Build, find, and test Ansible per-rule playbooks

lib/util/content.py

@@ -47,7 +47,17 @@ def _find_playbooks(root):
         build_content(user_content)
         return user_content / 'build' / 'ansible'
     else:
-        return root / Path('/usr/share/scap-security-guide/ansible')
+        return root / Path('usr/share/scap-security-guide/ansible')
+
+
+def _find_per_rule_playbooks(root):
+    if user_content:
+        build_content(user_content)
+        return user_content / 'build' / f'rhel{rhel.major}' / 'playbooks' / 'all'
+    else:
+        return root / Path(
+            f'usr/share/scap-security-guide/ansible/rule_playbooks/rhel{rhel.major}/all'
+        )
 
 
 def get_playbook(profile, root='/'):
@@ -65,9 +75,12 @@ def get_playbook(profile, root='/'):
 
 
 def iter_playbooks(root='/'):
-    for file in _find_playbooks(root).rglob('*'):
+    for file in _find_playbooks(root).iterdir():
         if file.suffix == '.yml':
             yield file
+    per_rule_dir = _find_per_rule_playbooks(root)
+    if per_rule_dir.exists():
+        yield from per_rule_dir.iterdir()
 
 
 def get_kickstart(profile):
@@ -98,7 +111,7 @@ def build_content(path):
     cmd = ['dnf', '-y', 'builddep', '--spec', 'scap-security-guide.spec']
     util.subprocess_run(cmd, check=True, cwd=path)
     # build content
-    cmd = ['./build_product', f'rhel{rhel.major}']
+    cmd = ['./build_product', '--playbook-per-rule', f'rhel{rhel.major}']
     util.subprocess_run(cmd, check=True, cwd=path)
 
 
@@ -139,6 +152,6 @@ def get_content(build=True):
                     raise FileNotFoundError(f"{extracted} not in extracted/patched SRPM")
                 # build content
                 if build:
-                    cmd = ['./build_product', f'rhel{rhel.major}']
+                    cmd = ['./build_product', '--playbook-per-rule', f'rhel{rhel.major}']
                     util.subprocess_run(cmd, check=True, cwd=extracted)
                 yield extracted

plans/errata.fmf

@@ -9,6 +9,7 @@ discover:
       # just some basic smoke testing that should never fail
       - /scanning/oscap-eval
       - /static-checks
+      - /static-checks/ansible/syntax-check
     exclude:
       # often fails on temporary retrieval issues
       - /static-checks/html-links