[richm]

Small third-party actions create recurring dependency updates across
role repositories. Replace them with composite actions in
linux-system-roles/.github. Implement commit status, release, pull
request, and other workflow operations with git, gh, Bash, and Python.
Use pinned official GitHub actions for checkout and artifact transfer,
and retain the upstream actions needed for CodeQL, Codecov, codespell,
setup-python, and Testing Farm.

Update the role workflow templates to use the shared actions. Document
the publishing order so the actions are available before the templates
are rolled out to role repositories.

Generate an actions.lock file for each managed role repository. Limit
organization workflows to GitHub-owned and selected external actions,
and require SHA pinning. Locked commits satisfy the pinning rule for
workflows covered by an actions.lock file.

Assisted-by: Codex using model Sol medium 6

Signed-off-by: Rich Megginson rmeggins@redhat.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: linux-system-roles/ssh/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 118d9351-c03c-42db-9a6d-1ab8ec2e6bd9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI tests do not run automatically on pull requests. A role repository
maintainer can start them by posting a /citest slash command in a
pull request comment.

See GitHub CI testing using /citest
for details.

Run every available CI workflow:

/citest all

Run the linting and other lightweight checks:

/citest linters

Run the integration tests (QEMU/container and Testing Farm):

/citest integration

Run one or more selected workflows by separating their names with spaces:

/citest ansible-lint
/citest ansible-lint markdownlint

Command	Check name	Description
/citest all	All checks listed below	Run every CI test available for this role
/citest linters	Lint and lightweight checks	Run ansible-lint, ansible-test, ansible-managed-var-comment, codespell, markdownlint, pr-title-lint, test_converting_readme, and codeql, python-unit-test, and shellcheck when those workflows exist
/citest integration	QEMU/container and Testing Farm checks	Run qemu-kvm-integration-tests and tft
/citest ansible-lint	Ansible Lint / ansible_lint (<ansible-lint>, <ansible>, <python>) (pull_request)	Lint Ansible content after converting the role to collection format
/citest ansible-managed-var-comment	Check for ansible_managed variable use in comments / ansible_managed_var_comment (pull_request)	Fail if ansible_managed is used in comments
/citest ansible-test	Ansible Test / ansible_test (<ansible>, <python>) (pull_request)	Run ansible-test sanity tests
/citest codespell	Codespell / Check for spelling errors (pull_request)	Check for spelling errors
/citest markdownlint	Markdown Lint / markdownlint (pull_request)	Lint Markdown files
/citest pr-title-lint	PR Title Lint / commit-checks	Check that the pull request title follows the required format
/citest qemu-kvm-integration-tests	Test / scenario (<image>, <env>) (pull_request)	Run role integration tests in QEMU VMs and containers
/citest test_converting_readme	Test converting README.md to README.html / test_converting_readme (pull_request)	Convert README.md to HTML
/citest tft	<platform>|ansible-<version>	Run integration tests in Testing Farm
/citest woke	Woke / Detect non-inclusive language (pull_request)	Detect non-inclusive language
/citest shellcheck	ShellCheck / shellcheck (pull_request)	Lint shell scripts

Post another /citest comment at any time to run another selection.