public-health-ch/ansible/roles/dev-sec.os-hardening/.travis.yml

---
services: docker

env:
  - distro: centos6
    version: latest
    init: /sbin/init

  - distro: centos7
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
    version: latest

  - distro: centos8
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
    version: latest

  - distro: fedora
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
    version: latest

  - distro: oracle6
    version: latest
    init: /sbin/init

#  - distro: oracle7
#    init: /lib/systemd/systemd
#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
#    version: latest

  - distro: ubuntu1604
    version: latest
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"

  - distro: ubuntu1804
    version: latest
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"

  - distro: debian9
    version: latest
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"

  - distro: debian10
    version: latest
    init: /lib/systemd/systemd
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"

  - distro: amazon
    init: /lib/systemd/systemd
    version: latest
    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"

  # - distro: opensuse_tumbleweed
  #   init: /usr/lib/systemd/systemd
  #   version: latest
  #   run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro --volume=/run:/run:ro"

before_install:
  # Pull container
  - 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'

script:
  - pip install --user ansible-lint
  - ansible-lint ./

  - container_id=$(mktemp)
  # Run container in detached state.
  - 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'

  # Output Ansible version from docker image
  - 'docker exec "$(cat ${container_id})" ansible-playbook --version'

   # Test role.
  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff'

   # Verify role
  - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-05b os-06 os-07 os-09 os-10 os-11 package-01 package-02 package-03 package-05 package-06 package-08 package-09 --no-distinct-exit'

notifications:
  webhooks: https://galaxy.ansible.com/api/v1/notifications/