itamae 1.14.2 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4e4d3ac8c4c594f8721621e3ac992482d8f89a4391525e7f40ae7bbf6c492d1
-  data.tar.gz: fdb3b1e0f358f66453c9097a1f3bc8577eb606f76522059885dbde4b938d92d8
+  metadata.gz: 12b8fcd57c70cc4c440ccd46a34786f1ac43a6bc7f4b66b68598ffeecfe9daaf
+  data.tar.gz: c1e77510842948b7cc4222e566939e8e32c1540d4b09178dc6492449b38d98c2
 SHA512:
-  metadata.gz: 4e47d72e5095bf93a0e11f2ac0686bb787693de09b84672be240a41addb09d7b2a56b205a10f3738fd8b2d64d0d75a6ea431861aef5e27c1eb147d40c444ca37
-  data.tar.gz: c03a588ab12d43ce1921b96e8d8581d9296f847ac127a0af956b6fba5edbc085a8eab53ff8876e93b4303854ecb60d34186b7dd49d68e1bac002d06eea0b7843
+  metadata.gz: 4d033e29941f7cc56de7626d1b3bdee2e00d1adca58e13c2927c4f3a1202046d80427eb614111424c8e21cc43c2bf480009069782fa5faebfdbf2f9dcd7fdbc5
+  data.tar.gz: bd55aa58068d1ec98b5bc74e4e6829d7e0927f575e352289b74801916ebab2f9e511a4b197a947da538c033b0d054af39dc91209facc0e1e74b797c0da07b599

data/.github/dependabot.yml

@@ -6,3 +6,5 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7

data/.github/workflows/docker-daemon.json

@@ -0,0 +1,3 @@
+{
+  "registry-mirrors": ["https://mirror.gcr.io"]
+}

data/.github/workflows/release.yml

@@ -18,20 +18,20 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@eaecf785f6a34567a6d97f686bbb7bccc1ac1e5c # v1.237.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           ruby-version: ruby
 
       - name: Publish to RubyGems
-        uses: rubygems/release-gem@a25424ba2ba8b387abc8ef40807c2c85b96cbe32 # v1.1.1
+        uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0
 
       - name: Create GitHub release
         run: |

data/.github/workflows/test.yml

@@ -11,6 +11,7 @@ on:
       - reopened
   schedule:
     - cron: "0 0 * * 5" # JST 9:00 (Fri)
+  workflow_dispatch:
 
 jobs:
   test_main:
@@ -29,10 +30,12 @@ jobs:
           - "3.2"
           - "3.3"
           - "3.4"
+          - "4.0"
         rubyopt:
           - ""
           - "--jit"
           - "--yjit"
+          - "--zjit"
         exclude:
           # --jit is available since MRI 2.6
           - ruby:    "2.3"
@@ -62,20 +65,35 @@ jobs:
             rubyopt: "--yjit"
           - ruby:    "3.4"
             rubyopt: "--yjit"
+          - ruby:    "4.0"
+            rubyopt: "--yjit"
+
+          # --zjit is available since MRI 4.0
+          - ruby:    "2.3"
+            rubyopt: "--zjit"
+          - ruby:    "2.4"
+            rubyopt: "--zjit"
+          - ruby:    "2.5"
+            rubyopt: "--zjit"
+          - ruby:    "2.6"
+            rubyopt: "--zjit"
+          - ruby:    "2.7"
+            rubyopt: "--zjit"
+          - ruby:    "3.0"
+            rubyopt: "--zjit"
+          - ruby:    "3.1"
+            rubyopt: "--zjit"
+          - ruby:    "3.2"
+            rubyopt: "--zjit"
+          - ruby:    "3.3"
+            rubyopt: "--zjit"
+          - ruby:    "3.4"
+            rubyopt: "--zjit"
 
     uses: ./.github/workflows/test_main.yml
     with:
       ruby: ${{ matrix.ruby }}
       rubyopt: ${{ matrix.rubyopt }}
-
-      # This repository uses matrix to run 50+ builds in a pipeline.
-      # This results in simultaneous requests being sent to httpbin.org,
-      # similar to a DDoS attack, often causing 500 errors and test failures.
-      #
-      # e.g. https://github.com/itamae-kitchen/itamae/actions/runs/17045210601/job/48319099479?pr=379
-      #
-      # Therefore, I suppressed simultaneous requests to httpbin.org.
-      skip_http_request_test: ${{ (matrix.ruby == '2.3' && matrix.rubyopt == '') && 'false' || 'true' }}
     secrets:
       SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
@@ -87,12 +105,9 @@ jobs:
 
     steps:
       - name: Slack Notification (success)
-        uses: lazy-actions/slatify@master
+        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054 # v2.2.0
         if: always()
         continue-on-error: true
         with:
-          job_name: '*notify*'
-          type: ${{ job.status }}
-          icon_emoji: ":octocat:"
-          url: ${{ secrets.SLACK_WEBHOOK }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK }}

data/.github/workflows/test_main.yml

@@ -10,9 +10,6 @@ on:
         required: false
         type: string
         default: ""
-      skip_http_request_test:
-        required: true
-        type: string
     secrets:
       SLACK_WEBHOOK:
         required: true
@@ -22,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby }}
           bundler-cache: true
@@ -37,15 +34,13 @@ jobs:
           RUBYOPT: ${{ inputs.rubyopt }}
 
       - name: Slack Notification (not success)
-        uses: lazy-actions/slatify@master
+        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054 # v2.2.0
         if: "! success()"
         continue-on-error: true
         with:
-          job_name: ${{ format('*unit* ({0},{1})', inputs.ruby, inputs.rubyopt) }}
-          type: ${{ job.status }}
-          icon_emoji: ":octocat:"
-          url: ${{ secrets.SLACK_WEBHOOK }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
+          inputs: ${{ toJson(inputs) }}
 
   integration-docker:
     runs-on: ubuntu-latest
@@ -59,12 +54,16 @@ jobs:
 
     env:
       TEST_IMAGE: ${{ matrix.image }}
-      SKIP_HTTP_REQUEST_TEST: ${{ inputs.skip_http_request_test }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Pull Docker Hub images through mirror.gcr.io
+        run: |
+          sudo cp .github/workflows/docker-daemon.json /etc/docker/daemon.json
+          sudo systemctl restart docker
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby }}
           bundler-cache: true
@@ -72,6 +71,10 @@ jobs:
 
       - run: bundle update
 
+      - run: bundle exec rake spec:integration:docker:httpbin_start
+        env:
+          RUBYOPT: ${{ inputs.rubyopt }}
+
       - run: bundle exec rake spec:integration:docker:boot
         env:
           RUBYOPT: ${{ inputs.rubyopt }}
@@ -91,16 +94,19 @@ jobs:
         env:
           RUBYOPT: ${{ inputs.rubyopt }}
 
+      - run: bundle exec rake spec:integration:docker:httpbin_stop
+        if: always()
+        env:
+          RUBYOPT: ${{ inputs.rubyopt }}
+
       - name: Slack Notification (not success)
-        uses: lazy-actions/slatify@master
+        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054 # v2.2.0
         if: "! success()"
         continue-on-error: true
         with:
-          job_name: ${{ format('*integration-docker* ({0},{1},{2})', inputs.ruby, inputs.rubyopt, matrix.image) }}
-          type: ${{ job.status }}
-          icon_emoji: ":octocat:"
-          url: ${{ secrets.SLACK_WEBHOOK }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
+          matrix: ${{ toJson(matrix) }}
 
   integration-local:
     runs-on: ubuntu-latest
@@ -108,13 +114,15 @@ jobs:
     # NOTE: When ruby is 2.5, tests run on buster. But buster is already EOL and didn't work apt-get
     if: ${{ inputs.ruby >= '2.6' }}
 
-    env:
-      SKIP_HTTP_REQUEST_TEST: ${{ inputs.skip_http_request_test }}
-
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Pull Docker Hub images through mirror.gcr.io
+        run: |
+          sudo cp .github/workflows/docker-daemon.json /etc/docker/daemon.json
+          sudo systemctl restart docker
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby }}
           bundler-cache: true
@@ -131,12 +139,10 @@ jobs:
           RUBYOPT: ${{ inputs.rubyopt }}
 
       - name: Slack Notification (not success)
-        uses: lazy-actions/slatify@master
+        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054 # v2.2.0
         if: "! success()"
         continue-on-error: true
         with:
-          job_name: ${{ format('*integration-local* ({0},{1})', inputs.ruby, inputs.rubyopt) }}
-          type: ${{ job.status }}
-          icon_emoji: ":octocat:"
-          url: ${{ secrets.SLACK_WEBHOOK }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
+          inputs: ${{ toJson(inputs) }}

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 ## Unreleased
-[full changelog](https://github.com/itamae-kitchen/itamae/compare/v1.14.2...master)
+[full changelog](https://github.com/itamae-kitchen/itamae/compare/v1.15.0...master)
+
+## v1.15.0
+[full changelog](https://github.com/itamae-kitchen/itamae/compare/v1.14.2...v1.15.0)
+
+Improvements
+
+- [Add `system_group` option to `group` resource by takumin](https://github.com/itamae-kitchen/itamae/pull/297)
+  - NOTE: This bumps the minimum required specinfra version to 2.81.0.
+- [Add 'etc' library requirement in backend.rb by neidiom](https://github.com/itamae-kitchen/itamae/pull/389)
+- [Prefer `Bundler.with_unbundled_env` over deprecated `with_clean_env` by neidiom](https://github.com/itamae-kitchen/itamae/pull/390)
+- [Convert ohai commands to array form in runner by neidiom](https://github.com/itamae-kitchen/itamae/pull/395)
+- [Use `respond_to_missing?` instead of `respond_to?` in Node by neidiom](https://github.com/itamae-kitchen/itamae/pull/409)
+- [Replace abort with raise in notification validation by neidiom](https://github.com/itamae-kitchen/itamae/pull/410)
+- [Fix shadowed variable in `include_recipe` find block by neidiom](https://github.com/itamae-kitchen/itamae/pull/408)
 
 ## v1.14.2
 [full changelog](https://github.com/itamae-kitchen/itamae/compare/v1.14.1...v1.14.2)

data/Gemfile

@@ -11,3 +11,12 @@ group :test do
     gem 'growl'
   end
 end
+
+# FIXME: Delete the following after https://github.com/fakefs/fakefs/pull/494 is merged and released
+if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("4.0.0.preview2")
+  gem "english"
+  gem "fileutils"
+  gem "find"
+  gem "irb"
+  gem "stringio"
+end

data/Rakefile

@@ -24,12 +24,22 @@ namespace :spec do
     task :all => ['spec:integration:docker', 'spec:integration:local']
 
     desc "Run provision and specs"
-    task :docker => ["docker:boot", "docker:provision", "docker:serverspec", 'docker:clean_docker_container']
+    task :docker => ["docker:httpbin_start", "docker:boot", "docker:provision", "docker:serverspec", 'docker:clean_docker_container', "docker:httpbin_stop"]
 
     namespace :docker do
+      desc "Start a local go-httpbin server for http_request tests"
+      task :httpbin_start do
+        HttpbinServer.start
+      end
+
+      desc "Stop the local go-httpbin server"
+      task :httpbin_stop do
+        HttpbinServer.stop
+      end
+
       desc "Run docker"
       task :boot do
-        sh "docker run --env SKIP_HTTP_REQUEST_TEST --privileged -d --name #{container_name} #{TEST_IMAGE} /sbin/init"
+        sh "docker run --privileged -d --name #{container_name} #{TEST_IMAGE} /sbin/init"
       end
 
       desc "Run itamae"

data/itamae.gemspec

@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_runtime_dependency "thor", ">= 1.0.0"
-  spec.add_runtime_dependency "specinfra", [">= 2.64.0", "< 3.0.0"]
+  spec.add_runtime_dependency "specinfra", [">= 2.81.0", "< 3.0.0"]
   spec.add_runtime_dependency "hashie"
   spec.add_runtime_dependency "ansi"
   spec.add_runtime_dependency "schash", "~> 0.1.0"
@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", ">= 1.3"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec", "~> 3.0"
-  spec.add_development_dependency "serverspec", "~> 2.1"
+  spec.add_development_dependency "serverspec", "~> 2.43"
   spec.add_development_dependency "pry-byebug"
   spec.add_development_dependency "docker-api", "~> 2"
   spec.add_development_dependency "fakefs"

data/lib/itamae/backend.rb

@@ -2,6 +2,7 @@ require 'specinfra/core'
 require 'singleton'
 require 'io/console'
 require 'net/ssh'
+require 'etc'
 
 Specinfra::Configuration.error_on_missing_backend_type = true
 
@@ -267,7 +268,8 @@ module Itamae
           hostname = opts[:host_name] || 'default'
           vagrant_cmd = "vagrant ssh-config #{hostname} > #{config.path}"
           if defined?(Bundler)
-            Bundler.with_clean_env do
+            bundler_method = Bundler.respond_to?(:with_unbundled_env) ? :with_unbundled_env : :with_clean_env
+            Bundler.public_send(bundler_method) do
               `#{vagrant_cmd}`
             end
           else

data/lib/itamae/node.rb

@@ -56,7 +56,7 @@ module Itamae
       super
     end
 
-    def respond_to?(method, priv = false)
+    def respond_to_missing?(method, priv = false)
       @mash.respond_to?(method, priv) || super
     end
 

data/lib/itamae/notification.rb

@@ -30,8 +30,7 @@ module Itamae
 
     def validate!
       unless [:delay, :delayed, :immediately].include?(timing)
-        Itamae.logger.error "'#{timing}' is not valid notification timing. (Valid option is delayed or immediately)"
-        abort
+        raise ArgumentError, "'#{timing}' is not valid notification timing. (Valid option is delayed or immediately)"
       end
     end
   end

data/lib/itamae/recipe.rb

@@ -122,7 +122,7 @@ module Itamae
         expanded_path = ::File.join(expanded_path, 'default.rb') if ::Dir.exist?(expanded_path)
         expanded_path.concat('.rb') unless expanded_path.end_with?('.rb')
         candidate_paths = [expanded_path, Recipe.find_recipe_in_gem(target)].compact
-        path = candidate_paths.find {|path| File.exist?(path) }
+        path = candidate_paths.find {|candidate_path| File.exist?(candidate_path) }
 
         unless path
           raise NotFoundError, "Recipe not found. (#{target})"

data/lib/itamae/resource/group.rb

@@ -4,6 +4,7 @@ module Itamae
       define_attribute :action, default: :create
       define_attribute :groupname, type: String, default_name: true
       define_attribute :gid, type: Integer
+      define_attribute :system_group, type: [TrueClass, FalseClass]
 
       def set_current_attributes
         current.exist = exist?
@@ -21,7 +22,8 @@ module Itamae
           end
         else
           options = {
-            gid: attributes.gid,
+            gid:          attributes.gid,
+            system_group: attributes.system_group,
           }
 
           run_specinfra(:add_group, attributes.groupname, options)

data/lib/itamae/runner.rb

@@ -101,14 +101,14 @@ module Itamae
       hash.extend(Hashie::Extensions::DeepMerge)
 
       if @options[:ohai]
-        unless @backend.run_command("which ohai", error: false).exit_status == 0
+        unless @backend.run_command(["which", "ohai"], error: false).exit_status == 0
           # install Ohai
           Itamae.logger.info "Installing Chef package... (to use Ohai)"
           @backend.run_command("curl -L https://omnitruck.chef.io/install.sh | bash")
         end
 
         Itamae.logger.info "Loading node data via ohai..."
-        hash.merge!(JSON.parse(@backend.run_command("ohai 2>/dev/null").stdout))
+        hash.merge!(JSON.parse(@backend.run_command(["ohai"], error: false).stdout))
       end
 
       @options.fetch(:node_json, []).each do |name|

data/lib/itamae/version.rb

@@ -1,3 +1,3 @@
 module Itamae
-  VERSION = "1.14.2"
+  VERSION = "1.15.0"
 end

data/spec/integration/default_spec.rb

@@ -7,6 +7,16 @@ describe user("itamae") do
   it { should have_login_shell '/bin/dash' }
 end
 
+describe user("itamae_system") do
+  it { should exist }
+  it { should be_is_system_user }
+end
+
+describe group("itamae_system") do
+  it { should exist }
+  it { should be_is_system_group }
+end
+
 describe file('/tmp/included_recipe') do
   it { should be_file }
 end
@@ -77,34 +87,34 @@ describe file('/tmp/never_exist2') do
   it { should_not be_file }
 end
 
-describe file('/tmp/http_request.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request.html') do
   it { should be_file }
-  its(:content) { should match(/"from":\s*"itamae"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
 end
 
-describe file('/tmp/http_request_delete.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request_delete.html') do
   it { should be_file }
-  its(:content) { should match(/"from":\s*"itamae"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
 end
 
-describe file('/tmp/http_request_post.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request_post.html') do
   it { should be_file }
-  its(:content) { should match(/"from":\s*"itamae"/) }
-  its(:content) { should match(/"love":\s*"sushi"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
+  its(:content) { should match(/"love":\s*\[?\s*"sushi"/) }
 end
 
-describe file('/tmp/http_request_put.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request_put.html') do
   it { should be_file }
-  its(:content) { should match(/"from":\s*"itamae"/) }
-  its(:content) { should match(/"love":\s*"sushi"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
+  its(:content) { should match(/"love":\s*\[?\s*"sushi"/) }
 end
 
-describe file('/tmp/http_request_headers.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request_headers.html') do
   it { should be_file }
-  its(:content) { should match(/"User-Agent":\s*"Itamae"/) }
+  its(:content) { should match(/"User-Agent":\s*\[?\s*"Itamae"/) }
 end
 
-xdescribe file('/tmp/http_request_redirect.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+xdescribe file('/tmp/http_request_redirect.html') do
   it { should be_file }
   its(:content) { should match(/"from":\s*"itamae"/) }
 end

data/spec/integration/ordinary_user_spec.rb

@@ -84,25 +84,25 @@ end
 
 ###
 
-describe file('/tmp/http_request.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true" do
+describe file('/tmp/http_request.html') do
   it { should be_file }
   it { should be_owned_by "ordinary_san" }
   it { should be_grouped_into "ordinary_san" }
-  its(:content) { should match(/"from":\s*"itamae"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
 end
 
-describe file('/tmp/http_request_root.html'), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+describe file('/tmp/http_request_root.html') do
   it { should be_file }
   it { should be_owned_by "root" }
   it { should be_grouped_into "root" }
-  its(:content) { should match(/"from":\s*"itamae"/) }
+  its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
 end
 
 %w[/tmp/http_request_another_ordinary.html /tmp/http_request_another_ordinary_with_root.html].each do |path|
-  describe file(path), unless: ENV["SKIP_HTTP_REQUEST_TEST"] == "true"  do
+  describe file(path) do
     it { should be_file }
     it { should be_owned_by "itamae" }
     it { should be_grouped_into "itamae" }
-    its(:content) { should match(/"from":\s*"itamae"/) }
+    its(:content) { should match(/"from":\s*\[?\s*"itamae"/) }
   end
 end

data/spec/integration/recipes/default.rb

@@ -39,6 +39,17 @@ user "create itamae2 user with create home directory" do
   shell "/bin/sh"
 end
 
+group "create itamae_system group" do
+  groupname "itamae_system"
+  system_group true
+end
+
+user "create itamae_system user" do
+  gid "itamae_system"
+  username "itamae_system"
+  system_user true
+end
+
 ######
 
 package 'jq' do
@@ -192,39 +203,41 @@ end
 
 ######
 
-unless ENV["SKIP_HTTP_REQUEST_TEST"] == "true"
-  http_request "/tmp/http_request.html" do
-    url "https://httpbin.org/get?from=itamae"
-  end
+httpbin_url = ENV.fetch("HTTPBIN_URL") { "http://127.0.0.1:#{ENV.fetch('HTTPBIN_HOST_PORT', '8080')}" }
 
-  http_request "/tmp/http_request_delete.html" do
-    action :delete
-    url "https://httpbin.org/delete?from=itamae"
-  end
+http_request "/tmp/http_request.html" do
+  url "#{httpbin_url}/get?from=itamae"
+end
 
-  http_request "/tmp/http_request_post.html" do
-    action :post
-    message "love=sushi"
-    url "https://httpbin.org/post?from=itamae"
-  end
+http_request "/tmp/http_request_delete.html" do
+  action :delete
+  url "#{httpbin_url}/delete?from=itamae"
+end
 
-  http_request "/tmp/http_request_put.html" do
-    action :put
-    message "love=sushi"
-    url "https://httpbin.org/put?from=itamae"
-  end
+http_request "/tmp/http_request_post.html" do
+  action :post
+  headers "Content-Type" => "application/x-www-form-urlencoded"
+  message "love=sushi"
+  url "#{httpbin_url}/post?from=itamae"
+end
 
-  http_request "/tmp/http_request_headers.html" do
-    headers "User-Agent" => "Itamae"
-    url "https://httpbin.org/get"
-  end
+http_request "/tmp/http_request_put.html" do
+  action :put
+  headers "Content-Type" => "application/x-www-form-urlencoded"
+  message "love=sushi"
+  url "#{httpbin_url}/put?from=itamae"
+end
 
-  # http_request "/tmp/http_request_redirect.html" do
-  #   redirect_limit 1
-  #   url "https://httpbin.org/redirect-to?url=https%3A%2F%2Fhttpbin.org%2Fget%3Ffrom%3Ditamae"
-  # end
+http_request "/tmp/http_request_headers.html" do
+  headers "User-Agent" => "Itamae"
+  url "#{httpbin_url}/get"
 end
 
+# http_request "/tmp/http_request_redirect.html" do
+#   redirect_limit 1
+#   url "#{httpbin_url}/redirect-to?url=#{httpbin_url}/get%3Ffrom%3Ditamae"
+# end
+
 link "/tmp-link" do
   to "/tmp"
 end

data/spec/integration/recipes/ordinary_user.rb

@@ -83,29 +83,29 @@ end
 
 ###
 
-unless ENV["SKIP_HTTP_REQUEST_TEST"] == "true"
-  http_request "/tmp/http_request.html" do
-    url "https://httpbin.org/get?from=itamae"
-  end
-
-  http_request "/tmp/http_request_root.html" do
-    user 'root'
-    owner 'root'
-    group 'root'
-    url "https://httpbin.org/get?from=itamae"
-  end
-
-  http_request "/tmp/http_request_another_ordinary.html" do
-    user 'itamae'
-    owner 'itamae'
-    group 'itamae'
-    url "https://httpbin.org/get?from=itamae"
-  end
-
-  http_request "/tmp/http_request_another_ordinary_with_root.html" do
-    user 'root'
-    owner 'itamae'
-    group 'itamae'
-    url "https://httpbin.org/get?from=itamae"
-  end
+httpbin_url = ENV.fetch("HTTPBIN_URL") { "http://127.0.0.1:#{ENV.fetch('HTTPBIN_HOST_PORT', '8080')}" }
+
+http_request "/tmp/http_request.html" do
+  url "#{httpbin_url}/get?from=itamae"
+end
+
+http_request "/tmp/http_request_root.html" do
+  user 'root'
+  owner 'root'
+  group 'root'
+  url "#{httpbin_url}/get?from=itamae"
+end
+
+http_request "/tmp/http_request_another_ordinary.html" do
+  user 'itamae'
+  owner 'itamae'
+  group 'itamae'
+  url "#{httpbin_url}/get?from=itamae"
+end
+
+http_request "/tmp/http_request_another_ordinary_with_root.html" do
+  user 'root'
+  owner 'itamae'
+  group 'itamae'
+  url "#{httpbin_url}/get?from=itamae"
 end

data/tasks/httpbin_server.rb

@@ -0,0 +1,63 @@
+# Manage a local mccutchen/go-httpbin container for the integration tests.
+#
+# The public httpbin.org service is flaky and, under the CI matrix, receives
+# so many simultaneous requests that it returns 500s. Running an httpbin-compatible
+# server locally removes that external dependency.
+#
+# The `http_request` resource issues the HTTP request from the itamae process
+# itself (`Net::HTTP`), so the reachable URL differs per backend:
+#   - docker backend: itamae runs on the host    -> host_url    (published port)
+#   - local  backend: itamae runs in a container -> NETWORK_URL (shared network)
+# The container therefore exposes both a published loopback port and a shared network.
+module HttpbinServer
+  IMAGE     = 'ghcr.io/mccutchen/go-httpbin:2.24.0'
+  NETWORK   = 'itamae-test'
+  CONTAINER = 'httpbin'
+  PORT      = 8080 # container port; also the port in NETWORK_URL
+  NETWORK_URL = "http://#{CONTAINER}:#{PORT}".freeze # reachable from a container on NETWORK
+
+  module_function
+
+  # Host port to publish go-httpbin on. Overridable so local runs can avoid a
+  # port already in use on the host (CI runners always have the default free).
+  def host_port
+    ENV.fetch('HTTPBIN_HOST_PORT', PORT.to_s)
+  end
+
+  # URL reachable from the itamae host (docker backend). Kept in sync with the
+  # recipe default in spec/integration/recipes/*.rb.
+  def host_url
+    "http://127.0.0.1:#{host_port}"
+  end
+
+  def start
+    create_network
+    remove_container # drop any stale container from a previous run
+    run! 'docker', 'run', '-d', '--name', CONTAINER,
+         '--network', NETWORK,
+         '-p', "127.0.0.1:#{host_port}:#{PORT}",
+         IMAGE
+  end
+
+  def stop
+    remove_container
+    quiet 'docker', 'network', 'rm', NETWORK
+  end
+
+  def create_network
+    return if system('docker', 'network', 'inspect', NETWORK, out: File::NULL, err: File::NULL)
+    run! 'docker', 'network', 'create', NETWORK
+  end
+
+  def remove_container
+    quiet 'docker', 'rm', '-f', CONTAINER
+  end
+
+  def run!(*cmd)
+    system(*cmd) or raise "command failed: #{cmd.join(' ')}"
+  end
+
+  def quiet(*cmd)
+    system(*cmd, out: File::NULL, err: File::NULL)
+  end
+end

data/tasks/integration_local_spec.rb

@@ -10,22 +10,27 @@ namespace 'spec:integration:local' do
       next
     end
 
-    IntegrationLocalSpecRunner.new(
-      [
+    HttpbinServer.start
+    ENV['HTTPBIN_URL'] = HttpbinServer::NETWORK_URL
+    begin
+      IntegrationLocalSpecRunner.new(
         [
-          "spec/integration/recipes/default.rb",
-          "spec/integration/recipes/default2.rb",
-          "spec/integration/recipes/redefine.rb",
-          "spec/integration/recipes/local.rb",
+          [
+            "spec/integration/recipes/default.rb",
+            "spec/integration/recipes/default2.rb",
+            "spec/integration/recipes/redefine.rb",
+            "spec/integration/recipes/local.rb",
+          ],
+          [
+            "--dry-run",
+            "spec/integration/recipes/dry_run.rb",
+          ],
         ],
-        [
-          "--dry-run",
-          "spec/integration/recipes/dry_run.rb",
-        ],
-      ],
-      ['spec/integration/default_spec.rb']
-    ).run
-    
+        ['spec/integration/default_spec.rb']
+      ).run
+    ensure
+      HttpbinServer.stop
+    end
   end
 
   desc 'Run integration test for ordinary user with `itamae local`'
@@ -36,23 +41,29 @@ namespace 'spec:integration:local' do
       next
     end
 
-    runner = IntegrationLocalSpecRunner.new(
-      [
+    HttpbinServer.start
+    ENV['HTTPBIN_URL'] = HttpbinServer::NETWORK_URL
+    begin
+      runner = IntegrationLocalSpecRunner.new(
         [
-          "--dry-run",
-          "spec/integration/recipes/ordinary_user.rb",
+          [
+            "--dry-run",
+            "spec/integration/recipes/ordinary_user.rb",
+          ],
+          [
+            "spec/integration/recipes/ordinary_user.rb"
+          ],
         ],
-        [
-          "spec/integration/recipes/ordinary_user.rb"
-        ],
-      ],
-      ['spec/integration/ordinary_user_spec.rb'],
-      user: 'ordinary_san'
-    )
-    runner.docker_exec 'useradd', 'ordinary_san', '-p', '*'
-    runner.docker_exec 'useradd', 'itamae', '-p', '*', '--create-home'
-    runner.docker_exec 'sh', '-c', 'echo "ordinary_san ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers'
-    runner.run
+        ['spec/integration/ordinary_user_spec.rb'],
+        user: 'ordinary_san'
+      )
+      runner.docker_exec 'useradd', 'ordinary_san', '-p', '*'
+      runner.docker_exec 'useradd', 'itamae', '-p', '*', '--create-home'
+      runner.docker_exec 'sh', '-c', 'echo "ordinary_san ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers'
+      runner.run
+    ensure
+      HttpbinServer.stop
+    end
   end
 end
 
@@ -78,7 +89,7 @@ class IntegrationLocalSpecRunner
 
   def docker_run
     mount_dir = Pathname(__dir__).join('../').to_s
-    sh 'docker', 'run', '--env', 'SKIP_HTTP_REQUEST_TEST', '--privileged', '-d', '--name', CONTAINER_NAME, '-v', "#{mount_dir}:/itamae", "ruby:#{@ruby_version}", 'sleep', '1d'
+    sh 'docker', 'run', '--env', 'HTTPBIN_URL', '--network', HttpbinServer::NETWORK, '--privileged', '-d', '--name', CONTAINER_NAME, '-v', "#{mount_dir}:/itamae", "ruby:#{@ruby_version}", 'sleep', '1d'
   end
 
   def prepare
@@ -115,6 +126,6 @@ class IntegrationLocalSpecRunner
   end
 
   def docker_exec(*cmd, options: [])
-    sh 'docker', 'exec', '--env', 'LANG=en_US.utf8', '--env', 'SKIP_HTTP_REQUEST_TEST', *options, CONTAINER_NAME, *cmd
+    sh 'docker', 'exec', '--env', 'LANG=en_US.utf8', '--env', 'HTTPBIN_URL', *options, CONTAINER_NAME, *cmd
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itamae
 version: !ruby/object:Gem::Version
-  version: 1.14.2
+  version: 1.15.0
 platform: ruby
 authors:
 - Ryota Arai
@@ -31,7 +31,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.64.0
+        version: 2.81.0
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -41,7 +41,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.64.0
+        version: 2.81.0
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -135,14 +135,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.43'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.43'
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -209,6 +209,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/dependabot.yml"
+- ".github/workflows/docker-daemon.json"
 - ".github/workflows/release.yml"
 - ".github/workflows/test.yml"
 - ".github/workflows/test_main.yml"
@@ -309,6 +310,7 @@ files:
 - spec/unit/lib/itamae/resource_spec.rb
 - spec/unit/lib/itamae/runner_spec.rb
 - spec/unit/spec_helper.rb
+- tasks/httpbin_server.rb
 - tasks/integration_local_spec.rb
 homepage: https://itamae.kitchen/
 licenses:
@@ -332,7 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Simple Configuration Management Tool
 test_files: