plans:
- adjust:
  - prepare+:
    - how: install
      name: Install dependencies for further prepare steps
      package:
      - git-core
      - python-srpm-macros
  - prepare+:
    - how: shell
      name: Download and build latest or pull request content
      script: "set -xe\nif [ -n \"$CONTEST_CONTENT_BRANCH\" ]; then\n    ref=\"refs/heads/$CONTEST_CONTENT_BRANCH\"\nelif
        [ -n \"$CONTEST_CONTENT_PR\" ]; then\n    ref=\"refs/pull/$CONTEST_CONTENT_PR/head\"\nelse\n
        \   exit 0\nfi\ncontent_dir=/root/upstream-content\n[ -e \"$content_dir\"
        ] || git init \"$content_dir\"\ncd \"$content_dir\"\nold_fetch_head=$(git
        rev-parse FETCH_HEAD 2>/dev/null) || true\ngit fetch --depth=1 https://github.com/ComplianceAsCode/content.git
        \"$ref\"\nnew_fetch_head=$(git rev-parse FETCH_HEAD)\nif [ \"$old_fetch_head\"
        != \"$new_fetch_head\" ]; then\n    # remove any previously built content\n
        \   git clean -ffdx\n    git checkout FETCH_HEAD\nfi\necho \"CONTEST_CONTENT=$content_dir\"
        >> \"$TMT_PLAN_ENVIRONMENT_FILE\"\n"
  - prepare+:
    - how: shell
      name: Update OpenSCAP from Packit (if specified)
      script: "set -xe\n# both result in the same URL on fedoraproject.org\nif [ -n
        \"$CONTEST_OSCAP_BRANCH\" ]; then\n    ref=\"$CONTEST_OSCAP_BRANCH\"\nelif
        [ -n \"$CONTEST_OSCAP_PR\" ]; then\n    ref=\"$CONTEST_OSCAP_PR\"\nelse\n
        \   exit 0\nfi\nrepofile=/etc/yum.repos.d/openscap-upstream-packit.repo\necho
        \"CONTEST_OSCAP_REPOFILE=$repofile\" >> \"$TMT_PLAN_ENVIRONMENT_FILE\"\nrm
        -f \"$repofile\"\nif rpm -q openscap-scanner; then\n    # the RPM might have
        been upgraded from another PR, sanitize it\n    dnf -q -y downgrade openscap-scanner\nelse\n
        \   # this runs before test dependencies are installed\n    dnf -q -y install
        openscap-scanner\nfi\n# download a Packit-provided repository\nmajor=$(. /etc/os-release
        && echo \"${VERSION_ID%%.*}\")\nrepourl=\"https://copr.fedorainfracloud.org/coprs/packit/OpenSCAP-openscap-$ref/repo/centos-stream-$major/packit-OpenSCAP-openscap-$ref-centos-stream-$major.repo\"\ncurl
        --retry 10 -sSfkL -o \"$repofile\" \"$repourl\"\ntrap \"rm -f \\\"$repofile\\\"\"
        ERR\n# check that the per-PR repo contains a newer build\nrc=0\ndnf -q check-upgrade
        openscap-scanner || rc=$?\nif [ \"$rc\" -ne 100 ]; then  # see dnf(8)\n    nvr=$(rpm
        -q openscap-scanner)\n    echo \"openscap-scanner from $ref doesn't upgrade
        existing $nvr\" >&2\n    false  # exit with ERR\nfi\ndnf -q -y upgrade openscap-scanner\n#
        invalidate VM snapshots\nrm -f /var/lib/libvirt/images/*.ready\n"
  - finish+:
    - how: shell
      name: Restore original OpenSCAP (if upgraded from Packit)
      script: "set -xe\nrepofile=/etc/yum.repos.d/openscap-upstream-packit.repo\nif
        [ -f \"$repofile\" ]; then\n    dnf -q -y downgrade openscap-scanner\n    rm
        -f \"$repofile\"\nfi\n"
  - prepare+:
    - how: shell
      name: Restore original compose versions of installed packages
      script: "set -xe\n# clean up packages from extra repos, restoring original vanilla
        OS (sorta)\nrm -v -f \\\n    /etc/yum.repos.d/{tag-repository,*beakerlib*,rcmtools}.repo
        \\\n    /etc/yum.repos.d/beaker-{client,harness,tasks}.repo\n# downgrade any
        packages installed/upgraded from the extra package repos\nfunction list_foreign_rpms
        {\n    dnf list --installed \\\n    | grep -e @koji-override -e @testing-farm
        -e @rcmtools -e @@commandline \\\n    | sed 's/ .*//'\n}\nrpms=$(list_foreign_rpms)\n[[
        $rpms ]] && dnf downgrade -y --skip-broken $rpms || true\nrpms=$(list_foreign_rpms)\n[[
        $rpms ]] && dnf remove -y --noautoremove $rpms\ndnf clean all\n"
    when: trigger == build or newa_batch is defined
  cleanup:
    enabled: true
    phases:
    - how: tmt
      name: default-0
      order: 50
  discover:
    enabled: true
    phases:
    - dist-git-download-only: false
      dist-git-init: false
      dist-git-install-builddeps: false
      dist-git-merge: false
      dist-git-remove-fmf-root: false
      dist-git-source: false
      filter:
      - tag:-needs-param
      - tag:-broken
      - tag:-subset-profile
      fmf-id: false
      how: fmf
      modified-only: false
      name: default-0
      order: 50
      prune: false
      sync-repo: false
      test:
      - /scanning/audit-rules-syscalls-grouping
      - /scanning/container-rules-applicability
      url-content-type: git
    tests:
    - adjust:
      - environment+:
          CONTEST_PYTHON: python3.11
        recommend+:
        - python3.11
        - python3.11-requests
        - python3.11-pyyaml
        - python3.11-urllib3
        when: distro == rhel-8 or distro == centos-stream-8 or distro == rhel-9 or
          distro == centos-stream-9
      - environment+:
          CONTEST_PYTHON: python3
        when: distro ~= rhel-9.0
      - because: sufficient to test only on x86_64
        enabled: false
        when: arch != x86_64
      component:
      - scap-security-guide
      description: 'The grouping of similar syscalls was added in

        https://github.com/ComplianceAsCode/content/pull/7329

        (syscall_grouping parameter). The goal of grouping audit

        rules for similar syscalls is to reduce the overall number

        of audit rules which leads to improved performance.

        Also see https://bugzilla.redhat.com/show_bug.cgi?id=1876483.

        '
      discover-phase: default-0
      duration: 15m
      enabled: true
      environment:
        CONTEST_PYTHON: python3.11
        PYTHONPATH: ../..
        TMPDIR: /var/tmp
      framework: shell
      manual: false
      name: /scanning/audit-rules-syscalls-grouping
      order: 50
      path: /default-0/tests/scanning/audit-rules-syscalls-grouping
      recommend:
      - python3
      - python3-requests
      - python3-pyyaml
      - python3-dnf
      - rpm-build
      - audit
      - audit-rules
      - python3.11
      - python3.11-requests
      - python3.11-pyyaml
      - python3.11-urllib3
      require:
      - pattern:
        - /lib
        type: file
      - pattern:
        - /conf
        type: file
      - scap-security-guide
      restart-max-count: 1
      restart-with-reboot: false
      result: respect
      serial-number: 1
      summary: Verify audit rules for similar syscalls are grouped
      test: $CONTEST_PYTHON -m lib.runtest ./test.py
      tty: false
    - adjust:
      - environment+:
          CONTEST_PYTHON: python3.11
        recommend+:
        - python3.11
        - python3.11-requests
        - python3.11-pyyaml
        - python3.11-urllib3
        when: distro == rhel-8 or distro == centos-stream-8 or distro == rhel-9 or
          distro == centos-stream-9
      - environment+:
          CONTEST_PYTHON: python3
        when: distro ~= rhel-9.0
      - because: sufficient to check only on x86_64
        enabled: false
        when: arch != x86_64
      component:
      - scap-security-guide
      discover-phase: default-0
      duration: 30m
      enabled: true
      environment:
        CONTEST_PYTHON: python3.11
        PYTHONPATH: ../..
        TMPDIR: /var/tmp
      framework: shell
      manual: false
      name: /scanning/container-rules-applicability
      order: 50
      path: /default-0/tests/scanning/container-rules-applicability
      recommend:
      - python3
      - python3-requests
      - python3-pyyaml
      - python3-dnf
      - rpm-build
      - python3.11
      - python3.11-requests
      - python3.11-pyyaml
      - python3.11-urllib3
      require:
      - pattern:
        - /lib
        type: file
      - pattern:
        - /conf
        type: file
      - scap-security-guide
      - openscap-utils
      - podman
      restart-max-count: 1
      restart-with-reboot: false
      result: respect
      serial-number: 2
      summary: Check rules applicability when scanning containers.
      test: $CONTEST_PYTHON -m lib.runtest ./test.py
      tty: false
  enabled: true
  environment:
    CONTEST_VERBOSE: '0'
  execute:
    enabled: true
    phases:
    - duration: 1h
      exit-first: false
      how: tmt
      ignore-duration: false
      interactive: false
      name: default-0
      no-progress-bar: false
      order: 50
      restraint-compatible: false
    results-path: plans/upstream-parallel/other/scanning/execute/results.yaml
  finish:
    enabled: true
    phases:
    - how: shell
      name: Restore original OpenSCAP (if upgraded from Packit)
      order: 50
      script:
      - "set -xe\nrepofile=/etc/yum.repos.d/openscap-upstream-packit.repo\nif [ -f
        \"$repofile\" ]; then\n    dnf -q -y downgrade openscap-scanner\n    rm -f
        \"$repofile\"\nfi\n"
  name: /plans/upstream-parallel/other/scanning
  order: 50
  prepare:
    enabled: true
    phases:
    - how: install
      missing: fail
      name: Install dependencies for further prepare steps
      order: 50
      package:
      - git-core
      - python-srpm-macros
    - how: shell
      name: Download and build latest or pull request content
      order: 50
      script:
      - "set -xe\nif [ -n \"$CONTEST_CONTENT_BRANCH\" ]; then\n    ref=\"refs/heads/$CONTEST_CONTENT_BRANCH\"\nelif
        [ -n \"$CONTEST_CONTENT_PR\" ]; then\n    ref=\"refs/pull/$CONTEST_CONTENT_PR/head\"\nelse\n
        \   exit 0\nfi\ncontent_dir=/root/upstream-content\n[ -e \"$content_dir\"
        ] || git init \"$content_dir\"\ncd \"$content_dir\"\nold_fetch_head=$(git
        rev-parse FETCH_HEAD 2>/dev/null) || true\ngit fetch --depth=1 https://github.com/ComplianceAsCode/content.git
        \"$ref\"\nnew_fetch_head=$(git rev-parse FETCH_HEAD)\nif [ \"$old_fetch_head\"
        != \"$new_fetch_head\" ]; then\n    # remove any previously built content\n
        \   git clean -ffdx\n    git checkout FETCH_HEAD\nfi\necho \"CONTEST_CONTENT=$content_dir\"
        >> \"$TMT_PLAN_ENVIRONMENT_FILE\"\n"
    - how: shell
      name: Update OpenSCAP from Packit (if specified)
      order: 50
      script:
      - "set -xe\n# both result in the same URL on fedoraproject.org\nif [ -n \"$CONTEST_OSCAP_BRANCH\"
        ]; then\n    ref=\"$CONTEST_OSCAP_BRANCH\"\nelif [ -n \"$CONTEST_OSCAP_PR\"
        ]; then\n    ref=\"$CONTEST_OSCAP_PR\"\nelse\n    exit 0\nfi\nrepofile=/etc/yum.repos.d/openscap-upstream-packit.repo\necho
        \"CONTEST_OSCAP_REPOFILE=$repofile\" >> \"$TMT_PLAN_ENVIRONMENT_FILE\"\nrm
        -f \"$repofile\"\nif rpm -q openscap-scanner; then\n    # the RPM might have
        been upgraded from another PR, sanitize it\n    dnf -q -y downgrade openscap-scanner\nelse\n
        \   # this runs before test dependencies are installed\n    dnf -q -y install
        openscap-scanner\nfi\n# download a Packit-provided repository\nmajor=$(. /etc/os-release
        && echo \"${VERSION_ID%%.*}\")\nrepourl=\"https://copr.fedorainfracloud.org/coprs/packit/OpenSCAP-openscap-$ref/repo/centos-stream-$major/packit-OpenSCAP-openscap-$ref-centos-stream-$major.repo\"\ncurl
        --retry 10 -sSfkL -o \"$repofile\" \"$repourl\"\ntrap \"rm -f \\\"$repofile\\\"\"
        ERR\n# check that the per-PR repo contains a newer build\nrc=0\ndnf -q check-upgrade
        openscap-scanner || rc=$?\nif [ \"$rc\" -ne 100 ]; then  # see dnf(8)\n    nvr=$(rpm
        -q openscap-scanner)\n    echo \"openscap-scanner from $ref doesn't upgrade
        existing $nvr\" >&2\n    false  # exit with ERR\nfi\ndnf -q -y upgrade openscap-scanner\n#
        invalidate VM snapshots\nrm -f /var/lib/libvirt/images/*.ready\n"
  provision:
    enabled: true
    phases:
    - become: false
      guest: 18.191.9.197
      hard-reboot: /opt/artemis-cli/bin/artemis-cli guest reboot 90f1e5ce-878c-4ea4-a34a-d8e0ad67782c
      how: connect
      key:
      - /etc/citool.d/id_rsa_artemis
      name: default-0
      order: 50
      port: 22
      user: root
  report:
    enabled: true
    phases:
    - display-guest: auto
      how: display
      name: default-0
      order: 50
  summary: Limited no-virt-HW CaC/content upstream testing as parallel plans
run:
  context:
    arch:
    - x86_64
    deployment:
    - prod
    distro:
    - centos-stream-8
    initiator:
    - packit
    trigger:
    - commit
  environment:
    PACKIT_BUILD_LOG_URL: https://download.copr.fedorainfracloud.org/results/packit/ComplianceAsCode-content-15029/centos-stream-8-x86_64/10888911-scap-security-guide/builder-live.log
    PACKIT_COMMIT_SHA: 49c1529930f7ebe2795facb21824d75edab16ac9
    PACKIT_COPR_BUILD_ID: '10888911'
    PACKIT_COPR_PROJECT: packit/ComplianceAsCode-content-15029
    PACKIT_COPR_RPMS: scap-security-guide-0.1.83-0.20260821155937945321.pr15029.20689.g1837c5ead0.el8.noarch
      scap-security-guide-doc-0.1.83-0.20260821155937945321.pr15029.20689.g1837c5ead0.el8.noarch
    PACKIT_DOWNSTREAM_NAME: scap-security-guide
    PACKIT_DOWNSTREAM_URL: https://src.fedoraproject.org/rpms/scap-security-guide.git
    PACKIT_FULL_REPO_NAME: ComplianceAsCode/content
    PACKIT_PACKAGE_NAME: scap-security-guide
    PACKIT_PACKAGE_NVR: scap-security-guide-0.1.83-0.20260821155937945321.pr15029.20689.g1837c5ead0.el8
    PACKIT_PR_ID: '15029'
    PACKIT_SOURCE_BRANCH: fix-hipaa-session-timeout
    PACKIT_SOURCE_SHA: 49c1529930f7ebe2795facb21824d75edab16ac9
    PACKIT_SOURCE_URL: https://github.com/ggbecker/content
    PACKIT_SRPM_URL: https://download.copr.fedorainfracloud.org/results/packit/ComplianceAsCode-content-15029/srpm-builds/10888911/scap-security-guide-0.1.83-0.20260821155937945321.pr15029.20689.g1837c5ead0.src.rpm
    PACKIT_TARGET_BRANCH: master
    PACKIT_TARGET_SHA: b3a2cca9352cbcefb7f00d770bfd6f679da18d6a
    PACKIT_TARGET_URL: https://github.com/ComplianceAsCode/content
    PACKIT_UPSTREAM_NAME: scap-security-guide
    TESTING_FARM_GIT_REF: main
    TESTING_FARM_GIT_URL: https://github.com/RHSecurityCompliance/contest.git
    TESTING_FARM_REQUEST_ID: d109fc76-6656-4052-b4fb-23efa8e45e96
    TESTING_FARM_TEST_TYPE: fmf
  remove: false
  root: /var/ARTIFACTS/git-main6lycf26k
