Merge branch 'master' into reverse.aix.path2

Author: Haroon-Khel

.ansible-lint

@@ -1,18 +1,31 @@
+---
+# .ansible-lint
+
 skip_list:
   - '106'  # Role name {} does not match ``^[a-z][a-z0-9_]+$`` pattern
   - '204'  # Lines should be no longer than 160 chars
   - '207'  # Nested jinja pattern
   - '208'  # File permissions unset or incorrect
   - '301'  # Commands should not change things if nothing needs doing
-  - '303'  # Using command rather than module 
+  - '303'  # Using command rather than module
   - '305'  # Use shell only when shell functionality is required
-  - '306'  # Shells that use pipes should set the pipefail option  
+  - '306'  # Shells that use pipes should set the pipefail option
   - '401'  # Git checkouts must contain explicit version
   - '403'  # Package installs should not use latest
   - '501'  # Become_user requires become to work as expected
+  - '503'  # Tasks that run when changed should likely be handlers.
   - '601'  # Don't compare to literal True/False
   - '602'  # Don't compare to empty string
-  - 'var-naming' # var-naming File defines variable that violates variable naming standards
+  - 'var-naming'     # var-naming File defines variable that violates variable naming standards
+  - 'fqcn-builtins'  # Disable error introduced in ansible-lint 6.X (https://github.com/ansible/ansible-lint/pull/1908)
+  - 'name[template]' # Jinja templates should only be at the end of ‘name’.
+  - 'template-instead-of-copy' # Replaced upstream in https://github.com/ansible/ansible-lint/pull/2512
+  - 'no-free-form' # Exclude As Requires Significant Changes ( 196 changes required )
+  - 'fqcn[action]' # Exclude As Requires Significant Changes ( 249 changes required )
+  - 'args[module]' # Exclude Experimental Rule Validation ( Prevents 4 experimental warnings )
+
+kinds:
+  - vars: "ansible/playbooks/adoptopenjdk_variables.yml"
 
 exclude_paths:
-  - ./ansible/playbooks/adoptopenjdk_variables.yml # See: https://github.com/AdoptOpenJDK/openjdk-infrastructure/issues/1926
+  - ansible/playbooks/adoptopenjdk_variables.yml # See: https://github.com/AdoptOpenJDK/openjdk-infrastructure/issues/1926

.github/ISSUE_TEMPLATE/ansible.md

@@ -8,8 +8,10 @@ assignees: ''
 ---
 Please put the name of the software product (and affected platforms if relevant) in the title of this issue
 
-- [ ] Missing install
-- [ ] Bug in ansible playbook
-- [ ] Request for new playbook addition
+Delete as appropriate from this list:
+
+- Missing install
+- Bug in ansible playbook
+- Request for new playbook addition
 
 Details:

.github/ISSUE_TEMPLATE/machineaccess.md

@@ -6,7 +6,12 @@ labels: 'Temp Infra Access'
 assignees: 'sxa'
 
 ---
-Access level:
+**NOTE: THIS ISSUE SHOULD NOT BE CLOSED BY THE ORIGINATOR IF ACCESS IS GRANTED**.
+When the access is no longer needed please add a comment and a member
+of the infrastructure team will revoke it and close the issue.
+
+Required access level (Delete as appropriate). Note that you should only
+request the minimum level that is required to solve your problem
 
 - [ ] Non-privileged
 - [ ] jenkins user

.github/ISSUE_TEMPLATE/teamaccess.md

@@ -6,11 +6,11 @@ labels: ''
 assignees: 'sxa'
 
 ---
-Team requested:
+Team requested - delete those which are not applicable :
 
-- [ ] infrastructure-triage
-- [ ] infrastructure
-- [ ] infrastructure-core
-- [ ] infrastructure-secret
+- infrastructure-triage
+- infrastructure
+- infrastructure-core
+- infrastructure-secret
 
 Please explain why you need this access:

.github/ISSUE_TEMPLATE/testcasefail.md

@@ -10,10 +10,11 @@ Please set the title to indicate the test name and machine name where known.
 To make it easy for the infrastructure team to repeat and diagnose, please
 answer the following questions:
 
-- test suite/name?
+- test suite/name (e.g, BUILD_LIST, TARGET, CUSTOM_TARGET)?
+- a link into recent `Test_` job on https://ci.adoptium.net which showed the failure
+- **Hyperlink** to re-run in Grinder: 
 - Is there an existing issue elsewhere covering this?
 - Which machine(s) does it work on?
 - Which machine(s) does it fail on?
-- Do you have a link to a Grinder re-run if the test with the failure?
 
 Any other details:

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,10 +4,11 @@ the requirements below.
 -->
 
 ##### Checklist
-<!-- For completed items, change [ ] to [x]. Leave unchecked if not required -->
+<!-- For completed items, change [ ] to [x]. Delete any lines that are not applicable for this PR -->
 
 - [ ] commit message has one of the [standard prefixes](https://github.com/adoptium/infrastructure/blob/master/CONTRIBUTING.md#commit-messages)
 - [ ] [faq.md](https://github.com/adoptium/infrastructure/blob/master/FAQ.md) updated if appropriate
 - [ ] other documentation is changed or added (if applicable)
-- [ ] playbook changes run through [VPC](https://ci.adoptopenjdk.net/view/Tooling/job/VagrantPlaybookCheck/) or [QPC](https://ci.adoptopenjdk.net/view/Tooling/job/QEMUPlaybookCheck/) (if you have access)
+- [ ] playbook changes run through [VPC](https://ci.adoptium.net/view/Tooling/job/VagrantPlaybookCheck/) or [QPC](https://ci.adoptium.net/view/Tooling/job/QEMUPlaybookCheck/) (if you have access)
+- [ ] VPC/QPC not applicable for this PR
 - [ ] for inventory.yml changes, bastillion/nagios/jenkins updated accordingly

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10

.github/labeler.yml

@@ -9,20 +9,22 @@
 
 # label_name:
 #   - path/to/file_or_folder
+
 ghActions:
-    - .github/workflows/**/*
+- changed-files:
+  - any-glob-to-any-file: [.github/*]
 doc:
-    - docs/*
-    - '**/*.md'
+- changed-files:
+    - any-glob-to-any-file: [docs/*, '**/*.md']
 Vagrant:
-    - ansible/pbTestScripts/**/*
-    - ansible/vagrant/Vagrantfile*
+- changed-files:
+    - any-glob-to-any-file: [ansible/pbTestScripts/**/*, ansible/vagrant/Vagrantfile*]
 pbTests:
-    - ansible/pbTestScripts/**/*
+- changed-files:
+    - any-glob-to-any-file: [ansible/pbTestScripts/**/*]
 docker:
-    - ansible/docker/Dockerfile*
+- changed-files:
+    - any-glob-to-any-file: [ansible/docker/Dockerfile*]
 ansible:
-    - ansible/playbooks/**/*
-    - ansible/plugins/**/*
-    - ansible/inventory.yml
-    - ansible/ansible.cfg
+- changed-files:
+    - any-glob-to-any-file: [ansible/playbooks/**/*, ansible/plugins/**/*, ansible/inventory.yml, ansible/ansible.cfg]

.github/regex_labeler.yml

@@ -76,9 +76,9 @@ labels:
   - label: "provider:osuosl"
     matcher:
       title: "osuosl"
-  - label: "provider:scaleway"
+  - label: "provider:skytap"
     matcher:
-      title: "scaleway"
+      title: "skytap"
   - label: "provider:nine"
     matcher:
       title: "nine"

.github/workflows/build.yml

@@ -5,46 +5,77 @@ on:
     paths:
     - .github/workflows/build.yml
     - ansible/playbooks/AdoptOpenJDK_Unix_Playbook/**
-    branches:         
+    - ansible/docker/**
+    branches:
     - master
   push:
     paths:
     - .github/workflows/build.yml
     - ansible/playbooks/AdoptOpenJDK_Unix_Playbook/**
-    branches:         
+    - ansible/docker/**
+    branches:
     - master
 
+permissions:
+  contents: read
+
 jobs:
   build-and-push-centos6:
     name: Centos6
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+    - name: Set up Docker Buildx to use cache feature
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
 
-    - name: Docker Build & Push Centos6 Image to Docker Hub
-      uses: docker/build-push-action@v1
+    - name: Login to Docker Hub
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-        dockerfile: ./ansible/docker/Dockerfile.CentOS6
-        repository: adoptopenjdk/centos6_build_image
-        tags: latest
-        push: ${{ github.ref == 'refs/heads/master' }}
+        password: ${{ secrets.DOCKER_TOKEN }}
+      if: github.ref == 'refs/heads/master'
+
+
+    - name: Docker Build CentOS6 Image Test
+      uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+      with:
+        file: ./ansible/docker/Dockerfile.CentOS6
+        build-args: git_sha=${{ github.sha }}
+        tags: adoptopenjdk/centos6_build_image:latest
+        cache-from: type=registry,ref=adoptopenjdk/centos6_build_image:latest
+        cache-to: type=inline
+        push: false
+      if: github.ref != 'refs/heads/master'
+
+    - name: Docker Build & Push Centos6 Image to Docker Hub On Merge
+      uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+      with:
+        file: ./ansible/docker/Dockerfile.CentOS6
+        build-args: git_sha=${{ github.sha }}
+        tags: adoptopenjdk/centos6_build_image:latest
+        cache-from: type=registry,ref=adoptopenjdk/centos6_build_image:latest
+        cache-to: type=inline
+        push: false
+      if: github.ref == 'refs/heads/master'
 
   build-and-push-alpine3:
     name: Alpine3
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
-    - name: Docker Build & Push Alpine3 Image to Docker Hub
-      uses: docker/build-push-action@v1
+    - name: Set up Docker Buildx to use cache feature
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+
+    - name: Docker Build Alpine3 Image
+      uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
       with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-        dockerfile: ./ansible/docker/Dockerfile.Alpine3
-        repository: adoptopenjdk/alpine3_build_image
-        tags: latest
-        push: ${{ github.ref == 'refs/heads/master' }}
+        file: ./ansible/docker/Dockerfile.Alpine3
+        build-args: git_sha=${{ github.sha }}
+        tags: adoptopenjdk/alpine3_build_image:latest
+        cache-from: type=registry,ref=adoptopenjdk/alpine3_build_image:latest
+        cache-to: type=inline
+        push: false

.github/workflows/build_mac.yml

@@ -5,23 +5,38 @@ on:
     paths:
     - .github/workflows/build_mac.yml
     - ansible/playbooks/AdoptOpenJDK_Unix_Playbook/**
-    branches:         
+    branches:
     - master
 
+permissions:
+  contents: read
+
 jobs:
   build-macos:
     name: macOS
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [macos-10.15]
+        include:
+          - os: [macos-13]
+          - os: [macos-14]
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+    - name: Install Python
+      run: brew install [email protected] --overwrite
 
-    - name: Install dependencies
+    - name: Install Ansible
       run: brew install ansible
 
+    # This is to fix an issue with the github macos14 runner, that cant resolve keyserver.ubuntu.com
+    # but this does work when replaced with the IP address. Spotted during the GPG verification of ANT step
+    # Upstream Bug : https://github.com/actions/runner-images/issues/9777
+    - name: Replace keyserver address with IP address
+      run: |
+        sed -i '' 's/keyserver\.ubuntu\.com/185.125.188.27/g' ansible/playbooks/Supporting_Scripts/package_signature_verification.sh
+
     - name: Run Ansible Playbook
       run: |
         echo "localhost ansible_user=runner ansible_connection=local" > ansible/hosts

.github/workflows/build_qemu.yml

@@ -0,0 +1,53 @@
+name: QEMU Playbook Checker
+
+on:
+  pull_request:
+    paths:
+    - .github/workflows/build_qemu.yml
+    - ansible/playbooks/AdoptOpenJDK_Unix_Playbook/**
+    branches:       
+    - master
+    types: [ labeled ]
+
+permissions:
+  contents: read
+
+jobs:
+  build_job:
+    if: ${{ github.event.label.name == 'QEMU-playbook-check' }}
+    # The host should always be linux
+    runs-on: ubuntu-latest
+    name: Build on ${{ matrix.distro }} ${{ matrix.arch }}
+
+    strategy:
+      matrix:
+        include:
+          - arch: aarch64
+            distro: ubuntu18.04
+          - arch: aarch64
+            distro: buster
+          - arch: ppc64le
+            distro: ubuntu18.04
+          - arch: s390x
+            distro: ubuntu18.04
+          - arch: riscv64
+            distro: ubuntu20.04
+          # - arch: armv7
+          #   distro: jessie
+
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Run on architecture
+        uses: uraimo/run-on-arch-action@b0ffb25eb00af00468375982384441f063da1741 # v2.7.2
+        with:
+          arch: ${{ matrix.arch }}
+          distro: ${{ matrix.distro }}
+          run: |
+            apt -y update
+            apt -y install ansible sudo
+            echo "localhost ansible_user=runner ansible_connection=local" > ansible/hosts
+            set -eux
+            cd ansible
+            if [ ! -e /usr/bin/python ] ; then ln -s /usr/bin/python3 /usr/bin/python ; fi
+            sudo ansible-playbook -i hosts --extra-vars 'git_sha=${{ github.sha }}' playbooks/AdoptOpenJDK_Unix_Playbook/main.yml --skip-tags="debug,jenkins,docker,ntp_time,swap_file,adoptopenjdk,jenkins"