ansible-collection-hardening/molecule/os_hardening_vm/verify.yml

---
- name: Verify
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
    #    - name: Include PAM tests
    #      ansible.builtin.include_tasks: verify_tasks/pam.yml
    #      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'

    - name: Include YUM tests
      ansible.builtin.include_tasks: verify_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

- name: Verify
  hosts: localhost
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Get ssh-config
      ansible.builtin.command:
        cmd: vagrant ssh-config
        chdir: "{{ molecule_ephemeral_directory }}"
      register: ssh_config
      changed_when: false

    - name: Create ssh-config file
      ansible.builtin.copy:
        content: "{{ ssh_config.stdout_lines | join ('\n') }}"
        dest: "{{ molecule_ephemeral_directory }}/ssh-config"
        mode: "0400"
      changed_when: false

    - name: Execute cinc-auditor tests
      ansible.builtin.command: >
        docker run --rm
        --volume {{ molecule_ephemeral_directory }}:{{ molecule_ephemeral_directory }}
        docker.io/cincproject/auditor exec
        --ssh-config-file={{ molecule_ephemeral_directory }}/ssh-config
        -t ssh://{{ lookup('env', 'USER') }}
        --sudo --no-show-progress --no-color
        --no-distinct-exit https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip
      register: test_results
      changed_when: false
      ignore_errors: true

    - name: Display details about the cinc-auditor results
      ansible.builtin.debug:
        msg: "{{ test_results.stdout_lines }}"

    - name: Fail when tests fail
      ansible.builtin.fail:
        msg: Inspec failed to validate
      when: test_results.rc != 0