Add focused Audita integration coverage

README.md

@@ -48,8 +48,13 @@ than executing the CLI during production convergence.
 
 The integration driver installs pinned collection dependencies, runs syntax
 checking and ansible-lint, verifies the default release, file ownership and
-modes, executable behavior, and native configuration validation, then proves
-an immediate repeat is unchanged. It manages the default local installation:
+modes, executable behavior, and native configuration validation. It covers
+missing-binary and checkout rebuilds, caller-supplied Go with dependency
+management disabled, metadata repair without rebuilding, configuration-only
+convergence, and platform failures before isolated application state exists.
+The suite mutates only `/usr/local/src/audita`, `/usr/local/bin/audita`,
+`/usr/local/etc/audita/config.yml`, and paths inside its private temporary
+directory, then leaves the default release and configuration installed:
 
 ```sh
 tests/integration

tests/integration

@@ -12,10 +12,16 @@ export ANSIBLE_ROLES_PATH="$(dirname "$repository_root")"
 inventory="$repository_root/tests/inventory"
 converge="$repository_root/tests/converge.yml"
 verify="$repository_root/tests/verify.yml"
+unsupported="$repository_root/tests/unsupported.yml"
 ansible_playbook="$workspace_venv/bin/ansible-playbook"
 default_commit=a84941d68168a1ed9ea7423b6477ae8218be73f9
+alternate_commit=46b7356a3b54a2771ce9a617e4fa3e8d13728cac
+source_dir=/usr/local/src/audita
+binary_path=/usr/local/bin/audita
+config_path=/usr/local/etc/audita/config.yml
 
 cleanup() {
+  "$ansible_playbook" -i "$inventory" "$converge" >/dev/null 2>&1 || true
   rm -rf -- "$test_tmp"
 }
 trap cleanup EXIT
@@ -24,18 +30,147 @@ require_clean_recap() {
   grep -Eq 'changed=0 .*failed=0' "$1"
 }
 
+require_changed_recap() {
+  grep -Eq 'changed=[1-9][0-9]* .*failed=0' "$1"
+}
+
+run_converge() {
+  output_file=$1
+  shift
+  "$ansible_playbook" -i "$inventory" "$@" "$converge" | tee "$output_file"
+}
+
+verify_release() {
+  expected_commit=$1
+  "$ansible_playbook" -i "$inventory" \
+    -e "audita_expected_commit=$expected_commit" \
+    "$verify"
+}
+
+validate_config() {
+  [[ "$("$binary_path" config validate --config "$config_path")" == 'config is valid' ]]
+}
+
 cd "$repository_root"
 "$workspace_venv/bin/ansible-galaxy" collection install \
   -r collections/requirements.yml \
   -p "$ANSIBLE_COLLECTIONS_PATH"
 "$ansible_playbook" -i "$inventory" --syntax-check "$converge"
-"$workspace_venv/bin/ansible-lint" "$converge" "$verify"
+"$workspace_venv/bin/ansible-lint" "$converge" "$verify" "$unsupported"
 
 baseline_log="$test_tmp/baseline.log"
-"$ansible_playbook" -i "$inventory" "$converge" | tee "$baseline_log"
-"$ansible_playbook" -i "$inventory" \
-  -e "audita_expected_commit=$default_commit" \
-  "$verify"
+run_converge "$baseline_log"
+verify_release "$default_commit"
 baseline_repeat_log="$test_tmp/baseline-repeat.log"
-"$ansible_playbook" -i "$inventory" "$converge" | tee "$baseline_repeat_log"
+run_converge "$baseline_repeat_log"
 require_clean_recap "$baseline_repeat_log"
+
+sudo rm -f -- "$binary_path"
+missing_binary_log="$test_tmp/missing-binary.log"
+run_converge "$missing_binary_log"
+require_changed_recap "$missing_binary_log"
+grep -A1 -E 'TASK .*Build Audita' "$missing_binary_log" | grep -q '^changed:'
+missing_binary_repeat_log="$test_tmp/missing-binary-repeat.log"
+run_converge "$missing_binary_repeat_log"
+require_clean_recap "$missing_binary_repeat_log"
+
+custom_go_binary="$test_tmp/go"
+custom_go_invocation_log="$test_tmp/custom-go-invocation.log"
+printf '%s\n' \
+  '#!/usr/bin/env bash' \
+  "printf 'invoked\\n' >> '$custom_go_invocation_log'" \
+  'exec /snap/bin/go "$@"' > "$custom_go_binary"
+chmod 0755 "$custom_go_binary"
+sudo rm -f -- "$binary_path"
+custom_go_log="$test_tmp/custom-go.log"
+run_converge "$custom_go_log" \
+  -e '{"audita_manage_build_dependencies": false}' \
+  -e "audita_go_binary=$custom_go_binary"
+require_changed_recap "$custom_go_log"
+grep -A1 -E 'TASK .*Build Audita' "$custom_go_log" | grep -q '^changed:'
+[[ -s "$custom_go_invocation_log" ]]
+custom_go_repeat_log="$test_tmp/custom-go-repeat.log"
+run_converge "$custom_go_repeat_log" \
+  -e '{"audita_manage_build_dependencies": false}' \
+  -e "audita_go_binary=$custom_go_binary"
+require_clean_recap "$custom_go_repeat_log"
+
+sudo chmod 0700 "$binary_path"
+metadata_log="$test_tmp/metadata.log"
+run_converge "$metadata_log"
+require_changed_recap "$metadata_log"
+grep -A1 -E 'TASK .*Build Audita' "$metadata_log" | grep -q '^skipping:'
+grep -A3 -E 'TASK .*Converge installed metadata' "$metadata_log" | \
+  grep -q "^changed:.*'path': '$binary_path'"
+metadata_repeat_log="$test_tmp/metadata-repeat.log"
+run_converge "$metadata_repeat_log"
+require_clean_recap "$metadata_repeat_log"
+
+custom_config='{"audita_config": {"version": 1, "context": {"description": "Focused integration coverage"}}}'
+config_log="$test_tmp/config.log"
+run_converge "$config_log" -e "$custom_config"
+require_changed_recap "$config_log"
+grep -A1 -E 'TASK .*Build Audita' "$config_log" | grep -q '^skipping:'
+grep -A1 -E 'TASK .*Write Audita configuration' "$config_log" | grep -q '^changed:'
+validate_config
+config_repeat_log="$test_tmp/config-repeat.log"
+run_converge "$config_repeat_log" -e "$custom_config"
+require_clean_recap "$config_repeat_log"
+
+default_config_log="$test_tmp/default-config.log"
+run_converge "$default_config_log"
+require_changed_recap "$default_config_log"
+grep -A1 -E 'TASK .*Build Audita' "$default_config_log" | grep -q '^skipping:'
+default_config_repeat_log="$test_tmp/default-config-repeat.log"
+run_converge "$default_config_repeat_log"
+require_clean_recap "$default_config_repeat_log"
+
+alternate_release_log="$test_tmp/alternate-release.log"
+run_converge "$alternate_release_log" -e "audita_version=$alternate_commit"
+require_changed_recap "$alternate_release_log"
+grep -A1 -E 'TASK .*Build Audita' "$alternate_release_log" | grep -q '^changed:'
+verify_release "$alternate_commit"
+alternate_repeat_log="$test_tmp/alternate-repeat.log"
+run_converge "$alternate_repeat_log" -e "audita_version=$alternate_commit"
+require_clean_recap "$alternate_repeat_log"
+
+restored_release_log="$test_tmp/restored-release.log"
+run_converge "$restored_release_log"
+require_changed_recap "$restored_release_log"
+grep -A1 -E 'TASK .*Build Audita' "$restored_release_log" | grep -q '^changed:'
+verify_release "$default_commit"
+restored_repeat_log="$test_tmp/restored-repeat.log"
+run_converge "$restored_repeat_log"
+require_clean_recap "$restored_repeat_log"
+
+platform_cases=(
+  'Debian 26.04 x86_64 distribution'
+  'Ubuntu 24.04 x86_64 release'
+  'Ubuntu 26.04 riscv64 architecture'
+)
+for platform_case in "${platform_cases[@]}"; do
+  read -r distribution release architecture label <<<"$platform_case"
+  case_root="$test_tmp/unsupported-$label"
+  case_source="$case_root/source"
+  case_binary="$case_root/bin/audita"
+  case_config="$case_root/etc/config.yml"
+  case_log="$test_tmp/unsupported-$label.log"
+  if "$ansible_playbook" -i "$inventory" \
+    -e "test_distribution=$distribution" \
+    -e "test_distribution_version=$release" \
+    -e "test_architecture=$architecture" \
+    -e "audita_source_dir=$case_source" \
+    -e "audita_binary_path=$case_binary" \
+    -e "audita_config_path=$case_config" \
+    "$unsupported" | tee "$case_log"; then
+    echo "Unsupported $label case unexpectedly succeeded" >&2
+    exit 1
+  fi
+  grep -Eq 'failed=1' "$case_log"
+  [[ ! -e "$case_root" ]]
+done
+
+[[ "$(sudo git -C "$source_dir" rev-parse HEAD)" == "$default_commit" ]]
+[[ "$(sudo stat -c '%U:%G %a' "$binary_path")" == 'root:root 755' ]]
+[[ "$(sudo stat -c '%U:%G %a' "$config_path")" == 'root:root 644' ]]
+validate_config

tests/unsupported.yml

@@ -0,0 +1,11 @@
+---
+- name: Exercise Audita platform mutation guard
+  hosts: localhost
+  gather_facts: false
+  vars:
+    ansible_facts:
+      distribution: "{{ test_distribution }}"
+      distribution_version: "{{ test_distribution_version }}"
+      architecture: "{{ test_architecture }}"
+  roles:
+    - role: ansible-role-audita