- Fix Jinja2 filter spacing and name[template] violations
- Add explicit file permissions to home files copy task
- Fix CI workflow paths to use brianhartsock.users (Galaxy role name)
- Update tests/main.yml role reference and add play name
- Clean up meta/main.yml platforms (drop EOL EL 7, remove commented blocks)
- Remove .travis.yml (replaced by GitHub Actions)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Newer Ansible rejects non-boolean conditional results. The `when: users_group` check returned the string value instead of a boolean. Use `length > 0` to produce a proper boolean result. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bare Ubuntu Docker images lack ssh-keygen, which is required by the ansible.builtin.user module when generate_ssh_key is enabled. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rebrand fork and modernize tooling
Adds a Claude Code skill that guides the workflow of syncing with the upstream weareinteractive/ansible-users repository: adding the remote, fetching, comparing differences, prompting before merge, and handling conflicts interactively. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Prevent accidental PRs/issues on the upstream parent repo by adding gh write commands to the ask permission list and documenting the --repo flag requirement in CLAUDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…tream-skill Add gh CLI safeguards and sync-upstream skill
Fix groups parameter to use join(',') instead of returning a list, and
tighten the primary group when-condition to validate users_group.name.
Update molecule converge to use the new dict format and add tests for
GID assignment and role-level group inheritance.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Verify that when users_group is unset, a user's primary group defaults to their username. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adding gid to user_group and user_groups.
…cript Configure Dependabot to group pip and github-actions dependency updates into single PRs per ecosystem per week. Add a workflow to auto-approve and squash-merge patch/minor Dependabot PRs after CI passes, using pull_request_target for write access and a pinned SHA for dependabot/fetch-metadata. Include a script to configure branch protection with required status checks (Lint, Molecule) so --auto merge waits for CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ot-auto-merge Add Dependabot grouping and auto-merge
* use | bool best practice in when clause * add label to manage.yml user loop to keep noise level down This gets rid of the multiline output for the user loop. If access to the full user dict is desired, a debug task should be added * fix copyright statement in README.md this was the original statement from weareinteractive, significant work was done her that is separately copyrightable. Document this. * ignore __pycache__ * add requirements.txt to .gitignore --------- Co-authored-by: Marc Haber <mh+incluesion-ansible-users@zugschlus.de>
Follow-up to weareinteractive#5, which added | bool to the home_create when clause but left the user_create when clause unchanged. Without | bool, a string "false" supplied for users_user_create or per-user user_create would evaluate truthy in Jinja. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Claude Code creates ephemeral git worktrees under .claude/worktrees/ when isolated subagents run. These should never be committed. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* add check whether user exists This allows later tasks to determine whether the user was just created by ansible.builtin.user or just modified. This allows us to overwrite the password only for a brand new user. * implement "update_user" This implements an "update_user" parameter which works like "update_password": If set to "on_create", the user is only touched if it already exists. If set to "always", the existing user's data is always forced to match what is set for the user. This is an important distinction, for example between service accounts (which should always match what is in the playbook and local changes should be overwritten) and user accoutns (which might allow to user to, for example, set their own shell of desire without ansible stomping over the user's decision). * add defaults for users-debug and mention in README * add empty playbooks that molecule test wants to see * set galaxy dependency to disabled to make molecule test more happy --------- Co-authored-by: Marc Haber <mh+incluesion-ansible-users@zugschlus.de> Co-authored-by: Marc Haber <mh+ansible-roles@zugschlus.de>
- Drop stale post-add passwd_getent debug (never re-registered) - Sync README default to match defaults/main.yml (always) - Fix "just when just created" typo in defaults/main.yml Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This adds functionality to create a new user account with a random password generated at user creation time. It will put the generated password into /home/<newuser>/password which is only readable for the newly created user. A possible use case is creating a new user who is able to log in via ssh but needs a password set, for example, for console logins and sudo. Creating the user without password does not help here since a normal user does not have a possibility to set themselves a password if no password is set and the user knows the password. The command used to generate the password is configurable. Also, the random password can have an arbitrary change date set so that the user is forced to change the password before first actual use. That functionality depends on configuration of the local system.
This allows one to disable creating users that have incomplete info
- reset user_random_password_hash at start of each iteration to prevent fact leaking from one user into the next via include_tasks scope - switch is defined checks to length > 0 consistently - use users_update_user as default instead of hardcoded "on_create" so the role-level variable is actually honoured - fix home config condition fallback from users_user_create to users_home_create (wrong variable was introduced in this branch) - fix password file dest to respect user.home / users_home instead of hardcoding /home/<user> - add changed_when: false to chage task
- foobar_random_password: exercises random password generation path - foobar_update_always: exercises update_user: always mode - foobar_shell: exercises custom login shell - foobar_custom_home: exercises non-default home path - assertion block verifies: password file exists with correct mode/owner, foobar_shell has /bin/sh, custom home is at /tmp/foobar_custom_home, foobar_nohome home directory was not created
Zugschlus
force-pushed
the
zg/various_improvements
branch
from
August 4, 2026 16:33
a9af8d5 to
86a064f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi,
this is my first attempt to improve a published ansible role. I apologize for mixing up so many different things in one PR. I tried to separate the things in different commits so you can cherry-pick at will. I would love to add unit tests, but the docs don't seem to match reality, the Makefile doesn't actually have a test target.
My changes (see detailed commit comments for more in-depth explanations and use cases):
Thanks for your consideration