Set up molecule testing (#3)

- Add a `centos7` molecule scenario
(`tests/molecule/centos7/molecule.yml`) - it has two instances, one for
a database and another for a web server
- Add an inventory for testing
(`tests/molecule/resources/inventory/hosts.yml`)
- Add group vars for testing
(`tests/molecule/resources/inventory/group_vars/all.yml`)
- Add a converge playbook for testing
(`tests/molecule/resources/converge.yml`). This playbook uses tags to
limit which roles are included. This means we can run molecule only on
roles that have changed in a given pr.
- Add a workflow to run molecule on `mirsg.infrastructure.provision`
when the provision role has changed
- Add a requirements file so we can install this collection

Edit: @drmatthews after talking offline, we'll use a single instance for
running molecule tests rather than two (database + web server)

.github/workflows/molecule-provision.yml

@@ -0,0 +1,39 @@
+name: Test provision
+on:
+  pull_request:
+    paths:
+      - "roles/provision/**"
+
+jobs:
+  molecule:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        scenario:
+          - centos7
+    env:
+      MOLECULE_RUN_TAGS: provision
+      PY_COLORS: 1
+      ANSIBLE_FORCE_COLOR: 1
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@v4
+        with:
+          path: ansible_collections/mirsg/infrastructure
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+
+      - name: Install test dependencies
+        run: |
+          sudo apt-get update && sudo apt-get -y install rsync
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansible molecule molecule-plugins[docker] docker requests
+
+      - name: Test with molecule
+        run: |
+          cd ansible_collections/mirsg/infrastructure/tests
+          molecule test --scenario-name  "${{ matrix.scenario }}"

meta/requirements.yml

@@ -0,0 +1,7 @@
+---
+collections:
+  - community.general
+  - ansible.posix
+  - community.postgresql
+  - community.docker
+  - community.crypto

roles/provision/tasks/Rocky.yml

@@ -1,5 +1,5 @@
 ---
-- name: Install the ca-certificates package
+- name: Ensure the ca-certificates package is installed
   become: true
   ansible.builtin.yum:
     name: "ca-certificates"

tests/molecule/centos7/molecule.yml

@@ -0,0 +1,62 @@
+---
+dependency:
+  name: galaxy
+  options:
+    force: true
+    role-file: "${MOLECULE_SCENARIO_DIRECTORY}/../../../meta/requirements.yml"
+    requirements-file: "${MOLECULE_SCENARIO_DIRECTORY}/../../../meta/requirements.yml"
+
+driver:
+  name: docker
+
+platforms:
+  - name: instance
+    hostname: molecule.instnace.local
+    image: ${MOLECULE_DOCKER_IMAGE:-geerlingguy/docker-centos7-ansible:latest}
+    required: true
+    command: ""
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: ${MOLECULE_PRE_BUILD_IMAGE:-true}
+    volumes:
+      - ./molecule-data:/storage/molecule
+    keep_volumes: false
+    groups:
+      - all
+      - molecule
+      - centos7
+    docker_networks:
+      - name: molecule
+        ipam_config:
+          - subnet: "192.168.56.0/24"
+            gateway: "192.168.56.1"
+    networks:
+      - name: molecule
+        ipv4_address: "192.168.56.2"
+
+provisioner:
+  name: ansible
+  log: true
+  config_options:
+    defaults:
+      callbacks_enabled: profile_tasks, timer, yaml
+    tags:
+      run: ${MOLECULE_RUN_TAGS:-all}
+  inventory:
+    links:
+      hosts: ../resources/inventory/hosts.yml
+      group_vars: ../resources/inventory/group_vars/
+  playbooks:
+    converge: ../resources/converge.yml
+  env:
+    ANSIBLE_VERBOSITY: "1"
+
+verifier:
+  name: ansible
+  env:
+    ANSIBLE_VERBOSITY: "1"
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

tests/molecule/resources/converge.yml

@@ -0,0 +1,10 @@
+---
+- name: Provision infrastructure
+  hosts: all
+  become: true
+  gather_facts: true
+  roles:
+    - role: mirsg.infrastructure.provision
+      tags: provision
+    - role: mirsg.infrastructure.install_python
+      tags: python

tests/molecule/resources/inventory/group_vars/all.yml

@@ -0,0 +1,5 @@
+---
+EXTERNAL_STORAGE_DRIVE: "/storage/molecule"
+
+# mirsg.infrastructure.provision
+server_locale: "en_GB.UTF-8"

tests/molecule/resources/inventory/hosts.yml

@@ -0,0 +1,17 @@
+---
+all:
+  # List of all servers, defining their alias and IP (hostname)
+  hosts:
+    # Host for your database server. Variables in host_vars/instance will be available to this host
+    instance:
+      hostname: "molecule.instance.local"
+      ansible_ip: "192.168.56.2"
+      ansible_port: 22
+
+  # Ansible groups. Groups allow configuration and variables to be shared between hosts
+  # Variables in group_vars/all will be shared between all hosts
+  children:
+    # All molecule servers. Variables in group_vars/molecule will be shared between these hosts
+    molecule:
+      hosts:
+        instance: