feat(baseline): key-only admin — passwordless sudo + locked password #43

	---
	name: Molecule

	# Containerised converge + idempotence + verify for the decdn_node role.
	# Heavy (privileged systemd Docker container) — scoped to ansible/ changes and
	# blocking. Mark it a required status check in branch protection once proven.
	on:
	pull_request:
	paths: ['ansible/**']
	push:
	branches: [main]
	paths: ['ansible/**']

	permissions:
	contents: read

	concurrency:
	group: molecule-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	molecule:
	runs-on: ubuntu-latest # Docker is preinstalled
	defaults:
	run:
	working-directory: ansible
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: '3.12'
	- name: Install molecule + Ansible
	run: \|
	python -m pip install --upgrade \
	molecule "molecule-plugins[docker]" ansible ansible-lint docker
	- name: Install Galaxy collections
	run: make deps
	- name: molecule test
	# --all runs both scenarios: default (operator-provisioned keystore) and
	# generate-keystore (opt-in host-side wallet generation).
	run: molecule test --all

Navigation Menu