Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
#!/usr/bin/env groovy

node('salt-shaker-tests') {
properties([
buildDiscarder(logRotator(numToKeepStr: '20', daysToKeepStr: '4', artifactNumToKeepStr: '3')),
disableConcurrentBuilds(),
pipelineTriggers([
URLTrigger(
cronTabSpec: '* * * * *',
triggerLabel: "salt-shaker-tests",
labelRestriction: true,
entries: [URLTriggerEntry(
url: 'https://download.opensuse.org/repositories/systemsmanagement:/saltstack:/bundle:/next:/testsuite/SLFO/repodata/repomd.xml',
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that SLFO:1.2 was created for SLE16/SLMicro6.2, we should probably use it instead of SLFO:Main.

contentTypes: [MD5Sum()]
)]
),
cron('H 0 * * *')],
),
parameters([
choice(name: 'salt_flavor', choices: ['bundle'], description: 'Run testsuite for classic Salt or Salt Bundle'),
booleanParam(name: 'run_unit_tests', defaultValue: true, description: 'Run the Salt unit tests'),
booleanParam(name: 'run_integration_tests', defaultValue: true, description: 'Run the Salt integration tests'),
booleanParam(name: 'run_functional_tests', defaultValue: true, description: 'Run the Salt functional tests'),
string(name: 'cucumber_ref', defaultValue: 'master', description: 'Testsuite Git reference (branch, tag...)'),
string(name: 'skip_list_url', defaultValue: 'https://raw.githubusercontent.com/openSUSE/salt-test-skiplist/main/skipped_tests.toml', description: 'URL to the skiplist.toml file to run Salt shaker'),
string(name: 'tf_file', defaultValue: 'susemanager-ci/terracumber_config/tf_files/salt-shaker/Salt-Shaker-Next-SLES16-Bundle.tf', description: 'Path to the tf file to be used'),
string(name: 'sumaform_gitrepo', defaultValue: 'https://github.com/uyuni-project/sumaform.git', description: 'Sumaform Git Repository'),
string(name: 'sumaform_ref', defaultValue: 'master', description: 'Sumaform Git reference (branch, tag...)'),
choice(name: 'sumaform_backend', choices: ['libvirt', 'aws'], description: 'Sumaform backend to be used (see https://github.com/uyuni-project/sumaform#backend-choice)'),
choice(name: 'terraform_bin', choices: ['/usr/bin/terraform'], description: 'Terraform binary path'),
choice(name: 'terraform_bin_plugins', choices: ['/usr/bin'], description: 'Terraform plugins path'),
string(name: 'terraform_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for terraform'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
booleanParam(name: 'terraform_init', defaultValue: true, description: 'Call terraform init (needed if modules are added or changes)'),
booleanParam(name: 'terraform_taint', defaultValue: true, description: 'Call terraform taint (so the resources, except volumes, are recreated)'),
Comment on lines +27 to +36
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The parameters sumaform_gitrepo/sumaform_ref and terracumber_gitrepo/terracumber_ref are used by pipeline-salt-shaker.groovy to clone external Git repositories and then execute the terracumber-cli code from those checkouts with Jenkins credentials loaded from /home/jenkins/.credentials. Because these dependencies are pinned only to mutable branches like master and there is no checksum or signature verification, a compromise of those upstream repositories (or an attacker able to change these parameter values) would lead to arbitrary code execution on the Jenkins agent and potential secret exfiltration. To harden the supply chain, pin these repositories to immutable commit SHAs or signed release tags, and/or restrict who can modify these parameters so untrusted input cannot influence which code is fetched and executed.

Copilot uses AI. Check for mistakes.
booleanParam(name: 'use_previous_terraform_state', defaultValue: false, description: 'Use previous Terraform state'),
])
])

stage('Checkout pipeline') {
checkout scm
}
timeout(activity: false, time: 3, unit: 'HOURS') {
def pipeline = load "jenkins_pipelines/environments/common/pipeline-salt-shaker.groovy"
pipeline.run(params)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
#!/usr/bin/env groovy

node('salt-shaker-tests') {
properties([
buildDiscarder(logRotator(numToKeepStr: '20', daysToKeepStr: '4', artifactNumToKeepStr: '3')),
disableConcurrentBuilds(),
pipelineTriggers([
URLTrigger(
cronTabSpec: '* * * * *',
triggerLabel: "salt-shaker-tests",
labelRestriction: true,
entries: [URLTriggerEntry(
url: 'https://download.opensuse.org/repositories/systemsmanagement:/saltstack:/bundle:/next:/testsuite/SLFO/repodata/repomd.xml',
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same consideration about SLFO:1.2

contentTypes: [MD5Sum()]
)]
),
cron('H 0 * * *')],
),
parameters([
choice(name: 'salt_flavor', choices: ['bundle'], description: 'Run testsuite for classic Salt or Salt Bundle'),
booleanParam(name: 'run_unit_tests', defaultValue: true, description: 'Run the Salt unit tests'),
booleanParam(name: 'run_integration_tests', defaultValue: true, description: 'Run the Salt integration tests'),
booleanParam(name: 'run_functional_tests', defaultValue: true, description: 'Run the Salt functional tests'),
string(name: 'testsuite_dir', defaultValue: '/opt/salt-testsuite-bundle/', description: 'Optional: Run testsuite from this directory'),
string(name: 'wait_after_deploy', defaultValue: '120', description: 'Optional: Seconds to wait after deployment is done (usually to allow transactional systems to reboot)'),
string(name: 'cucumber_ref', defaultValue: 'master', description: 'Testsuite Git reference (branch, tag...)'),
string(name: 'skip_list_url', defaultValue: 'https://raw.githubusercontent.com/openSUSE/salt-test-skiplist/main/skipped_tests.toml', description: 'URL to the skiplist.toml file to run Salt shaker'),
string(name: 'tf_file', defaultValue: 'susemanager-ci/terracumber_config/tf_files/salt-shaker/Salt-Shaker-Next-SLMicro62-Bundle.tf', description: 'Path to the tf file to be used'),
string(name: 'sumaform_gitrepo', defaultValue: 'https://github.com/uyuni-project/sumaform.git', description: 'Sumaform Git Repository'),
string(name: 'sumaform_ref', defaultValue: 'master', description: 'Sumaform Git reference (branch, tag...)'),
choice(name: 'sumaform_backend', choices: ['libvirt', 'aws'], description: 'Sumaform backend to be used (see https://github.com/uyuni-project/sumaform#backend-choice)'),
choice(name: 'terraform_bin', choices: ['/usr/bin/terraform'], description: 'Terraform binary path'),
choice(name: 'terraform_bin_plugins', choices: ['/usr/bin'], description: 'Terraform plugins path'),
string(name: 'terraform_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for terraform'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
Comment on lines +29 to +36
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The parameters sumaform_gitrepo/sumaform_ref and terracumber_gitrepo/terracumber_ref are used by pipeline-salt-shaker.groovy to clone external Git repositories and then execute the terracumber-cli code from those checkouts with Jenkins credentials loaded from /home/jenkins/.credentials. Because these dependencies are pinned only to mutable branches like master and there is no checksum or signature verification, a compromise of those upstream repositories (or an attacker able to change these parameter values) would lead to arbitrary code execution on the Jenkins agent and potential secret exfiltration. To harden the supply chain, pin these repositories to immutable commit SHAs or signed release tags, and/or restrict who can modify these parameters so untrusted input cannot influence which code is fetched and executed.

Copilot uses AI. Check for mistakes.
booleanParam(name: 'terraform_init', defaultValue: true, description: 'Call terraform init (needed if modules are added or changes)'),
booleanParam(name: 'terraform_taint', defaultValue: true, description: 'Call terraform taint (so the resources, except volumes, are recreated)'),
booleanParam(name: 'use_previous_terraform_state', defaultValue: false, description: 'Use previous Terraform state'),
])
])

stage('Checkout pipeline') {
checkout scm
}
timeout(activity: false, time: 3, unit: 'HOURS') {
def pipeline = load "jenkins_pipelines/environments/common/pipeline-salt-shaker.groovy"
pipeline.run(params)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
#!/usr/bin/env groovy

node('salt-shaker-tests') {
properties([
buildDiscarder(logRotator(numToKeepStr: '20', daysToKeepStr: '4', artifactNumToKeepStr: '3')),
disableConcurrentBuilds(),
pipelineTriggers([
URLTrigger(
cronTabSpec: '* * * * *',
triggerLabel: "salt-shaker-tests",
labelRestriction: true,
entries: [URLTriggerEntry(
url: 'https://download.opensuse.org/repositories/systemsmanagement:/saltstack:/bundle:/testing:/testsuite/SLFO/repodata/repomd.xml',
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same consideration about SLFO:1.2

contentTypes: [MD5Sum()]
)]
),
cron('H 0 * * *')],
),
parameters([
choice(name: 'salt_flavor', choices: ['bundle'], description: 'Run testsuite for classic Salt or Salt Bundle'),
booleanParam(name: 'run_unit_tests', defaultValue: true, description: 'Run the Salt unit tests'),
booleanParam(name: 'run_integration_tests', defaultValue: true, description: 'Run the Salt integration tests'),
booleanParam(name: 'run_functional_tests', defaultValue: true, description: 'Run the Salt functional tests'),
string(name: 'cucumber_ref', defaultValue: 'master', description: 'Testsuite Git reference (branch, tag...)'),
string(name: 'skip_list_url', defaultValue: 'https://raw.githubusercontent.com/openSUSE/salt-test-skiplist/main/skipped_tests.toml', description: 'URL to the skiplist.toml file to run Salt shaker'),
string(name: 'tf_file', defaultValue: 'susemanager-ci/terracumber_config/tf_files/salt-shaker/Salt-Shaker-Testing-SLES16-Bundle.tf', description: 'Path to the tf file to be used'),
string(name: 'sumaform_gitrepo', defaultValue: 'https://github.com/uyuni-project/sumaform.git', description: 'Sumaform Git Repository'),
string(name: 'sumaform_ref', defaultValue: 'master', description: 'Sumaform Git reference (branch, tag...)'),
choice(name: 'sumaform_backend', choices: ['libvirt', 'aws'], description: 'Sumaform backend to be used (see https://github.com/uyuni-project/sumaform#backend-choice)'),
choice(name: 'terraform_bin', choices: ['/usr/bin/terraform'], description: 'Terraform binary path'),
choice(name: 'terraform_bin_plugins', choices: ['/usr/bin'], description: 'Terraform plugins path'),
string(name: 'terraform_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for terraform'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
booleanParam(name: 'terraform_init', defaultValue: true, description: 'Call terraform init (needed if modules are added or changes)'),
booleanParam(name: 'terraform_taint', defaultValue: true, description: 'Call terraform taint (so the resources, except volumes, are recreated)'),
Comment on lines +27 to +36
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The parameters sumaform_gitrepo/sumaform_ref and terracumber_gitrepo/terracumber_ref are used by pipeline-salt-shaker.groovy to clone external Git repositories and then execute the terracumber-cli code from those checkouts with Jenkins credentials loaded from /home/jenkins/.credentials. Because these dependencies are pinned only to mutable branches like master and there is no checksum or signature verification, a compromise of those upstream repositories (or an attacker able to change these parameter values) would lead to arbitrary code execution on the Jenkins agent and potential secret exfiltration. To harden the supply chain, pin these repositories to immutable commit SHAs or signed release tags, and/or restrict who can modify these parameters so untrusted input cannot influence which code is fetched and executed.

Copilot uses AI. Check for mistakes.
booleanParam(name: 'use_previous_terraform_state', defaultValue: false, description: 'Use previous Terraform state'),
])
])

stage('Checkout pipeline') {
checkout scm
}
timeout(activity: false, time: 3, unit: 'HOURS') {
def pipeline = load "jenkins_pipelines/environments/common/pipeline-salt-shaker.groovy"
pipeline.run(params)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
#!/usr/bin/env groovy

node('salt-shaker-tests') {
properties([
buildDiscarder(logRotator(numToKeepStr: '20', daysToKeepStr: '4', artifactNumToKeepStr: '3')),
disableConcurrentBuilds(),
pipelineTriggers([
URLTrigger(
cronTabSpec: '* * * * *',
triggerLabel: "salt-shaker-tests",
labelRestriction: true,
entries: [URLTriggerEntry(
url: 'https://download.opensuse.org/repositories/systemsmanagement:/saltstack:/bundle:/testing:/testsuite/SLFO/repodata/repomd.xml',
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same consideration about SLFO:1.2

contentTypes: [MD5Sum()]
)]
),
cron('H 0 * * *')],
),
parameters([
choice(name: 'salt_flavor', choices: ['bundle'], description: 'Run testsuite for classic Salt or Salt Bundle'),
booleanParam(name: 'run_unit_tests', defaultValue: true, description: 'Run the Salt unit tests'),
booleanParam(name: 'run_integration_tests', defaultValue: true, description: 'Run the Salt integration tests'),
booleanParam(name: 'run_functional_tests', defaultValue: true, description: 'Run the Salt functional tests'),
string(name: 'testsuite_dir', defaultValue: '/opt/salt-testsuite-bundle/', description: 'Optional: Run testsuite from this directory'),
string(name: 'wait_after_deploy', defaultValue: '120', description: 'Optional: Seconds to wait after deployment is done (usually to allow transactional systems to reboot)'),
string(name: 'cucumber_ref', defaultValue: 'master', description: 'Testsuite Git reference (branch, tag...)'),
string(name: 'skip_list_url', defaultValue: 'https://raw.githubusercontent.com/openSUSE/salt-test-skiplist/main/skipped_tests.toml', description: 'URL to the skiplist.toml file to run Salt shaker'),
string(name: 'tf_file', defaultValue: 'susemanager-ci/terracumber_config/tf_files/salt-shaker/Salt-Shaker-Testing-SLMicro62-Bundle.tf', description: 'Path to the tf file to be used'),
string(name: 'sumaform_gitrepo', defaultValue: 'https://github.com/uyuni-project/sumaform.git', description: 'Sumaform Git Repository'),
string(name: 'sumaform_ref', defaultValue: 'master', description: 'Sumaform Git reference (branch, tag...)'),
choice(name: 'sumaform_backend', choices: ['libvirt', 'aws'], description: 'Sumaform backend to be used (see https://github.com/uyuni-project/sumaform#backend-choice)'),
choice(name: 'terraform_bin', choices: ['/usr/bin/terraform'], description: 'Terraform binary path'),
choice(name: 'terraform_bin_plugins', choices: ['/usr/bin'], description: 'Terraform plugins path'),
string(name: 'terraform_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for terraform'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
Comment on lines +29 to +36
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The parameters sumaform_gitrepo/sumaform_ref and terracumber_gitrepo/terracumber_ref are used by pipeline-salt-shaker.groovy to clone external Git repositories and then execute the terracumber-cli code from those checkouts with Jenkins credentials loaded from /home/jenkins/.credentials. Because these dependencies are pinned only to mutable branches like master and there is no checksum or signature verification, a compromise of those upstream repositories (or an attacker able to change these parameter values) would lead to arbitrary code execution on the Jenkins agent and potential secret exfiltration. To harden the supply chain, pin these repositories to immutable commit SHAs or signed release tags, and/or restrict who can modify these parameters so untrusted input cannot influence which code is fetched and executed.

Copilot uses AI. Check for mistakes.
booleanParam(name: 'terraform_init', defaultValue: true, description: 'Call terraform init (needed if modules are added or changes)'),
booleanParam(name: 'terraform_taint', defaultValue: true, description: 'Call terraform taint (so the resources, except volumes, are recreated)'),
booleanParam(name: 'use_previous_terraform_state', defaultValue: false, description: 'Use previous Terraform state'),
])
])

stage('Checkout pipeline') {
checkout scm
}
timeout(activity: false, time: 3, unit: 'HOURS') {
def pipeline = load "jenkins_pipelines/environments/common/pipeline-salt-shaker.groovy"
pipeline.run(params)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,118 @@
// Mandatory variables for terracumber
variable "URL_PREFIX" {
type = string
default = "https://ci.suse.de/user/manager/my-views/view/Salt%20Shaker/job/manager-salt-shaker-products-next-sles16-bundle"
}

// Not really used as this is for --runall parameter, and we run cucumber step by step
variable "CUCUMBER_COMMAND" {
type = string
default = "echo EXECUTE SALT TESTS HERE"
}
variable "CUCUMBER_BRANCH" {
type = string
default = "master"
}

variable "CUCUMBER_RESULTS" {
type = string
default = "/root/"
}

variable "MAIL_SUBJECT" {
type = string
default = "Results Salt Shaker - products:next - SLES16 Salt Bundle $status: $tests scenarios ($failures failed, $errors errors, $skipped skipped, $passed passed)"
}

variable "MAIL_TEMPLATE" {
type = string
default = "../../mail_templates/mail-template-salt-shaker.txt"
}

variable "MAIL_SUBJECT_ENV_FAIL" {
type = string
default = "Results Salt Shaker - products:next - SLES16 Salt Bundle: Environment setup failed"
}

variable "MAIL_TEMPLATE_ENV_FAIL" {
type = string
default = "../../mail_templates/mail-template-salt-shaker-env-fail.txt"
}

variable "MAIL_FROM" {
type = string
default = "salt-shaker@suse.de"
}

variable "MAIL_TO" {
type = string
default = "salt-ci@suse.de"
}

// sumaform specific variables
variable "SCC_USER" {
type = string
default = null // Not needed for Salt tests
}

variable "SCC_PASSWORD" {
type = string
default = null // Not needed for Salt tests
}

variable "GIT_USER" {
type = string
default = null // Not needed for master, as it is public
}

variable "GIT_PASSWORD" {
type = string
default = null // Not needed for master, as it is public
}

terraform {
required_version = "1.0.10"
required_providers {
libvirt = {
source = "dmacvicar/libvirt"
version = "0.8.1"
}
}
}

provider "libvirt" {
uri = "qemu+tcp://suma-04.mgr.suse.de/system"
}

module "base" {
source = "./modules/base"

cc_username = var.SCC_USER
cc_password = var.SCC_PASSWORD
use_avahi = false
domain = "mgr.suse.de"

provider_settings = {
pool = "ssd"
network_name = null
bridge = "br1"
}

images = [ "sles16o" ]
}

module "salt-shaker-products-next" {
source = "./modules/salt_testenv"
base_configuration = module.base.configuration

name = "salt-shaker-products-next-sles16-bundle"
image = "sles16o"
salt_obs_flavor = "saltstack:products:next"
provider_settings = {
mac = "aa:b2:93:02:02:0f"
}
}

output "configuration" {
value = module.salt-shaker-products-next.configuration
}
Loading
Loading