120 lines
4.6 KiB
Markdown
120 lines
4.6 KiB
Markdown
# Feature 0006 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
Reviewed implementation commits:
|
|
|
|
- `b515968 Compose the D&D pipeline roles`
|
|
- `61869d1 Add focused pipeline composition coverage`
|
|
|
|
Remediation commit:
|
|
|
|
- `4ea4358 Clean up pipeline composition review findings`
|
|
|
|
The production architecture matches Feature 0006: the role contains only its
|
|
public defaults and argument specification, five pinned role dependencies,
|
|
the approved variable forwarding, and fixed Narratio path wiring. Its task
|
|
file is empty, and it does not duplicate downstream tasks, templates, state
|
|
inspection, or validation. The complete integration entry point passes.
|
|
|
|
The review identified two repository-quality findings.
|
|
|
|
## Finding 1: Remove the Misleading Placeholder README Sentence
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/README.md` still ends with the original placeholder
|
|
sentence claiming that the role installs the full production pipeline “plus
|
|
supporting assets.” Feature 0006 expressly defers campaign and prompt assets,
|
|
operator policy, secrets, and the opinionated D&D configuration layer. The
|
|
sentence is both redundant with the rewritten introduction and inaccurate for
|
|
the implemented foundation.
|
|
|
|
The supported-platform summary also names Ubuntu 26.04 without recording the
|
|
roadmap's `amd64` and `arm64` boundary.
|
|
|
|
### Required Remediation
|
|
|
|
- Remove the retained placeholder sentence.
|
|
- State the supported `amd64` and `arm64` architectures in the rewritten
|
|
platform summary.
|
|
- Make no broader README expansion; the existing dependency, interface,
|
|
deferral, and validation documentation is otherwise aligned.
|
|
|
|
### Resolution
|
|
|
|
The retained sentence was removed, and the introduction now records the
|
|
supported `amd64` and `arm64` architectures without expanding the role's
|
|
claimed scope.
|
|
|
|
## Finding 2: Give the Isolated Dependency Path Resolution Priority
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/tests/integration` installs the five pinned Git
|
|
roles into `$test_tmp/roles`, but sets `ANSIBLE_ROLES_PATH` with the workspace
|
|
parent before that isolated directory:
|
|
|
|
```sh
|
|
export ANSIBLE_ROLES_PATH="$(dirname "$repository_root"):$test_tmp/roles"
|
|
```
|
|
|
|
No conflicting canonical role directories currently exist in the workspace,
|
|
so the reviewed run used the installed dependencies and passed. Nevertheless,
|
|
the ordering does not preserve the test's stated invariant if a
|
|
`rakestraw.<application>` directory is later present in the parent path:
|
|
Ansible would resolve that checkout before the exact version installed from
|
|
`requirements.yml`. Feature 0006 requires the integration suite to exercise
|
|
the same pinned dependency combination delivered to consumers.
|
|
|
|
### Required Remediation
|
|
|
|
Put the fresh dependency path first while retaining the workspace parent only
|
|
as the fallback that resolves the pipeline role under test:
|
|
|
|
```sh
|
|
export ANSIBLE_ROLES_PATH="$test_tmp/roles:$(dirname "$repository_root")"
|
|
```
|
|
|
|
Do not add dependency-content comparisons, source-revision assertions, or
|
|
other verification machinery. Ordinary Ansible role lookup with the correct
|
|
path precedence is sufficient.
|
|
|
|
### Resolution
|
|
|
|
The integration driver now places its private dependency directory first and
|
|
uses the workspace parent only as the fallback for the pipeline role under
|
|
test. No additional dependency verification was added.
|
|
|
|
## Final Validation
|
|
|
|
From `ansible-role-dnd-pipeline`, run:
|
|
|
|
```text
|
|
tests/integration
|
|
git diff --check
|
|
git status --short --branch
|
|
```
|
|
|
|
Expected result: dependency bootstrap, syntax checking, production lint,
|
|
baseline native checks, Narratio configuration validation, both immediate
|
|
clean repeats, the explicit Seriatim `v1.4.0` outcome, and baseline cleanup all
|
|
pass. The role repository contains only the intended remediation changes.
|
|
|
|
## Review Validation Evidence
|
|
|
|
During review, `tests/integration` completed successfully. It installed
|
|
`community.general` 13.3.0 and all five exact Git role revisions into private
|
|
temporary paths, passed syntax checking and production-profile ansible-lint,
|
|
validated the assembled applications through their native interfaces, and
|
|
reported `changed=0` and `failed=0` on both required immediate repeats. The
|
|
cleanup trap restored the baseline Seriatim `v1.5.0` deployment. `git diff
|
|
--check` also passed before this review record was written.
|
|
|
|
After remediation, `bash -n tests/integration`, `git diff --check`, and the
|
|
complete `tests/integration` entry point passed again. The rerun installed the
|
|
exact pinned dependencies into fresh private paths, passed syntax and
|
|
production-profile lint, completed all native checks, reported `changed=0` and
|
|
`failed=0` on both required repeats, and restored the baseline suite. No
|
|
Feature 0006 findings remain.
|