cfengine 0.23.0__tar.gz → 0.23.2__tar.gz

{cfengine-0.23.0 → cfengine-0.23.2}/.coveragerc

@@ -1,5 +1,5 @@
 [run]
 parallel = True
-source = src
+source = ${PROJECT_ROOT}/src
 concurrency = multiprocessing
 sigterm = True

{cfengine-0.23.0 → cfengine-0.23.2}/.github/workflows/lint-policy-in-other-repos.yml

@@ -13,7 +13,7 @@ permissions:
   contents: read
 jobs:
   lint:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout cfengine-cli
         uses: actions/checkout@v7

{cfengine-0.23.0 → cfengine-0.23.2}/.github/workflows/make-check.yml

@@ -19,7 +19,7 @@ permissions:
   contents: read
 jobs:
   check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: true
       matrix:

{cfengine-0.23.0 → cfengine-0.23.2}/.github/workflows/pypi-publish.yml

@@ -5,7 +5,7 @@ on:
     types: [published]
 jobs:
   release-build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -26,7 +26,7 @@ jobs:
           name: release-dists
           path: dist/
   pre-release-tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -38,7 +38,7 @@ jobs:
           uv build
           uv run pytest
   pypi-publish:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - release-build
       - pre-release-tests

{cfengine-0.23.0 → cfengine-0.23.2}/.github/workflows/renovate.yml

@@ -12,7 +12,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7.0.1
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v46.2.4
+        uses: renovatebot/github-action@v46.3.6
         with:
           configurationFile: .github/renovate-config.js
           token: ${{ secrets.RENOVATE_TOKEN }}

{cfengine-0.23.0 → cfengine-0.23.2}/.github/workflows/update-syntax-description.yml

@@ -15,7 +15,7 @@ jobs:
   update_syntax_desc:
     if: contains(fromJSON('["cfengine","mendersoftware","NorthernTechHQ"]'), github.repository_owner)
     name: Update syntax-description
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       pull-requests: write

{cfengine-0.23.0 → cfengine-0.23.2}/Makefile

@@ -23,7 +23,9 @@ install:
 	pipx install --force --editable .
 
 
-export COVERAGE_PROCESS_START = $(PWD)/.coveragerc
+coverage: export COVERAGE_PROCESS_START = $(PWD)/.coveragerc
+coverage: export COVERAGE_FILE = $(PWD)/.coverage
+coverage: export PROJECT_ROOT = $(PWD)
 coverage:
 	uv run coverage erase
 	uv run coverage run --parallel-mode -m pytest

{cfengine-0.23.0 → cfengine-0.23.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cfengine
-Version: 0.23.0
+Version: 0.23.2
 Summary: Human-oriented CLI for interacting with CFEngine policy language, projects, and other CFEngine tools
 License:                     GNU GENERAL PUBLIC LICENSE
                                Version 3, 29 June 2007
@@ -694,13 +694,13 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: cf-remote>=0.9.5
-Requires-Dist: cfbs>=5.7.0
+Requires-Dist: cf-remote>=0.9.6
+Requires-Dist: cfbs>=5.8.1
 Requires-Dist: tree-sitter-cfengine>=1.1.12
-Requires-Dist: tree-sitter>=0.25
-Requires-Dist: markdown-it-py>=3.0.0
+Requires-Dist: tree-sitter>=0.26.0
+Requires-Dist: markdown-it-py>=4.2.0
 Requires-Dist: pyyaml>=6.0.3
-Requires-Dist: pydantic>=2.12.5
+Requires-Dist: pydantic>=2.13.5
 
 # CFEngine command line interface (CLI)
 

{cfengine-0.23.0 → cfengine-0.23.2}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=82.0.1", "setuptools-scm>=10.0.5"]
+requires = ["setuptools>=84.0.0", "setuptools-scm>=10.3.4"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -10,13 +10,13 @@ readme = "README.md"
 license = {file = "LICENSE"}
 requires-python = ">=3.10"
 dependencies = [
-    "cf-remote>=0.9.5",
-    "cfbs>=5.7.0",
+    "cf-remote>=0.9.6",
+    "cfbs>=5.8.1",
     "tree-sitter-cfengine>=1.1.12",
-    "tree-sitter>=0.25",
-    "markdown-it-py>=3.0.0",
+    "tree-sitter>=0.26.0",
+    "markdown-it-py>=4.2.0",
     "pyyaml>=6.0.3",
-    "pydantic>=2.12.5",
+    "pydantic>=2.13.5",
 ]
 classifiers = [
   "Development Status :: 3 - Alpha",
@@ -43,7 +43,7 @@ cfengine = "cfengine_cli.main:main"
 license-files = [] # Workaround bug in setuptools https://github.com/astral-sh/uv/issues/9513
 
 [tool.setuptools.package-data]
-cfengine_cli = ["*.json"] # syntax-description.json
+cfengine_cli = ["*.json", "docker/test-agent/Dockerfile"] # syntax-description.json, cfengine test's container
 
 [tool.pyright]
 include = ["src"]
@@ -54,7 +54,7 @@ venv = ".venv"
 
 [dependency-groups]
 dev = [
-    "flake8>=7.1.2",
-    "pytest>=8.3.4",
+    "flake8>=7.4.1",
+    "pytest>=9.1.1",
     "coverage; python_version >= '3.10'",
 ]

cfengine-0.23.2/renovate.json5

@@ -0,0 +1,91 @@
+// Global (self-hosted) settings are in .github/renovate-config.js,
+// the runner workflow is .github/workflows/renovate.yml.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended"],
+  reviewers: ["larsewi", "olehermanse"],
+
+  // Renovate does not infer maintenance branches from git, they have to be
+  // named here.
+  baseBranchPatterns: ["main"],
+
+  // Rebasing on every push to main would restart a pipeline per open PR.
+  rebaseWhen: "conflicted",
+
+  // The workflow runs once a day, so an hourly limit would act as a daily
+  // limit. Let the concurrent limit do the throttling.
+  prHourlyLimit: 0,
+  prConcurrentLimit: 5,
+
+  // Transitive deps only exist in uv.lock, so nothing in pyproject.toml
+  // reaches them. Replaces dependabot's "uv" ecosystem.
+  lockFileMaintenance: {
+    enabled: true,
+    schedule: ["before 5am on monday"],
+  },
+
+  // osvVulnerabilityAlerts does not depend on the PAT being able to read
+  // GitHub's own alerts API.
+  vulnerabilityAlerts: {
+    enabled: true,
+    schedule: ["at any time"],
+    labels: ["security"],
+  },
+  osvVulnerabilityAlerts: true,
+
+  packageRules: [
+    // pyproject.toml uses ">=" floors, which newer releases already satisfy,
+    // so the default rangeStrategy proposes nothing. "bump" raises the floor.
+    {
+      matchManagers: ["pep621"],
+      rangeStrategy: "bump",
+    },
+
+    {
+      matchManagers: ["pep621"],
+      matchDepTypes: ["project.dependencies", "build-system.requires"],
+      groupName: "python-dependencies",
+      groupSlug: "python-deps",
+    },
+    {
+      matchManagers: ["pep621"],
+      matchDepTypes: ["dependency-groups"],
+      groupName: "python-dev-dependencies",
+      groupSlug: "python-dev-deps",
+    },
+
+    // Bumping CFEngine's own packages is a product decision. Must stay after
+    // the python-dependencies rule above: packageRules are last-match-wins.
+    {
+      matchManagers: ["pep621"],
+      matchDepTypes: ["project.dependencies"],
+      matchPackageNames: ["cf-remote", "cfbs", "tree-sitter-cfengine"],
+      groupName: "cfengine-dependencies",
+      groupSlug: "cfengine-deps",
+    },
+
+    // Majors stay separate so they get a real review.
+    {
+      matchManagers: ["github-actions"],
+      matchUpdateTypes: ["minor", "patch", "digest"],
+      groupName: "github-actions",
+      groupSlug: "github-actions",
+    },
+
+    // The python version is also pinned in the make-check matrix and in the
+    // classifiers, which Renovate cannot reach. One PR, not three.
+    {
+      matchDepNames: ["python"],
+      groupName: "python-version",
+      groupSlug: "python-version",
+    },
+
+    // Support floor, not a dependency. "bump" would raise it to ">=3.14.7"
+    // and drop 3.10 - 3.13, which make-check.yml still tests.
+    {
+      matchManagers: ["pep621"],
+      matchDepTypes: ["requires-python"],
+      enabled: false,
+    },
+  ],
+}

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cfengine
-Version: 0.23.0
+Version: 0.23.2
 Summary: Human-oriented CLI for interacting with CFEngine policy language, projects, and other CFEngine tools
 License:                     GNU GENERAL PUBLIC LICENSE
                                Version 3, 29 June 2007
@@ -694,13 +694,13 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: cf-remote>=0.9.5
-Requires-Dist: cfbs>=5.7.0
+Requires-Dist: cf-remote>=0.9.6
+Requires-Dist: cfbs>=5.8.1
 Requires-Dist: tree-sitter-cfengine>=1.1.12
-Requires-Dist: tree-sitter>=0.25
-Requires-Dist: markdown-it-py>=3.0.0
+Requires-Dist: tree-sitter>=0.26.0
+Requires-Dist: markdown-it-py>=4.2.0
 Requires-Dist: pyyaml>=6.0.3
-Requires-Dist: pydantic>=2.12.5
+Requires-Dist: pydantic>=2.13.5
 
 # CFEngine command line interface (CLI)
 

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine.egg-info/SOURCES.txt

@@ -8,7 +8,7 @@ LICENSE
 Makefile
 README.md
 pyproject.toml
-renovate.json
+renovate.json5
 uv.lock
 .github/renovate-config.js
 .github/workflows/coverage.yml
@@ -33,6 +33,7 @@ src/cfengine_cli/__init__.py
 src/cfengine_cli/__main__.py
 src/cfengine_cli/changelog.py
 src/cfengine_cli/commands.py
+src/cfengine_cli/container.py
 src/cfengine_cli/deptool-README.md
 src/cfengine_cli/deptool.py
 src/cfengine_cli/dev.py
@@ -57,6 +58,7 @@ src/cfengine_cli/cfengine_wrapper/arg_parse.py
 src/cfengine_cli/cfengine_wrapper/cfengine_commands.py
 src/cfengine_cli/cfengine_wrapper/cfengine_objects.py
 src/cfengine_cli/cfengine_wrapper/cfengine_utils.py
+src/cfengine_cli/docker/test-agent/Dockerfile
 src/cfengine_cli/masterfiles/__init__.py
 src/cfengine_cli/masterfiles/analyze.py
 src/cfengine_cli/masterfiles/check_download_matches_git.py
@@ -158,6 +160,9 @@ tests/shell/002-version.sh
 tests/shell/003-format.sh
 tests/shell/004-format-check.sh
 tests/shell/005-lint.sh
+tests/shell/006-test-fail.sh
+tests/shell/007-test-container.sh
+tests/shell/008-cfbs-index.sh
 tests/unit/__init__.py
 tests/unit/test_changelog.py
 tests/unit/test_deps.py

cfengine-0.23.2/src/cfengine.egg-info/requires.txt

@@ -0,0 +1,7 @@
+cf-remote>=0.9.6
+cfbs>=5.8.1
+tree-sitter-cfengine>=1.1.12
+tree-sitter>=0.26.0
+markdown-it-py>=4.2.0
+pyyaml>=6.0.3
+pydantic>=2.13.5

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine.egg-info/scm_file_list.json

@@ -21,7 +21,7 @@
     "ci/02-safe-tests.sh",
     "ci/03-unsafe-tests.sh",
     "pyproject.toml",
-    "renovate.json",
+    "renovate.json5",
     "src/cfengine_cli/__init__.py",
     "src/cfengine_cli/__main__.py",
     "src/cfengine_cli/cfengine_wrapper/__init__.py",
@@ -31,9 +31,11 @@
     "src/cfengine_cli/cfengine_wrapper/cfengine_utils.py",
     "src/cfengine_cli/changelog.py",
     "src/cfengine_cli/commands.py",
+    "src/cfengine_cli/container.py",
     "src/cfengine_cli/deptool-README.md",
     "src/cfengine_cli/deptool.py",
     "src/cfengine_cli/dev.py",
+    "src/cfengine_cli/docker/test-agent/Dockerfile",
     "src/cfengine_cli/docs.py",
     "src/cfengine_cli/format.py",
     "src/cfengine_cli/initialize_project.py",
@@ -151,6 +153,9 @@
     "tests/shell/003-format.sh",
     "tests/shell/004-format-check.sh",
     "tests/shell/005-lint.sh",
+    "tests/shell/006-test-fail.sh",
+    "tests/shell/007-test-container.sh",
+    "tests/shell/008-cfbs-index.sh",
     "tests/unit/__init__.py",
     "tests/unit/test_changelog.py",
     "tests/unit/test_deps.py",

cfengine-0.23.2/src/cfengine.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.23.2",
+  "distance": 0,
+  "node": "g65afc1bd8b3f77fcd47eefe94ee19898b7fce5c8",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-30"
+}

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine_cli/cfengine_wrapper/arg_parse.py

@@ -11,6 +11,15 @@ from cf_remote.args import (
 )
 
 
+def _add_index_arg(parser: argparse.ArgumentParser):
+    parser.add_argument(
+        "--index",
+        help="Specify alternate index (HTTPS URL or relative path to JSON file)",
+        type=str,
+        default=None,
+    )
+
+
 def parse_wrapper_args(subp: argparse._SubParsersAction):
     update_parser = subp.add_parser(
         "update",
@@ -20,7 +29,7 @@ def parse_wrapper_args(subp: argparse._SubParsersAction):
     update_parser.add_argument(
         "to_update",
         nargs="*",
-        help="Directory of cfbs-project to update",
+        help="Module(s) to update (all modules if omitted)",
     )
     remove_parser = subp.add_parser(
         "remove",
@@ -43,6 +52,7 @@ def parse_wrapper_args(subp: argparse._SubParsersAction):
         nargs="+",
         help="Module(s) for which to add",
     )
+    _add_index_arg(add_parser)
     search_parser = subp.add_parser(
         "search",
         help="Searches the build-index for specified module(s)",
@@ -53,6 +63,7 @@ def parse_wrapper_args(subp: argparse._SubParsersAction):
         nargs="+",
         help="Module(s) for which to lookup",
     )
+    _add_index_arg(search_parser)
 
     input_parser = subp.add_parser(
         "input",
@@ -84,6 +95,7 @@ def parse_wrapper_args(subp: argparse._SubParsersAction):
         nargs="*",
         help="Module(s) for which you would like more info, utilizes cfbs `info` function",
     )
+    _add_index_arg(moduleinfo_parser)
 
     show_parser = subp.add_parser(
         "show", help="Shows your saved host-groups or info about a specified host"

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine_cli/cfengine_wrapper/cfengine_commands.py

@@ -1,6 +1,8 @@
 import os
 
+from cfbs.cfbs_config import CFBSConfig
 from cfbs.utils import is_cfbs_repo
+from cfbs.validate import validate_index_string
 from cfbs.commands import (
     build_command,
     info_command,
@@ -22,6 +24,7 @@ from cfbs.commands import (
 )
 
 from cfengine_cli.utils import UserError
+from cfengine_cli.container import run_in_container
 from cfengine_cli.cfengine_wrapper.cfengine_objects import (
     Executable,
     ensure_default_agent_flags,
@@ -271,10 +274,7 @@ def deploy(
 
     # TODO/WOULD be nice: Deploy without run (CFE-4704: https://northerntech.atlassian.net/browse/CFE-4704)
     if hubs:
-        # cf-remote functions use "localhost" (not "local" as it is here)
-        deploy_targets = [
-            "localhost" if location == "local" else location for location in hubs
-        ]
+        deploy_targets = [location for location in hubs]
         error = deploy_command(deploy_targets, masterfiles)
     else:
         return deploy_command(hubs, masterfiles)
@@ -287,6 +287,14 @@ def deploy(
     return error
 
 
+def test() -> int:
+    rc = build_command()
+    if rc != 0:
+        return rc
+
+    return run_in_container("out/masterfiles")
+
+
 def show(target: list[str] | None = None) -> int:
     if target == [] or target is None:
         return show_command(False)
@@ -295,7 +303,14 @@ def show(target: list[str] | None = None) -> int:
     return info(target)
 
 
-def moduleinfo(modules: list[str]) -> int:
+def _init_cfbs_config(index: str | None = None) -> None:
+    if index is not None:
+        validate_index_string(index)
+    CFBSConfig.get_instance(index=index)
+
+
+def moduleinfo(modules: list[str], index: str | None = None) -> int:
+    _init_cfbs_config(index)
     if modules != []:
         return info_command(modules)
     if not is_cfbs_repo():
@@ -312,17 +327,19 @@ def cfbs_input(modules: list[str]) -> int:
     return input_command(modules, "cfengine input")
 
 
-def cfbs_add(modules: list[str]) -> int:
-    return add_command(modules, "cfengine input")
+def cfbs_add(modules: list[str], index: str | None = None) -> int:
+    _init_cfbs_config(index)
+    return add_command(modules, "cfengine add")
 
 
-def cfbs_remove(modules: list[str] | None = None) -> int:
-    return remove_command(modules, "cfengine input")
+def cfbs_remove(modules: list[str]) -> int:
+    return remove_command(modules)
 
 
-def cfbs_update(to_update) -> int:
+def cfbs_update(to_update: list[str]) -> int:
     return update_command(to_update)
 
 
-def cfbs_search(modules: list[str]) -> int:
+def cfbs_search(modules: list[str], index: str | None = None) -> int:
+    _init_cfbs_config(index)
     return search_command(modules)

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine_cli/cfengine_wrapper/cfengine_objects.py

@@ -27,14 +27,14 @@ def ensure_default_agent_flags(command: str) -> str:
 class Executable:
     """
     A single binary (cf-agent or cf-hub) at a known location -- either
-    "local" or a remote host identifier ("user@ip"). Knows its own path
+    localhost or a remote host identifier ("user@ip"). Knows its own path
     and how to run a command against itself, whether that means a local
     subprocess or an SSH call via cf-remote.
     """
 
     def __init__(self, name: str, location: str, path: str, aliases=None) -> None:
         self.name = name  # "cf-agent" / "cf-hub"
-        self.location = location  # "local" or "user@ip"
+        self.location = location  # "localhost" or "user@ip"
         self.path = path  # absolute path to the binary at that location
         self.aliases = (
             aliases or []
@@ -42,7 +42,7 @@ class Executable:
 
     @property
     def is_local(self) -> bool:
-        return self.location == "local"
+        return self.location == "localhost"
 
     @property
     def label(self) -> str:
@@ -102,7 +102,7 @@ class Installation:
 
     @property
     def is_local(self) -> bool:
-        return self.location == "local"
+        return self.location == "localhost"
 
     @property
     def aliases(self) -> list:

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine_cli/cfengine_wrapper/cfengine_utils.py

@@ -111,21 +111,22 @@ _Id = namedtuple("_Id", "location aliases")
 
 def _identities(binary_name: str) -> Iterator[_Id]:
     """local + every known host as (location, aliases), without connecting."""
-    yield _Id("local", ["localhost"])
+    yield _Id("localhost", ["localhost", "local"])
     for host, aliases in _known_hosts(None if binary_name == "cf-agent" else "hub"):
         yield _Id(host, aliases)
 
 
 def _resolve(binary_name: str, ident: _Id) -> Executable | None:
     """Connect (if remote) and build an Executable, or None if unavailable."""
-    if ident.location == "local":
+    if ident.location == "localhost":
         path = _find_local_path(binary_name)
-        return Executable(binary_name, "local", path) if path else None
+        return Executable(binary_name, "localhost", path) if path else None
     data = _host_info(ident.location)
     if not data:
         return None
-    # band-aid: hostinfo has no path for cf-hub, so assume it's on PATH
-    path = data.get("agent") if binary_name == "cf-agent" else "cf-hub"
+    path = data.get("agent") if binary_name == "cf-agent" else data.get("hub")
+    if not path:
+        return None
     return (
         Executable(binary_name, ident.location, path, ident.aliases) if path else None
     )

{cfengine-0.23.0 → cfengine-0.23.2}/src/cfengine_cli/commands.py

@@ -12,6 +12,7 @@ from cfengine_cli.up import validate_config, up_do, resolve_templates
 from cfengine_cli.initialize_project import init_policy_module, init_promise_type
 from cf_remote.paths import cf_remote_dir
 from cfbs.commands import init_command
+from cfengine_cli.cfengine_wrapper.cfengine_commands import test as _cfengine_test
 from pydantic import ValidationError
 
 
@@ -47,6 +48,17 @@ def lint(files, strict, syntax_path) -> int:
     return errors
 
 
+def test(files, strict) -> int:
+    errors = _lint(files, strict, None)
+    if errors != 0:
+        plural = "error" if errors == 1 else "errors"
+        print(f"Lint failed, {errors} {plural} in total. Skipping build/deploy/run.")
+        return errors
+
+    print("Lint passed, no errors found.")
+    return _cfengine_test()
+
+
 def dev(subcommand, args) -> int:
     return dispatch_dev_subcommand(subcommand, args)
 

cfengine-0.23.2/src/cfengine_cli/container.py

@@ -0,0 +1,52 @@
+import os
+import shutil
+import subprocess
+
+from cfengine_cli.utils import UserError
+
+_DOCKERFILE_DIR = os.path.join(os.path.dirname(__file__), "docker", "test-agent")
+_IMAGE_TAG = "cfengine-cli-test-agent:latest"
+
+
+def require_docker() -> None:
+    if shutil.which("docker") is None:
+        raise UserError(
+            "`cfengine test` runs the built policy set inside a Docker container -- install Docker to use it."
+        )
+
+
+def _ensure_image_built() -> None:
+    result = subprocess.run(
+        ["docker", "build", "-q", "-t", _IMAGE_TAG, _DOCKERFILE_DIR]
+    )
+    if result.returncode != 0:
+        raise UserError("Failed to build the cfengine-test Docker image.")
+
+
+def run_in_container(masterfiles_dir: str) -> int:
+    """
+    Runs cf-agent against the given built masterfiles directory inside a container
+    """
+    require_docker()
+    _ensure_image_built()
+
+    abs_masterfiles = os.path.abspath(masterfiles_dir)
+    result = subprocess.run(
+        [
+            "docker",
+            "run",
+            "--rm",
+            "-v",
+            f"{abs_masterfiles}:/mnt/masterfiles:ro",
+            _IMAGE_TAG,
+            "sh",
+            "-c",
+            "rm -rf /var/cfengine/inputs "
+            "&& rm -rf /var/cfengine/masterfiles "
+            "&& cp -r /mnt/masterfiles /var/cfengine/masterfiles "
+            "&& /var/cfengine/bin/cf-agent --bootstrap 127.0.0.1 "
+            "&& /var/cfengine/bin/cf-agent -KIf update.cf "
+            "&& /var/cfengine/bin/cf-agent -KI",
+        ]
+    )
+    return result.returncode

cfengine-0.23.2/src/cfengine_cli/docker/test-agent/Dockerfile

@@ -0,0 +1,13 @@
+FROM debian:13-slim
+ENV PATH="/root/.local/bin:${PATH}"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        python3 pipx sudo procps
+
+RUN pipx install cfengine
+
+RUN cfengine install --clients localhost --edition community
+
+RUN mkdir -p /var/cfengine/bin/ \
+    && ln -sf "$(command -v python3)" /var/cfengine/bin/cfengine-selected-python