test: ensure role gathers the facts it uses by having test clear_facts before include_role

The role gathers the facts it uses.  For example, if the user uses
`ANSIBLE_GATHERING=explicit`, the role uses the `setup` module with the
facts and subsets it requires.

This change allows us to test this.  Before every role invocation, the test
will use `meta: clear_facts` so that the role starts with no facts.  However, since
the tests use facts, we save and restore the facts used by the test.

Create a task file tests/tasks/run_role_with_clear_facts.yml to do the tasks
to save, clear, run the role, and restore the facts.  This uses an action plugin
merge_ansible_facts to merge the saved facts with any changes by the role.

Any vars defined using `ansible_facts` have been changed to be defined with
`set_fact` instead.  This is because of the fact that `vars` are lazily
evaluated - the var might be referenced when the facts have been cleared, and
will issue an error like `ansible_facts["distribution"] is undefined`.

Any blocks with a `when` condition that uses `ansible_facts` has been rewritten.
This is because the `when` condition is evaluated every time a task is
invoked in the block, and if the facts are cleared, this will raise an
undefined variable error.

Signed-off-by: Rich Megginson <rmeggins@redhat.com>

Author: richm

tests/action_plugins/merge_ansible_facts.py

@@ -0,0 +1,58 @@
+# -*- coding: utf-8 -*-
+#
+# Ansible action plugin merge_ansible_facts.
+# Merges saved facts with current Ansible facts on the controller and returns
+# ansible_facts (saved_ansible_facts with current_ansible_facts overlaid).
+#
+# Copyright: (c) 2025, Linux System Roles
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible.plugins.action import ActionBase
+
+
+class ActionModule(ActionBase):
+
+    TRANSFERS_FILES = False
+
+    def run(self, tmp=None, task_vars=None):
+        if task_vars is None:
+            task_vars = {}
+
+        result = super(ActionModule, self).run(tmp, task_vars)
+        result["changed"] = False
+
+        current = self._task.args.get("current_ansible_facts")
+        saved = self._task.args.get("saved_ansible_facts")
+
+        if current is None:
+            result["failed"] = True
+            result["msg"] = "current_ansible_facts is required"
+            return result
+        if saved is None:
+            result["failed"] = True
+            result["msg"] = "saved_ansible_facts is required"
+            return result
+
+        # Template in case args were passed as raw Jinja
+        current = self._templar.template(current)
+        saved = self._templar.template(saved)
+
+        if not isinstance(current, dict):
+            result["failed"] = True
+            result["msg"] = "current_ansible_facts must be a dict"
+            return result
+        if not isinstance(saved, dict):
+            result["failed"] = True
+            result["msg"] = "saved_ansible_facts must be a dict"
+            return result
+
+        # Merge: start with a copy of saved, overlay current (same behavior as module)
+        merged = dict(saved)
+        merged.update(current)
+        result["ansible_facts"] = merged
+
+        return result

tests/library

@@ -3,8 +3,8 @@
   hosts: all
   tasks:
     - name: Set platform/version specific variables
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         tasks_from: set_vars.yml
         public: true
 

tests/setup-snapshot.yml

@@ -7,8 +7,9 @@
 - name: Run the role and check for errors
   block:
     - name: Run the role
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
+        __ha_cluster_failed_when: true
 
     - name: Fail
       fail:

tests/tasks/assert_node_options_check.yml

@@ -5,13 +5,19 @@
     file: vars/rh_distros_vars.yml
   when: __ha_cluster_is_rh_distro is not defined
 
+- name: Set variable for crypto-policies PQC block
+  set_fact:
+    __need_crypto_policies_pqc: >-
+      {{ __ha_cluster_is_rh_distro | bool and (
+        (ansible_facts['distribution'] == 'RedHat' and
+         ansible_facts['distribution_version'] is version('9.7', '>=') and
+         ansible_facts['distribution_version'] is version('10', '<'))
+        or (ansible_facts['distribution'] != 'RedHat' and
+            ansible_facts['distribution_major_version'] is version('9', '=='))
+      ) }}
+
 - name: Check if the managed node needs crypto-policies to be able to use PQC
-  when:
-    - __ha_cluster_is_rh_distro | bool
-    - (ansible_facts["distribution"] == "RedHat" and ansible_facts["distribution_version"] is version("9.7", ">=")
-       and ansible_facts["distribution_version"] is version("10", "<"))
-      or (ansible_facts["distribution"] != "RedHat" and
-          ansible_facts['distribution_major_version'] is version("9", "=="))
+  when: __need_crypto_policies_pqc | bool
   block:
     # calling role with null will just return the current policy
     - name: Get current crypto policy

tests/tasks/fixture_psks.yml

@@ -0,0 +1,39 @@
+---
+# Task file: save facts, clear_facts, run linux-system-roles.ha_cluster, then restore facts.
+# Include this with include_tasks or import_tasks; ensure tests/library is in module search path.
+
+- name: Save current ansible facts
+  set_fact:
+    saved_facts: "{{ ansible_facts }}"
+
+- name: Clear facts
+  meta: clear_facts
+
+# note that you can use failed_when with import_role but not with include_role
+# so this simulates the failed_when false case
+- name: Run the role with failed_when false
+  when:
+    - failed_when is defined
+    - not failed_when
+  block:
+    - name: Run the role
+      include_role:
+        name: linux-system-roles.ha_cluster
+        tasks_from: "{{ tasks_from | default('main') }}"
+        public: "{{ public | default(false) }}"
+  rescue:
+    - name: Ignore the failure when failed_when is false
+      debug:
+        msg: Ignoring failure when failed_when is false
+
+- name: Run the role normally
+  include_role:
+    name: linux-system-roles.ha_cluster
+    tasks_from: "{{ tasks_from | default('main') }}"
+    public: "{{ public | default(false) }}"
+  when: failed_when | d(true)
+
+- name: Reset ansible_facts (saved base with current overrides)
+  merge_ansible_facts:
+    current_ansible_facts: "{{ ansible_facts }}"
+    saved_ansible_facts: "{{ saved_facts }}"

tests/tasks/run_role_with_clear_facts.yml

@@ -5,18 +5,18 @@
     ha_cluster_cluster_name: test-cluster
   block:
     - name: Set up test environment
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         tasks_from: test_setup.yml
 
     - name: Clean up test environment for qnetd
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         tasks_from: test_cleanup_qnetd.yml
 
     - name: Set up test environment for qnetd
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         tasks_from: test_setup_qnetd.yml
       run_once: true  # noqa: run_once[task]
 
@@ -27,10 +27,9 @@
       run_once: true  # noqa: run_once[task]
 
     - name: Run HA Cluster role
-      include_role:
-        name: linux-system-roles.ha_cluster
-        # variables for the role are supposed to be defined in a playbook which
-        # includes this task file
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      # variables for the role are supposed to be defined in a playbook which
+      # includes this task file
 
     # The role removed qnetd configuration
     - name: Restore qnetd
@@ -63,6 +62,6 @@
 
   always:
     - name: Clean up test environment for qnetd
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         tasks_from: test_cleanup_qnetd.yml

tests/template_qdevice.yml

@@ -23,8 +23,8 @@
         - /etc/modules-load.d/softdog.conf
 
     - name: Run HA Cluster role
-      include_role:
-        name: linux-system-roles.ha_cluster
+      include_tasks: tasks/run_role_with_clear_facts.yml
+      vars:
         public: true
 
     - name: Slurp generated SBD watchdog blocklist file

tests/template_sbd_all_options.yml

@@ -9,16 +9,16 @@
       when: ansible_connection | d("") == "buildah" or __bootc_validation | d(false)
       block:
         - name: Set up test environment
-          include_role:
-            name: linux-system-roles.ha_cluster
+          include_tasks: tasks/run_role_with_clear_facts.yml
+          vars:
             tasks_from: test_setup.yml
 
         - name: Do build time tasks and verify
           when: not __bootc_validation | d(false)
           block:
             - name: Run HA Cluster role
-              include_role:
-                name: linux-system-roles.ha_cluster
+              include_tasks: tasks/run_role_with_clear_facts.yml
+              vars:
                 public: true
               when: not __bootc_validation | d(false)
 

tests/tests_bootc_e2e_cluster.yml

@@ -14,16 +14,16 @@
       when: ansible_connection | d("") == "buildah" or __bootc_validation | d(false)
       block:
         - name: Set up test environment
-          include_role:
-            name: linux-system-roles.ha_cluster
+          include_tasks: tasks/run_role_with_clear_facts.yml
+          vars:
             tasks_from: test_setup.yml
 
         - name: Do build time tasks and verify
           when: not __bootc_validation | d(false)
           block:
             - name: Run HA Cluster role
-              include_role:
-                name: linux-system-roles.ha_cluster
+              include_tasks: tasks/run_role_with_clear_facts.yml
+              vars:
                 public: true
               when: not __bootc_validation | d(false)