simp-beaker-helpers 3.1.2 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7487245f845a8b08a99fb9ff13bc22527ed5438c3ba59d9fcae3f98a7e48851c
-  data.tar.gz: 8870dc7e054399cb22974c5858791389d6a0678985e9a2d332be8ff8f73bb8ae
+  metadata.gz: 715fefc3d0f97c9acd754714500ad5b7449bab8ff8cf37143d5c67ffaf23769a
+  data.tar.gz: f91cc5e9a932e037889ec0db8380dab0c3a146bb3a00c7724afa086dbab235ca
 SHA512:
-  metadata.gz: 5254345501682c0657fe99d79616258ddd1126beb2b74cab969f31e4ce31b9f8f670c8981be75246492b60981304519ae8bd29480c7e939ed100f546f2b431f3
-  data.tar.gz: b2e96e3bdd29439ae26ce70916b4a2ddfc34840ff8d9a3ba163c26a33cc3a75a29d0480be786a6890f5c0de92f600c686130e11fb30f31a532bed7af0e0637b8
+  metadata.gz: 8802f41a286e3ce1e504fe6753a0767575caf74d326d0a33f679c714f9026aa92b9b92ce2146f22547c9ba3fb41033d960eec3c20d0d58ad208df492695b1d17
+  data.tar.gz: 4dca280a068b3f74ad4993556215f6131ed3d68ca86ed6f8e36487f62f0872742d7dc371da63d88c8db80a8328a389d963d2dedb8a5bd6e6cbbab99891509770

data/.fixtures.yml

@@ -4,6 +4,3 @@ fixtures:
     stdlib: https://github.com/simp/puppetlabs-stdlib
     simplib: https://github.com/simp/pupmod-simp-simplib
     compliance_markup: https://github.com/simp/pupmod-simp-compliance_markup
-    disa_stig-el7-baseline:
-      repo: https://github.com/mitre/redhat-enterprise-linux-7-stig-baseline
-      target: spec/fixtures/inspec_deps/inspec_profiles/profiles

data/.github/workflows/pr_tests.yml

@@ -36,7 +36,7 @@ jobs:
       - name: "Install Ruby 3.2"
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.7
+          ruby-version: 4.0.9
           bundler-cache: true
       - run: |
           bundle show
@@ -52,10 +52,8 @@ jobs:
             puppet_version: '~> 8.0'
             ruby_version: '3.2'
             experimental: false
-          # OpenVox 9 is unreleased; preview the future Ruby 4.0 / OpenVox 9
-          # combo by running the OpenVox 8 gem on Ruby 4.0.
-          - label: 'OpenVox 9.x preview (Ruby 4.0, OpenVox 8 gem)'
-            puppet_version: '~> 8.0'
+          - label: 'OpenVox 9.x (Ruby 4.0)'
+            puppet_version: '~> 9.0'
             ruby_version: '4.0'
             experimental: false
     env:
@@ -71,6 +69,80 @@ jobs:
       - run: 'bundle exec rake spec'
         continue-on-error: ${{matrix.puppet.experimental}}
 
+  acceptance:
+    name: '${{matrix.beaker.suite}}, ${{matrix.puppet.label}}'
+    runs-on:
+      - ubuntu-latest
+    strategy:
+      matrix:
+        puppet:
+          - label: 'OpenVox 8.x'
+            puppet_version: '~> 8.0'
+            ruby_version: '3.2'
+            collection: 'openvox8'
+            experimental: false
+        beaker:
+          - label: beaker
+            suite: default
+            allowed_to_fail: false
+          - label: beaker puppet_collections
+            suite: puppet_collections
+            allowed_to_fail: false
+      fail-fast: false
+    env:
+      PUPPET_VERSION: ${{matrix.puppet.puppet_version}}
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@v7
+      - name: setup ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.puppet.ruby_version }}
+      - name: ensure entropy
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y rng-tools
+          sudo systemctl start rng-tools
+      - name: install docker
+        run: |
+          set -x
+          sudo apt-get remove -y podman ||:
+          sudo apt-get install -y docker-ce docker docker-engine docker.io containerd runc ||:
+          sudo apt-get update
+          sudo apt autoremove -y
+          sudo systemctl start docker
+      - name: install bundle
+        run: |
+          bundle config path vendor
+          bundle install -j $(nproc)
+      - name: set BEAKER_PUPPET_COLLECTION
+        if: ${{matrix.puppet.collection}}
+        run: echo "BEAKER_PUPPET_COLLECTION=${{matrix.puppet.collection}}" >> $GITHUB_ENV
+      - name: 'run beaker:suite "${{matrix.beaker.label}}"'
+        continue-on-error: ${{matrix.puppet.experimental || matrix.beaker.allowed_to_fail}}
+        env:
+          BEAKER_SUITE: ${{matrix.beaker.suite}}
+        run: bundle exec rake beaker:suites[$BEAKER_SUITE,docker]
+
+  # The one check for branch protection to require: GitHub only blocks a
+  # merge on checks listed by name, and this job fails unless every job it
+  # needs succeeded. Add any new job in this workflow to `needs:`.
+  all-checks:
+    name: 'All checks'
+    if: always()
+    needs:
+      - ruby-style
+      - spec-tests
+      - acceptance
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Fail unless every needed job succeeded'
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$NEEDS"
+          jq -e 'all(.[]; .result == "success")' <<< "$NEEDS" > /dev/null
+
 #  dump_contexts:
 #    name: 'Examine Context contents'
 #    runs-on: ubuntu-latest

data/.github/workflows/tag_deploy_rubygem.yml

@@ -92,7 +92,7 @@ jobs:
           echo "release_command=$GEM_RELEASE_COMMAND" | tee -a "$GITHUB_OUTPUT"
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.7
+          ruby-version: 4.0.9
           bundler-cache: true
       - name: Test build the package
         run: "${{ steps.commands.outputs.build_command }}"
@@ -184,7 +184,7 @@ jobs:
           clean: true
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.7
+          ruby-version: 4.0.9
           bundler-cache: true
       - name: Build RubyGem
         run: |

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+### 3.2.0 / 2026-11-13
+* Added:
+  * Tested with OpenVox 9 (the gem itself does not constrain the openvox
+    version)
+* Deprecated:
+  * `Simp::BeakerHelpers::Inspec` now warns when used and will be removed in
+    the next major release
+
 ### 3.1.2 / 2026-09-29
 * Fixed:
   * Minor changes for rubocop 1.91

data/Gemfile

@@ -41,13 +41,13 @@ group :system_tests do
   gem 'ed25519'
   gem 'net-ssh'
   # renovate: datasource=rubygems versioning=ruby
-  gem 'openvox', ENV.fetch('OPENVOX_VERSION', ENV.fetch('PUPPET_VERSION', ['>= 8.0.0', '< 9.0.0']))
+  gem 'openvox', ENV.fetch('OPENVOX_VERSION', ENV.fetch('PUPPET_VERSION', ['>= 8.0.0', '< 10.0.0']))
   gem 'pry-byebug', '~> 3.12.0'
   gem 'syslog' # Required for Ruby >= 3.4
 end
 
 group :tests do
-  gem 'rubocop', '~> 1.91.0'
+  gem 'rubocop', '~> 1.92.0'
   gem 'rubocop-performance', '~> 1.27.0'
   gem 'rubocop-rake', '~> 0.7.0'
   gem 'rubocop-rspec', '~> 3.10.0'

data/README.md

@@ -262,8 +262,8 @@ copy_fixture_modules_to( suts = hosts, opts = {} )
   - **`opts`**   = _(Hash)_ Options passed on to `copy_module_to()` for each SUT
 
 By default, this will copy modules to the first path listed in each SUT's
-`modulepath` and simulate a pluginsync so the Beaker DSL's `facter_on` will
-still work.
+`modulepath` and simulate a pluginsync, which copies the modules' plugins (such
+as custom facts) into each SUT's `libdir`.
 
 If you need to use a non-default module path:
 ```ruby
@@ -275,7 +275,7 @@ copy_fixture_modules_to( hosts, {
 
 If you want to disable pluginsync:
 ```ruby
-# WARNING: `fact_on` will not see custom facts
+# `fact_on` and `pfact_on` still see the copied modules' facts
 copy_fixture_modules_to( hosts, {
    :pluginsync => false
 })
@@ -462,10 +462,11 @@ might try to install packages before subscription manager is configured.
 
 #### BEAKER_inspec_version
 
-The version of InSpec to use when running inspec tests. Currently hard-coded to
-`4.16.14` due to a bug introduced in `4.16.15`.
+**Deprecated:** `Simp::BeakerHelpers::Inspec` will be removed in the next
+major release.
 
-Set to 'latest' to use the latest available in the upstream repos.
+The version of InSpec that `Simp::BeakerHelpers::Inspec` installs. Defaults to
+`latest`, the newest version in the upstream repos.
 
 #### BEAKER_RHSM_UNSUBSCRIBE
 

data/lib/simp/beaker_helpers/inspec.rb

@@ -3,14 +3,26 @@ module Simp::BeakerHelpers
   require 'simp/beaker_helpers/constants'
 
   # Helpers for working with Inspec
+  #
+  # @deprecated Will be removed in the next major release.
   class Inspec
     require 'json'
 
+    # Warn once per process that this helper is deprecated
+    def self.deprecation_warning
+      return if @deprecation_warned
+
+      warn('DEPRECATION: Simp::BeakerHelpers::Inspec is deprecated and will be removed in the next major release of simp-beaker-helpers')
+      @deprecation_warned = true
+    end
+
     attr_reader :profile
     attr_reader :profile_dir
     attr_reader :deps_root
 
     def self.enable_repo_on(suts)
+      deprecation_warning
+
       parallel = (ENV['BEAKER_SIMP_parallel'] == 'yes')
       block_on(suts, run_in_parallel: parallel) do |sut|
         repo_manifest = create_yum_resource(
@@ -34,6 +46,8 @@ module Simp::BeakerHelpers
     #   The name of the profile against which to run
     #
     def initialize(sut, profile)
+      self.class.deprecation_warning
+
       @inspec_version = ENV['BEAKER_inspec_version'] || 'latest'
 
       @sut = sut
@@ -240,12 +254,10 @@ module Simp::BeakerHelpers
 
             if control['results'] && !control['results'].empty?
               status = :passed
-              color = 'green'
 
               control['results'].each do |_result|
                 if %r{^fail}.match?(results['status'])
                   status = :failed
-                  color = 'red'
                 end
               end
 

data/lib/simp/beaker_helpers/version.rb

@@ -4,5 +4,5 @@
 module Simp; end
 
 module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
-  VERSION = '3.1.2'
+  VERSION = '3.2.0'
 end

data/spec/acceptance/suites/default/fixture_modules_spec.rb

@@ -6,13 +6,6 @@ context 'after copy_fixture_modules_to( hosts )' do
     copy_fixture_modules_to(hosts)
   end
 
-  describe "fact_on(default,'root_home')" do
-    # fact_on in beaker_puppet_helpers is equivalent to pfact_on
-    xit 'does not return value of `root_home`' do
-      expect(fact_on(default, 'root_home').to_s).to eq ''
-    end
-  end
-
   describe "pfact_on(default,'root_home')" do
     it 'returns value of `root_home`' do
       expect(pfact_on(default, 'root_home')).to eq '/root'

data/spec/lib/simp/beaker_helpers_spec.rb

@@ -145,16 +145,9 @@ describe 'Simp::BeakerHelpers' do
     end
 
     it 'uses defaults when no environment variables are set' do
-      # Prevent namespace pollution
-      pipe_out, pipe_in = IO.pipe
-      fork do
-        pipe_out.close
-        require 'puppet'
-        pipe_in.write(Puppet.version)
-      end
-      pipe_in.close
-
-      expected_major_version = pipe_out.gets.split('.').first
+      # The default collection follows DEFAULT_PUPPET_AGENT_VERSION, not the
+      # openvox gem the test suite happens to be running under
+      expected_major_version = Simp::BeakerHelpers::DEFAULT_PUPPET_AGENT_VERSION[%r{\d+}]
 
       expect(helper.get_puppet_install_info[:puppet_collection]).to eq("puppet#{expected_major_version}")
       expect(helper.get_puppet_install_info[:puppet_install_type]).to eq('agent')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simp-beaker-helpers
 version: !ruby/object:Gem::Version
-  version: 3.1.2
+  version: 3.2.0
 platform: ruby
 authors:
 - Chris Tessmer
 - Trevor Vaughan
 bindir: bin
 cert_chain: []
-date: 2026-09-30 00:00:00.000000000 Z
+date: 2026-11-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: beaker
@@ -196,7 +196,6 @@ files:
 - ".fixtures.yml"
 - ".github/workflows.local.json"
 - ".github/workflows/add_new_issue_to_triage_project.yml"
-- ".github/workflows/pr_acceptance.yml"
 - ".github/workflows/pr_tests.yml"
 - ".github/workflows/tag_deploy_rubygem.yml"
 - ".gitignore"
@@ -237,9 +236,6 @@ files:
 - spec/acceptance/suites/fips_from_fixtures/00_default_spec.rb
 - spec/acceptance/suites/fips_from_fixtures/metadata.yml
 - spec/acceptance/suites/fips_from_fixtures/nodesets
-- spec/acceptance/suites/inspec/00_default_spec.rb
-- spec/acceptance/suites/inspec/metadata.yml
-- spec/acceptance/suites/inspec/nodesets
 - spec/acceptance/suites/offline/00_default_spec.rb
 - spec/acceptance/suites/offline/README
 - spec/acceptance/suites/offline/nodesets/default.yml
@@ -254,9 +250,6 @@ files:
 - spec/acceptance/suites/windows/nodesets/win2012.yml
 - spec/acceptance/suites/windows/nodesets/win2016.yml
 - spec/acceptance/suites/windows/nodesets/win2019.yml
-- spec/fixtures/inspec_profiles/CentOS-7-disa_stig
-- spec/fixtures/inspec_profiles/RedHat-7-disa_stig/controls/00_Control_Selector.rb
-- spec/fixtures/inspec_profiles/RedHat-7-disa_stig/inspec.yml
 - spec/lib/simp/beaker_helpers_spec.rb
 - spec/spec_helper.rb
 - spec/spec_helper_acceptance.rb

data/.github/workflows/pr_acceptance.yml

@@ -1,72 +0,0 @@
-# Run all tests as GitHub Actions
----
-name: Acceptance Tests
-'on':
-  push:
-    branches:
-      # A test branch for seeing if your tests will pass in your personal fork
-      - test_me_github
-  pull_request:
-    types: [opened, reopened, synchronize]
-
-jobs:
-  acceptance:
-    name: '${{matrix.beaker.suite}}, ${{matrix.puppet.label}}'
-    runs-on:
-      - ubuntu-latest
-    strategy:
-      matrix:
-        puppet:
-          - label: 'OpenVox 8.x'
-            puppet_version: '~> 8.0'
-            ruby_version: '3.2'
-            collection: 'openvox8'
-            experimental: false
-        beaker:
-          - label: beaker
-            suite: default
-            allowed_to_fail: false
-          - label: beaker puppet_collections
-            suite: puppet_collections
-            allowed_to_fail: false
-          # The inspec suite fails for unclear reasons during an scp.
-          # Sicura tests compliance at the framework level, so troubleshooting
-          # inspec acceptance tests is not a priority at present.
-          - label: beaker inspec
-            suite: inspec
-            allowed_to_fail: true
-      fail-fast: false
-    env:
-      PUPPET_VERSION: ${{matrix.puppet.puppet_version}}
-    steps:
-      - name: checkout repo
-        uses: actions/checkout@v7
-      - name: setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.puppet.ruby_version }}
-      - name: ensure entropy
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y rng-tools
-          sudo systemctl start rng-tools
-      - name: install docker
-        run: |
-          set -x
-          sudo apt-get remove -y podman ||:
-          sudo apt-get install -y docker-ce docker docker-engine docker.io containerd runc ||:
-          sudo apt-get update
-          sudo apt autoremove -y
-          sudo systemctl start docker
-      - name: install bundle
-        run: |
-          bundle config path vendor
-          bundle install -j $(nproc)
-      - name: set BEAKER_PUPPET_COLLECTION
-        if: ${{matrix.puppet.collection}}
-        run: echo "BEAKER_PUPPET_COLLECTION=${{matrix.puppet.collection}}" >> $GITHUB_ENV
-      - name: 'run beaker:suite "${{matrix.beaker.label}}"'
-        continue-on-error: ${{matrix.puppet.experimental || matrix.beaker.allowed_to_fail}}
-        env:
-          BEAKER_SUITE: ${{matrix.beaker.suite}}
-        run: bundle exec rake beaker:suites[$BEAKER_SUITE,docker]

data/spec/acceptance/suites/inspec/00_default_spec.rb

@@ -1,52 +0,0 @@
-require 'spec_helper_acceptance'
-require 'json'
-
-test_name 'Inspec STIG Profile'
-
-describe 'Inspec STIG Profile' do
-  profiles_to_validate = ['disa_stig']
-
-  hosts.each do |host|
-    profiles_to_validate.each do |profile|
-      context "for profile #{profile}" do
-        context "on #{host}" do
-          profile_path = File.join(
-              fixtures_path,
-              'inspec_profiles',
-              "#{fact_on(host, 'os.name')}-#{fact_on(host, 'os.release.major')}-#{profile}",
-            )
-
-          if File.exist?(profile_path)
-            let(:inspec) do
-              Simp::BeakerHelpers::Inspec.enable_repo_on(hosts)
-              Simp::BeakerHelpers::Inspec.new(host, profile)
-            end
-
-            let(:inspec_report_data) { inspec.process_inspec_results }
-
-            # rubocop:disable-next RSpec/RepeatedDescription
-            it 'runs inspec' do
-              inspec.run
-            end
-
-            it 'has an inspec report' do
-              expect(inspec_report_data).not_to be_nil
-
-              inspec.write_report(inspec_report_data)
-            end
-
-            it 'has a report' do
-              expect(inspec_report_data[:report]).not_to be_nil
-              puts inspec_report_data[:report] # rubocop:disable RSpec/Output
-            end
-          else
-            # rubocop:disable-next RSpec/RepeatedDescription
-            it 'runs inspec' do
-              skip("No matching profile available at #{profile_path}")
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/spec/acceptance/suites/inspec/metadata.yml

@@ -1,2 +0,0 @@
----
-'default_run': true

data/spec/acceptance/suites/inspec/nodesets

@@ -1 +0,0 @@
-../../nodesets

data/spec/fixtures/inspec_profiles/CentOS-7-disa_stig

@@ -1 +0,0 @@
-RedHat-7-disa_stig

data/spec/fixtures/inspec_profiles/RedHat-7-disa_stig/controls/00_Control_Selector.rb

@@ -1,45 +0,0 @@
-skips = {
-  'V-72209' => 'Cannot guarantee a remote syslog server during test'
-}
-overrides = [ 'V-72091' ]
-subsystems = []
-
-require_controls 'disa_stig-el7-baseline' do
-  skips.each_pair do |ctrl, reason|
-    control ctrl do
-      describe "Skip #{ctrl}" do
-        skip "Reason: #{skips[ctrl]}" do
-        end
-      end
-    end
-  end
-
-  @conf['profile'].info[:controls].each do |ctrl|
-    next if (overrides + skips.keys).include?(ctrl[:id])
-
-    if subsystems.empty?
-      control ctrl[:id]
-    else
-      tags = ctrl[:tags]
-      if tags && tags[:subsystems]
-        subsystems.each do |subsystem|
-          if tags[:subsystems].include?(subsystem)
-            control ctrl[:id]
-          end
-        end
-      end
-    end
-  end
-
-  ## Overrides ##
-
-  # There's no email server to send anything to by default so syslog is a safer
-  # default for processing.
-  control 'V-72091' do
-    overrides << self.to_s
-
-    describe auditd_conf do
-      its('space_left_action.downcase') { should cmp 'syslog' }
-    end
-  end
-end

data/spec/fixtures/inspec_profiles/RedHat-7-disa_stig/inspec.yml

@@ -1,14 +0,0 @@
-name: EL7 STIG
-title: STIG for EL 7
-supports:
-  - os-family: redhat
-maintainer: SIMP Team
-copyright: Onyx Point, Inc.
-copyright_email: simp@onyxpoint.com
-license: Apache-2.0
-summary: |
-  A collection of InSpec tests
-version: 0.0.1
-depends:
-  - name: disa_stig-el7-baseline
-    path: ../../inspec_deps/inspec_profiles/profiles/disa_stig-el7-baseline