ansible-role-audita/tests/integration

#!/usr/bin/env bash
set -euo pipefail

repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
workspace_venv="$repository_root/../.venv"
test_tmp=$(mktemp -d)
chmod 0700 "$test_tmp"

export ANSIBLE_COLLECTIONS_PATH="$test_tmp/collections"
export ANSIBLE_ROLES_PATH="$(dirname "$repository_root")"

inventory="$repository_root/tests/inventory"
converge="$repository_root/tests/converge.yml"
verify_config="$repository_root/tests/verify-config.yml"
ansible_playbook="$workspace_venv/bin/ansible-playbook"
binary_path=/usr/local/bin/audita
config_root="$test_tmp/config"
config_path="$config_root/config.yml"
profile_dir="$config_root/profiles"

cleanup() {
  exit_status=$?
  trap - EXIT
  rm -rf -- "$test_tmp"
  exit "$exit_status"
}
trap cleanup EXIT

require_clean_recap() {
  grep -Eq 'changed=0 .*failed=0' "$1"
}

run_converge() {
  output_file=$1
  shift
  "$ansible_playbook" -i "$inventory" "${baseline_args[@]}" "$@" "$converge" | tee "$output_file"
}

validate_config() {
  "$binary_path" config validate --config "$config_path"
}

verify_profiles() {
  expected_validation_id=$1
  expected_validation_model=$2
  expected_validation_timeout=$3
  "$binary_path" config print-effective --config "$config_path" --view profiles | \
    "$workspace_venv/bin/python" -c '
import sys
import yaml
profiles = yaml.safe_load(sys.stdin)
assert profiles["proposal"]["id"] == "fixture-proposal"
assert profiles["proposal"]["backend"] == "fixture"
assert profiles["proposal"]["model"] == "offline-fixture"
assert profiles["proposal"]["timeout_seconds"] == 30
assert profiles["validation"]["id"] == sys.argv[1]
assert profiles["validation"]["backend"] == "fixture"
assert profiles["validation"]["model"] == sys.argv[2]
assert profiles["validation"]["timeout_seconds"] == int(sys.argv[3])
' "$expected_validation_id" "$expected_validation_model" "$expected_validation_timeout"
}

mkdir -p "$profile_dir"
printf '%s\n' \
  'id: fixture-proposal' \
  'backend: fixture' \
  'model: offline-fixture' \
  'timeout_seconds: 30' > "$profile_dir/fixture-proposal.yaml"
printf '%s\n' \
  'id: fixture-validation' \
  'backend: fixture' \
  'model: offline-validation' \
  'timeout_seconds: 45' > "$profile_dir/fixture-validation.yaml"

baseline_args=(
  -e "audita_config_path=$config_path"
  -e "audita_config_owner=$(id -un)"
  -e "audita_config_group=$(id -gn)"
  -e '{"audita_backends": {"fixture": {"endpoint": "http://127.0.0.1:11434/v1", "credential": null}}, "audita_llm_proposal_profile": "fixture-proposal"}'
)

cd "$repository_root"
"$workspace_venv/bin/ansible-galaxy" collection install \
  -r collections/requirements.yml \
  -p "$ANSIBLE_COLLECTIONS_PATH"
"$ansible_playbook" -i "$inventory" "${baseline_args[@]}" --syntax-check "$converge"
"$workspace_venv/bin/ansible-lint" "$converge" "$verify_config"

baseline_log="$test_tmp/baseline.log"
run_converge "$baseline_log"
validate_config
verify_profiles fixture-proposal offline-fixture 30
"$ansible_playbook" -i "$inventory" \
  -e "audita_test_config_path=$config_path" \
  -e 'audita_test_case=baseline' "$verify_config"
baseline_repeat_log="$test_tmp/baseline-repeat.log"
run_converge "$baseline_repeat_log"
require_clean_recap "$baseline_repeat_log"

representative_config='{
  "audita_backend_base": {"fixture": {"endpoint": "http://127.0.0.1:11434/v1", "credential": null}},
  "audita_backend_capacity": {"fixture": {"concurrency": 2, "queue_capacity": 0}},
  "audita_backends": "{{ audita_backend_base | combine(audita_backend_capacity, recursive=true) }}",
  "audita_profiles_dir": "profiles",
  "audita_llm_validation_profile": "fixture-validation",
  "audita_llm_transient_retries": 0,
  "audita_llm_repair_attempts": 0,
  "audita_llm_operation_timeout": "45s",
  "audita_validation_max_prompt_tokens": 128,
  "audita_pipeline_modules": [],
  "audita_normalization_max_segment_gap": 1.25,
  "audita_normalization_ellipsis_gap": 2.5,
  "audita_normalization_max_segment_duration": 30.75,
  "audita_context_description": "",
  "audita_reporting_enabled": false,
  "audita_reporting_stdout_dir": "",
  "audita_diagnostics_debug": false
}'
representative_log="$test_tmp/representative-config.log"
run_converge "$representative_log" -e "$representative_config"
validate_config
verify_profiles fixture-validation offline-validation 45
"$binary_path" config print-effective --config "$config_path" --view settings | \
  "$workspace_venv/bin/python" -c '
import sys
import yaml
settings = yaml.safe_load(sys.stdin)
assert settings["backends"]["fixture"]["concurrency"] == 2
assert settings["backends"]["fixture"]["queue_capacity"] == 0
assert settings["llm"]["validation_profile"] == "fixture-validation"
assert settings["llm"]["transient_retries"] == 0
assert settings["llm"]["repair_attempts"] == 0
assert settings["llm"]["operation_timeout"] == "45s"
assert settings["normalization"]["max_segment_gap"] == 1.25
assert settings["reporting"]["enabled"] is False
assert settings["diagnostics"]["debug"] is False
'
"$ansible_playbook" -i "$inventory" \
  -e "audita_test_config_path=$config_path" \
  -e 'audita_test_case=representative' "$verify_config"
representative_repeat_log="$test_tmp/representative-config-repeat.log"
run_converge "$representative_repeat_log" -e "$representative_config"
require_clean_recap "$representative_repeat_log"

custom_go_binary="$test_tmp/go"
custom_go_invocations="$test_tmp/go-invocations.log"
printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  "printf '%s\\n' \"\$*\" >> '$custom_go_invocations'" \
  'exec /snap/bin/go "$@"' > "$custom_go_binary"
chmod 0755 "$custom_go_binary"
sudo rm -f -- "$binary_path"
recovery_log="$test_tmp/recovery.log"
run_converge "$recovery_log" \
  -e '{"audita_manage_build_dependencies": false}' \
  -e "audita_go_binary=$custom_go_binary"
grep -q . "$custom_go_invocations"
validate_config
recovery_repeat_log="$test_tmp/recovery-repeat.log"
run_converge "$recovery_repeat_log" \
  -e '{"audita_manage_build_dependencies": false}' \
  -e "audita_go_binary=$custom_go_binary"
require_clean_recap "$recovery_repeat_log"