fix plugin smoke schema mismatches

Author: marcofortina

docs/plugins/generated.md

@@ -2404,7 +2404,7 @@ List system cron.d entries and optionally one user's crontab.
 
 | Parameter | Required | Type | Default | Description |
 |---|---:|---|---|---|
-| `user` | no | `boolean` | `False` | Use systemctl --user instead of the system manager. |
+| `user` | no | `string` | `False` | User account whose crontab should be listed. |
 | `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
 
 Result fields:
@@ -8746,7 +8746,7 @@ Set an SELinux boolean.
 | Parameter | Required | Type | Default | Description |
 |---|---:|---|---|---|
 | `name` | yes | `string` |  | Package, user or group name. |
-| `value` | yes | `string` |  | Desired parameter value. |
+| `value` | yes | `string` |  | Desired SELinux boolean value. |
 | `persist` | no | `boolean` | `False` | Persist the change across reboots. |
 | `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
 

examples/runbooks/runbooks/49-secret.check.yaml

@@ -18,14 +18,14 @@ tasks:
       use: secret.redact_assert
       with:
         text: password=secret
-        value: 1
+        value: '1'
     - id: secret_scan_output
       use: secret.scan_output
       with:
         text: password=secret
-        value: 1
+        value: '1'
     - id: secret_scan_preview
       use: secret.scan_preview
       with:
         text: password=secret
-        value: 1
+        value: '1'

examples/runbooks/runbooks/56-sysctl.check.yaml

@@ -18,7 +18,7 @@ tasks:
       use: sysctl.assert
       with:
         name: nginx
-        value: 1
+        value: '1'
     - id: sysctl_dropin
       use: sysctl.dropin
       with:
@@ -40,7 +40,7 @@ tasks:
       use: sysctl.persist
       with:
         name: nginx
-        value: 1
+        value: '1'
     - id: sysctl_reload
       use: sysctl.reload
       with:

examples/runbooks/runbooks/58-systemctl.check.yaml

@@ -18,7 +18,7 @@ tasks:
       use: systemctl.daemon_reload
       with:
         sudo: true
-        user: deploy
+        user: true
     - id: systemctl_disable
       use: systemctl.disable
       with:

src/automax/plugins/cron.py

@@ -100,6 +100,7 @@ class CronListPlugin(BasePlugin):
     name = "cron.list"
     description = "List system cron.d entries and optionally one user's crontab."
     optional_params = ("user", "sudo")
+    parameter_schema = {"user": {"type": "string", "description": "User account whose crontab should be listed."}}
     opens_remote_session = True
     supports_check_mode = True
 

src/automax/plugins/security_modules.py

@@ -68,6 +68,7 @@ class SelinuxBooleanPlugin(BasePlugin):
     description = "Set an SELinux boolean."
     required_params = ("name", "value")
     optional_params = ("persist", "sudo")
+    parameter_schema = {"value": {"types": ("boolean", "string"), "description": "Desired SELinux boolean value."}}
     opens_remote_session = True
 
     def execute(self, params: Dict[str, Any], context: ExecutionContext) -> PluginResult:

tests/test_documentation_and_regressions.py

@@ -681,6 +681,35 @@ def test_plugin_smoke_runbooks_match_auditd_search_user_schema():
     assert search_substeps
     assert all(isinstance((substep.get("with") or {}).get("user"), str) for substep in search_substeps)
 
+
+def test_plugin_smoke_runbooks_validate_against_builtin_schemas():
+    from automax.plugins.registry import build_builtin_registry
+
+    registry = build_builtin_registry()
+    failures = []
+    for runbook_path in sorted(Path("examples/runbooks/runbooks").glob("*.check.yaml")):
+        data = yaml.safe_load(runbook_path.read_text(encoding="utf-8"))
+        for task in data.get("tasks", []):
+            for step in task.get("steps", []):
+                for substep in step.get("substeps", []):
+                    plugin_name = substep.get("use")
+                    params = substep.get("with") or {}
+                    try:
+                        registry.get(plugin_name).validate(params)
+                    except Exception as exc:  # pragma: no cover - assertion reports all offenders
+                        failures.append(f"{runbook_path}:{substep.get('id')}:{plugin_name}: {exc}")
+
+    assert failures == []
+
+
+def test_plugin_specific_user_and_boolean_value_schemas_do_not_use_global_fallbacks():
+    from automax.plugins.registry import build_builtin_registry
+
+    registry = build_builtin_registry()
+    registry.get("cron.list").validate({"user": "deploy", "sudo": True})
+    registry.get("selinux.boolean").validate({"name": "httpd_can_network_connect", "value": True, "persist": True})
+
+
 def test_docs_show_sudo_password_env_for_runs_and_capability_installs():
     docs = "\n".join(
         path.read_text(encoding="utf-8")