collection: Merge dev to main for release 2.0.0

.ansible-lint

@@ -1,11 +1,32 @@
+---
+## Collection wide ansible-lint configuration file.
+# Changes for ansible-lint v25.7.0+
+# - Always executed from collection root using collection configuration.
+# - .ansible-lint-ignore can be used to ignore files, not folders.
+## Execution examples:
+# ansible-lint
+# ansible-lint roles/sap_firewall
+# ansible-lint roles/sap_firewall -c roles/sap_firewall/.ansible-lint
+
+exclude_paths:
+  - .ansible/
+  - .cache/
+  - .github/
+  - changelogs/
+  - playbooks/
+  - tests/
+  # sap_rfc role is excluded because it is no longer supported.
+  - roles/sap_rfc
+
+
 skip_list:
-  - empty-string-compare
-  - indentation
-  - line-length
-  - command-instead-of-module  # Using command rather than module
-  - command-instead-of-shell  # Use shell only when shell functionality is required
-  - experimental  # all rules tagged as experimental
-  - no-changed-when  # Commands should not change things if nothing needs doing
-  - no-handler  # Tasks that run when changed should likely be handlers
-  - risky-shell-pipe  # Shells that use pipes should set the pipefail option
-  - unnamed-task  # All tasks should be named
+  # We don't want to enforce new Ansible versions for Galaxy:
+  - meta-runtime[unsupported-version]
+  # We do not want to use checks which are marked as experimental:
+  - experimental
+  # We use ignore_errors for all the assert tasks, which should be acceptable:
+  - ignore-errors
+  # We want to allow single digit version numbers in a role's meta/main.yml file:
+  - schema
+  # Allow templating inside name because it creates more detailed output:
+  - name[template]

.github/workflows/ansible-lint-sap_control.yml

@@ -0,0 +1,36 @@
+---
+name: Ansible Lint - sap_control
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_control/**'
+  pull_request:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_control/**'
+
+  workflow_dispatch:
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # v25.7.0 no longer uses 'working_directory' and role path is set in 'args'.
+          # Role specific .ansible-lint can be added with argument '-c'.
+          args: roles/sap_control
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-lint-sap_firewall.yml

@@ -0,0 +1,36 @@
+---
+name: Ansible Lint - sap_firewall
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_firewall/**'
+  pull_request:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_firewall/**'
+
+  workflow_dispatch:
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # v25.7.0 no longer uses 'working_directory' and role path is set in 'args'.
+          # Role specific .ansible-lint can be added with argument '-c'.
+          args: roles/sap_firewall
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-lint-sap_hana_backint.yml

@@ -0,0 +1,36 @@
+---
+name: Ansible Lint - sap_hana_backint
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_hana_backint/**'
+  pull_request:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_hana_backint/**'
+
+  workflow_dispatch:
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # v25.7.0 no longer uses 'working_directory' and role path is set in 'args'.
+          # Role specific .ansible-lint can be added with argument '-c'.
+          args: roles/sap_hana_backint
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-lint-sap_hana_sr_takeover.yml

@@ -0,0 +1,36 @@
+---
+name: Ansible Lint - sap_hana_sr_takeover
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_hana_sr_takeover/**'
+  pull_request:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_hana_sr_takeover/**'
+
+  workflow_dispatch:
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # v25.7.0 no longer uses 'working_directory' and role path is set in 'args'.
+          # Role specific .ansible-lint can be added with argument '-c'.
+          args: roles/sap_hana_sr_takeover
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-lint-sap_profile_update.yml

@@ -0,0 +1,36 @@
+---
+name: Ansible Lint - sap_profile_update
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_profile_update/**'
+  pull_request:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'roles/sap_profile_update/**'
+
+  workflow_dispatch:
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # v25.7.0 no longer uses 'working_directory' and role path is set in 'args'.
+          # Role specific .ansible-lint can be added with argument '-c'.
+          args: roles/sap_profile_update
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-lint.yml

@@ -1,17 +1,24 @@
-name: Ansible Lint
+---
+name: Ansible Lint - Collection
 
-on: [push, pull_request]
+on:
+  schedule:
+    # This is 03:05 UTC, which is 5:05 AM in Prague/CEST.
+    - cron: '5 3 * * 1'
+
+  workflow_dispatch:
 
 jobs:
   ansible-lint:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions/setup-python@v3
-    - run: |
-        pip3 install ansible-lint
-        ansible-lint -p roles/ -c .github/workflows/ansible-lint-config
+      - uses: actions/checkout@v5
 
-# Static: use Ansible Community Edition 4.8.0, with lowest compatible Ansible Core 2.11.6 and use Ansible-lint 5.2.1
+        # Use @v25 to automatically track the latest release from the year 2025.
+        # ansible-lint uses Calendar Versioning (e.g., v25.9.0 -> YYYY.MM.PATCH).
+        # Avoid using @main, which can introduce breaking changes unexpectedly.
+      - uses: ansible/ansible-lint@v25
+        with:
+          # Use the shared requirements file from the collection root for dependency context.
+          requirements_file: ./requirements.yml

.github/workflows/ansible-test-sanity.yml

@@ -0,0 +1,84 @@
+---
+# Always check ansible-core support matrix before configuring units matrix.
+# https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
+
+name: Ansible Test - Sanity
+
+on:
+  schedule:
+    # This is 01:05 UTC, which is 3:05 AM in Prague/CEST
+    - cron: '5 3 * * 1'
+
+  pull_request:
+    branches:
+      - main
+      - dev
+
+  workflow_dispatch:
+
+jobs:
+  sanity-supported:
+    runs-on: ubuntu-latest
+    name: Sanity (Supported Ⓐ${{ matrix.ansible }})
+    strategy:
+      fail-fast: false  # Disabled so we can see all failed combinations.
+      # Define a build matrix to test compatibility across multiple Ansible versions.
+      # Each version listed below will spawn a separate job that runs in parallel.
+      matrix:
+        ansible:
+          # Supported versions (must pass)
+          - 'stable-2.18'  # Python 3.11 - 3.13
+          - 'stable-2.19'  # Python 3.11 - 3.13
+          - 'devel'  # Test against the upcoming development version.
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ansible-test - sanity
+        uses: ansible-community/ansible-test-gh-action@release/v1
+        with:
+          ansible-core-version: ${{ matrix.ansible }}
+          testing-type: sanity
+
+  sanity-eol:
+    runs-on: ubuntu-latest
+    # This job only runs if the supported tests pass
+    needs: sanity-supported
+    name: Sanity (EOL Ⓐ${{ matrix.ansible }}+py${{ matrix.python }})
+    continue-on-error: true  # This entire job is allowed to fail
+    strategy:
+      fail-fast: false  # Disabled so we can see all failed combinations.
+      # Define a build matrix to test compatibility across multiple Ansible versions.
+      # Each version listed below will spawn a separate job that runs in parallel.
+      matrix:
+        ansible:
+          - 'stable-2.14'  # Python 3.9 - 3.11
+          - 'stable-2.15'  # Python 3.9 - 3.11
+          - 'stable-2.16'  # Python 3.10 - 3.12
+          - 'stable-2.17'  # Python 3.10 - 3.12
+        python:
+          - '3.9'
+          - '3.10'
+          - '3.11'
+          - '3.12'
+        exclude:
+          # Exclusions for incompatible Python versions.
+          - ansible: 'stable-2.14'
+            python: '3.12'
+
+          - ansible: 'stable-2.15'
+            python: '3.12'
+
+          - ansible: 'stable-2.16'
+            python: '3.9'
+
+          - ansible: 'stable-2.17'
+            python: '3.9'
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ansible-test - sanity
+        uses: ansible-community/ansible-test-gh-action@release/v1
+        with:
+          ansible-core-version: ${{ matrix.ansible }}
+          target-python-version: ${{ matrix.python }}
+          testing-type: sanity

.github/workflows/codespell.yml

@@ -0,0 +1,25 @@
+---
+name: CodeSpell
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    branches:
+      - dev
+
+  workflow_dispatch:
+
+jobs:
+  codespell:
+    name: Check for spelling errors
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: codespell-project/actions-codespell@v2
+        with:
+          # lowercase only
+          ignore_words_list: aas,hsa,te,chage,addopt,sybsystem,uptodate,pase,enque

.gitignore

@@ -51,3 +51,6 @@ __pycache__/
 
 # VSCode
 .vscode
+
+# Ignore ansible workspace
+.ansible