From b96faf18c6341d04cec08855ba197a76a2458663 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 21 Oct 2026 14:49:47 +0300 Subject: [PATCH] Pin Molecule CI to supported Python 3.14 --- .github/workflows/molecule.yml | 3 ++- docs/molecule-testing.md | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/molecule.yml b/.github/workflows/molecule.yml index 07014d2d8..97b351fe9 100644 --- a/.github/workflows/molecule.yml +++ b/.github/workflows/molecule.yml @@ -93,7 +93,8 @@ jobs: - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.x" + # ansible-core 2.21 supports controller Python through 3.14. + python-version: "3.14" - name: Install test dependencies run: python3 -m pip install -r molecule-shared/requirements.txt diff --git a/docs/molecule-testing.md b/docs/molecule-testing.md index a533d4993..411851fe8 100644 --- a/docs/molecule-testing.md +++ b/docs/molecule-testing.md @@ -26,6 +26,10 @@ Molecule is deliberately **not** part of the `prek` hooks. A run is far too slow ## What CI runs +CI uses Python 3.14, which is supported by the pinned Ansible dependencies. Keep the +workflow's Python minor version within Ansible's supported controller versions; +an unrestricted `3.x` can select a newer Python before Ansible supports it. + `.github/workflows/molecule.yml` does not run every scenario on every push — with one repository holding every role, that would be unaffordable. Its first job works out which roles the push actually touched, keeps the ones that have a scenario, and builds the job matrix from those. A documentation change runs nothing. For pushes, CI compares against the previous branch tip. On a new branch, or when the previous commit is unavailable after a force push, it instead compares against the branch's common ancestor with the default branch. This keeps a new Renovate branch limited to the roles it changes. If no usable comparison exists, it falls back to running every scenario. `workflow_dispatch` accepts an optional role name; leaving it empty runs every scenario.