test.yml

name: Lint & Test

on:
  push:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results

    steps:
      - uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          cache: pip

      - name: Create virtual environment and install dependencies
        run: |
          python -m venv .venv
          source ./.venv/bin/activate
          pip install -r requirements.txt
          echo "PATH=$(pwd)/.venv/bin:${PATH}" >> "${GITHUB_ENV}"
          echo "VIRTUAL_ENV=$(pwd)/.venv" >> "${GITHUB_ENV}"

      - name: Run Ansible-Lint
        continue-on-error: true # Allow uploading SARIF report if ansible-lint is not happy
        run: ansible-lint --offline --sarif-file ansible-lint.sarif.json # TODO: Reuse just lint

      - name: Upload Ansible-Lint SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ansible-lint.sarif.json
          category: ansible-lint