WIP: add gated ServiceRadar SSH CA enrollment collection #1

Draft

mfreeman451 wants to merge 19 commits from feat/serviceradar-remote-access-enrollment into main

pull from: feat/serviceradar-remote-access-enrollment

merge into: carverauto:main

carverauto:main

Conversation 0 Commits 19 Files changed 94 +6472 -2

mfreeman451 commented 2026-07-13 02:26:11 +00:00

Owner

Copy link

Adds a reusable public collection for staged SSH user-CA enrollment, overlap, retirement, removal, rollback, and the ServiceRadar callback seam. Security review closed all identified P0/P1 findings. Production import remains explicitly gated until callback/AWX integration and the full real-SSH mutation matrix pass. Local gates: repository/private-material checks, yamllint, ansible-lint production profile, every wrapper syntax check, hash-locked dependency install, and collection build. Molecule DIND runs in CI.

Adds a reusable public collection for staged SSH user-CA enrollment, overlap, retirement, removal, rollback, and the ServiceRadar callback seam. Security review closed all identified P0/P1 findings. Production import remains explicitly gated until callback/AWX integration and the full real-SSH mutation matrix pass. Local gates: repository/private-material checks, yamllint, ansible-lint production profile, every wrapper syntax check, hash-locked dependency install, and collection build. Molecule DIND runs in CI.

mfreeman451 added 2 commits 2026-07-13 02:26:11 +00:00

feat: add gated SSH CA enrollment collection c445c2990b

test: enforce reproducible Ansible quality gates 05d931ce7a

mfreeman451 added 1 commit 2026-07-13 02:35:16 +00:00

ci: use available disposable runner pool dafbbb3f96

mfreeman451 added 1 commit 2026-07-13 02:38:23 +00:00

ci: run quality jobs in provisioned worker image 991647699d

mfreeman451 added 1 commit 2026-07-13 02:40:18 +00:00

ci: isolate locked Python dependencies 3c4bd7f625

mfreeman451 added 2 commits 2026-07-13 02:46:27 +00:00

ci: keep environment out of collection content 3fda8105ed

fix(ci): resolve lock for Python 3.12 6cd60a737a

mfreeman451 added 1 commit 2026-07-13 02:47:26 +00:00

feat(callback): bind retries to idempotency key d9771fd4be

mfreeman451 added 2 commits 2026-07-13 03:02:56 +00:00

fix(callback): retry pending grant safely ed1319def5

ci: isolate real SSH fixture matrix 5311c8618a

mfreeman451 added 1 commit 2026-07-13 05:27:23 +00:00

fix(callback): allow bounded AWX activation retries 9d3f5f85e5

mfreeman451 added 1 commit 2026-07-13 05:49:42 +00:00

fix(callback): bind CA response to AWX runtime job 178353dcf0

mfreeman451 added 1 commit 2026-07-13 05:59:41 +00:00

fix(callback): materialize exact AWX host scope 648d3f24f4

mfreeman451 added 3 commits 2026-07-13 06:59:55 +00:00

fix(callback): align public response schema contract 660875a8d5

feat(ansible): manage Windows QEMU guest agent 1670b0f998

fix(ansible): pin mounted QGA installer digest 3875e686d0

mfreeman451 added 1 commit 2026-07-13 07:08:30 +00:00

fix(ansible): support pinned unsigned VirtIO QGA MSI 5c0534b79b

mfreeman451 added 1 commit 2026-07-13 07:11:47 +00:00

feat(ansible): pin Windows AWX execution environment 92bbe074ab

mfreeman451 added 1 commit 2026-07-13 07:20:54 +00:00

fix(ansible): validate Windows MSI paths at runtime 2b16a98f94

Some checks are pending

Hide all checks

remote-access-content-quality / molecule-systemd-sshd (preflight) (pull_request) Waiting to run

Details

remote-access-content-quality / lint-and-syntax (pull_request) Successful in 49s

Details

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/serviceradar-remote-access-enrollment:feat/serviceradar-remote-access-enrollment

git switch feat/serviceradar-remote-access-enrollment

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff feat/serviceradar-remote-access-enrollment

git switch feat/serviceradar-remote-access-enrollment

git rebase main

git switch main

git merge --ff-only feat/serviceradar-remote-access-enrollment

git switch feat/serviceradar-remote-access-enrollment

git rebase main

git switch main

git merge --no-ff feat/serviceradar-remote-access-enrollment

git switch main

git merge --squash feat/serviceradar-remote-access-enrollment

git switch main

git merge --ff-only feat/serviceradar-remote-access-enrollment

git switch main

git merge feat/serviceradar-remote-access-enrollment

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

carverauto/serviceradar-ansible!1

No description provided.