Remove CI.

keycloak_user: mark credentials[].value as no_log=True (#11005)

Mark credentials[].value as no_log=True.

(cherry picked from commit 54af64ad36)

Co-authored-by: Felix Fontein <felix@fontein.de>

.azure-pipelines/azure-pipelines.yml

@@ -1,434 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-trigger:
-  batch: true
-  branches:
-    include:
-      - main
-      - stable-*
-
-pr:
-  autoCancel: true
-  branches:
-    include:
-      - main
-      - stable-*
-
-schedules:
-  - cron: 0 8 * * *
-    displayName: Nightly (main)
-    always: true
-    branches:
-      include:
-        - main
-  - cron: 0 10 * * *
-    displayName: Nightly (active stable branches)
-    always: true
-    branches:
-      include:
-        - stable-10
-        - stable-9
-  - cron: 0 11 * * 0
-    displayName: Weekly (old stable branches)
-    always: true
-    branches:
-      include:
-        - stable-8
-
-variables:
-  - name: checkoutPath
-    value: ansible_collections/community/general
-  - name: coverageBranches
-    value: main
-  - name: entryPoint
-    value: tests/utils/shippable/shippable.sh
-  - name: fetchDepth
-    value: 0
-
-resources:
-  containers:
-    - container: default
-      image: quay.io/ansible/azure-pipelines-test-container:6.0.0
-
-pool: Standard
-
-stages:
-### Sanity
-  - stage: Sanity_devel
-    displayName: Sanity devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Test {0}
-          testFormat: devel/sanity/{0}
-          targets:
-            - test: 1
-            - test: 2
-            - test: 3
-            - test: 4
-            - test: extra
-  - stage: Sanity_2_18
-    displayName: Sanity 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Test {0}
-          testFormat: 2.18/sanity/{0}
-          targets:
-            - test: 1
-            - test: 2
-            - test: 3
-            - test: 4
-  - stage: Sanity_2_17
-    displayName: Sanity 2.17
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Test {0}
-          testFormat: 2.17/sanity/{0}
-          targets:
-            - test: 1
-            - test: 2
-            - test: 3
-            - test: 4
-  - stage: Sanity_2_16
-    displayName: Sanity 2.16
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Test {0}
-          testFormat: 2.16/sanity/{0}
-          targets:
-            - test: 1
-            - test: 2
-            - test: 3
-            - test: 4
-### Units
-  - stage: Units_devel
-    displayName: Units devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Python {0}
-          testFormat: devel/units/{0}/1
-          targets:
-            - test: 3.8
-            - test: 3.9
-            - test: '3.10'
-            - test: '3.11'
-            - test: '3.12'
-            - test: '3.13'
-  - stage: Units_2_18
-    displayName: Units 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Python {0}
-          testFormat: 2.18/units/{0}/1
-          targets:
-            - test: 3.8
-            - test: "3.13"
-  - stage: Units_2_17
-    displayName: Units 2.17
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Python {0}
-          testFormat: 2.17/units/{0}/1
-          targets:
-            - test: 3.7
-            - test: "3.12"
-  - stage: Units_2_16
-    displayName: Units 2.16
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Python {0}
-          testFormat: 2.16/units/{0}/1
-          targets:
-            - test: 2.7
-            - test: 3.6
-            - test: "3.11"
-
-## Remote
-  - stage: Remote_devel_extra_vms
-    displayName: Remote devel extra VMs
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/{0}
-          targets:
-            - name: Alpine 3.21
-              test: alpine/3.21
-            # - name: Fedora 41
-            #   test: fedora/41
-            - name: Ubuntu 22.04
-              test: ubuntu/22.04
-            - name: Ubuntu 24.04
-              test: ubuntu/24.04
-          groups:
-            - vm
-  - stage: Remote_devel
-    displayName: Remote devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/{0}
-          targets:
-            - name: macOS 14.3
-              test: macos/14.3
-            - name: RHEL 9.5
-              test: rhel/9.5
-            - name: FreeBSD 14.2
-              test: freebsd/14.2
-            - name: FreeBSD 13.4
-              test: freebsd/13.4
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Remote_2_18
-    displayName: Remote 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/{0}
-          targets:
-            - name: RHEL 9.4
-              test: rhel/9.4
-            - name: FreeBSD 14.1
-              test: freebsd/14.1
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Remote_2_17
-    displayName: Remote 2.17
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.17/{0}
-          targets:
-            - name: FreeBSD 13.3
-              test: freebsd/13.3
-            - name: RHEL 9.3
-              test: rhel/9.3
-            - name: FreeBSD 14.0
-              test: freebsd/14.0
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Remote_2_16
-    displayName: Remote 2.16
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.16/{0}
-          targets:
-            - name: macOS 13.2
-              test: macos/13.2
-            - name: RHEL 9.2
-              test: rhel/9.2
-            - name: RHEL 8.8
-              test: rhel/8.8
-            - name: RHEL 7.9
-              test: rhel/7.9
-            # - name: FreeBSD 13.2
-            #   test: freebsd/13.2
-          groups:
-            - 1
-            - 2
-            - 3
-
-### Docker
-  - stage: Docker_devel
-    displayName: Docker devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/linux/{0}
-          targets:
-            - name: Fedora 41
-              test: fedora41
-            - name: Alpine 3.21
-              test: alpine321
-            - name: Ubuntu 22.04
-              test: ubuntu2204
-            - name: Ubuntu 24.04
-              test: ubuntu2404
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Docker_2_18
-    displayName: Docker 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/linux/{0}
-          targets:
-            - name: Fedora 40
-              test: fedora40
-            - name: Alpine 3.20
-              test: alpine320
-            - name: Ubuntu 24.04
-              test: ubuntu2404
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Docker_2_17
-    displayName: Docker 2.17
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.17/linux/{0}
-          targets:
-            - name: Fedora 39
-              test: fedora39
-            - name: Alpine 3.19
-              test: alpine319
-            - name: Ubuntu 20.04
-              test: ubuntu2004
-          groups:
-            - 1
-            - 2
-            - 3
-  - stage: Docker_2_16
-    displayName: Docker 2.16
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.16/linux/{0}
-          targets:
-            - name: Fedora 38
-              test: fedora38
-            - name: openSUSE 15
-              test: opensuse15
-            - name: Alpine 3
-              test: alpine3
-            - name: CentOS 7
-              test: centos7
-          groups:
-            - 1
-            - 2
-            - 3
-
-### Community Docker
-  - stage: Docker_community_devel
-    displayName: Docker (community images) devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/linux-community/{0}
-          targets:
-            - name: Debian Bullseye
-              test: debian-bullseye/3.9
-            - name: Debian Bookworm
-              test: debian-bookworm/3.11
-            - name: ArchLinux
-              test: archlinux/3.13
-          groups:
-            - 1
-            - 2
-            - 3
-
-### Generic
-# Right now all generic tests are disabled. Uncomment when at least one of them is re-enabled.
-#  - stage: Generic_devel
-#    displayName: Generic devel
-#    dependsOn: []
-#    jobs:
-#      - template: templates/matrix.yml
-#        parameters:
-#          nameFormat: Python {0}
-#          testFormat: devel/generic/{0}/1
-#          targets:
-#            - test: '3.8'
-#            - test: '3.11'
-#            - test: '3.13'
-#  - stage: Generic_2_18
-#    displayName: Generic 2.18
-#    dependsOn: []
-#    jobs:
-#      - template: templates/matrix.yml
-#        parameters:
-#          nameFormat: Python {0}
-#          testFormat: 2.18/generic/{0}/1
-#          targets:
-#            - test: '3.8'
-#            - test: '3.13'
-#  - stage: Generic_2_17
-#    displayName: Generic 2.17
-#    dependsOn: []
-#    jobs:
-#      - template: templates/matrix.yml
-#        parameters:
-#          nameFormat: Python {0}
-#          testFormat: 2.17/generic/{0}/1
-#          targets:
-#            - test: '3.7'
-#            - test: '3.12'
-#  - stage: Generic_2_16
-#    displayName: Generic 2.16
-#    dependsOn: []
-#    jobs:
-#      - template: templates/matrix.yml
-#        parameters:
-#          nameFormat: Python {0}
-#          testFormat: 2.16/generic/{0}/1
-#          targets:
-#            - test: '2.7'
-#            - test: '3.6'
-#            - test: '3.11'
-
-  - stage: Summary
-    condition: succeededOrFailed()
-    dependsOn:
-      - Sanity_devel
-      - Sanity_2_18
-      - Sanity_2_17
-      - Sanity_2_16
-      - Units_devel
-      - Units_2_18
-      - Units_2_17
-      - Units_2_16
-      - Remote_devel_extra_vms
-      - Remote_devel
-      - Remote_2_18
-      - Remote_2_17
-      - Remote_2_16
-      - Docker_devel
-      - Docker_2_18
-      - Docker_2_17
-      - Docker_2_16
-      - Docker_community_devel
-# Right now all generic tests are disabled. Uncomment when at least one of them is re-enabled.
-#      - Generic_devel
-#      - Generic_2_18
-#      - Generic_2_17
-#      - Generic_2_16
-    jobs:
-      - template: templates/coverage.yml

.azure-pipelines/scripts/aggregate-coverage.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# Aggregate code coverage results for later processing.
-
-set -o pipefail -eu
-
-agent_temp_directory="$1"
-
-PATH="${PWD}/bin:${PATH}"
-
-mkdir "${agent_temp_directory}/coverage/"
-
-options=(--venv --venv-system-site-packages --color -v)
-
-ansible-test coverage combine --group-by command --export "${agent_temp_directory}/coverage/" "${options[@]}"
-
-if ansible-test coverage analyze targets generate --help >/dev/null 2>&1; then
-    # Only analyze coverage if the installed version of ansible-test supports it.
-    # Doing so allows this script to work unmodified for multiple Ansible versions.
-    ansible-test coverage analyze targets generate "${agent_temp_directory}/coverage/coverage-analyze-targets.json" "${options[@]}"
-fi

.azure-pipelines/scripts/combine-coverage.py

@@ -1,64 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""
-Combine coverage data from multiple jobs, keeping the data only from the most recent attempt from each job.
-Coverage artifacts must be named using the format: "Coverage $(System.JobAttempt) {StableUniqueNameForEachJob}"
-The recommended coverage artifact name format is: Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)
-Keep in mind that Azure Pipelines does not enforce unique job display names (only names).
-It is up to pipeline authors to avoid name collisions when deviating from the recommended format.
-"""
-
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import os
-import re
-import shutil
-import sys
-
-
-def main():
-    """Main program entry point."""
-    source_directory = sys.argv[1]
-
-    if '/ansible_collections/' in os.getcwd():
-        output_path = "tests/output"
-    else:
-        output_path = "test/results"
-
-    destination_directory = os.path.join(output_path, 'coverage')
-
-    if not os.path.exists(destination_directory):
-        os.makedirs(destination_directory)
-
-    jobs = {}
-    count = 0
-
-    for name in os.listdir(source_directory):
-        match = re.search('^Coverage (?P<attempt>[0-9]+) (?P<label>.+)$', name)
-        label = match.group('label')
-        attempt = int(match.group('attempt'))
-        jobs[label] = max(attempt, jobs.get(label, 0))
-
-    for label, attempt in jobs.items():
-        name = 'Coverage {attempt} {label}'.format(label=label, attempt=attempt)
-        source = os.path.join(source_directory, name)
-        source_files = os.listdir(source)
-
-        for source_file in source_files:
-            source_path = os.path.join(source, source_file)
-            destination_path = os.path.join(destination_directory, source_file + '.' + label)
-            print('"%s" -> "%s"' % (source_path, destination_path))
-            shutil.copyfile(source_path, destination_path)
-            count += 1
-
-    print('Coverage file count: %d' % count)
-    print('##vso[task.setVariable variable=coverageFileCount]%d' % count)
-    print('##vso[task.setVariable variable=outputPath]%s' % output_path)
-
-
-if __name__ == '__main__':
-    main()

.azure-pipelines/scripts/process-results.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# Check the test results and set variables for use in later steps.
-
-set -o pipefail -eu
-
-if [[ "$PWD" =~ /ansible_collections/ ]]; then
-    output_path="tests/output"
-else
-    output_path="test/results"
-fi
-
-echo "##vso[task.setVariable variable=outputPath]${output_path}"
-
-if compgen -G "${output_path}"'/junit/*.xml' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveTestResults]true"
-fi
-
-if compgen -G "${output_path}"'/bot/ansible-test-*' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveBotResults]true"
-fi
-
-if compgen -G "${output_path}"'/coverage/*' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveCoverageData]true"
-fi

.azure-pipelines/scripts/publish-codecov.py

@@ -1,105 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""
-Upload code coverage reports to codecov.io.
-Multiple coverage files from multiple languages are accepted and aggregated after upload.
-Python coverage, as well as PowerShell and Python stubs can all be uploaded.
-"""
-
-import argparse
-import dataclasses
-import pathlib
-import shutil
-import subprocess
-import tempfile
-import typing as t
-import urllib.request
-
-
-@dataclasses.dataclass(frozen=True)
-class CoverageFile:
-    name: str
-    path: pathlib.Path
-    flags: t.List[str]
-
-
-@dataclasses.dataclass(frozen=True)
-class Args:
-    dry_run: bool
-    path: pathlib.Path
-
-
-def parse_args() -> Args:
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-n', '--dry-run', action='store_true')
-    parser.add_argument('path', type=pathlib.Path)
-
-    args = parser.parse_args()
-
-    # Store arguments in a typed dataclass
-    fields = dataclasses.fields(Args)
-    kwargs = {field.name: getattr(args, field.name) for field in fields}
-
-    return Args(**kwargs)
-
-
-def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
-    processed = []
-    for file in directory.joinpath('reports').glob('coverage*.xml'):
-        name = file.stem.replace('coverage=', '')
-
-        # Get flags from name
-        flags = name.replace('-powershell', '').split('=')  # Drop '-powershell' suffix
-        flags = [flag if not flag.startswith('stub') else flag.split('-')[0] for flag in flags]  # Remove "-01" from stub files
-
-        processed.append(CoverageFile(name, file, flags))
-
-    return tuple(processed)
-
-
-def upload_files(codecov_bin: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
-    for file in files:
-        cmd = [
-            str(codecov_bin),
-            '--name', file.name,
-            '--file', str(file.path),
-        ]
-        for flag in file.flags:
-            cmd.extend(['--flags', flag])
-
-        if dry_run:
-            print(f'DRY-RUN: Would run command: {cmd}')
-            continue
-
-        subprocess.run(cmd, check=True)
-
-
-def download_file(url: str, dest: pathlib.Path, flags: int, dry_run: bool = False) -> None:
-    if dry_run:
-        print(f'DRY-RUN: Would download {url} to {dest} and set mode to {flags:o}')
-        return
-
-    with urllib.request.urlopen(url) as resp:
-        with dest.open('w+b') as f:
-            # Read data in chunks rather than all at once
-            shutil.copyfileobj(resp, f, 64 * 1024)
-
-    dest.chmod(flags)
-
-
-def main():
-    args = parse_args()
-    url = 'https://ansible-ci-files.s3.amazonaws.com/codecov/linux/codecov'
-    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
-        codecov_bin = pathlib.Path(tmpdir) / 'codecov'
-        download_file(url, codecov_bin, 0o755, args.dry_run)
-
-        files = process_files(args.path)
-        upload_files(codecov_bin, files, args.dry_run)
-
-
-if __name__ == '__main__':
-    main()

.azure-pipelines/scripts/report-coverage.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# Generate code coverage reports for uploading to Azure Pipelines and codecov.io.
-
-set -o pipefail -eu
-
-PATH="${PWD}/bin:${PATH}"
-
-if ! ansible-test --help >/dev/null 2>&1; then
-    # Install the devel version of ansible-test for generating code coverage reports.
-    # This is only used by Ansible Collections, which are typically tested against multiple Ansible versions (in separate jobs).
-    # Since a version of ansible-test is required that can work the output from multiple older releases, the devel version is used.
-    pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
-fi
-
-ansible-test coverage xml --group-by command --stub --venv --venv-system-site-packages --color -v

.azure-pipelines/scripts/run-tests.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# Configure the test environment and run the tests.
-
-set -o pipefail -eu
-
-entry_point="$1"
-test="$2"
-read -r -a coverage_branches <<< "$3"  # space separated list of branches to run code coverage on for scheduled builds
-
-export COMMIT_MESSAGE
-export COMPLETE
-export COVERAGE
-export IS_PULL_REQUEST
-
-if [ "${SYSTEM_PULLREQUEST_TARGETBRANCH:-}" ]; then
-    IS_PULL_REQUEST=true
-    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD^2)
-else
-    IS_PULL_REQUEST=
-    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD)
-fi
-
-COMPLETE=
-COVERAGE=
-
-if [ "${BUILD_REASON}" = "Schedule" ]; then
-    COMPLETE=yes
-
-    if printf '%s\n' "${coverage_branches[@]}" | grep -q "^${BUILD_SOURCEBRANCHNAME}$"; then
-        COVERAGE=yes
-    fi
-fi
-
-"${entry_point}" "${test}" 2>&1 | "$(dirname "$0")/time-command.py"

.azure-pipelines/scripts/time-command.py

@@ -1,29 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""Prepends a relative timestamp to each input line from stdin and writes it to stdout."""
-
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import sys
-import time
-
-
-def main():
-    """Main program entry point."""
-    start = time.time()
-
-    sys.stdin.reconfigure(errors='surrogateescape')
-    sys.stdout.reconfigure(errors='surrogateescape')
-
-    for line in sys.stdin:
-        seconds = time.time() - start
-        sys.stdout.write('%02d:%02d %s' % (seconds // 60, seconds % 60, line))
-        sys.stdout.flush()
-
-
-if __name__ == '__main__':
-    main()

.azure-pipelines/templates/coverage.yml

@@ -1,34 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# This template adds a job for processing code coverage data.
-# It will upload results to Azure Pipelines and codecov.io.
-# Use it from a job stage that completes after all other jobs have completed.
-# This can be done by placing it in a separate summary stage that runs after the test stage(s) have completed.
-
-jobs:
-  - job: Coverage
-    displayName: Code Coverage
-    container: default
-    workspace:
-      clean: all
-    steps:
-      - checkout: self
-        fetchDepth: $(fetchDepth)
-        path: $(checkoutPath)
-      - task: DownloadPipelineArtifact@2
-        displayName: Download Coverage Data
-        inputs:
-          path: coverage/
-          patterns: "Coverage */*=coverage.combined"
-      - bash: .azure-pipelines/scripts/combine-coverage.py coverage/
-        displayName: Combine Coverage Data
-      - bash: .azure-pipelines/scripts/report-coverage.sh
-        displayName: Generate Coverage Report
-        condition: gt(variables.coverageFileCount, 0)
-      - bash: .azure-pipelines/scripts/publish-codecov.py "$(outputPath)"
-        displayName: Publish to codecov.io
-        condition: gt(variables.coverageFileCount, 0)
-        continueOnError: true

.azure-pipelines/templates/matrix.yml

@@ -1,60 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# This template uses the provided targets and optional groups to generate a matrix which is then passed to the test template.
-# If this matrix template does not provide the required functionality, consider using the test template directly instead.
-
-parameters:
-  # A required list of dictionaries, one per test target.
-  # Each item in the list must contain a "test" or "name" key.
-  # Both may be provided. If one is omitted, the other will be used.
-  - name: targets
-    type: object
-
-  # An optional list of values which will be used to multiply the targets list into a matrix.
-  # Values can be strings or numbers.
-  - name: groups
-    type: object
-    default: []
-
-  # An optional format string used to generate the job name.
-  # - {0} is the name of an item in the targets list.
-  - name: nameFormat
-    type: string
-    default: "{0}"
-
-  # An optional format string used to generate the test name.
-  # - {0} is the name of an item in the targets list.
-  - name: testFormat
-    type: string
-    default: "{0}"
-
-  # An optional format string used to add the group to the job name.
-  # {0} is the formatted name of an item in the targets list.
-  # {{1}} is the group -- be sure to include the double "{{" and "}}".
-  - name: nameGroupFormat
-    type: string
-    default: "{0} - {{1}}"
-
-  # An optional format string used to add the group to the test name.
-  # {0} is the formatted test of an item in the targets list.
-  # {{1}} is the group -- be sure to include the double "{{" and "}}".
-  - name: testGroupFormat
-    type: string
-    default: "{0}/{{1}}"
-
-jobs:
-  - template: test.yml
-    parameters:
-      jobs:
-        - ${{ if eq(length(parameters.groups), 0) }}:
-          - ${{ each target in parameters.targets }}:
-            - name: ${{ format(parameters.nameFormat, coalesce(target.name, target.test)) }}
-              test: ${{ format(parameters.testFormat, coalesce(target.test, target.name)) }}
-        - ${{ if not(eq(length(parameters.groups), 0)) }}:
-          - ${{ each group in parameters.groups }}:
-            - ${{ each target in parameters.targets }}:
-              - name: ${{ format(format(parameters.nameGroupFormat, parameters.nameFormat), coalesce(target.name, target.test), group) }}
-                test: ${{ format(format(parameters.testGroupFormat, parameters.testFormat), coalesce(target.test, target.name), group) }}

.azure-pipelines/templates/test.yml

@@ -1,50 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# This template uses the provided list of jobs to create test one or more test jobs.
-# It can be used directly if needed, or through the matrix template.
-
-parameters:
-  # A required list of dictionaries, one per test job.
-  # Each item in the list must contain a "job" and "name" key.
-  - name: jobs
-    type: object
-
-jobs:
-  - ${{ each job in parameters.jobs }}:
-    - job: test_${{ replace(replace(replace(job.test, '/', '_'), '.', '_'), '-', '_') }}
-      displayName: ${{ job.name }}
-      container: default
-      workspace:
-        clean: all
-      steps:
-        - checkout: self
-          fetchDepth: $(fetchDepth)
-          path: $(checkoutPath)
-        - bash: .azure-pipelines/scripts/run-tests.sh "$(entryPoint)" "${{ job.test }}" "$(coverageBranches)"
-          displayName: Run Tests
-        - bash: .azure-pipelines/scripts/process-results.sh
-          condition: succeededOrFailed()
-          displayName: Process Results
-        - bash: .azure-pipelines/scripts/aggregate-coverage.sh "$(Agent.TempDirectory)"
-          condition: eq(variables.haveCoverageData, 'true')
-          displayName: Aggregate Coverage Data
-        - task: PublishTestResults@2
-          condition: eq(variables.haveTestResults, 'true')
-          inputs:
-            testResultsFiles: "$(outputPath)/junit/*.xml"
-          displayName: Publish Test Results
-        - task: PublishPipelineArtifact@1
-          condition: eq(variables.haveBotResults, 'true')
-          displayName: Publish Bot Results
-          inputs:
-            targetPath: "$(outputPath)/bot/"
-            artifactName: "Bot $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)"
-        - task: PublishPipelineArtifact@1
-          condition: eq(variables.haveCoverageData, 'true')
-          displayName: Publish Coverage Data
-          inputs:
-            targetPath: "$(Agent.TempDirectory)/coverage/"
-            artifactName: "Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)"

.github/workflows/ansible-test.yml

@@ -1,226 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-# For the comprehensive list of the inputs supported by the ansible-community/ansible-test-gh-action GitHub Action, see
-# https://github.com/marketplace/actions/ansible-test
-
-name: EOL CI
-on:
-  # Run EOL CI against all pushes (direct commits, also merged PRs), Pull Requests
-  push:
-    branches:
-      - main
-      - stable-*
-  pull_request:
-  # Run EOL CI once per day (at 08:00 UTC)
-  schedule:
-    - cron: '0 8 * * *'
-
-concurrency:
-  # Make sure there is at most one active run per PR, but do not cancel any non-PR runs
-  group: ${{ github.workflow }}-${{ (github.head_ref && github.event.number) || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  sanity:
-    name: EOL Sanity (Ⓐ${{ matrix.ansible }})
-    strategy:
-      matrix:
-        ansible:
-          - '2.13'
-          - '2.14'
-          - '2.15'
-    # Ansible-test on various stable branches does not yet work well with cgroups v2.
-    # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04
-    # image for these stable branches. The list of branches where this is necessary will
-    # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28
-    # for the latest list.
-    runs-on: ubuntu-latest
-    steps:
-      - name: Perform sanity testing
-        uses: felixfontein/ansible-test-gh-action@main
-        with:
-          ansible-core-version: stable-${{ matrix.ansible }}
-          codecov-token: ${{ secrets.CODECOV_TOKEN }}
-          coverage: ${{ github.event_name == 'schedule' && 'always' || 'never' }}
-          pull-request-change-detection: 'true'
-          testing-type: sanity
-
-  units:
-    # Ansible-test on various stable branches does not yet work well with cgroups v2.
-    # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04
-    # image for these stable branches. The list of branches where this is necessary will
-    # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28
-    # for the latest list.
-    runs-on: ubuntu-latest
-    name: EOL Units (Ⓐ${{ matrix.ansible }}+py${{ matrix.python }})
-    strategy:
-      # As soon as the first unit test fails, cancel the others to free up the CI queue
-      fail-fast: true
-      matrix:
-        ansible:
-          - ''
-        python:
-          - ''
-        exclude:
-          - ansible: ''
-        include:
-          - ansible: '2.13'
-            python: '2.7'
-          - ansible: '2.13'
-            python: '3.8'
-          - ansible: '2.13'
-            python: '2.7'
-          - ansible: '2.13'
-            python: '3.8'
-          - ansible: '2.14'
-            python: '3.9'
-          - ansible: '2.15'
-            python: '3.5'
-          - ansible: '2.15'
-            python: '3.10'
-
-    steps:
-      - name: >-
-          Perform unit testing against
-          Ansible version ${{ matrix.ansible }}
-        uses: felixfontein/ansible-test-gh-action@main
-        with:
-          ansible-core-version: stable-${{ matrix.ansible }}
-          codecov-token: ${{ secrets.CODECOV_TOKEN }}
-          coverage: ${{ github.event_name == 'schedule' && 'always' || 'never' }}
-          pre-test-cmd: >-
-            mkdir -p ../../ansible
-            ;
-            git clone --depth=1 --single-branch https://github.com/ansible-collections/community.internal_test_tools.git ../../community/internal_test_tools
-          pull-request-change-detection: 'true'
-          target-python-version: ${{ matrix.python }}
-          testing-type: units
-
-  integration:
-    # Ansible-test on various stable branches does not yet work well with cgroups v2.
-    # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04
-    # image for these stable branches. The list of branches where this is necessary will
-    # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28
-    # for the latest list.
-    runs-on: ubuntu-latest
-    name: EOL I (Ⓐ${{ matrix.ansible }}+${{ matrix.docker }}+py${{ matrix.python }}:${{ matrix.target }})
-    strategy:
-      fail-fast: false
-      matrix:
-        ansible:
-          - ''
-        docker:
-          - ''
-        python:
-          - ''
-        target:
-          - ''
-        exclude:
-          - ansible: ''
-        include:
-          # 2.13
-          - ansible: '2.13'
-            docker: fedora35
-            python: ''
-            target: azp/posix/1/
-          - ansible: '2.13'
-            docker: fedora35
-            python: ''
-            target: azp/posix/2/
-          - ansible: '2.13'
-            docker: fedora35
-            python: ''
-            target: azp/posix/3/
-          - ansible: '2.13'
-            docker: opensuse15py2
-            python: ''
-            target: azp/posix/1/
-          - ansible: '2.13'
-            docker: opensuse15py2
-            python: ''
-            target: azp/posix/2/
-          - ansible: '2.13'
-            docker: opensuse15py2
-            python: ''
-            target: azp/posix/3/
-          - ansible: '2.13'
-            docker: alpine3
-            python: ''
-            target: azp/posix/1/
-          - ansible: '2.13'
-            docker: alpine3
-            python: ''
-            target: azp/posix/2/
-          - ansible: '2.13'
-            docker: alpine3
-            python: ''
-            target: azp/posix/3/
-          # 2.14
-          - ansible: '2.14'
-            docker: alpine3
-            python: ''
-            target: azp/posix/1/
-          - ansible: '2.14'
-            docker: alpine3
-            python: ''
-            target: azp/posix/2/
-          - ansible: '2.14'
-            docker: alpine3
-            python: ''
-            target: azp/posix/3/
-          # 2.15
-          - ansible: '2.15'
-            docker: fedora37
-            python: ''
-            target: azp/posix/1/
-          - ansible: '2.15'
-            docker: fedora37
-            python: ''
-            target: azp/posix/2/
-          - ansible: '2.15'
-            docker: fedora37
-            python: ''
-            target: azp/posix/3/
-          # Right now all generic tests are disabled. Uncomment when at least one of them is re-enabled.
-          # - ansible: '2.13'
-          #   docker: default
-          #   python: '3.9'
-          #   target: azp/generic/1/
-          # - ansible: '2.14'
-          #   docker: default
-          #   python: '3.10'
-          #   target: azp/generic/1/
-          # - ansible: '2.15'
-          #   docker: default
-          #   python: '3.9'
-          #   target: azp/generic/1/
-
-    steps:
-      - name: >-
-          Perform integration testing against
-          Ansible version ${{ matrix.ansible }}
-          under Python ${{ matrix.python }}
-        uses: felixfontein/ansible-test-gh-action@main
-        with:
-          ansible-core-version: stable-${{ matrix.ansible }}
-          codecov-token: ${{ secrets.CODECOV_TOKEN }}
-          coverage: ${{ github.event_name == 'schedule' && 'always' || 'never' }}
-          docker-image: ${{ matrix.docker }}
-          integration-continue-on-error: 'false'
-          integration-diff: 'false'
-          integration-retry-on-error: 'true'
-          pre-test-cmd: >-
-            mkdir -p ../../ansible
-            ;
-            git clone --depth=1 --single-branch https://github.com/ansible-collections/ansible.posix.git ../../ansible/posix
-            ;
-            git clone --depth=1 --single-branch https://github.com/ansible-collections/community.crypto.git ../../community/crypto
-            ;
-            git clone --depth=1 --single-branch https://github.com/ansible-collections/community.internal_test_tools.git ../../community/internal_test_tools
-          pull-request-change-detection: 'true'
-          target: ${{ matrix.target }}
-          target-python-version: ${{ matrix.python }}
-          testing-type: integration

.github/workflows/codeql-analysis.yml

@@ -1,38 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-name: "Code scanning - action"
-
-on:
-  schedule:
-    - cron: '26 19 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  CodeQL-Build:
-
-    permissions:
-      actions: read  # for github/codeql-action/init to get workflow details
-      contents: read  # for actions/checkout to fetch code
-      security-events: write  # for github/codeql-action/autobuild to send a status report
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        persist-credentials: false
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: python
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3

.github/workflows/import-galaxy.yml

@@ -1,20 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-name: import-galaxy
-'on':
-  # Run CI against all pushes (direct commits, also merged PRs) to main, and all Pull Requests
-  push:
-    branches:
-      - main
-      - stable-*
-  pull_request:
-
-jobs:
-  import-galaxy:
-    permissions:
-      contents: read
-    name: Test to import built collection artifact with Galaxy importer
-    uses: ansible-community/github-action-test-galaxy-import/.github/workflows/test-galaxy-import.yml@main

.github/workflows/reuse.yml

@@ -1,35 +0,0 @@
----
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-name: Verify REUSE
-
-on:
-  push:
-    branches:
-      - main
-      - stable-*
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
-      - stable-*
-  # Run CI once per day (at 07:30 UTC)
-  schedule:
-    - cron: '30 7 * * *'
-
-jobs:
-  check:
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          ref: ${{ github.event.pull_request.head.sha || '' }}
-
-      - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v5

.gitignore

@@ -383,6 +383,16 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
 
+### Python Patch ###
+# Poetry local configuration file - https://python-poetry.org/docs/configuration/#local-configuration
+poetry.toml
+
+# ruff
+.ruff_cache/
+
+# LSP config files
+pyrightconfig.json
+
 ### Vim ###
 # Swap
 [._]*.s[a-v][a-z]
@@ -482,6 +492,10 @@ tags
 # https://plugins.jetbrains.com/plugin/12206-codestream
 .idea/codestream.xml
 
+# Azure Toolkit for IntelliJ plugin
+# https://plugins.jetbrains.com/plugin/8053-azure-toolkit-for-intellij
+.idea/**/azureSettings.xml
+
 ### Windows ###
 # Windows thumbnail cache files
 Thumbs.db

.reuse/dep5

@@ -1,5 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-
-Files: changelogs/fragments/*
-Copyright: Ansible Project
-License: GPL-3.0-or-later

CHANGELOG.md

@@ -2,70 +2,97 @@
 
 **Topics**
 
-- <a href="#v9-5-5">v9\.5\.5</a>
+- <a href="#v9-5-13">v9\.5\.13</a>
     - <a href="#release-summary">Release Summary</a>
-    - <a href="#bugfixes">Bugfixes</a>
-- <a href="#v9-5-4">v9\.5\.4</a>
     - <a href="#security-fixes">Security Fixes</a>
-    - <a href="#bugfixes-1">Bugfixes</a>
-- <a href="#v9-5-3">v9\.5\.3</a>
+- <a href="#v9-5-12">v9\.5\.12</a>
     - <a href="#release-summary-1">Release Summary</a>
-    - <a href="#minor-changes">Minor Changes</a>
-    - <a href="#security-fixes-1">Security Fixes</a>
-    - <a href="#bugfixes-2">Bugfixes</a>
-- <a href="#v9-5-2">v9\.5\.2</a>
+    - <a href="#bugfixes">Bugfixes</a>
+- <a href="#v9-5-11">v9\.5\.11</a>
     - <a href="#release-summary-2">Release Summary</a>
-    - <a href="#minor-changes-1">Minor Changes</a>
-    - <a href="#bugfixes-3">Bugfixes</a>
-- <a href="#v9-5-1">v9\.5\.1</a>
+    - <a href="#bugfixes-1">Bugfixes</a>
+- <a href="#v9-5-10">v9\.5\.10</a>
     - <a href="#release-summary-3">Release Summary</a>
-    - <a href="#minor-changes-2">Minor Changes</a>
-    - <a href="#bugfixes-4">Bugfixes</a>
-- <a href="#v9-5-0">v9\.5\.0</a>
+    - <a href="#bugfixes-2">Bugfixes</a>
+- <a href="#v9-5-9">v9\.5\.9</a>
     - <a href="#release-summary-4">Release Summary</a>
-    - <a href="#minor-changes-3">Minor Changes</a>
-    - <a href="#deprecated-features">Deprecated Features</a>
+    - <a href="#bugfixes-3">Bugfixes</a>
+- <a href="#v9-5-8">v9\.5\.8</a>
+    - <a href="#release-summary-5">Release Summary</a>
+    - <a href="#bugfixes-4">Bugfixes</a>
+- <a href="#v9-5-7">v9\.5\.7</a>
+    - <a href="#release-summary-6">Release Summary</a>
+    - <a href="#minor-changes">Minor Changes</a>
     - <a href="#bugfixes-5">Bugfixes</a>
+    - <a href="#known-issues">Known Issues</a>
+- <a href="#v9-5-6">v9\.5\.6</a>
+    - <a href="#release-summary-7">Release Summary</a>
+    - <a href="#minor-changes-1">Minor Changes</a>
+    - <a href="#bugfixes-6">Bugfixes</a>
+- <a href="#v9-5-5">v9\.5\.5</a>
+    - <a href="#release-summary-8">Release Summary</a>
+    - <a href="#bugfixes-7">Bugfixes</a>
+- <a href="#v9-5-4">v9\.5\.4</a>
+    - <a href="#security-fixes-1">Security Fixes</a>
+    - <a href="#bugfixes-8">Bugfixes</a>
+- <a href="#v9-5-3">v9\.5\.3</a>
+    - <a href="#release-summary-9">Release Summary</a>
+    - <a href="#minor-changes-2">Minor Changes</a>
+    - <a href="#security-fixes-2">Security Fixes</a>
+    - <a href="#bugfixes-9">Bugfixes</a>
+- <a href="#v9-5-2">v9\.5\.2</a>
+    - <a href="#release-summary-10">Release Summary</a>
+    - <a href="#minor-changes-3">Minor Changes</a>
+    - <a href="#bugfixes-10">Bugfixes</a>
+- <a href="#v9-5-1">v9\.5\.1</a>
+    - <a href="#release-summary-11">Release Summary</a>
+    - <a href="#minor-changes-4">Minor Changes</a>
+    - <a href="#bugfixes-11">Bugfixes</a>
+- <a href="#v9-5-0">v9\.5\.0</a>
+    - <a href="#release-summary-12">Release Summary</a>
+    - <a href="#minor-changes-5">Minor Changes</a>
+    - <a href="#deprecated-features">Deprecated Features</a>
+    - <a href="#bugfixes-12">Bugfixes</a>
     - <a href="#new-modules">New Modules</a>
 - <a href="#v9-4-0">v9\.4\.0</a>
-    - <a href="#release-summary-5">Release Summary</a>
-    - <a href="#minor-changes-4">Minor Changes</a>
+    - <a href="#release-summary-13">Release Summary</a>
+    - <a href="#minor-changes-6">Minor Changes</a>
     - <a href="#deprecated-features-1">Deprecated Features</a>
-    - <a href="#bugfixes-6">Bugfixes</a>
+    - <a href="#bugfixes-13">Bugfixes</a>
     - <a href="#new-modules-1">New Modules</a>
 - <a href="#v9-3-0">v9\.3\.0</a>
-    - <a href="#release-summary-6">Release Summary</a>
-    - <a href="#minor-changes-5">Minor Changes</a>
-    - <a href="#bugfixes-7">Bugfixes</a>
+    - <a href="#release-summary-14">Release Summary</a>
+    - <a href="#minor-changes-7">Minor Changes</a>
+    - <a href="#bugfixes-14">Bugfixes</a>
     - <a href="#new-modules-2">New Modules</a>
 - <a href="#v9-2-0">v9\.2\.0</a>
-    - <a href="#release-summary-7">Release Summary</a>
-    - <a href="#minor-changes-6">Minor Changes</a>
-    - <a href="#bugfixes-8">Bugfixes</a>
+    - <a href="#release-summary-15">Release Summary</a>
+    - <a href="#minor-changes-8">Minor Changes</a>
+    - <a href="#bugfixes-15">Bugfixes</a>
     - <a href="#new-plugins">New Plugins</a>
         - <a href="#filter">Filter</a>
         - <a href="#test">Test</a>
 - <a href="#v9-1-0">v9\.1\.0</a>
-    - <a href="#release-summary-8">Release Summary</a>
-    - <a href="#minor-changes-7">Minor Changes</a>
+    - <a href="#release-summary-16">Release Summary</a>
+    - <a href="#minor-changes-9">Minor Changes</a>
     - <a href="#deprecated-features-2">Deprecated Features</a>
-    - <a href="#bugfixes-9">Bugfixes</a>
-    - <a href="#known-issues">Known Issues</a>
+    - <a href="#bugfixes-16">Bugfixes</a>
+    - <a href="#known-issues-1">Known Issues</a>
     - <a href="#new-plugins-1">New Plugins</a>
         - <a href="#filter-1">Filter</a>
     - <a href="#new-modules-3">New Modules</a>
 - <a href="#v9-0-1">v9\.0\.1</a>
-    - <a href="#release-summary-9">Release Summary</a>
-    - <a href="#minor-changes-8">Minor Changes</a>
-    - <a href="#bugfixes-10">Bugfixes</a>
+    - <a href="#release-summary-17">Release Summary</a>
+    - <a href="#minor-changes-10">Minor Changes</a>
+    - <a href="#bugfixes-17">Bugfixes</a>
 - <a href="#v9-0-0">v9\.0\.0</a>
-    - <a href="#release-summary-10">Release Summary</a>
-    - <a href="#minor-changes-9">Minor Changes</a>
+    - <a href="#release-summary-18">Release Summary</a>
+    - <a href="#minor-changes-11">Minor Changes</a>
     - <a href="#breaking-changes--porting-guide">Breaking Changes / Porting Guide</a>
     - <a href="#deprecated-features-3">Deprecated Features</a>
     - <a href="#removed-features-previously-deprecated">Removed Features \(previously deprecated\)</a>
-    - <a href="#security-fixes-2">Security Fixes</a>
-    - <a href="#bugfixes-11">Bugfixes</a>
+    - <a href="#security-fixes-3">Security Fixes</a>
+    - <a href="#bugfixes-18">Bugfixes</a>
     - <a href="#new-plugins-2">New Plugins</a>
         - <a href="#become">Become</a>
         - <a href="#callback">Callback</a>
@@ -76,17 +103,176 @@
     - <a href="#new-modules-4">New Modules</a>
 This changelog describes changes after version 8\.0\.0\.
 
-<a id="v9-5-5"></a>
-## v9\.5\.5
+<a id="v9-5-13"></a>
+## v9\.5\.13
 
 <a id="release-summary"></a>
 ### Release Summary
 
-Regular bugfix release\.
+Final maintenance release\.
+
+This is the last community\.general 9\.x\.y release\.
+Please upgrade to community\.general 10\.x\.y\, 11\.x\.y\, or 12\.x\.y\.
+Thanks a lot to everyone who contributed to a 9\.x\.y release\!
+
+<a id="security-fixes"></a>
+### Security Fixes
+
+* keycloak\_user \- the parameter <code>credentials\[\]\.value</code> is now marked as <code>no\_log\=true</code>\. Before it was logged by Ansible\, unless the task was marked as <code>no\_log\: true</code>\. Since this parameter can be used for passwords\, this resulted in credential leaking \([https\://github\.com/ansible\-collections/community\.general/issues/11000](https\://github\.com/ansible\-collections/community\.general/issues/11000)\, [https\://github\.com/ansible\-collections/community\.general/pull/11005](https\://github\.com/ansible\-collections/community\.general/pull/11005)\)\.
+
+<a id="v9-5-12"></a>
+## v9\.5\.12
+
+<a id="release-summary-1"></a>
+### Release Summary
+
+Bugfix release\.
 
 <a id="bugfixes"></a>
 ### Bugfixes
 
+* github\_deploy\_key \- fix bug during error handling if no body was present in the result \([https\://github\.com/ansible\-collections/community\.general/issues/10853](https\://github\.com/ansible\-collections/community\.general/issues/10853)\, [https\://github\.com/ansible\-collections/community\.general/pull/10857](https\://github\.com/ansible\-collections/community\.general/pull/10857)\)\.
+* yaml cache plugin \- make compatible with ansible\-core 2\.19 \([https\://github\.com/ansible\-collections/community\.general/issues/10849](https\://github\.com/ansible\-collections/community\.general/issues/10849)\, [https\://github\.com/ansible\-collections/community\.general/issues/10852](https\://github\.com/ansible\-collections/community\.general/issues/10852)\)\.
+
+<a id="v9-5-11"></a>
+## v9\.5\.11
+
+<a id="release-summary-2"></a>
+### Release Summary
+
+Bugfix release\.
+
+<a id="bugfixes-1"></a>
+### Bugfixes
+
+* apache2\_module \- avoid ansible\-core 2\.19 deprecation \([https\://github\.com/ansible\-collections/community\.general/pull/10459](https\://github\.com/ansible\-collections/community\.general/pull/10459)\)\.
+* doas become plugin \- disable pipelining on ansible\-core 2\.19\+\. The plugin does not work with pipelining\, and since ansible\-core 2\.19 become plugins can indicate that they do not work with pipelining \([https\://github\.com/ansible\-collections/community\.general/issues/9977](https\://github\.com/ansible\-collections/community\.general/issues/9977)\, [https\://github\.com/ansible\-collections/community\.general/pull/10537](https\://github\.com/ansible\-collections/community\.general/pull/10537)\)\.
+* htpasswd \- avoid ansible\-core 2\.19 deprecation \([https\://github\.com/ansible\-collections/community\.general/pull/10459](https\://github\.com/ansible\-collections/community\.general/pull/10459)\)\.
+* irc \- pass hostname to <code>wrap\_socket\(\)</code> if <code>use\_tls\=true</code> and <code>validate\_certs\=true</code> \([https\://github\.com/ansible\-collections/community\.general/issues/10472](https\://github\.com/ansible\-collections/community\.general/issues/10472)\, [https\://github\.com/ansible\-collections/community\.general/pull/10491](https\://github\.com/ansible\-collections/community\.general/pull/10491)\)\.
+* json\_query filter plugin \- make compatible with lazy evaluation list and dictionary types of ansible\-core 2\.19 \([https\://github\.com/ansible\-collections/community\.general/pull/10539](https\://github\.com/ansible\-collections/community\.general/pull/10539)\)\.
+* machinectl become plugin \- disable pipelining on ansible\-core 2\.19\+\. The plugin does not work with pipelining\, and since ansible\-core 2\.19 become plugins can indicate that they do not work with pipelining \([https\://github\.com/ansible\-collections/community\.general/pull/10537](https\://github\.com/ansible\-collections/community\.general/pull/10537)\)\.
+* merge\_variables lookup plugin \- avoid deprecated functionality from ansible\-core 2\.19 \([https\://github\.com/ansible\-collections/community\.general/pull/10566](https\://github\.com/ansible\-collections/community\.general/pull/10566)\)\.
+* proxmox inventory plugin \- avoid using deprecated option when templating options \([https\://github\.com/ansible\-collections/community\.proxmox/pull/108](https\://github\.com/ansible\-collections/community\.proxmox/pull/108)\, [https\://github\.com/ansible\-collections/community\.general/pull/10553](https\://github\.com/ansible\-collections/community\.general/pull/10553)\)\.
+* syspatch \- avoid ansible\-core 2\.19 deprecation \([https\://github\.com/ansible\-collections/community\.general/pull/10459](https\://github\.com/ansible\-collections/community\.general/pull/10459)\)\.
+* sysupgrade \- avoid ansible\-core 2\.19 deprecation \([https\://github\.com/ansible\-collections/community\.general/pull/10459](https\://github\.com/ansible\-collections/community\.general/pull/10459)\)\.
+* zypper\_repository \- avoid ansible\-core 2\.19 deprecation \([https\://github\.com/ansible\-collections/community\.general/pull/10459](https\://github\.com/ansible\-collections/community\.general/pull/10459)\)\.
+
+<a id="v9-5-10"></a>
+## v9\.5\.10
+
+<a id="release-summary-3"></a>
+### Release Summary
+
+Bugfix release with improved ansible\-core 2\.19 compatibility\.
+
+<a id="bugfixes-2"></a>
+### Bugfixes
+
+* dependent lookup plugin \- avoid deprecated ansible\-core 2\.19 functionality \([https\://github\.com/ansible\-collections/community\.general/pull/10359](https\://github\.com/ansible\-collections/community\.general/pull/10359)\)\.
+* icinga2 inventory plugin \- avoid using deprecated option when templating options \([https\://github\.com/ansible\-collections/community\.general/pull/10271](https\://github\.com/ansible\-collections/community\.general/pull/10271)\)\.
+* keycloak module\_utils \- fix call of method which does not exist in stable\-9\, which was introduced by backporting 8b1a193a \([https\://github\.com/ansible\-collections/community\.general/pull/10298](https\://github\.com/ansible\-collections/community\.general/pull/10298)\)\.
+* linode inventory plugin \- avoid using deprecated option when templating options \([https\://github\.com/ansible\-collections/community\.general/pull/10271](https\://github\.com/ansible\-collections/community\.general/pull/10271)\)\.
+
+<a id="v9-5-9"></a>
+## v9\.5\.9
+
+<a id="release-summary-4"></a>
+### Release Summary
+
+Bugfix release\.
+
+<a id="bugfixes-3"></a>
+### Bugfixes
+
+* yaml callback plugin \- adjust to latest changes in ansible\-core devel \([https\://github\.com/ansible\-collections/community\.general/pull/10212](https\://github\.com/ansible\-collections/community\.general/pull/10212)\)\.
+* yaml callback plugin \- when using ansible\-core 2\.19\.0b2 or newer\, uses a new utility provided by ansible\-core\. This allows us to remove all hacks and vendored code that was part of the plugin for ansible\-core versions with Data Tagging so far \([https\://github\.com/ansible\-collections/community\.general/pull/10242](https\://github\.com/ansible\-collections/community\.general/pull/10242)\)\.
+
+<a id="v9-5-8"></a>
+## v9\.5\.8
+
+<a id="release-summary-5"></a>
+### Release Summary
+
+Regular bugfix release\.
+
+<a id="bugfixes-4"></a>
+### Bugfixes
+
+* cobbler\_system \- fix bug with Cobbler \>\= 3\.4\.0 caused by giving more than 2 positional arguments to <code>CobblerXMLRPCInterface\.get\_system\_handle\(\)</code> \([https\://github\.com/ansible\-collections/community\.general/issues/8506](https\://github\.com/ansible\-collections/community\.general/issues/8506)\, [https\://github\.com/ansible\-collections/community\.general/pull/10145](https\://github\.com/ansible\-collections/community\.general/pull/10145)\)\.
+* kdeconfig \- allow option values beginning with a dash \([https\://github\.com/ansible\-collections/community\.general/issues/10127](https\://github\.com/ansible\-collections/community\.general/issues/10127)\, [https\://github\.com/ansible\-collections/community\.general/pull/10128](https\://github\.com/ansible\-collections/community\.general/pull/10128)\)\.
+* keycloak\_user\_rolemapping \- fix <code>\-\-diff</code> mode \([https\://github\.com/ansible\-collections/community\.general/issues/10067](https\://github\.com/ansible\-collections/community\.general/issues/10067)\, [https\://github\.com/ansible\-collections/community\.general/pull/10075](https\://github\.com/ansible\-collections/community\.general/pull/10075)\)\.
+* pickle cache plugin \- avoid extra JSON serialization with ansible\-core \>\= 2\.19 \([https\://github\.com/ansible\-collections/community\.general/pull/10136](https\://github\.com/ansible\-collections/community\.general/pull/10136)\)\.
+* rundeck\_acl\_policy \- ensure that project ACLs are sent to the correct endpoint \([https\://github\.com/ansible\-collections/community\.general/pull/10097](https\://github\.com/ansible\-collections/community\.general/pull/10097)\)\.
+* sysrc \- split the output of <code>sysrc \-e \-a</code> on the first <code>\=</code> only \([https\://github\.com/ansible\-collections/community\.general/issues/10120](https\://github\.com/ansible\-collections/community\.general/issues/10120)\, [https\://github\.com/ansible\-collections/community\.general/pull/10121](https\://github\.com/ansible\-collections/community\.general/pull/10121)\)\.
+
+<a id="v9-5-7"></a>
+## v9\.5\.7
+
+<a id="release-summary-6"></a>
+### Release Summary
+
+Regular bugfix release\.
+
+<a id="minor-changes"></a>
+### Minor Changes
+
+* apache2\_module \- added workaround for new PHP module name\, from <code>php7\_module</code> to <code>php\_module</code> \([https\://github\.com/ansible\-collections/community\.general/pull/9951](https\://github\.com/ansible\-collections/community\.general/pull/9951)\)\.
+
+<a id="bugfixes-5"></a>
+### Bugfixes
+
+* dependent look plugin \- make compatible with ansible\-core\'s Data Tagging feature \([https\://github\.com/ansible\-collections/community\.general/pull/9833](https\://github\.com/ansible\-collections/community\.general/pull/9833)\)\.
+* diy callback plugin \- make compatible with ansible\-core\'s Data Tagging feature \([https\://github\.com/ansible\-collections/community\.general/pull/9833](https\://github\.com/ansible\-collections/community\.general/pull/9833)\)\.
+* github\_deploy\_key \- check that key really exists on 422 to avoid masking other errors \([https\://github\.com/ansible\-collections/community\.general/issues/6718](https\://github\.com/ansible\-collections/community\.general/issues/6718)\, [https\://github\.com/ansible\-collections/community\.general/pull/10011](https\://github\.com/ansible\-collections/community\.general/pull/10011)\)\.
+* hashids and unicode\_normalize filter plugins \- avoid deprecated <code>AnsibleFilterTypeError</code> on ansible\-core 2\.19 \([https\://github\.com/ansible\-collections/community\.general/pull/9992](https\://github\.com/ansible\-collections/community\.general/pull/9992)\)\.
+* keycloak\_authentication \- fix authentification config duplication for Keycloak \< 26\.2\.0 \([https\://github\.com/ansible\-collections/community\.general/pull/9987](https\://github\.com/ansible\-collections/community\.general/pull/9987)\)\.
+* keycloak\_client \- fix the idempotency regression by normalizing the Keycloak response for <code>after\_client</code> \([https\://github\.com/ansible\-collections/community\.general/issues/9905](https\://github\.com/ansible\-collections/community\.general/issues/9905)\, [https\://github\.com/ansible\-collections/community\.general/pull/9976](https\://github\.com/ansible\-collections/community\.general/pull/9976)\)\.
+* proxmox inventory plugin \- fix <code>ansible\_host</code> staying empty for certain Proxmox nodes \([https\://github\.com/ansible\-collections/community\.general/issues/5906](https\://github\.com/ansible\-collections/community\.general/issues/5906)\, [https\://github\.com/ansible\-collections/community\.general/pull/9952](https\://github\.com/ansible\-collections/community\.general/pull/9952)\)\.
+* proxmox\_disk \- fail gracefully if <code>storage</code> is required but not provided by the user \([https\://github\.com/ansible\-collections/community\.general/issues/9941](https\://github\.com/ansible\-collections/community\.general/issues/9941)\, [https\://github\.com/ansible\-collections/community\.general/pull/9963](https\://github\.com/ansible\-collections/community\.general/pull/9963)\)\.
+* reveal\_ansible\_type filter plugin and ansible\_type test plugin \- make compatible with ansible\-core\'s Data Tagging feature \([https\://github\.com/ansible\-collections/community\.general/pull/9833](https\://github\.com/ansible\-collections/community\.general/pull/9833)\)\.
+* sysrc \- no longer always reporting <code>changed\=true</code> when <code>state\=absent</code>\. This fixes the method <code>exists\(\)</code> \([https\://github\.com/ansible\-collections/community\.general/issues/10004](https\://github\.com/ansible\-collections/community\.general/issues/10004)\, [https\://github\.com/ansible\-collections/community\.general/pull/10005](https\://github\.com/ansible\-collections/community\.general/pull/10005)\)\.
+* yaml callback plugin \- use ansible\-core internals to avoid breakage with Data Tagging \([https\://github\.com/ansible\-collections/community\.general/pull/9833](https\://github\.com/ansible\-collections/community\.general/pull/9833)\)\.
+
+<a id="known-issues"></a>
+### Known Issues
+
+* reveal\_ansible\_type filter plugin and ansible\_type test plugin \- note that ansible\-core\'s Data Tagging feature implements new aliases\, such as <code>\_AnsibleTaggedStr</code> for <code>str</code>\, <code>\_AnsibleTaggedInt</code> for <code>int</code>\, and <code>\_AnsibleTaggedFloat</code> for <code>float</code> \([https\://github\.com/ansible\-collections/community\.general/pull/9833](https\://github\.com/ansible\-collections/community\.general/pull/9833)\)\.
+
+<a id="v9-5-6"></a>
+## v9\.5\.6
+
+<a id="release-summary-7"></a>
+### Release Summary
+
+Regular bugfix release\.
+
+<a id="minor-changes-1"></a>
+### Minor Changes
+
+* consul\_token \- fix idempotency when <code>policies</code> or <code>roles</code> are supplied by name \([https\://github\.com/ansible\-collections/community\.general/issues/9841](https\://github\.com/ansible\-collections/community\.general/issues/9841)\, [https\://github\.com/ansible\-collections/community\.general/pull/9845](https\://github\.com/ansible\-collections/community\.general/pull/9845)\)\.
+
+<a id="bugfixes-6"></a>
+### Bugfixes
+
+* cloudlare\_dns \- handle exhausted response stream in case of HTTP errors to show nice error message to the user \([https\://github\.com/ansible\-collections/community\.general/issues/9782](https\://github\.com/ansible\-collections/community\.general/issues/9782)\, [https\://github\.com/ansible\-collections/community\.general/pull/9818](https\://github\.com/ansible\-collections/community\.general/pull/9818)\)\.
+* dnf\_versionlock \- add support for dnf5 \([https\://github\.com/ansible\-collections/community\.general/issues/9556](https\://github\.com/ansible\-collections/community\.general/issues/9556)\)\.
+* homebrew\_cask \- handle unusual brew version strings \([https\://github\.com/ansible\-collections/community\.general/issues/8432](https\://github\.com/ansible\-collections/community\.general/issues/8432)\, [https\://github\.com/ansible\-collections/community\.general/pull/9881](https\://github\.com/ansible\-collections/community\.general/pull/9881)\)\.
+* ipa\_host \- module revoked existing host certificates even if <code>user\_certificate</code> was not given \([https\://github\.com/ansible\-collections/community\.general/pull/9694](https\://github\.com/ansible\-collections/community\.general/pull/9694)\)\.
+* nmcli \- enable changing only the order of DNS servers or search suffixes \([https\://github\.com/ansible\-collections/community\.general/issues/8724](https\://github\.com/ansible\-collections/community\.general/issues/8724)\, [https\://github\.com/ansible\-collections/community\.general/pull/9880](https\://github\.com/ansible\-collections/community\.general/pull/9880)\)\.
+* proxmox\_vm\_info \- the module no longer expects that the key <code>template</code> exists in a dictionary returned by Proxmox \([https\://github\.com/ansible\-collections/community\.general/issues/9875](https\://github\.com/ansible\-collections/community\.general/issues/9875)\, [https\://github\.com/ansible\-collections/community\.general/pull/9910](https\://github\.com/ansible\-collections/community\.general/pull/9910)\)\.
+* sudoers \- display stdout and stderr raised while failed validation \([https\://github\.com/ansible\-collections/community\.general/issues/9674](https\://github\.com/ansible\-collections/community\.general/issues/9674)\, [https\://github\.com/ansible\-collections/community\.general/pull/9871](https\://github\.com/ansible\-collections/community\.general/pull/9871)\)\.
+
+<a id="v9-5-5"></a>
+## v9\.5\.5
+
+<a id="release-summary-8"></a>
+### Release Summary
+
+Regular bugfix release\.
+
+<a id="bugfixes-7"></a>
+### Bugfixes
+
 * apache2\_mod\_proxy \- make compatible with Python 3 \([https\://github\.com/ansible\-collections/community\.general/pull/9762](https\://github\.com/ansible\-collections/community\.general/pull/9762)\)\.
 * apache2\_mod\_proxy \- passing the cluster\'s page as referer for the member\'s pages\. This makes the module actually work again for halfway modern Apache versions\. According to some comments founds on the net the referer was required since at least 2019 for some versions of Apache 2 \([https\://github\.com/ansible\-collections/community\.general/pull/9762](https\://github\.com/ansible\-collections/community\.general/pull/9762)\)\.
 * cloudflare\_dns \- fix crash when deleting a DNS record or when updating a record with <code>solo\=true</code> \([https\://github\.com/ansible\-collections/community\.general/issues/9652](https\://github\.com/ansible\-collections/community\.general/issues/9652)\, [https\://github\.com/ansible\-collections/community\.general/pull/9649](https\://github\.com/ansible\-collections/community\.general/pull/9649)\)\.
@@ -105,12 +291,12 @@ Regular bugfix release\.
 <a id="v9-5-4"></a>
 ## v9\.5\.4
 
-<a id="security-fixes"></a>
+<a id="security-fixes-1"></a>
 ### Security Fixes
 
 * keycloak\_client \- Sanitize <code>saml\.encryption\.private\.key</code> so it does not show in the logs \([https\://github\.com/ansible\-collections/community\.general/pull/9621](https\://github\.com/ansible\-collections/community\.general/pull/9621)\)\.
 
-<a id="bugfixes-1"></a>
+<a id="bugfixes-8"></a>
 ### Bugfixes
 
 * redhat\_subscription \- do not try to unsubscribe \(i\.e\. remove subscriptions\)
@@ -122,22 +308,22 @@ Regular bugfix release\.
 <a id="v9-5-3"></a>
 ## v9\.5\.3
 
-<a id="release-summary-1"></a>
+<a id="release-summary-9"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="minor-changes"></a>
+<a id="minor-changes-2"></a>
 ### Minor Changes
 
 * proxmox module utils \- add method <code>api\_task\_complete</code> that can wait for task completion and return error message \([https\://github\.com/ansible\-collections/community\.general/pull/9256](https\://github\.com/ansible\-collections/community\.general/pull/9256)\)\.
 
-<a id="security-fixes-1"></a>
+<a id="security-fixes-2"></a>
 ### Security Fixes
 
 * keycloak\_authentication \- API calls did not properly set the <code>priority</code> during update resulting in incorrectly sorted authentication flows\. This apparently only affects Keycloak 25 or newer \([https\://github\.com/ansible\-collections/community\.general/pull/9263](https\://github\.com/ansible\-collections/community\.general/pull/9263)\)\.
 
-<a id="bugfixes-2"></a>
+<a id="bugfixes-9"></a>
 ### Bugfixes
 
 * dig lookup plugin \- correctly handle <code>NoNameserver</code> exception \([https\://github\.com/ansible\-collections/community\.general/pull/9363](https\://github\.com/ansible\-collections/community\.general/pull/9363)\, [https\://github\.com/ansible\-collections/community\.general/issues/9362](https\://github\.com/ansible\-collections/community\.general/issues/9362)\)\.
@@ -150,17 +336,17 @@ Regular bugfix release\.
 <a id="v9-5-2"></a>
 ## v9\.5\.2
 
-<a id="release-summary-2"></a>
+<a id="release-summary-10"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="minor-changes-1"></a>
+<a id="minor-changes-3"></a>
 ### Minor Changes
 
 * proxmox inventory plugin \- fix urllib3 <code>InsecureRequestWarnings</code> not being suppressed when a token is used \([https\://github\.com/ansible\-collections/community\.general/pull/9099](https\://github\.com/ansible\-collections/community\.general/pull/9099)\)\.
 
-<a id="bugfixes-3"></a>
+<a id="bugfixes-10"></a>
 ### Bugfixes
 
 * dnf\_config\_manager \- fix hanging when prompting to import GPG keys \([https\://github\.com/ansible\-collections/community\.general/pull/9124](https\://github\.com/ansible\-collections/community\.general/pull/9124)\, [https\://github\.com/ansible\-collections/community\.general/issues/8830](https\://github\.com/ansible\-collections/community\.general/issues/8830)\)\.
@@ -177,17 +363,17 @@ Regular bugfix release\.
 <a id="v9-5-1"></a>
 ## v9\.5\.1
 
-<a id="release-summary-3"></a>
+<a id="release-summary-11"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="minor-changes-2"></a>
+<a id="minor-changes-4"></a>
 ### Minor Changes
 
 * redfish\_utils module utils \- schedule a BIOS configuration job at next reboot when the BIOS config is changed \([https\://github\.com/ansible\-collections/community\.general/pull/9012](https\://github\.com/ansible\-collections/community\.general/pull/9012)\)\.
 
-<a id="bugfixes-4"></a>
+<a id="bugfixes-11"></a>
 ### Bugfixes
 
 * bitwarden lookup plugin \- support BWS v0\.3\.0 syntax breaking change \([https\://github\.com/ansible\-collections/community\.general/pull/9028](https\://github\.com/ansible\-collections/community\.general/pull/9028)\)\.
@@ -205,7 +391,7 @@ Regular bugfix release\.
 <a id="v9-5-0"></a>
 ## v9\.5\.0
 
-<a id="release-summary-4"></a>
+<a id="release-summary-12"></a>
 ### Release Summary
 
 Regular bugfix and feature release\.
@@ -213,7 +399,7 @@ Regular bugfix and feature release\.
 Please note that this is the last feature release for community\.general 9\.x\.y\.
 From now on\, new features will only go into community\.general 10\.x\.y\.
 
-<a id="minor-changes-3"></a>
+<a id="minor-changes-5"></a>
 ### Minor Changes
 
 * dig lookup plugin \- add <code>port</code> option to specify DNS server port \([https\://github\.com/ansible\-collections/community\.general/pull/8966](https\://github\.com/ansible\-collections/community\.general/pull/8966)\)\.
@@ -270,7 +456,7 @@ From now on\, new features will only go into community\.general 10\.x\.y\.
 
 * hipchat \- the hipchat service has been discontinued and the self\-hosted variant has been End of Life since 2020\. The module is therefore deprecated and will be removed from community\.general 11\.0\.0 if nobody provides compelling reasons to still keep it \([https\://github\.com/ansible\-collections/community\.general/pull/8919](https\://github\.com/ansible\-collections/community\.general/pull/8919)\)\.
 
-<a id="bugfixes-5"></a>
+<a id="bugfixes-12"></a>
 ### Bugfixes
 
 * cloudflare\_dns \- fix changing Cloudflare SRV records \([https\://github\.com/ansible\-collections/community\.general/issues/8679](https\://github\.com/ansible\-collections/community\.general/issues/8679)\, [https\://github\.com/ansible\-collections/community\.general/pull/8948](https\://github\.com/ansible\-collections/community\.general/pull/8948)\)\.
@@ -304,12 +490,12 @@ From now on\, new features will only go into community\.general 10\.x\.y\.
 <a id="v9-4-0"></a>
 ## v9\.4\.0
 
-<a id="release-summary-5"></a>
+<a id="release-summary-13"></a>
 ### Release Summary
 
 Bugfix and feature release\.
 
-<a id="minor-changes-4"></a>
+<a id="minor-changes-6"></a>
 ### Minor Changes
 
 * MH module utils \- add parameter <code>when</code> to <code>cause\_changes</code> decorator \([https\://github\.com/ansible\-collections/community\.general/pull/8766](https\://github\.com/ansible\-collections/community\.general/pull/8766)\)\.
@@ -396,7 +582,7 @@ Bugfix and feature release\.
 * pipx \- support for versions of the command line tool <code>pipx</code> older than <code>1\.7\.0</code> is deprecated and will be removed in community\.general 11\.0\.0 \([https\://github\.com/ansible\-collections/community\.general/pull/8793](https\://github\.com/ansible\-collections/community\.general/pull/8793)\)\.
 * pipx\_info \- support for versions of the command line tool <code>pipx</code> older than <code>1\.7\.0</code> is deprecated and will be removed in community\.general 11\.0\.0 \([https\://github\.com/ansible\-collections/community\.general/pull/8793](https\://github\.com/ansible\-collections/community\.general/pull/8793)\)\.
 
-<a id="bugfixes-6"></a>
+<a id="bugfixes-13"></a>
 ### Bugfixes
 
 * gitlab\_group\_access\_token \- fix crash in check mode caused by attempted access to a newly created access token \([https\://github\.com/ansible\-collections/community\.general/pull/8796](https\://github\.com/ansible\-collections/community\.general/pull/8796)\)\.
@@ -418,12 +604,12 @@ Bugfix and feature release\.
 <a id="v9-3-0"></a>
 ## v9\.3\.0
 
-<a id="release-summary-6"></a>
+<a id="release-summary-14"></a>
 ### Release Summary
 
 Regular bugfix and feature release\.
 
-<a id="minor-changes-5"></a>
+<a id="minor-changes-7"></a>
 ### Minor Changes
 
 * cgroup\_memory\_recap\, hipchat\, jabber\, log\_plays\, loganalytics\, logentries\, logstash\, slack\, splunk\, sumologic\, syslog\_json callback plugins \- make sure that all options are typed \([https\://github\.com/ansible\-collections/community\.general/pull/8628](https\://github\.com/ansible\-collections/community\.general/pull/8628)\)\.
@@ -446,7 +632,7 @@ Regular bugfix and feature release\.
 * proxmox inventory plugin \- add new fact for LXC interface details \([https\://github\.com/ansible\-collections/community\.general/pull/8713](https\://github\.com/ansible\-collections/community\.general/pull/8713)\)\.
 * redis\, redis\_info \- add <code>client\_cert</code> and <code>client\_key</code> options to specify path to certificate for Redis authentication  \([https\://github\.com/ansible\-collections/community\.general/pull/8654](https\://github\.com/ansible\-collections/community\.general/pull/8654)\)\.
 
-<a id="bugfixes-7"></a>
+<a id="bugfixes-14"></a>
 ### Bugfixes
 
 * gitlab\_runner \- fix <code>paused</code> parameter being ignored \([https\://github\.com/ansible\-collections/community\.general/pull/8648](https\://github\.com/ansible\-collections/community\.general/pull/8648)\)\.
@@ -467,12 +653,12 @@ Regular bugfix and feature release\.
 <a id="v9-2-0"></a>
 ## v9\.2\.0
 
-<a id="release-summary-7"></a>
+<a id="release-summary-15"></a>
 ### Release Summary
 
 Regular bugfix and feature release\.
 
-<a id="minor-changes-6"></a>
+<a id="minor-changes-8"></a>
 ### Minor Changes
 
 * CmdRunner module utils \- the parameter <code>force\_lang</code> now supports the special value <code>auto</code> which will automatically try and determine the best parsable locale in the system \([https\://github\.com/ansible\-collections/community\.general/pull/8517](https\://github\.com/ansible\-collections/community\.general/pull/8517)\)\.
@@ -484,7 +670,7 @@ Regular bugfix and feature release\.
 * virtualbox inventory plugin \- expose a new parameter <code>enable\_advanced\_group\_parsing</code> to change how the VirtualBox dynamic inventory parses VM groups \([https\://github\.com/ansible\-collections/community\.general/issues/8508](https\://github\.com/ansible\-collections/community\.general/issues/8508)\, [https\://github\.com/ansible\-collections/community\.general/pull/8510](https\://github\.com/ansible\-collections/community\.general/pull/8510)\)\.
 * wdc\_redfish\_command \- minor change to handle upgrade file for Redfish WD platforms \([https\://github\.com/ansible\-collections/community\.general/pull/8444](https\://github\.com/ansible\-collections/community\.general/pull/8444)\)\.
 
-<a id="bugfixes-8"></a>
+<a id="bugfixes-15"></a>
 ### Bugfixes
 
 * bitwarden lookup plugin \- fix <code>KeyError</code> in <code>search\_field</code> \([https\://github\.com/ansible\-collections/community\.general/issues/8549](https\://github\.com/ansible\-collections/community\.general/issues/8549)\, [https\://github\.com/ansible\-collections/community\.general/pull/8557](https\://github\.com/ansible\-collections/community\.general/pull/8557)\)\.
@@ -509,12 +695,12 @@ Regular bugfix and feature release\.
 <a id="v9-1-0"></a>
 ## v9\.1\.0
 
-<a id="release-summary-8"></a>
+<a id="release-summary-16"></a>
 ### Release Summary
 
 Regular feature and bugfix release\.
 
-<a id="minor-changes-7"></a>
+<a id="minor-changes-9"></a>
 ### Minor Changes
 
 * CmdRunner module util \- argument formats can be specified as plain functions without calling <code>cmd\_runner\_fmt\.as\_func\(\)</code> \([https\://github\.com/ansible\-collections/community\.general/pull/8479](https\://github\.com/ansible\-collections/community\.general/pull/8479)\)\.
@@ -538,7 +724,7 @@ Regular feature and bugfix release\.
 * git\_config \- the <code>list\_all</code> option has been deprecated and will be removed in community\.general 11\.0\.0\. Use the <code>community\.general\.git\_config\_info</code> module instead \([https\://github\.com/ansible\-collections/community\.general/pull/8453](https\://github\.com/ansible\-collections/community\.general/pull/8453)\)\.
 * git\_config \- using <code>state\=present</code> without providing <code>value</code> is deprecated and will be disallowed in community\.general 11\.0\.0\. Use the <code>community\.general\.git\_config\_info</code> module instead to read a value \([https\://github\.com/ansible\-collections/community\.general/pull/8453](https\://github\.com/ansible\-collections/community\.general/pull/8453)\)\.
 
-<a id="bugfixes-9"></a>
+<a id="bugfixes-16"></a>
 ### Bugfixes
 
 * git\_config \- fix behavior of <code>state\=absent</code> if <code>value</code> is present \([https\://github\.com/ansible\-collections/community\.general/issues/8436](https\://github\.com/ansible\-collections/community\.general/issues/8436)\, [https\://github\.com/ansible\-collections/community\.general/pull/8452](https\://github\.com/ansible\-collections/community\.general/pull/8452)\)\.
@@ -549,7 +735,7 @@ Regular feature and bugfix release\.
 * opentelemetry callback \- do not save the content response when using the <code>ansible\.builtin\.slurp</code> module \([https\://github\.com/ansible\-collections/community\.general/pull/8430](https\://github\.com/ansible\-collections/community\.general/pull/8430)\)\.
 * paman \- do not fail if an empty list of packages has been provided and there is nothing to do \([https\://github\.com/ansible\-collections/community\.general/pull/8514](https\://github\.com/ansible\-collections/community\.general/pull/8514)\)\.
 
-<a id="known-issues"></a>
+<a id="known-issues-1"></a>
 ### Known Issues
 
 * homectl \- the module does not work under Python 3\.13 or newer\, since it relies on the removed <code>crypt</code> standard library module \([https\://github\.com/ansible\-collections/community\.general/issues/4691](https\://github\.com/ansible\-collections/community\.general/issues/4691)\, [https\://github\.com/ansible\-collections/community\.general/pull/8497](https\://github\.com/ansible\-collections/community\.general/pull/8497)\)\.
@@ -576,17 +762,17 @@ Regular feature and bugfix release\.
 <a id="v9-0-1"></a>
 ## v9\.0\.1
 
-<a id="release-summary-9"></a>
+<a id="release-summary-17"></a>
 ### Release Summary
 
 Bugfix release for inclusion in Ansible 10\.0\.0rc1\.
 
-<a id="minor-changes-8"></a>
+<a id="minor-changes-10"></a>
 ### Minor Changes
 
 * ansible\_galaxy\_install \- minor refactor in the module \([https\://github\.com/ansible\-collections/community\.general/pull/8413](https\://github\.com/ansible\-collections/community\.general/pull/8413)\)\.
 
-<a id="bugfixes-10"></a>
+<a id="bugfixes-17"></a>
 ### Bugfixes
 
 * cpanm \- use new <code>VarDict</code> to prevent deprecation warning \([https\://github\.com/ansible\-collections/community\.general/issues/8410](https\://github\.com/ansible\-collections/community\.general/issues/8410)\, [https\://github\.com/ansible\-collections/community\.general/pull/8411](https\://github\.com/ansible\-collections/community\.general/pull/8411)\)\.
@@ -605,12 +791,12 @@ Bugfix release for inclusion in Ansible 10\.0\.0rc1\.
 <a id="v9-0-0"></a>
 ## v9\.0\.0
 
-<a id="release-summary-10"></a>
+<a id="release-summary-18"></a>
 ### Release Summary
 
 This is release 9\.0\.0 of <code>community\.general</code>\, released on 2024\-05\-20\.
 
-<a id="minor-changes-9"></a>
+<a id="minor-changes-11"></a>
 ### Minor Changes
 
 * PythonRunner module utils \- specialisation of <code>CmdRunner</code> to execute Python scripts \([https\://github\.com/ansible\-collections/community\.general/pull/8289](https\://github\.com/ansible\-collections/community\.general/pull/8289)\)\.
@@ -774,13 +960,13 @@ This is release 9\.0\.0 of <code>community\.general</code>\, released on 2024\-0
 * stackdriver \- this module relied on HTTPS APIs that do not exist anymore and was thus removed \([https\://github\.com/ansible\-collections/community\.general/pull/8198](https\://github\.com/ansible\-collections/community\.general/pull/8198)\)\.
 * webfaction\_\* modules \- these modules relied on HTTPS APIs that do not exist anymore and were thus removed \([https\://github\.com/ansible\-collections/community\.general/pull/8198](https\://github\.com/ansible\-collections/community\.general/pull/8198)\)\.
 
-<a id="security-fixes-2"></a>
+<a id="security-fixes-3"></a>
 ### Security Fixes
 
 * cobbler\, gitlab\_runners\, icinga2\, linode\, lxd\, nmap\, online\, opennebula\, proxmox\, scaleway\, stackpath\_compute\, virtualbox\, and xen\_orchestra inventory plugin \- make sure all data received from the remote servers is marked as unsafe\, so remote code execution by obtaining texts that can be evaluated as templates is not possible \([https\://www\.die\-welt\.net/2024/03/remote\-code\-execution\-in\-ansible\-dynamic\-inventory\-plugins/](https\://www\.die\-welt\.net/2024/03/remote\-code\-execution\-in\-ansible\-dynamic\-inventory\-plugins/)\, [https\://github\.com/ansible\-collections/community\.general/pull/8098](https\://github\.com/ansible\-collections/community\.general/pull/8098)\)\.
 * keycloak\_identity\_provider \- the client secret was not correctly sanitized by the module\. The return values <code>proposed</code>\, <code>existing</code>\, and <code>end\_state</code>\, as well as the diff\, did contain the client secret unmasked \([https\://github\.com/ansible\-collections/community\.general/pull/8355](https\://github\.com/ansible\-collections/community\.general/pull/8355)\)\.
 
-<a id="bugfixes-11"></a>
+<a id="bugfixes-18"></a>
 ### Bugfixes
 
 * aix\_filesystem \- fix <code>\_validate\_vg</code> not passing VG name to <code>lsvg\_cmd</code> \([https\://github\.com/ansible\-collections/community\.general/issues/8151](https\://github\.com/ansible\-collections/community\.general/issues/8151)\)\.

CHANGELOG.rst

@@ -6,6 +6,165 @@ Community General Release Notes
 
 This changelog describes changes after version 8.0.0.
 
+v9.5.13
+=======
+
+Release Summary
+---------------
+
+Final maintenance release.
+
+This is the last community.general 9.x.y release.
+Please upgrade to community.general 10.x.y, 11.x.y, or 12.x.y.
+Thanks a lot to everyone who contributed to a 9.x.y release!
+
+Security Fixes
+--------------
+
+- keycloak_user - the parameter ``credentials[].value`` is now marked as ``no_log=true``. Before it was logged by Ansible, unless the task was marked as ``no_log: true``. Since this parameter can be used for passwords, this resulted in credential leaking (https://github.com/ansible-collections/community.general/issues/11000, https://github.com/ansible-collections/community.general/pull/11005).
+
+v9.5.12
+=======
+
+Release Summary
+---------------
+
+Bugfix release.
+
+Bugfixes
+--------
+
+- github_deploy_key - fix bug during error handling if no body was present in the result (https://github.com/ansible-collections/community.general/issues/10853, https://github.com/ansible-collections/community.general/pull/10857).
+- yaml cache plugin - make compatible with ansible-core 2.19 (https://github.com/ansible-collections/community.general/issues/10849, https://github.com/ansible-collections/community.general/issues/10852).
+
+v9.5.11
+=======
+
+Release Summary
+---------------
+
+Bugfix release.
+
+Bugfixes
+--------
+
+- apache2_module - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+- doas become plugin - disable pipelining on ansible-core 2.19+. The plugin does not work with pipelining, and since ansible-core 2.19 become plugins can indicate that they do not work with pipelining (https://github.com/ansible-collections/community.general/issues/9977, https://github.com/ansible-collections/community.general/pull/10537).
+- htpasswd - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+- irc - pass hostname to ``wrap_socket()`` if ``use_tls=true`` and ``validate_certs=true`` (https://github.com/ansible-collections/community.general/issues/10472, https://github.com/ansible-collections/community.general/pull/10491).
+- json_query filter plugin - make compatible with lazy evaluation list and dictionary types of ansible-core 2.19 (https://github.com/ansible-collections/community.general/pull/10539).
+- machinectl become plugin - disable pipelining on ansible-core 2.19+. The plugin does not work with pipelining, and since ansible-core 2.19 become plugins can indicate that they do not work with pipelining (https://github.com/ansible-collections/community.general/pull/10537).
+- merge_variables lookup plugin - avoid deprecated functionality from ansible-core 2.19 (https://github.com/ansible-collections/community.general/pull/10566).
+- proxmox inventory plugin - avoid using deprecated option when templating options (https://github.com/ansible-collections/community.proxmox/pull/108, https://github.com/ansible-collections/community.general/pull/10553).
+- syspatch - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+- sysupgrade - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+- zypper_repository - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+
+v9.5.10
+=======
+
+Release Summary
+---------------
+
+Bugfix release with improved ansible-core 2.19 compatibility.
+
+Bugfixes
+--------
+
+- dependent lookup plugin - avoid deprecated ansible-core 2.19 functionality (https://github.com/ansible-collections/community.general/pull/10359).
+- icinga2 inventory plugin - avoid using deprecated option when templating options (https://github.com/ansible-collections/community.general/pull/10271).
+- keycloak module_utils - fix call of method which does not exist in stable-9, which was introduced by backporting 8b1a193a (https://github.com/ansible-collections/community.general/pull/10298).
+- linode inventory plugin - avoid using deprecated option when templating options (https://github.com/ansible-collections/community.general/pull/10271).
+
+v9.5.9
+======
+
+Release Summary
+---------------
+
+Bugfix release.
+
+Bugfixes
+--------
+
+- yaml callback plugin - adjust to latest changes in ansible-core devel (https://github.com/ansible-collections/community.general/pull/10212).
+- yaml callback plugin - when using ansible-core 2.19.0b2 or newer, uses a new utility provided by ansible-core. This allows us to remove all hacks and vendored code that was part of the plugin for ansible-core versions with Data Tagging so far (https://github.com/ansible-collections/community.general/pull/10242).
+
+v9.5.8
+======
+
+Release Summary
+---------------
+
+Regular bugfix release.
+
+Bugfixes
+--------
+
+- cobbler_system - fix bug with Cobbler >= 3.4.0 caused by giving more than 2 positional arguments to ``CobblerXMLRPCInterface.get_system_handle()`` (https://github.com/ansible-collections/community.general/issues/8506, https://github.com/ansible-collections/community.general/pull/10145).
+- kdeconfig - allow option values beginning with a dash (https://github.com/ansible-collections/community.general/issues/10127, https://github.com/ansible-collections/community.general/pull/10128).
+- keycloak_user_rolemapping - fix ``--diff`` mode (https://github.com/ansible-collections/community.general/issues/10067, https://github.com/ansible-collections/community.general/pull/10075).
+- pickle cache plugin - avoid extra JSON serialization with ansible-core >= 2.19 (https://github.com/ansible-collections/community.general/pull/10136).
+- rundeck_acl_policy - ensure that project ACLs are sent to the correct endpoint (https://github.com/ansible-collections/community.general/pull/10097).
+- sysrc - split the output of ``sysrc -e -a`` on the first ``=`` only (https://github.com/ansible-collections/community.general/issues/10120, https://github.com/ansible-collections/community.general/pull/10121).
+
+v9.5.7
+======
+
+Release Summary
+---------------
+
+Regular bugfix release.
+
+Minor Changes
+-------------
+
+- apache2_module - added workaround for new PHP module name, from ``php7_module`` to ``php_module`` (https://github.com/ansible-collections/community.general/pull/9951).
+
+Bugfixes
+--------
+
+- dependent look plugin - make compatible with ansible-core's Data Tagging feature (https://github.com/ansible-collections/community.general/pull/9833).
+- diy callback plugin - make compatible with ansible-core's Data Tagging feature (https://github.com/ansible-collections/community.general/pull/9833).
+- github_deploy_key - check that key really exists on 422 to avoid masking other errors (https://github.com/ansible-collections/community.general/issues/6718, https://github.com/ansible-collections/community.general/pull/10011).
+- hashids and unicode_normalize filter plugins - avoid deprecated ``AnsibleFilterTypeError`` on ansible-core 2.19 (https://github.com/ansible-collections/community.general/pull/9992).
+- keycloak_authentication - fix authentification config duplication for Keycloak < 26.2.0 (https://github.com/ansible-collections/community.general/pull/9987).
+- keycloak_client - fix the idempotency regression by normalizing the Keycloak response for ``after_client`` (https://github.com/ansible-collections/community.general/issues/9905, https://github.com/ansible-collections/community.general/pull/9976).
+- proxmox inventory plugin - fix ``ansible_host`` staying empty for certain Proxmox nodes (https://github.com/ansible-collections/community.general/issues/5906, https://github.com/ansible-collections/community.general/pull/9952).
+- proxmox_disk - fail gracefully if ``storage`` is required but not provided by the user (https://github.com/ansible-collections/community.general/issues/9941, https://github.com/ansible-collections/community.general/pull/9963).
+- reveal_ansible_type filter plugin and ansible_type test plugin - make compatible with ansible-core's Data Tagging feature (https://github.com/ansible-collections/community.general/pull/9833).
+- sysrc - no longer always reporting ``changed=true`` when ``state=absent``. This fixes the method ``exists()`` (https://github.com/ansible-collections/community.general/issues/10004, https://github.com/ansible-collections/community.general/pull/10005).
+- yaml callback plugin - use ansible-core internals to avoid breakage with Data Tagging (https://github.com/ansible-collections/community.general/pull/9833).
+
+Known Issues
+------------
+
+- reveal_ansible_type filter plugin and ansible_type test plugin - note that ansible-core's Data Tagging feature implements new aliases, such as ``_AnsibleTaggedStr`` for ``str``, ``_AnsibleTaggedInt`` for ``int``, and ``_AnsibleTaggedFloat`` for ``float`` (https://github.com/ansible-collections/community.general/pull/9833).
+
+v9.5.6
+======
+
+Release Summary
+---------------
+
+Regular bugfix release.
+
+Minor Changes
+-------------
+
+- consul_token - fix idempotency when ``policies`` or ``roles`` are supplied by name (https://github.com/ansible-collections/community.general/issues/9841, https://github.com/ansible-collections/community.general/pull/9845).
+
+Bugfixes
+--------
+
+- cloudlare_dns - handle exhausted response stream in case of HTTP errors to show nice error message to the user (https://github.com/ansible-collections/community.general/issues/9782, https://github.com/ansible-collections/community.general/pull/9818).
+- dnf_versionlock - add support for dnf5 (https://github.com/ansible-collections/community.general/issues/9556).
+- homebrew_cask - handle unusual brew version strings (https://github.com/ansible-collections/community.general/issues/8432, https://github.com/ansible-collections/community.general/pull/9881).
+- ipa_host - module revoked existing host certificates even if ``user_certificate`` was not given (https://github.com/ansible-collections/community.general/pull/9694).
+- nmcli - enable changing only the order of DNS servers or search suffixes (https://github.com/ansible-collections/community.general/issues/8724, https://github.com/ansible-collections/community.general/pull/9880).
+- proxmox_vm_info - the module no longer expects that the key ``template`` exists in a dictionary returned by Proxmox (https://github.com/ansible-collections/community.general/issues/9875, https://github.com/ansible-collections/community.general/pull/9910).
+- sudoers - display stdout and stderr raised while failed validation (https://github.com/ansible-collections/community.general/issues/9674, https://github.com/ansible-collections/community.general/pull/9871).
+
 v9.5.5
 ======
 

CONTRIBUTING.md

@@ -44,7 +44,49 @@ If you want to test a PR locally, refer to [our testing guide](https://github.co
 
 If you find any inconsistencies or places in this document which can be improved, feel free to raise an issue or pull request to fix it.
 
-## Run sanity, unit or integration tests locally
+## Run sanity or unit locally (with antsibull-nox)
+
+The easiest way to run sanity and unit tests locally is to use [antsibull-nox](https://ansible.readthedocs.io/projects/antsibull-nox/).
+(If you have [nox](https://nox.thea.codes/en/stable/) installed, it will automatically install antsibull-nox in a virtual environment for you.)
+
+### Sanity tests
+
+The following commands show how to run ansible-test sanity tests:
+
+```.bash
+# Run basic sanity tests for all files in the collection:
+nox -Re ansible-test-sanity-devel
+
+# Run basic sanity tests for the given files and directories:
+nox -Re ansible-test-sanity-devel -- plugins/modules/system/pids.py tests/integration/targets/pids/
+
+# Run all other sanity tests for all files in the collection:
+nox -R
+```
+
+If you replace `-Re` with `-e`, respectively. If you leave `-R` away, then the virtual environments will be re-created. The `-R` re-uses them (if they already exist).
+
+### Unit tests
+
+The following commands show how to run unit tests:
+
+```.bash
+# Run all unit tests:
+nox -Re ansible-test-units-devel
+
+# Run all unit tests for one Python version (a lot faster):
+nox -Re ansible-test-units-devel -- --python 3.13
+
+# Run a specific unit test (for the nmcli module) for one Python version:
+nox -Re ansible-test-units-devel -- --python 3.13 tests/unit/plugins/modules/net_tools/test_nmcli.py
+```
+
+If you replace `-Re` with `-e`, then the virtual environments will be re-created. The `-R` re-uses them (if they already exist).
+
+## Run basic sanity, unit or integration tests locally (with ansible-test)
+
+Instead of using antsibull-nox, you can also run sanity and unit tests with ansible-test directly.
+This also allows you to run integration tests.
 
 You have to check out the repository into a specific path structure to be able to run `ansible-test`. The path to the git checkout must end with `.../ansible_collections/community/general`. Please see [our testing guide](https://github.com/ansible/community-docs/blob/main/test_pr_locally_guide.rst) for instructions on how to check out the repository into a correct path structure. The short version of these instructions is:
 
@@ -56,20 +98,27 @@ cd ~/dev/ansible_collections/community/general
 
 Then you can run `ansible-test` (which is a part of [ansible-core](https://pypi.org/project/ansible-core/)) inside the checkout. The following example commands expect that you have installed Docker or Podman. Note that Podman has only been supported by more recent ansible-core releases. If you are using Docker, the following will work with Ansible 2.9+.
 
-### Sanity tests
+### Basic sanity tests
 
-The following commands show how to run sanity tests:
+The following commands show how to run basic sanity tests:
 
 ```.bash
-# Run sanity tests for all files in the collection:
+# Run basic sanity tests for all files in the collection:
 ansible-test sanity --docker -v
 
-# Run sanity tests for the given files and directories:
+# Run basic sanity tests for the given files and directories:
 ansible-test sanity --docker -v plugins/modules/system/pids.py tests/integration/targets/pids/
 ```
 
 ### Unit tests
 
+Note that for running unit tests, you need to install required collections in the same folder structure that `community.general` is checked out in.
+Right now, you need to install [`community.internal_test_tools`](https://github.com/ansible-collections/community.internal_test_tools).
+If you want to use the latest version from GitHub, you can run:
+```
+git clone https://github.com/ansible-collections/community.internal_test_tools.git ~/dev/ansible_collections/community/internal_test_tools
+```
+
 The following commands show how to run unit tests:
 
 ```.bash
@@ -85,6 +134,16 @@ ansible-test units --docker -v --python 3.8 tests/unit/plugins/modules/net_tools
 
 ### Integration tests
 
+Note that for running integration tests, you need to install required collections in the same folder structure that `community.general` is checked out in.
+Right now, depending on the test, you need to install [`ansible.posix`](https://github.com/ansible-collections/ansible.posix), [`community.crypto`](https://github.com/ansible-collections/community.crypto), and [`community.docker`](https://github.com/ansible-collections/community.docker):
+If you want to use the latest versions from GitHub, you can run:
+```
+mkdir -p ~/dev/ansible_collections/ansible
+git clone https://github.com/ansible-collections/ansible.posix.git ~/dev/ansible_collections/ansible/posix
+git clone https://github.com/ansible-collections/community.crypto.git ~/dev/ansible_collections/community/crypto
+git clone https://github.com/ansible-collections/community.docker.git ~/dev/ansible_collections/community/docker
+```
+
 The following commands show how to run integration tests:
 
 #### In Docker
@@ -92,8 +151,8 @@ The following commands show how to run integration tests:
 Integration tests on Docker have the following parameters:
 - `image_name` (required): The name of the Docker image. To get the list of supported Docker images, run
   `ansible-test integration --help` and look for _target docker images_.
-- `test_name` (optional): The name of the integration test.  
-  For modules, this equals the short name of the module; for example, `pacman` in case of `community.general.pacman`.  
+- `test_name` (optional): The name of the integration test.
+  For modules, this equals the short name of the module; for example, `pacman` in case of `community.general.pacman`.
   For plugins, the plugin type is added before the plugin's short name, for example `callback_yaml` for the `community.general.yaml` callback.
 ```.bash
 # Test all plugins/modules on fedora40

README.md

@@ -9,6 +9,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 [![Documentation](https://img.shields.io/badge/docs-brightgreen.svg)](https://docs.ansible.com/ansible/latest/collections/community/general/)
 [![Build Status](https://dev.azure.com/ansible/community.general/_apis/build/status/CI?branchName=stable-9)](https://dev.azure.com/ansible/community.general/_build?definitionId=31)
 [![EOL CI](https://github.com/ansible-collections/community.general/actions/workflows/ansible-test.yml/badge.svg?branch=stable-9)](https://github.com/ansible-collections/community.general/actions)
+[![Nox CI](https://github.com/ansible-collections/community.general/actions/workflows/nox.yml/badge.svg?branch=stable-9)](https://github.com/ansible-collections/community.general/actions)
 [![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/community.general)](https://codecov.io/gh/ansible-collections/community.general)
 [![REUSE status](https://api.reuse.software/badge/github.com/ansible-collections/community.general)](https://api.reuse.software/info/github.com/ansible-collections/community.general)
 
@@ -38,7 +39,7 @@ For more information about communication, see the [Ansible communication guide](
 
 ## Tested with Ansible
 
-Tested with the current ansible-core 2.13, ansible-core 2.14, ansible-core 2.15, ansible-core 2.16, ansible-core 2.17, ansible-core 2.18 releases and the current development version of ansible-core. Ansible-core versions before 2.13.0 are not supported. This includes all ansible-base 2.10 and Ansible 2.9 releases.
+Tested with the current ansible-core 2.13, ansible-core 2.14, ansible-core 2.15, ansible-core 2.16, ansible-core 2.17, ansible-core 2.18, and ansible-core 2.19 releases. Ansible-core versions before 2.13.0 are not supported. This includes all ansible-base 2.10 and Ansible 2.9 releases.
 
 ## External requirements
 
@@ -140,4 +141,4 @@ See [LICENSES/GPL-3.0-or-later.txt](https://github.com/ansible-collections/commu
 
 Parts of the collection are licensed under the [BSD 2-Clause license](https://github.com/ansible-collections/community.general/blob/stable-9/LICENSES/BSD-2-Clause.txt), the [MIT license](https://github.com/ansible-collections/community.general/blob/stable-9/LICENSES/MIT.txt), and the [PSF 2.0 license](https://github.com/ansible-collections/community.general/blob/stable-9/LICENSES/PSF-2.0.txt).
 
-All files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `.reuse/dep5`. This conforms to the [REUSE specification](https://reuse.software/spec/).
+All files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `REUSE.toml`. This conforms to the [REUSE specification](https://reuse.software/spec/).

REUSE.toml

@@ -0,0 +1,11 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+version = 1
+
+[[annotations]]
+path = "changelogs/fragments/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Ansible Project"
+SPDX-License-Identifier = "GPL-3.0-or-later"

antsibull-nox.toml

@@ -0,0 +1,68 @@
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
+
+[collection_sources]
+"ansible.posix" = "git+https://github.com/ansible-collections/ansible.posix.git,main"
+"community.crypto" = "git+https://github.com/ansible-collections/community.crypto.git,main"
+"community.docker" = "git+https://github.com/ansible-collections/community.docker.git,main"
+"community.internal_test_tools" = "git+https://github.com/ansible-collections/community.internal_test_tools.git,main"
+
+[collection_sources_per_ansible.'2.13']
+"community.crypto" = "git+https://github.com/ansible-collections/community.crypto.git,stable-2"
+
+[collection_sources_per_ansible.'2.14']
+"community.crypto" = "git+https://github.com/ansible-collections/community.crypto.git,stable-2"
+
+[collection_sources_per_ansible.'2.15']
+# community.crypto's main branch needs ansible-core >= 2.17
+"community.crypto" = "git+https://github.com/ansible-collections/community.crypto.git,stable-2"
+
+[collection_sources_per_ansible.'2.16']
+# community.crypto's main branch needs ansible-core >= 2.17
+"community.crypto" = "git+https://github.com/ansible-collections/community.crypto.git,stable-2"
+
+[vcs]
+vcs = "git"
+development_branch = "main"
+stable_branches = [ "stable-*" ]
+
+[sessions]
+
+[sessions.docs_check]
+validate_collection_refs="all"
+
+[sessions.license_check]
+
+[sessions.extra_checks]
+run_no_unwanted_files = true
+no_unwanted_files_module_extensions = [".py"]
+no_unwanted_files_yaml_extensions = [".yml"]
+run_action_groups = true
+
+[[sessions.extra_checks.action_groups_config]]
+name = "consul"
+pattern = "^consul_.*$"
+exclusions = [
+    "consul_acl",
+    "consul_acl_bootstrap",
+    "consul_kv",
+]
+doc_fragment = "community.general.consul.actiongroup_consul"
+
+[[sessions.extra_checks.action_groups_config]]
+name = "proxmox"
+pattern = "^proxmox(_.*)?$"
+exclusions = []
+doc_fragment = "community.general.proxmox.actiongroup_proxmox"
+
+[sessions.build_import_check]
+run_galaxy_importer = true
+
+[sessions.ansible_test_sanity]
+include_devel = false
+max_version = "2.19"
+
+[sessions.ansible_test_units]
+include_devel = false
+max_version = "2.19"

changelogs/changelog.yaml

@@ -1614,3 +1614,215 @@ releases:
       - 9774-fix-elasticsearch_plugin-proxy-settings.yml
       - 9778-redhat_subscription-ensure-to-enable-content.yml
     release_date: '2025-02-24'
+  9.5.6:
+    changes:
+      bugfixes:
+        - cloudlare_dns - handle exhausted response stream in case of HTTP errors
+          to show nice error message to the user (https://github.com/ansible-collections/community.general/issues/9782,
+          https://github.com/ansible-collections/community.general/pull/9818).
+        - dnf_versionlock - add support for dnf5 (https://github.com/ansible-collections/community.general/issues/9556).
+        - homebrew_cask - handle unusual brew version strings (https://github.com/ansible-collections/community.general/issues/8432,
+          https://github.com/ansible-collections/community.general/pull/9881).
+        - ipa_host - module revoked existing host certificates even if ``user_certificate``
+          was not given (https://github.com/ansible-collections/community.general/pull/9694).
+        - nmcli - enable changing only the order of DNS servers or search suffixes
+          (https://github.com/ansible-collections/community.general/issues/8724, https://github.com/ansible-collections/community.general/pull/9880).
+        - proxmox_vm_info - the module no longer expects that the key ``template``
+          exists in a dictionary returned by Proxmox (https://github.com/ansible-collections/community.general/issues/9875,
+          https://github.com/ansible-collections/community.general/pull/9910).
+        - sudoers - display stdout and stderr raised while failed validation (https://github.com/ansible-collections/community.general/issues/9674,
+          https://github.com/ansible-collections/community.general/pull/9871).
+      minor_changes:
+        - consul_token - fix idempotency when ``policies`` or ``roles`` are supplied
+          by name (https://github.com/ansible-collections/community.general/issues/9841,
+          https://github.com/ansible-collections/community.general/pull/9845).
+      release_summary: Regular bugfix release.
+    fragments:
+      - 9.5.6.yml
+      - 9694-ipa-host-certificate-revoked.yml
+      - 9818-cloudflare-dns-exhausted-response.yml
+      - 9845-consul_token_idempotency.yml
+      - 9875-proxmox-dont-expect-key-template-to-exist.yml
+      - 9880-nmcli-fix-reorder-same-dns-nameservers-search-suffixes.yml
+      - dnf_versionlock.yml
+      - homebrew_cask.yml
+      - sudoers.yml
+    release_date: '2025-03-24'
+  9.5.7:
+    changes:
+      bugfixes:
+        - dependent look plugin - make compatible with ansible-core's Data Tagging
+          feature (https://github.com/ansible-collections/community.general/pull/9833).
+        - diy callback plugin - make compatible with ansible-core's Data Tagging feature
+          (https://github.com/ansible-collections/community.general/pull/9833).
+        - "github_deploy_key - check that key really exists on 422\_to avoid masking\
+          \ other errors (https://github.com/ansible-collections/community.general/issues/6718,\
+          \ https://github.com/ansible-collections/community.general/pull/10011)."
+        - hashids and unicode_normalize filter plugins - avoid deprecated ``AnsibleFilterTypeError``
+          on ansible-core 2.19 (https://github.com/ansible-collections/community.general/pull/9992).
+        - keycloak_authentication - fix authentification config duplication for Keycloak
+          < 26.2.0 (https://github.com/ansible-collections/community.general/pull/9987).
+        - keycloak_client - fix the idempotency regression by normalizing the Keycloak
+          response for ``after_client`` (https://github.com/ansible-collections/community.general/issues/9905,
+          https://github.com/ansible-collections/community.general/pull/9976).
+        - proxmox inventory plugin - fix ``ansible_host`` staying empty for certain
+          Proxmox nodes (https://github.com/ansible-collections/community.general/issues/5906,
+          https://github.com/ansible-collections/community.general/pull/9952).
+        - proxmox_disk - fail gracefully if ``storage`` is required but not provided
+          by the user (https://github.com/ansible-collections/community.general/issues/9941,
+          https://github.com/ansible-collections/community.general/pull/9963).
+        - reveal_ansible_type filter plugin and ansible_type test plugin - make compatible
+          with ansible-core's Data Tagging feature (https://github.com/ansible-collections/community.general/pull/9833).
+        - sysrc - no longer always reporting ``changed=true`` when ``state=absent``.
+          This fixes the method ``exists()`` (https://github.com/ansible-collections/community.general/issues/10004,
+          https://github.com/ansible-collections/community.general/pull/10005).
+        - yaml callback plugin - use ansible-core internals to avoid breakage with
+          Data Tagging (https://github.com/ansible-collections/community.general/pull/9833).
+      known_issues:
+        - reveal_ansible_type filter plugin and ansible_type test plugin - note that
+          ansible-core's Data Tagging feature implements new aliases, such as ``_AnsibleTaggedStr``
+          for ``str``, ``_AnsibleTaggedInt`` for ``int``, and ``_AnsibleTaggedFloat``
+          for ``float`` (https://github.com/ansible-collections/community.general/pull/9833).
+      minor_changes:
+        - apache2_module - added workaround for new PHP module name, from ``php7_module``
+          to ``php_module`` (https://github.com/ansible-collections/community.general/pull/9951).
+      release_summary: Regular bugfix release.
+    fragments:
+      - 10005-fix-method-exists-in-sysrc.yml
+      - 10011-github_deploy_key-check-key-present.yml
+      - 9.5.7.yml
+      - 9833-data-tagging.yml
+      - 9951-mod-php-identifier.yml
+      - 9952-proxmox-inventory-plugin-improve-ansible_host.yml
+      - 9963-proxmox_disk-storage.yml
+      - 9976-keycloak_client-fix-idempotency-regression.yml
+      - 9987-keycloak-auth-flow-fix-config.yaml
+      - 9992-filtertypeerror.yml
+    release_date: '2025-04-21'
+  9.5.8:
+    changes:
+      bugfixes:
+        - cobbler_system - fix bug with Cobbler >= 3.4.0 caused by giving more than
+          2 positional arguments to ``CobblerXMLRPCInterface.get_system_handle()``
+          (https://github.com/ansible-collections/community.general/issues/8506, https://github.com/ansible-collections/community.general/pull/10145).
+        - kdeconfig - allow option values beginning with a dash (https://github.com/ansible-collections/community.general/issues/10127,
+          https://github.com/ansible-collections/community.general/pull/10128).
+        - keycloak_user_rolemapping - fix ``--diff`` mode (https://github.com/ansible-collections/community.general/issues/10067,
+          https://github.com/ansible-collections/community.general/pull/10075).
+        - pickle cache plugin - avoid extra JSON serialization with ansible-core >=
+          2.19 (https://github.com/ansible-collections/community.general/pull/10136).
+        - rundeck_acl_policy - ensure that project ACLs are sent to the correct endpoint
+          (https://github.com/ansible-collections/community.general/pull/10097).
+        - sysrc - split the output of ``sysrc -e -a`` on the first ``=`` only (https://github.com/ansible-collections/community.general/issues/10120,
+          https://github.com/ansible-collections/community.general/pull/10121).
+      release_summary: Regular bugfix release.
+    fragments:
+      - 10075-keycloak_user_rolemapping-diff.yml
+      - 10097-fix-rundeck_acl_policy-project-endpoint.yml
+      - 10121-sysrc-fix-split-first-separator.yml
+      - 10128-mark-end-of-options.yml
+      - 10136-cache-pickle-json.yml
+      - 10145-fix-typeerror-cobbler-xmlrpc.yml
+      - 9.5.8.yml
+    release_date: '2025-05-19'
+  9.5.9:
+    changes:
+      bugfixes:
+        - yaml callback plugin - adjust to latest changes in ansible-core devel (https://github.com/ansible-collections/community.general/pull/10212).
+        - yaml callback plugin - when using ansible-core 2.19.0b2 or newer, uses a
+          new utility provided by ansible-core. This allows us to remove all hacks
+          and vendored code that was part of the plugin for ansible-core versions
+          with Data Tagging so far (https://github.com/ansible-collections/community.general/pull/10242).
+      release_summary: Bugfix release.
+    fragments:
+      - 10212-yaml.yml
+      - 10242-yaml.yml
+      - 9.5.9.yml
+    release_date: '2025-06-15'
+  9.5.10:
+    changes:
+      bugfixes:
+        - dependent lookup plugin - avoid deprecated ansible-core 2.19 functionality
+          (https://github.com/ansible-collections/community.general/pull/10359).
+        - icinga2 inventory plugin - avoid using deprecated option when templating
+          options (https://github.com/ansible-collections/community.general/pull/10271).
+        - keycloak module_utils - fix call of method which does not exist in stable-9,
+          which was introduced by backporting 8b1a193a (https://github.com/ansible-collections/community.general/pull/10298).
+        - linode inventory plugin - avoid using deprecated option when templating
+          options (https://github.com/ansible-collections/community.general/pull/10271).
+      release_summary: Bugfix release with improved ansible-core 2.19 compatibility.
+    fragments:
+      - 10271--disable_lookups.yml
+      - 10298--keycloak-api-fix-stable9.yml
+      - 10359-dependent.yml
+      - 9.5.10.yml
+    release_date: '2025-07-13'
+  9.5.11:
+    changes:
+      bugfixes:
+        - apache2_module - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+        - doas become plugin - disable pipelining on ansible-core 2.19+. The plugin
+          does not work with pipelining, and since ansible-core 2.19 become plugins
+          can indicate that they do not work with pipelining (https://github.com/ansible-collections/community.general/issues/9977,
+          https://github.com/ansible-collections/community.general/pull/10537).
+        - htpasswd - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+        - irc - pass hostname to ``wrap_socket()`` if ``use_tls=true`` and ``validate_certs=true``
+          (https://github.com/ansible-collections/community.general/issues/10472,
+          https://github.com/ansible-collections/community.general/pull/10491).
+        - json_query filter plugin - make compatible with lazy evaluation list and
+          dictionary types of ansible-core 2.19 (https://github.com/ansible-collections/community.general/pull/10539).
+        - machinectl become plugin - disable pipelining on ansible-core 2.19+. The
+          plugin does not work with pipelining, and since ansible-core 2.19 become
+          plugins can indicate that they do not work with pipelining (https://github.com/ansible-collections/community.general/pull/10537).
+        - merge_variables lookup plugin - avoid deprecated functionality from ansible-core
+          2.19 (https://github.com/ansible-collections/community.general/pull/10566).
+        - proxmox inventory plugin - avoid using deprecated option when templating
+          options (https://github.com/ansible-collections/community.proxmox/pull/108,
+          https://github.com/ansible-collections/community.general/pull/10553).
+        - syspatch - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+        - sysupgrade - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+        - zypper_repository - avoid ansible-core 2.19 deprecation (https://github.com/ansible-collections/community.general/pull/10459).
+      release_summary: Bugfix release.
+    fragments:
+      - 10459-deprecations.yml
+      - 10491-irc.yml
+      - 10539-json_query.yml
+      - 10566-merge_variables.yml
+      - 108--disable_lookups.yml
+      - 9.5.11.yml
+      - become-pipelining.yml
+    release_date: '2025-08-11'
+  9.5.12:
+    changes:
+      bugfixes:
+        - github_deploy_key - fix bug during error handling if no body was present
+          in the result (https://github.com/ansible-collections/community.general/issues/10853,
+          https://github.com/ansible-collections/community.general/pull/10857).
+        - yaml cache plugin - make compatible with ansible-core 2.19 (https://github.com/ansible-collections/community.general/issues/10849,
+          https://github.com/ansible-collections/community.general/issues/10852).
+      release_summary: Bugfix release.
+    fragments:
+      - 10852-yaml.yml
+      - 10857-github_deploy_key-err.yml
+      - 9.5.12.yml
+    release_date: '2025-10-06'
+  9.5.13:
+    changes:
+      release_summary: 'Final maintenance release.
+
+
+        This is the last community.general 9.x.y release.
+
+        Please upgrade to community.general 10.x.y, 11.x.y, or 12.x.y.
+
+        Thanks a lot to everyone who contributed to a 9.x.y release!'
+      security_fixes:
+        - 'keycloak_user - the parameter ``credentials[].value`` is now marked as
+          ``no_log=true``. Before it was logged by Ansible, unless the task was marked
+          as ``no_log: true``. Since this parameter can be used for passwords, this
+          resulted in credential leaking (https://github.com/ansible-collections/community.general/issues/11000,
+          https://github.com/ansible-collections/community.general/pull/11005).'
+    fragments:
+      - 11005-keycloak_user.yml
+      - 9.5.13.yml
+    release_date: '2025-11-02'

changelogs/config.yaml

@@ -7,9 +7,9 @@ changelog_filename_template: ../CHANGELOG.rst
 changelog_filename_version_depth: 0
 changes_file: changelog.yaml
 changes_format: combined
+ignore_other_fragment_extensions: true
 keep_fragments: false
 mention_ancestor: true
-flatmap: true
 new_plugins_after_name: removed_features
 notesdir: fragments
 output_formats:
@@ -40,3 +40,4 @@ use_fqcn: true
 add_plugin_period: true
 changelog_nice_yaml: true
 changelog_sort: version
+vcs: auto

docs/docsite/rst/guide_deps.rst

@@ -22,6 +22,7 @@ The same example from the Developer Guide would become:
 
     from ansible_collections.community.general.plugins.module_utils import deps
 
+
     with deps.declare("foo"):
         import foo
 

docs/docsite/rst/guide_modulehelper.rst

@@ -75,6 +75,7 @@ section above, but there are more elements that will take part in it.
 
     from ansible_collections.community.general.plugins.module_utils.module_helper import ModuleHelper
 
+
     class MyTest(ModuleHelper):
         output_params = ()
         change_params = ()
@@ -256,9 +257,9 @@ With that, MH will automatically generate the diff output for variables that hav
     class MyTest(ModuleHelper):
         diff_params = ('value', )
 
-    def __run__(self):
-        # example from community.general.gio_mime
-        self.vars.set_meta("handler", initial_value=gio_mime_get(self.runner, self.vars.mime_type), diff=True, change=True)
+        def __run__(self):
+            # example from community.general.gio_mime
+            self.vars.set_meta("handler", initial_value=gio_mime_get(self.runner, self.vars.mime_type), diff=True, change=True)
 
 Moreover, if a module is set to return *facts* instead of return values, then again use the metadata ``fact=True`` and ``fact_params`` for module parameters.
 Additionally, you must specify ``facts_name``, as in:

galaxy.yml

@@ -5,7 +5,7 @@
 
 namespace: community
 name: general
-version: 9.5.5
+version: 9.5.13
 readme: README.md
 authors:
   - Ansible (https://github.com/ansible)

noxfile.py

@@ -0,0 +1,38 @@
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
+
+# /// script
+# dependencies = ["nox>=2025.02.09", "antsibull-nox"]
+# ///
+
+import sys
+
+import nox
+
+
+try:
+    import antsibull_nox
+except ImportError:
+    print("You need to install antsibull-nox in the same Python environment as nox.")
+    sys.exit(1)
+
+
+antsibull_nox.load_antsibull_nox_toml()
+
+
+@nox.session(name="aliases", python=False, default=True)
+def aliases(session: nox.Session) -> None:
+    session.run("python", "tests/sanity/extra/aliases.py")
+
+
+@nox.session(name="botmeta", default=True)
+def botmeta(session: nox.Session) -> None:
+    session.install("PyYAML", "voluptuous")
+    session.run("python", "tests/sanity/extra/botmeta.py")
+
+
+# Allow to run the noxfile with `python noxfile.py`, `pipx run noxfile.py`, or similar.
+# Requires nox >= 2025.02.09
+if __name__ == "__main__":
+    nox.main()

plugins/become/doas.py

@@ -84,6 +84,9 @@ DOCUMENTATION = '''
               - name: ansible_doas_prompt_l10n
             env:
               - name: ANSIBLE_DOAS_PROMPT_L10N
+    notes:
+      - This become plugin does not work when connection pipelining is enabled. With ansible-core 2.19+, using it automatically
+        disables pipelining. On ansible-core 2.18 and before, pipelining must explicitly be disabled by the user.
 '''
 
 import re
@@ -100,6 +103,10 @@ class BecomeModule(BecomeBase):
     fail = ('Permission denied',)
     missing = ('Authorization required',)
 
+    # See https://github.com/ansible-collections/community.general/issues/9977,
+    # https://github.com/ansible/ansible/pull/78111
+    pipelining = False
+
     def check_password_prompt(self, b_output):
         ''' checks if the expected password prompt exists in b_output '''
 

plugins/become/machinectl.py

@@ -77,6 +77,8 @@ DOCUMENTATION = '''
         if the user is allowed to perform the action (take a look at the examples section).
         If such a rule is not present the plugin only work if it is used in context with the root user,
         because then no further prompt will be shown by machinectl.
+      - This become plugin does not work when connection pipelining is enabled. With ansible-core 2.19+, using it automatically
+        disables pipelining. On ansible-core 2.18 and before, pipelining must explicitly be disabled by the user.
 '''
 
 EXAMPLES = r'''
@@ -109,6 +111,10 @@ class BecomeModule(BecomeBase):
     success = ('==== AUTHENTICATION COMPLETE ====',)
     require_tty = True  # see https://github.com/ansible-collections/community.general/issues/6932
 
+    # See https://github.com/ansible/ansible/issues/81254,
+    # https://github.com/ansible/ansible/pull/78111
+    pipelining = False
+
     @staticmethod
     def remove_ansi_codes(line):
         return ansi_color_codes.sub(b"", line)

plugins/cache/pickle.py

@@ -57,6 +57,7 @@ class CacheModule(BaseFileCacheModule):
     """
     A caching module backed by pickle files.
     """
+    _persistent = False  # prevent unnecessary JSON serialization and key munging
 
     def _load(self, filepath):
         # Pickle is a binary format

plugins/cache/yaml.py

@@ -45,8 +45,7 @@ options:
         # TODO: determine whether it is OK to change to: type: float
 """
 
-
-import codecs
+import os
 
 import yaml
 
@@ -61,9 +60,9 @@ class CacheModule(BaseFileCacheModule):
     """
 
     def _load(self, filepath):
-        with codecs.open(filepath, 'r', encoding='utf-8') as f:
+        with open(os.path.abspath(filepath), 'r', encoding='utf-8') as f:
             return AnsibleLoader(f).get_single_data()
 
     def _dump(self, value, filepath):
-        with codecs.open(filepath, 'w', encoding='utf-8') as f:
+        with open(os.path.abspath(filepath), 'w', encoding='utf-8') as f:
             yaml.dump(value, f, Dumper=AnsibleDumper, default_flow_style=False)

plugins/callback/diy.py

@@ -786,6 +786,12 @@ from ansible.vars.manager import VariableManager
 from ansible.plugins.callback.default import CallbackModule as Default
 from ansible.module_utils.common.text.converters import to_text
 
+try:
+    from ansible.template import trust_as_template  # noqa: F401, pylint: disable=unused-import
+    SUPPORTS_DATA_TAGGING = True
+except ImportError:
+    SUPPORTS_DATA_TAGGING = False
+
 
 class DummyStdout(object):
     def flush(self):
@@ -839,7 +845,10 @@ class CallbackModule(Default):
         return _ret
 
     def _using_diy(self, spec):
-        return (spec['msg'] is not None) and (spec['msg'] != spec['vars']['omit'])
+        sentinel = object()
+        omit = spec['vars'].get('omit', sentinel)
+        # With Data Tagging, omit is sentinel
+        return (spec['msg'] is not None) and (spec['msg'] != omit or omit is sentinel)
 
     def _parent_has_callback(self):
         return hasattr(super(CallbackModule, self), sys._getframe(1).f_code.co_name)
@@ -895,7 +904,7 @@ class CallbackModule(Default):
             )
         _ret.update(_all)
 
-        _ret.update(_ret.get(self.DIY_NS, {self.DIY_NS: CallbackDIYDict()}))
+        _ret.update(_ret.get(self.DIY_NS, {self.DIY_NS: {} if SUPPORTS_DATA_TAGGING else CallbackDIYDict()}))
 
         _ret[self.DIY_NS].update({'playbook': {}})
         _playbook_attributes = ['entries', 'file_name', 'basedir']

plugins/callback/yaml.py

@@ -33,9 +33,9 @@ import yaml
 import json
 import re
 import string
+from collections.abc import Mapping, Sequence
 
 from ansible.module_utils.common.text.converters import to_text
-from ansible.parsing.yaml.dumper import AnsibleDumper
 from ansible.plugins.callback import strip_internal_keys, module_response_deepcopy
 from ansible.plugins.callback.default import CallbackModule as Default
 
@@ -49,29 +49,77 @@ def should_use_block(value):
     return False
 
 
-class MyDumper(AnsibleDumper):
-    def represent_scalar(self, tag, value, style=None):
-        """Uses block style for multi-line strings"""
-        if style is None:
-            if should_use_block(value):
-                style = '|'
-                # we care more about readable than accuracy, so...
-                # ...no trailing space
-                value = value.rstrip()
-                # ...and non-printable characters
-                value = ''.join(x for x in value if x in string.printable or ord(x) >= 0xA0)
-                # ...tabs prevent blocks from expanding
-                value = value.expandtabs()
-                # ...and odd bits of whitespace
-                value = re.sub(r'[\x0b\x0c\r]', '', value)
-                # ...as does trailing space
-                value = re.sub(r' +\n', '\n', value)
-            else:
-                style = self.default_style
-        node = yaml.representer.ScalarNode(tag, value, style=style)
-        if self.alias_key is not None:
-            self.represented_objects[self.alias_key] = node
-        return node
+def adjust_str_value_for_block(value):
+    # we care more about readable than accuracy, so...
+    # ...no trailing space
+    value = value.rstrip()
+    # ...and non-printable characters
+    value = ''.join(x for x in value if x in string.printable or ord(x) >= 0xA0)
+    # ...tabs prevent blocks from expanding
+    value = value.expandtabs()
+    # ...and odd bits of whitespace
+    value = re.sub(r'[\x0b\x0c\r]', '', value)
+    # ...as does trailing space
+    value = re.sub(r' +\n', '\n', value)
+    return value
+
+
+def create_string_node(tag, value, style, default_style):
+    if style is None:
+        if should_use_block(value):
+            style = '|'
+            value = adjust_str_value_for_block(value)
+        else:
+            style = default_style
+    return yaml.representer.ScalarNode(tag, value, style=style)
+
+
+try:
+    from ansible.module_utils.common.yaml import HAS_LIBYAML
+    # import below was added in https://github.com/ansible/ansible/pull/85039,
+    # first contained in ansible-core 2.19.0b2:
+    from ansible.utils.vars import transform_to_native_types
+
+    if HAS_LIBYAML:
+        from yaml.cyaml import CSafeDumper as SafeDumper
+    else:
+        from yaml import SafeDumper
+
+    class MyDumper(SafeDumper):
+        def represent_scalar(self, tag, value, style=None):
+            """Uses block style for multi-line strings"""
+            node = create_string_node(tag, value, style, self.default_style)
+            if self.alias_key is not None:
+                self.represented_objects[self.alias_key] = node
+            return node
+
+except ImportError:
+    # In case transform_to_native_types cannot be imported, we either have ansible-core 2.19.0b1
+    # (or some random commit from the devel or stable-2.19 branch after merging the DT changes
+    # and before transform_to_native_types was added), or we have a version without the DT changes.
+
+    # Here we simply assume we have a version without the DT changes, and thus can continue as
+    # with ansible-core 2.18 and before.
+
+    transform_to_native_types = None
+
+    from ansible.parsing.yaml.dumper import AnsibleDumper
+
+    class MyDumper(AnsibleDumper):  # pylint: disable=inherit-non-class
+        def represent_scalar(self, tag, value, style=None):
+            """Uses block style for multi-line strings"""
+            node = create_string_node(tag, value, style, self.default_style)
+            if self.alias_key is not None:
+                self.represented_objects[self.alias_key] = node
+            return node
+
+
+def transform_recursively(value, transform):
+    if isinstance(value, Mapping):
+        return {transform(k): transform(v) for k, v in value.items()}
+    if isinstance(value, Sequence) and not isinstance(value, (str, bytes)):
+        return [transform(e) for e in value]
+    return transform(value)
 
 
 class CallbackModule(Default):
@@ -128,6 +176,8 @@ class CallbackModule(Default):
 
         if abridged_result:
             dumped += '\n'
+            if transform_to_native_types is not None:
+                abridged_result = transform_recursively(abridged_result, lambda v: transform_to_native_types(v, redact=False))
             dumped += to_text(yaml.dump(abridged_result, allow_unicode=True, width=1000, Dumper=MyDumper, default_flow_style=False))
 
         # indent by a couple of spaces

plugins/filter/hashids.py

@@ -10,12 +10,16 @@ __metaclass__ = type
 from ansible.errors import (
     AnsibleError,
     AnsibleFilterError,
-    AnsibleFilterTypeError,
 )
 
 from ansible.module_utils.common.text.converters import to_native
 from ansible.module_utils.common.collections import is_sequence
 
+try:
+    from ansible.errors import AnsibleTypeError
+except ImportError:
+    from ansible.errors import AnsibleFilterTypeError as AnsibleTypeError
+
 try:
     from hashids import Hashids
     HAS_HASHIDS = True
@@ -64,7 +68,7 @@ def hashids_encode(nums, salt=None, alphabet=None, min_length=None):
     try:
         hashid = hashids.encode(*nums)
     except TypeError as e:
-        raise AnsibleFilterTypeError(
+        raise AnsibleTypeError(
             "Data to encode must by a tuple or list of ints: %s" % to_native(e)
         )
 

plugins/filter/json_query.py

@@ -125,10 +125,17 @@ def json_query(data, expr):
                            'json_query filter')
 
     # Hack to handle Ansible Unsafe text, AnsibleMapping and AnsibleSequence
-    # See issue: https://github.com/ansible-collections/community.general/issues/320
-    jmespath.functions.REVERSE_TYPES_MAP['string'] = jmespath.functions.REVERSE_TYPES_MAP['string'] + ('AnsibleUnicode', 'AnsibleUnsafeText', )
-    jmespath.functions.REVERSE_TYPES_MAP['array'] = jmespath.functions.REVERSE_TYPES_MAP['array'] + ('AnsibleSequence', )
-    jmespath.functions.REVERSE_TYPES_MAP['object'] = jmespath.functions.REVERSE_TYPES_MAP['object'] + ('AnsibleMapping', )
+    # See issues https://github.com/ansible-collections/community.general/issues/320
+    # and https://github.com/ansible/ansible/issues/85600.
+    jmespath.functions.REVERSE_TYPES_MAP['string'] = jmespath.functions.REVERSE_TYPES_MAP['string'] + (
+        'AnsibleUnicode', 'AnsibleUnsafeText', '_AnsibleTaggedStr',
+    )
+    jmespath.functions.REVERSE_TYPES_MAP['array'] = jmespath.functions.REVERSE_TYPES_MAP['array'] + (
+        'AnsibleSequence', '_AnsibleLazyTemplateList',
+    )
+    jmespath.functions.REVERSE_TYPES_MAP['object'] = jmespath.functions.REVERSE_TYPES_MAP['object'] + (
+        'AnsibleMapping', '_AnsibleLazyTemplateDict',
+    )
     try:
         return jmespath.search(expr, data)
     except jmespath.exceptions.JMESPathError as e:

plugins/filter/reveal_ansible_type.py

@@ -23,93 +23,107 @@ DOCUMENTATION = '''
         type: dictionary
 '''
 
-EXAMPLES = '''
-# Substitution converts str to AnsibleUnicode
-# -------------------------------------------
+EXAMPLES = r"""
+# Substitution converts str to AnsibleUnicode or _AnsibleTaggedStr
+# ----------------------------------------------------------------
 
-# String. AnsibleUnicode.
-data: "abc"
-result: '{{ data | community.general.reveal_ansible_type }}'
-# result => AnsibleUnicode
+# String. AnsibleUnicode or _AnsibleTaggedStr.
+- data: "abc"
+  result: '{{ data | community.general.reveal_ansible_type }}'
+# result => AnsibleUnicode (or _AnsibleTaggedStr)
 
-# String. AnsibleUnicode alias str.
-alias: {"AnsibleUnicode": "str"}
-data: "abc"
-result: '{{ data | community.general.reveal_ansible_type(alias) }}'
+# String. AnsibleUnicode/_AnsibleTaggedStr alias str.
+- alias: {"AnsibleUnicode": "str", "_AnsibleTaggedStr": "str"}
+  data: "abc"
+  result: '{{ data | community.general.reveal_ansible_type(alias) }}'
 # result => str
 
-# List. All items are AnsibleUnicode.
-data: ["a", "b", "c"]
-result: '{{ data | community.general.reveal_ansible_type }}'
-# result => list[AnsibleUnicode]
+# List. All items are AnsibleUnicode/_AnsibleTaggedStr.
+- data: ["a", "b", "c"]
+  result: '{{ data | community.general.reveal_ansible_type }}'
+# result => list[AnsibleUnicode] or list[_AnsibleTaggedStr]
 
-# Dictionary. All keys are AnsibleUnicode. All values are AnsibleUnicode.
-data: {"a": "foo", "b": "bar", "c": "baz"}
-result: '{{ data | community.general.reveal_ansible_type }}'
-# result => dict[AnsibleUnicode, AnsibleUnicode]
+# Dictionary. All keys and values are AnsibleUnicode/_AnsibleTaggedStr.
+- data: {"a": "foo", "b": "bar", "c": "baz"}
+  result: '{{ data | community.general.reveal_ansible_type }}'
+# result => dict[AnsibleUnicode, AnsibleUnicode] or dict[_AnsibleTaggedStr, _AnsibleTaggedStr]
 
 # No substitution and no alias. Type of strings is str
 # ----------------------------------------------------
 
 # String
-result: '{{ "abc" | community.general.reveal_ansible_type }}'
+- result: '{{ "abc" | community.general.reveal_ansible_type }}'
 # result => str
 
 # Integer
-result: '{{ 123 | community.general.reveal_ansible_type }}'
+- result: '{{ 123 | community.general.reveal_ansible_type }}'
 # result => int
 
 # Float
-result: '{{ 123.45 | community.general.reveal_ansible_type }}'
+- result: '{{ 123.45 | community.general.reveal_ansible_type }}'
 # result => float
 
 # Boolean
-result: '{{ true | community.general.reveal_ansible_type }}'
+- result: '{{ true | community.general.reveal_ansible_type }}'
 # result => bool
 
 # List. All items are strings.
-result: '{{ ["a", "b", "c"] | community.general.reveal_ansible_type }}'
+- result: '{{ ["a", "b", "c"] | community.general.reveal_ansible_type }}'
 # result => list[str]
 
 # List of dictionaries.
-result: '{{ [{"a": 1}, {"b": 2}] | community.general.reveal_ansible_type }}'
+- result: '{{ [{"a": 1}, {"b": 2}] | community.general.reveal_ansible_type }}'
 # result => list[dict]
 
 # Dictionary. All keys are strings. All values are integers.
-result: '{{ {"a": 1} | community.general.reveal_ansible_type }}'
+- result: '{{ {"a": 1} | community.general.reveal_ansible_type }}'
 # result => dict[str, int]
 
 # Dictionary. All keys are strings. All values are integers.
-result: '{{ {"a": 1, "b": 2} | community.general.reveal_ansible_type }}'
+- result: '{{ {"a": 1, "b": 2} | community.general.reveal_ansible_type }}'
 # result => dict[str, int]
 
-# Type of strings is AnsibleUnicode or str
-# ----------------------------------------
+# Type of strings is AnsibleUnicode, _AnsibleTaggedStr, or str
+# ------------------------------------------------------------
 
 # Dictionary. The keys are integers or strings. All values are strings.
-alias: {"AnsibleUnicode": "str"}
-data: {1: 'a', 'b': 'b'}
-result: '{{ data | community.general.reveal_ansible_type(alias) }}'
+- alias:
+    AnsibleUnicode: str
+    _AnsibleTaggedStr: str
+    _AnsibleTaggedInt: int
+  data: {1: 'a', 'b': 'b'}
+  result: '{{ data | community.general.reveal_ansible_type(alias) }}'
 # result => dict[int|str, str]
 
 # Dictionary. All keys are integers. All values are keys.
-alias: {"AnsibleUnicode": "str"}
-data: {1: 'a', 2: 'b'}
-result: '{{ data | community.general.reveal_ansible_type(alias) }}'
+- alias:
+    AnsibleUnicode: str
+    _AnsibleTaggedStr: str
+    _AnsibleTaggedInt: int
+  data: {1: 'a', 2: 'b'}
+  result: '{{ data | community.general.reveal_ansible_type(alias) }}'
 # result => dict[int, str]
 
 # Dictionary. All keys are strings. Multiple types values.
-alias: {"AnsibleUnicode": "str"}
-data: {'a': 1, 'b': 1.1, 'c': 'abc', 'd': True, 'e': ['x', 'y', 'z'], 'f': {'x': 1, 'y': 2}}
-result: '{{ data | community.general.reveal_ansible_type(alias) }}'
+- alias:
+    AnsibleUnicode: str
+    _AnsibleTaggedStr: str
+    _AnsibleTaggedInt: int
+    _AnsibleTaggedFloat: float
+  data: {'a': 1, 'b': 1.1, 'c': 'abc', 'd': true, 'e': ['x', 'y', 'z'], 'f': {'x': 1, 'y': 2}}
+  result: '{{ data | community.general.reveal_ansible_type(alias) }}'
 # result => dict[str, bool|dict|float|int|list|str]
 
 # List. Multiple types items.
-alias: {"AnsibleUnicode": "str"}
-data: [1, 2, 1.1, 'abc', True, ['x', 'y', 'z'], {'x': 1, 'y': 2}]
-result: '{{ data | community.general.reveal_ansible_type(alias) }}'
+- alias:
+    AnsibleUnicode: str
+    _AnsibleTaggedStr: str
+    _AnsibleTaggedInt: int
+    _AnsibleTaggedFloat: float
+  data: [1, 2, 1.1, 'abc', true, ['x', 'y', 'z'], {'x': 1, 'y': 2}]
+  result: '{{ data | community.general.reveal_ansible_type(alias) }}'
 # result => list[bool|dict|float|int|list|str]
-'''
+"""
 
 RETURN = '''
   _value:
@@ -123,6 +137,7 @@ from ansible_collections.community.general.plugins.plugin_utils.ansible_type imp
 def reveal_ansible_type(data, alias=None):
     """Returns data type"""
 
+    # TODO: expose use_native_type parameter
     return _ansible_type(data, alias)
 
 

plugins/filter/to_days.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_days
-  short_description: Converte a duration string to days
+  short_description: Converts a duration string to days
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to days.

plugins/filter/to_hours.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_hours
-  short_description: Converte a duration string to hours
+  short_description: Converts a duration string to hours
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to hours.

plugins/filter/to_milliseconds.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_milliseconds
-  short_description: Converte a duration string to milliseconds
+  short_description: Converts a duration string to milliseconds
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to milliseconds.

plugins/filter/to_minutes.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_minutes
-  short_description: Converte a duration string to minutes
+  short_description: Converts a duration string to minutes
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to minutes.

plugins/filter/to_months.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_months
-  short_description: Converte a duration string to months
+  short_description: Convert a duration string to months
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to months.

plugins/filter/to_seconds.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_seconds
-  short_description: Converte a duration string to seconds
+  short_description: Converts a duration string to seconds
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to seconds.

plugins/filter/to_time_unit.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_time_unit
-  short_description: Converte a duration string to the given time unit
+  short_description: Converts a duration string to the given time unit
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to the given time unit.

plugins/filter/to_weeks.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_weeks
-  short_description: Converte a duration string to weeks
+  short_description: Converts a duration string to weeks
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to weeks.

plugins/filter/to_years.yml

@@ -5,7 +5,7 @@
 
 DOCUMENTATION:
   name: to_years
-  short_description: Converte a duration string to years
+  short_description: Converts a duration string to years
   version_added: 0.2.0
   description:
     - Parse a human readable time duration string and convert to years.

plugins/filter/unicode_normalize.py

@@ -49,9 +49,14 @@ RETURN = '''
 
 from unicodedata import normalize
 
-from ansible.errors import AnsibleFilterError, AnsibleFilterTypeError
+from ansible.errors import AnsibleFilterError
 from ansible.module_utils.six import text_type
 
+try:
+    from ansible.errors import AnsibleTypeError
+except ImportError:
+    from ansible.errors import AnsibleFilterTypeError as AnsibleTypeError
+
 
 def unicode_normalize(data, form='NFC'):
     """Applies normalization to 'unicode' strings.
@@ -66,7 +71,7 @@ def unicode_normalize(data, form='NFC'):
     """
 
     if not isinstance(data, text_type):
-        raise AnsibleFilterTypeError("%s is not a valid input type" % type(data))
+        raise AnsibleTypeError("%s is not a valid input type" % type(data))
 
     if form not in ('NFC', 'NFD', 'NFKC', 'NFKD'):
         raise AnsibleFilterError("%s is not a valid form" % form)

plugins/inventory/icinga2.py

@@ -296,11 +296,11 @@ class InventoryModule(BaseInventoryPlugin, Constructable):
         self.group_by_hostgroups = self.get_option('group_by_hostgroups')
 
         if self.templar.is_template(self.icinga2_url):
-            self.icinga2_url = self.templar.template(variable=self.icinga2_url, disable_lookups=False)
+            self.icinga2_url = self.templar.template(variable=self.icinga2_url)
         if self.templar.is_template(self.icinga2_user):
-            self.icinga2_user = self.templar.template(variable=self.icinga2_user, disable_lookups=False)
+            self.icinga2_user = self.templar.template(variable=self.icinga2_user)
         if self.templar.is_template(self.icinga2_password):
-            self.icinga2_password = self.templar.template(variable=self.icinga2_password, disable_lookups=False)
+            self.icinga2_password = self.templar.template(variable=self.icinga2_password)
 
         self.icinga2_url = self.icinga2_url.rstrip('/') + '/v1'
 

plugins/inventory/linode.py

@@ -146,7 +146,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
         access_token = self.get_option('access_token')
         if self.templar.is_template(access_token):
-            access_token = self.templar.template(variable=access_token, disable_lookups=False)
+            access_token = self.templar.template(variable=access_token)
 
         if access_token is None:
             raise AnsibleError((

plugins/inventory/proxmox.py

@@ -362,11 +362,26 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
     def _get_node_ip(self, node):
         ret = self._get_json("%s/api2/json/nodes/%s/network" % (self.proxmox_url, node))
 
+        # sort interface by iface name to make selection as stable as possible
+        ret.sort(key=lambda x: x['iface'])
+
         for iface in ret:
             try:
+                # only process interfaces adhering to these rules
+                if 'active' not in iface:
+                    self.display.vvv(f"Interface {iface['iface']} on node {node} does not have an active state")
+                    continue
+                if 'address' not in iface:
+                    self.display.vvv(f"Interface {iface['iface']} on node {node} does not have an address")
+                    continue
+                if 'gateway' not in iface:
+                    self.display.vvv(f"Interface {iface['iface']} on node {node} does not have a gateway")
+                    continue
+                self.display.vv(f"Using interface {iface['iface']} on node {node} with address {iface['address']} as node ip for ansible_host")
                 return iface['address']
             except Exception:
-                return None
+                continue
+        return None
 
     def _get_lxc_interfaces(self, properties, node, vmid):
         status_key = self._fact('status')
@@ -667,7 +682,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
         for o in ('url', 'user', 'password', 'token_id', 'token_secret'):
             v = self.get_option(o)
             if self.templar.is_template(v):
-                v = self.templar.template(v, disable_lookups=False)
+                v = self.templar.template(v)
             setattr(self, 'proxmox_%s' % o, v)
 
         # some more cleanup and validation

plugins/lookup/dependent.py

@@ -130,12 +130,24 @@ from ansible.template import Templar
 
 from ansible_collections.community.general.plugins.module_utils.version import LooseVersion
 
+try:
+    from ansible.template import trust_as_template as _trust_as_template
+    HAS_DATATAGGING = True
+except ImportError:
+    HAS_DATATAGGING = False
+
 
 # Whether Templar has a cache, which can be controlled by Templar.template()'s cache option.
 # The cache was removed for ansible-core 2.14 (https://github.com/ansible/ansible/pull/78419)
 _TEMPLAR_HAS_TEMPLATE_CACHE = LooseVersion(ansible_version) < LooseVersion('2.14.0')
 
 
+def _make_safe(value):
+    if HAS_DATATAGGING and isinstance(value, str):
+        return _trust_as_template(value)
+    return value
+
+
 class LookupModule(LookupBase):
     def __evaluate(self, expression, templar, variables):
         """Evaluate expression with templar.
@@ -144,10 +156,13 @@ class LookupModule(LookupBase):
         ``variables`` are the variables to use.
         """
         templar.available_variables = variables or {}
-        expression = "{0}{1}{2}".format("{{", expression, "}}")
+        quoted_expression = "{0}{1}{2}".format("{{", expression, "}}")
         if _TEMPLAR_HAS_TEMPLATE_CACHE:
-            return templar.template(expression, cache=False)
-        return templar.template(expression)
+            return templar.template(quoted_expression, cache=False)
+        if hasattr(templar, 'evaluate_expression'):
+            # This is available since the Data Tagging PR has been merged
+            return templar.evaluate_expression(_make_safe(expression))
+        return templar.template(quoted_expression)
 
     def __process(self, result, terms, index, current, templar, variables):
         """Fills ``result`` list with evaluated items.
@@ -195,7 +210,10 @@ class LookupModule(LookupBase):
 
         result = []
         if len(terms) > 0:
-            templar = Templar(loader=self._templar._loader)
+            if HAS_DATATAGGING:
+                templar = self._templar.copy_with_new_env(available_variables={})
+            else:
+                templar = Templar(loader=self._templar._loader)
             data = []
             vars_so_far = set()
             for index, term in enumerate(terms):

plugins/lookup/merge_variables.py

@@ -197,8 +197,8 @@ class LookupModule(LookupBase):
             result = initial_value
 
         for var_name in var_merge_names:
-            with self._templar.set_temporary_context(available_variables=variables):  # tmp. switch renderer to context of current variables
-                var_value = self._templar.template(variables[var_name])  # Render jinja2 templates
+            temp_templar = self._templar.copy_with_new_env(available_variables=variables)  # tmp. switch renderer to context of current variables
+            var_value = temp_templar.template(variables[var_name])  # Render jinja2 templates
             var_type = _verify_and_get_type(var_value)
 
             if prev_var_type is None:

plugins/module_utils/identity/keycloak/keycloak.py

@@ -2228,6 +2228,26 @@ class KeycloakAPI(object):
         except Exception as e:
             self.fail_open_url(e, msg="Unable to add authenticationConfig %s: %s" % (executionId, str(e)))
 
+    def delete_authentication_config(self, configId, realm='master'):
+        """ Delete authenticator config
+
+        :param configId: id of authentication config
+        :param realm: realm of authentication config to be deleted
+        """
+        try:
+            # Send a DELETE request to remove the specified authentication config from the Keycloak server.
+            open_url(
+                URL_AUTHENTICATION_CONFIG.format(
+                    url=self.baseurl,
+                    realm=realm,
+                    id=configId),
+                method='DELETE',
+                http_agent=self.http_agent, headers=self.restheaders,
+                timeout=self.connection_timeout,
+                validate_certs=self.validate_certs)
+        except Exception as e:
+            self.fail_open_url(e, msg="Unable to delete authentication config %s: %s" % (configId, str(e)))
+
     def create_subflow(self, subflowName, flowAlias, realm='master', flowType='basic-flow'):
         """ Create new sublow on the flow
 

plugins/modules/apache2_module.py

@@ -166,12 +166,12 @@ def _module_is_enabled(module):
         if module.params['ignore_configcheck']:
             if 'AH00534' in stderr and 'mpm_' in module.params['name']:
                 if module.params['warn_mpm_absent']:
-                    module.warnings.append(
+                    module.warn(
                         "No MPM module loaded! apache2 reload AND other module actions"
                         " will fail if no MPM module is loaded immediately."
                     )
             else:
-                module.warnings.append(error_msg)
+                module.warn(error_msg)
             return False
         else:
             module.fail_json(msg=error_msg)
@@ -196,6 +196,7 @@ def create_apache_identifier(name):
 
     # re expressions to extract subparts of names
     re_workarounds = [
+        ('php8', re.compile(r'^(php)[\d\.]+')),
         ('php', re.compile(r'^(php\d)\.')),
     ]
 
@@ -225,9 +226,7 @@ def _set_state(module, state):
 
     if _module_is_enabled(module) != want_enabled:
         if module.check_mode:
-            module.exit_json(changed=True,
-                             result=success_msg,
-                             warnings=module.warnings)
+            module.exit_json(changed=True, result=success_msg)
 
         a2mod_binary_path = module.get_bin_path(a2mod_binary)
         if a2mod_binary_path is None:
@@ -242,9 +241,7 @@ def _set_state(module, state):
         result, stdout, stderr = module.run_command(a2mod_binary_cmd + [name])
 
         if _module_is_enabled(module) == want_enabled:
-            module.exit_json(changed=True,
-                             result=success_msg,
-                             warnings=module.warnings)
+            module.exit_json(changed=True, result=success_msg)
         else:
             msg = (
                 'Failed to set module {name} to {state}:\n'
@@ -262,9 +259,7 @@ def _set_state(module, state):
                              stdout=stdout,
                              stderr=stderr)
     else:
-        module.exit_json(changed=False,
-                         result=success_msg,
-                         warnings=module.warnings)
+        module.exit_json(changed=False, result=success_msg)
 
 
 def main():
@@ -280,8 +275,6 @@ def main():
         supports_check_mode=True,
     )
 
-    module.warnings = []
-
     name = module.params['name']
     if name == 'cgi' and _run_threaded(module):
         module.fail_json(msg="Your MPM seems to be threaded. No automatic actions on module cgi possible.")

plugins/modules/cloudflare_dns.py

@@ -511,6 +511,9 @@ class CloudflareAPI(object):
         try:
             content = resp.read()
         except AttributeError:
+            content = None
+
+        if not content:
             if info['body']:
                 content = info['body']
             else:

plugins/modules/cobbler_system.py

@@ -162,6 +162,8 @@ from ansible.module_utils.common.text.converters import to_text
 from ansible_collections.community.general.plugins.module_utils.datetime import (
     now,
 )
+from ansible_collections.community.general.plugins.module_utils.version import LooseVersion
+
 
 IFPROPS_MAPPING = dict(
     bondingopts='bonding_opts',
@@ -279,7 +281,11 @@ def main():
 
         if system:
             # Update existing entry
-            system_id = conn.get_system_handle(name, token)
+            system_id = None
+            if LooseVersion(str(conn.version())) >= LooseVersion('3.4.0'):
+                system_id = conn.get_system_handle(name)
+            else:
+                system_id = conn.get_system_handle(name, token)
 
             for key, value in iteritems(module.params['properties']):
                 if key not in system:

plugins/modules/consul_token.py

@@ -225,7 +225,7 @@ def normalize_link_obj(api_obj, module_obj, key):
 
     for obj in module_objs:
         identifier = obj.get("ID")
-        name = obj.get("Name)")
+        name = obj.get("Name")
         if identifier and not name and identifier in id_to_name:
             obj["Name"] = id_to_name[identifier]
         if not identifier and name and name in name_to_id:

plugins/modules/copr.py

@@ -78,6 +78,13 @@ EXAMPLES = r"""
   community.general.copr:
     state: absent
     name: '@copr/integration_tests'
+
+- name: Install Caddy
+  community.general.copr:
+    name: '@caddy/caddy'
+    chroot: fedora-rawhide-{{ ansible_facts.architecture }}
+    includepkgs:
+      - caddy
 """
 
 RETURN = r"""

plugins/modules/crypttab.py

@@ -77,7 +77,7 @@ EXAMPLES = r'''
     state: opts_present
     opts: discard
   loop: '{{ ansible_mounts }}'
-  when: "'/dev/mapper/luks-' in {{ item.device }}"
+  when: "'/dev/mapper/luks-' in item.device"
 '''
 
 import os

plugins/modules/dnf_config_manager.py

@@ -40,6 +40,8 @@ options:
     required: false
     type: str
     choices: [enabled, disabled]
+notes:
+  - Does not work with C(dnf5).
 seealso:
   - module: ansible.builtin.dnf
   - module: ansible.builtin.yum_repository

plugins/modules/dnf_versionlock.py

@@ -74,6 +74,7 @@ notes:
     guess as close as possible to the behaviour inferred from its code.
   - For most of cases where you want to lock and unlock specific versions of a
     package, this works fairly well.
+  - Does not work with C(dnf5).
 requirements:
   - dnf
   - dnf-plugin-versionlock
@@ -96,12 +97,12 @@ EXAMPLES = r'''
 
 - name: Remove lock from nginx to be updated again
   community.general.dnf_versionlock:
-    package: nginx
+    name: nginx
     state: absent
 
 - name: Exclude bind 32:9.11 from installs or updates
   community.general.dnf_versionlock:
-    package: bind-32:9.11*
+    name: bind-32:9.11*
     state: excluded
 
 - name: Keep bash package in major version 4
@@ -235,6 +236,43 @@ def get_packages(module, patterns, only_installed=False):
     return packages_available_map_name_evrs
 
 
+def get_package_mgr():
+    for bin_path in (DNF_BIN,):
+        if os.path.exists(bin_path):
+            return "dnf5" if os.path.realpath(bin_path) == "/usr/bin/dnf5" else "dnf"
+    # fallback to dnf
+    return "dnf"
+
+
+def get_package_list(module, package_mgr="dnf"):
+    if package_mgr == "dnf":
+        return do_versionlock(module, "list").split()
+
+    package_list = []
+    if package_mgr == "dnf5":
+        stanza_start = False
+        package_name = None
+        for line in do_versionlock(module, "list").splitlines():
+            if line.startswith(("#", " ")):
+                continue
+            if line.startswith("Package name:"):
+                stanza_start = True
+                dummy, name = line.split(":", 1)
+                name = name.strip()
+                pkg_name = get_packages(module, patterns=[name])
+                package_name = "%s-%s.*" % (name, pkg_name[name].pop())
+                if package_name and package_name not in package_list:
+                    package_list.append(package_name)
+            if line.startswith("evr"):
+                dummy, package_version = line.split("=", 1)
+                package_version = package_version.strip()
+                if stanza_start:
+                    if package_name and package_name not in package_list:
+                        package_list.append(package_name)
+                    stanza_start = False
+    return package_list
+
+
 def main():
     module = AnsibleModule(
         argument_spec=dict(
@@ -253,9 +291,10 @@ def main():
     msg = ""
 
     # Check module pre-requisites.
-    if not os.path.exists(DNF_BIN):
-        module.fail_json(msg="%s was not found" % DNF_BIN)
-    if not os.path.exists(VERSIONLOCK_CONF):
+    global DNF_BIN
+    DNF_BIN = module.get_bin_path('dnf', True)
+    package_mgr = get_package_mgr()
+    if package_mgr == "dnf" and not os.path.exists(VERSIONLOCK_CONF):
         module.fail_json(msg="plugin versionlock is required")
 
     # Check incompatible options.
@@ -264,7 +303,7 @@ def main():
     if state != "clean" and not patterns:
         module.fail_json(msg="name list is required for %s state" % state)
 
-    locklist_pre = do_versionlock(module, "list").split()
+    locklist_pre = get_package_list(module, package_mgr=package_mgr)
 
     specs_toadd = []
     specs_todelete = []
@@ -343,7 +382,7 @@ def main():
         "specs_todelete": specs_todelete
     }
     if not module.check_mode:
-        response["locklist_post"] = do_versionlock(module, "list").split()
+        response["locklist_post"] = get_package_list(module, package_mgr=package_mgr)
     else:
         if state == "clean":
             response["locklist_post"] = []

plugins/modules/github_deploy_key.py

@@ -259,7 +259,12 @@ class GithubDeployKey(object):
             key_id = response_body["id"]
             self.module.exit_json(changed=True, msg="Deploy key successfully added", id=key_id)
         elif status_code == 422:
-            self.module.exit_json(changed=False, msg="Deploy key already exists")
+            # there might be multiple reasons for a 422
+            # so we must check if the reason is that the key already exists
+            if self.get_existing_key():
+                self.module.exit_json(changed=False, msg="Deploy key already exists")
+            else:
+                self.handle_error(method="POST", info=info)
         else:
             self.handle_error(method="POST", info=info)
 
@@ -279,6 +284,8 @@ class GithubDeployKey(object):
         body = info.get('body')
         if body:
             err = self.module.from_json(body)['message']
+        else:
+            err = None
 
         if status_code == 401:
             self.module.fail_json(msg="Failed to connect to {0} due to invalid credentials".format(self.github_url), http_status_code=status_code, error=err)

plugins/modules/homebrew_cask.py

@@ -425,10 +425,7 @@ class HomebrewCask(object):
         cmd = base_opts + [self.current_cask]
         rc, out, err = self.module.run_command(cmd)
 
-        if rc == 0:
-            return True
-        else:
-            return False
+        return rc == 0
 
     def _get_brew_version(self):
         if self.brew_version:
@@ -436,11 +433,13 @@ class HomebrewCask(object):
 
         cmd = [self.brew_path, '--version']
 
-        rc, out, err = self.module.run_command(cmd, check_rc=True)
+        dummy, out, dummy = self.module.run_command(cmd, check_rc=True)
 
-        # get version string from first line of "brew --version" output
-        version = out.split('\n')[0].split(' ')[1]
-        self.brew_version = version
+        pattern = r"Homebrew (.*)(\d+\.\d+\.\d+)(-dirty)?"
+        rematch = re.search(pattern, out)
+        if not rematch:
+            self.module.fail_json(msg="Failed to match regex to get brew version", stdout=out)
+        self.brew_version = rematch.groups()[1]
         return self.brew_version
 
     def _brew_cask_command_is_deprecated(self):

plugins/modules/homebrew_services.py

@@ -72,7 +72,7 @@ EXAMPLES = r"""
 - name: Remove the foo service (equivalent to `brew services stop foo`)
   community.general.homebrew_services:
     name: foo
-    service_state: absent
+    state: absent
 """
 
 RETURN = r"""

plugins/modules/htpasswd.py

@@ -238,8 +238,8 @@ def main():
             (msg, changed) = present(path, username, password, hash_scheme, create, check_mode)
         elif state == 'absent':
             if not os.path.exists(path):
-                module.exit_json(msg="%s not present" % username,
-                                 warnings="%s does not exist" % path, changed=False)
+                module.warn("%s does not exist" % path)
+                module.exit_json(msg="%s not present" % username, changed=False)
             (msg, changed) = absent(path, username, check_mode)
         else:
             module.fail_json(msg="Invalid state: %s" % state)

plugins/modules/ipa_host.py

@@ -272,6 +272,10 @@ def ensure(module, client):
                     data = {}
                     for key in diff:
                         data[key] = module_host.get(key)
+                    if "usercertificate" not in data:
+                        data["usercertificate"] = [
+                            cert['__base64__'] for cert in ipa_host.get("usercertificate", [])
+                        ]
                     ipa_host_show = client.host_show(name=name)
                     if ipa_host_show.get('has_keytab', True) and (state == 'disabled' or module.params.get('random_password')):
                         client.host_disable(name=name)

plugins/modules/irc.py

@@ -221,9 +221,11 @@ def send_msg(msg, server='localhost', port='6667', channel=None, nick_to=None, k
 
     irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     if use_tls:
+        kwargs = {}
         if validate_certs:
             try:
                 context = ssl.create_default_context()
+                kwargs["server_hostname"] = server
             except AttributeError:
                 raise Exception('Need at least Python 2.7.9 for SSL certificate validation')
         else:
@@ -233,7 +235,7 @@ def send_msg(msg, server='localhost', port='6667', channel=None, nick_to=None, k
             else:
                 context = ssl.SSLContext()
             context.verify_mode = ssl.CERT_NONE
-        irc = context.wrap_socket(irc)
+        irc = context.wrap_socket(irc, **kwargs)
     irc.connect((server, int(port)))
 
     if passwd:

plugins/modules/kdeconfig.py

@@ -144,7 +144,7 @@ def run_kwriteconfig(module, cmd, path, groups, key, value):
         else:
             args.append('false')
     else:
-        args.append(value)
+        args.extend(['--', value])
     module.run_command(args, check_rc=True)
 
 

plugins/modules/keycloak_authentication.py

@@ -308,6 +308,8 @@ def create_or_update_executions(kc, config, realm='master'):
                         }
                         # add the execution configuration
                         if new_exec["authenticationConfig"] is not None:
+                            if "authenticationConfig" in execution and "id" in execution["authenticationConfig"]:
+                                kc.delete_authentication_config(execution["authenticationConfig"]["id"], realm=realm)
                             kc.add_authenticationConfig_to_execution(updated_exec["id"], new_exec["authenticationConfig"], realm=realm)
                         for key in new_exec:
                             # remove unwanted key for the next API call

plugins/modules/keycloak_client.py

@@ -837,6 +837,13 @@ def normalise_cr(clientrep, remove_ids=False):
     return clientrep
 
 
+def normalize_kc_resp(clientrep):
+    # kc drops the variable 'authorizationServicesEnabled' if set to false
+    # to minimize diff/changes we set it to false if not set by kc
+    if clientrep and 'authorizationServicesEnabled' not in clientrep:
+        clientrep['authorizationServicesEnabled'] = False
+
+
 def sanitize_cr(clientrep):
     """ Removes probably sensitive details from a client representation.
 
@@ -1026,10 +1033,7 @@ def main():
     else:
         before_client = kc.get_client_by_id(cid, realm=realm)
 
-    # kc drops the variable 'authorizationServicesEnabled' if set to false
-    # to minimize diff/changes we set it to false if not set by kc
-    if before_client and 'authorizationServicesEnabled' not in before_client:
-        before_client['authorizationServicesEnabled'] = False
+    normalize_kc_resp(before_client)
 
     if before_client is None:
         before_client = {}
@@ -1110,6 +1114,8 @@ def main():
             kc.update_client(cid, desired_client, realm=realm)
 
             after_client = kc.get_client_by_id(cid, realm=realm)
+            normalize_kc_resp(after_client)
+
             if before_client == after_client:
                 result['changed'] = False
             if module._diff:

plugins/modules/keycloak_user.py

@@ -360,7 +360,7 @@ def main():
     argument_spec['auth_username']['aliases'] = []
     credential_spec = dict(
         type=dict(type='str', required=True),
-        value=dict(type='str', required=True),
+        value=dict(type='str', required=True, no_log=True),
         temporary=dict(type='bool', default=False)
     )
     client_consents_spec = dict(

plugins/modules/keycloak_user_rolemapping.py

@@ -369,7 +369,7 @@ def main():
             # Assign roles
             result['changed'] = True
             if module._diff:
-                result['diff'] = dict(before=assigned_roles_before, after=update_roles)
+                result['diff'] = dict(before={"roles": assigned_roles_before}, after={"roles": update_roles})
             if module.check_mode:
                 module.exit_json(**result)
             kc.add_user_rolemapping(uid=uid, cid=cid, role_rep=update_roles, realm=realm)
@@ -384,7 +384,7 @@ def main():
             # Remove mapping of role
             result['changed'] = True
             if module._diff:
-                result['diff'] = dict(before=assigned_roles_before, after=update_roles)
+                result['diff'] = dict(before={"roles": assigned_roles_before}, after={"roles": update_roles})
             if module.check_mode:
                 module.exit_json(**result)
             kc.delete_user_rolemapping(uid=uid, cid=cid, role_rep=update_roles, realm=realm)

plugins/modules/nmcli.py

@@ -1335,7 +1335,7 @@ EXAMPLES = r'''
     community.general.nmcli:
       conn_name: my-eth1
       state: up
-      reload: true
+      conn_reload: true
 
   - name: Add second ip4 address
     community.general.nmcli:
@@ -2416,9 +2416,11 @@ class Nmcli(object):
 
             if isinstance(current_value, list) and isinstance(value, list):
                 # compare values between two lists
-                if key in ('ipv4.addresses', 'ipv6.addresses'):
+                if key in ('ipv4.addresses', 'ipv6.addresses', 'ipv4.dns', 'ipv6.dns', 'ipv4.dns-search', 'ipv6.dns-search'):
                     # The order of IP addresses matters because the first one
                     # is the default source address for outbound connections.
+                    # Similarly, the order of DNS nameservers and search
+                    # suffixes is important.
                     changed |= current_value != value
                 else:
                     changed |= sorted(current_value) != sorted(value)

plugins/modules/proxmox_disk.py

@@ -567,6 +567,8 @@ class ProxmoxDiskAnsible(ProxmoxAnsible):
                 ok_str = "CD-ROM was created on %s bus in VM %s"
             else:
                 config_str = self.module.params["storage"]
+                if not config_str:
+                    self.module.fail_json(msg="The storage option must be specified.")
                 if self.module.params.get("media") != "cdrom":
                     config_str += ":%s" % (self.module.params["size"])
                 ok_str = "Disk %s created in VM %s"

plugins/modules/proxmox_vm_info.py

@@ -201,7 +201,7 @@ class ProxmoxVmInfoAnsible(ProxmoxAnsible):
                 if desired_vm:
                     desired_vm.update(detected_vm)
                     desired_vm["vmid"] = this_vm_id
-                    desired_vm["template"] = proxmox_to_ansible_bool(desired_vm["template"])
+                    desired_vm["template"] = proxmox_to_ansible_bool(desired_vm.get("template", 0))
                     # When user wants to retrieve the VM configuration
                     if config != "none":
                         # pending = 0, current = 1

plugins/modules/rundeck_acl_policy.py

@@ -130,11 +130,18 @@ from ansible_collections.community.general.plugins.module_utils.rundeck import (
 class RundeckACLManager:
     def __init__(self, module):
         self.module = module
+        if module.params.get("project"):
+            self.endpoint = "project/%s/acl/%s.aclpolicy" % (
+                self.module.params["project"],
+                self.module.params["name"],
+            )
+        else:
+            self.endpoint = "system/acl/%s.aclpolicy" % self.module.params["name"]
 
     def get_acl(self):
         resp, info = api_request(
             module=self.module,
-            endpoint="system/acl/%s.aclpolicy" % self.module.params["name"],
+            endpoint=self.endpoint,
         )
 
         return resp
@@ -148,7 +155,7 @@ class RundeckACLManager:
 
             resp, info = api_request(
                 module=self.module,
-                endpoint="system/acl/%s.aclpolicy" % self.module.params["name"],
+                endpoint=self.endpoint,
                 method="POST",
                 data={"contents": self.module.params["policy"]},
             )
@@ -172,7 +179,7 @@ class RundeckACLManager:
 
             resp, info = api_request(
                 module=self.module,
-                endpoint="system/acl/%s.aclpolicy" % self.module.params["name"],
+                endpoint=self.endpoint,
                 method="PUT",
                 data={"contents": self.module.params["policy"]},
             )
@@ -195,7 +202,7 @@ class RundeckACLManager:
             if not self.module.check_mode:
                 api_request(
                     module=self.module,
-                    endpoint="system/acl/%s.aclpolicy" % self.module.params["name"],
+                    endpoint=self.endpoint,
                     method="DELETE",
                 )
 

plugins/modules/sudoers.py

@@ -246,7 +246,7 @@ class Sudoers(object):
         rc, stdout, stderr = self.module.run_command(check_command, data=self.content())
 
         if rc != 0:
-            raise Exception('Failed to validate sudoers rule:\n{stdout}'.format(stdout=stdout))
+            self.module.fail_json(msg='Failed to validate sudoers rule:\n{stdout}'.format(stdout=stdout or stderr), stdout=stdout, stderr=stderr)
 
     def run(self):
         if self.state == 'absent':

plugins/modules/syspatch.py

@@ -103,7 +103,6 @@ def syspatch_run(module):
     cmd = module.get_bin_path('syspatch', True)
     changed = False
     reboot_needed = False
-    warnings = []
 
     # Set safe defaults for run_flag and check_flag
     run_flag = ['-c']
@@ -145,11 +144,11 @@ def syspatch_run(module):
             # Kernel update applied
             reboot_needed = True
         elif out.lower().find('syspatch updated itself') >= 0:
-            warnings.append('Syspatch was updated. Please run syspatch again.')
+            module.warn('Syspatch was updated. Please run syspatch again.')
 
         # If no stdout, then warn user
         if len(out) == 0:
-            warnings.append('syspatch had suggested changes, but stdout was empty.')
+            module.warn('syspatch had suggested changes, but stdout was empty.')
 
         changed = True
     else:
@@ -161,7 +160,6 @@ def syspatch_run(module):
         rc=rc,
         stderr=err,
         stdout=out,
-        warnings=warnings
     )
 
 

plugins/modules/sysrc.py

@@ -122,14 +122,19 @@ class Sysrc(object):
         return err.find("unknown variable") > 0 or out.find("unknown variable") > 0
 
     def exists(self):
-        # sysrc doesn't really use exit codes
-        (rc, out, err) = self.run_sysrc(self.name)
+        """
+        Tests whether the name is in the file.  If parameter value is defined,
+        then tests whether name=value is in the file.  These tests are necessary
+        because sysrc doesn't use exit codes.  Instead, let sysrc read the
+        file's content and create a dictionary comprising the configuration.
+        Use this dictionary to preform the tests.
+        """
+        (rc, out, err) = self.run_sysrc('-e', '-a')
+        conf = dict([i.split('=', 1) for i in out.splitlines()])
         if self.value is None:
-            regex = "%s: " % re.escape(self.name)
+            return self.name in conf
         else:
-            regex = "%s: %s$" % (re.escape(self.name), re.escape(self.value))
-
-        return not self.has_unknown_variable(out, err) and re.match(regex, out) is not None
+            return self.name in conf and conf[self.name] == '"%s"' % self.value
 
     def contains(self):
         (rc, out, err) = self.run_sysrc('-n', self.name)
@@ -142,13 +147,10 @@ class Sysrc(object):
         if self.exists():
             return
 
-        if self.module.check_mode:
-            self.changed = True
-            return
+        if not self.module.check_mode:
+            (rc, out, err) = self.run_sysrc("%s=%s" % (self.name, self.value))
 
-        (rc, out, err) = self.run_sysrc("%s=%s" % (self.name, self.value))
-        if out.find("%s:" % self.name) == 0 and re.search("-> %s$" % re.escape(self.value), out) is not None:
-            self.changed = True
+        self.changed = True
 
     def absent(self):
         if not self.exists():

plugins/modules/sysupgrade.py

@@ -101,7 +101,6 @@ def sysupgrade_run(module):
     sysupgrade_bin = module.get_bin_path('/usr/sbin/sysupgrade', required=True)
     cmd = [sysupgrade_bin]
     changed = False
-    warnings = []
 
     # Setup command flags
     if module.params['snapshot']:
@@ -137,7 +136,6 @@ def sysupgrade_run(module):
         rc=rc,
         stderr=err,
         stdout=out,
-        warnings=warnings
     )
 
 

plugins/modules/timezone.py

@@ -46,7 +46,7 @@ options:
     aliases: [rtc]
     choices: [local, UTC]
 notes:
-  - On Ubuntu 24.04 the C(util-linux-extra) package is required to provide the C(hwclock) command.
+  - On Ubuntu 24.04 and Debian 13 (Trixie), the C(util-linux-extra) package is required to provide the C(hwclock) command.
   - On SmartOS the C(sm-set-timezone) utility (part of the smtools package) is required to set the zone timezone.
   - On AIX only Olson/tz database timezones are usable (POSIX is not supported). An OS reboot is also required on AIX for the new timezone setting
     to take effect. Note that AIX 6.1+ is needed (OS level 61 or newer).

plugins/modules/yarn.py

@@ -16,7 +16,8 @@ DOCUMENTATION = '''
 module: yarn
 short_description: Manage node.js packages with Yarn
 description:
-  - Manage node.js packages with the Yarn package manager (https://yarnpkg.com/)
+  - Manage Node.js packages with the Yarn package manager U(https://yarnpkg.com/).
+  - Note that at the moment, this module B(only works with Yarn Classic).
 author:
   - "David Gunter (@verkaufer)"
   - "Chris Hoffman (@chrishoffman), creator of NPM Ansible module)"
@@ -85,7 +86,7 @@ options:
     default: present
     choices: [ "present", "absent", "latest" ]
 requirements:
-    - Yarn installed in bin path (typically /usr/local/bin)
+  - Yarn Classic installed in bin path (typically C(/usr/local/bin))
 '''
 
 EXAMPLES = '''

plugins/modules/zypper_repository.py

@@ -248,7 +248,7 @@ def repo_exists(module, repodata, overwrite_multiple):
             module.fail_json(msg=errmsg)
 
 
-def addmodify_repo(module, repodata, old_repos, zypper_version, warnings):
+def addmodify_repo(module, repodata, old_repos, zypper_version):
     "Adds the repo, removes old repos before, that would conflict."
     repo = repodata['url']
     cmd = _get_cmd(module, 'addrepo', '--check')
@@ -261,7 +261,7 @@ def addmodify_repo(module, repodata, old_repos, zypper_version, warnings):
         if zypper_version >= LooseVersion('1.12.25'):
             cmd.extend(['--priority', str(repodata['priority'])])
         else:
-            warnings.append("Setting priority only available for zypper >= 1.12.25. Ignoring priority argument.")
+            module.warn("Setting priority only available for zypper >= 1.12.25. Ignoring priority argument.")
 
     if repodata['enabled'] == '0':
         cmd.append('--disable')
@@ -275,7 +275,7 @@ def addmodify_repo(module, repodata, old_repos, zypper_version, warnings):
         else:
             cmd.append('--no-gpgcheck')
     else:
-        warnings.append("Enabling/disabling gpgcheck only available for zypper >= 1.6.2. Using zypper default value.")
+        module.warn("Enabling/disabling gpgcheck only available for zypper >= 1.6.2. Using zypper default value.")
 
     if repodata['autorefresh'] == '1':
         cmd.append('--refresh')
@@ -348,7 +348,6 @@ def main():
     runrefresh = module.params['runrefresh']
 
     zypper_version = get_zypper_version(module)
-    warnings = []  # collect warning messages for final output
 
     repodata = {
         'url': repo,
@@ -455,7 +454,7 @@ def main():
             if runrefresh:
                 runrefreshrepo(module, auto_import_keys, shortname)
             exit_unchanged()
-        rc, stdout, stderr = addmodify_repo(module, repodata, old_repos, zypper_version, warnings)
+        rc, stdout, stderr = addmodify_repo(module, repodata, old_repos, zypper_version)
         if rc == 0 and (runrefresh or auto_import_keys):
             runrefreshrepo(module, auto_import_keys, shortname)
     elif state == 'absent':
@@ -464,9 +463,9 @@ def main():
         rc, stdout, stderr = remove_repo(module, shortname)
 
     if rc == 0:
-        module.exit_json(changed=True, repodata=repodata, state=state, warnings=warnings)
+        module.exit_json(changed=True, repodata=repodata, state=state)
     else:
-        module.fail_json(msg="Zypper failed with rc %s" % rc, rc=rc, stdout=stdout, stderr=stderr, repodata=repodata, state=state, warnings=warnings)
+        module.fail_json(msg="Zypper failed with rc %s" % rc, rc=rc, stdout=stdout, stderr=stderr, repodata=repodata, state=state)
 
 
 if __name__ == '__main__':

plugins/plugin_utils/ansible_type.py

@@ -8,17 +8,31 @@ __metaclass__ = type
 from ansible.errors import AnsibleFilterError
 from ansible.module_utils.common._collections_compat import Mapping
 
+try:
+    # Introduced with Data Tagging (https://github.com/ansible/ansible/pull/84621):
+    from ansible.module_utils.datatag import native_type_name as _native_type_name
+except ImportError:
+    _native_type_name = None
 
-def _atype(data, alias):
+
+def _atype(data, alias, *, use_native_type: bool = False):
     """
     Returns the name of the type class.
     """
 
-    data_type = type(data).__name__
+    if use_native_type and _native_type_name:
+        data_type = _native_type_name(data)
+    else:
+        data_type = type(data).__name__
+    # The following types were introduced with Data Tagging (https://github.com/ansible/ansible/pull/84621):
+    if data_type == "_AnsibleLazyTemplateDict":
+        data_type = "dict"
+    elif data_type == "_AnsibleLazyTemplateList":
+        data_type = "list"
     return alias.get(data_type, data_type)
 
 
-def _ansible_type(data, alias):
+def _ansible_type(data, alias, *, use_native_type: bool = False):
     """
     Returns the Ansible data type.
     """
@@ -30,16 +44,16 @@ def _ansible_type(data, alias):
         msg = "The argument alias must be a dictionary. %s is %s"
         raise AnsibleFilterError(msg % (alias, type(alias)))
 
-    data_type = _atype(data, alias)
+    data_type = _atype(data, alias, use_native_type=use_native_type)
 
     if data_type == 'list' and len(data) > 0:
-        items = [_atype(i, alias) for i in data]
+        items = [_atype(i, alias, use_native_type=use_native_type) for i in data]
         items_type = '|'.join(sorted(set(items)))
         return ''.join((data_type, '[', items_type, ']'))
 
     if data_type == 'dict' and len(data) > 0:
-        keys = [_atype(i, alias) for i in data.keys()]
-        vals = [_atype(i, alias) for i in data.values()]
+        keys = [_atype(i, alias, use_native_type=use_native_type) for i in data.keys()]
+        vals = [_atype(i, alias, use_native_type=use_native_type) for i in data.values()]
         keys_type = '|'.join(sorted(set(keys)))
         vals_type = '|'.join(sorted(set(vals)))
         return ''.join((data_type, '[', keys_type, ', ', vals_type, ']'))

plugins/test/ansible_type.py

@@ -28,30 +28,36 @@ DOCUMENTATION = '''
 
 EXAMPLES = '''
 
-# Substitution converts str to AnsibleUnicode
-# -------------------------------------------
+# Substitution converts str to AnsibleUnicode or _AnsibleTaggedStr
+# ----------------------------------------------------------------
 
-# String. AnsibleUnicode.
-dtype: AnsibleUnicode
+# String. AnsibleUnicode or _AnsibleTaggedStr.
+dtype:
+  - AnsibleUnicode
+  - _AnsibleTaggedStr
 data: "abc"
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
 
-# String. AnsibleUnicode alias str.
-alias: {"AnsibleUnicode": "str"}
+# String. AnsibleUnicode/_AnsibleTaggedStr alias str.
+alias: {"AnsibleUnicode": "str", "_AnsibleTaggedStr": "str"}
 dtype: str
 data: "abc"
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # result => true
 
-# List. All items are AnsibleUnicode.
-dtype: list[AnsibleUnicode]
+# List. All items are AnsibleUnicode/_AnsibleTaggedStr.
+dtype:
+  - list[AnsibleUnicode]
+  - list[_AnsibleTaggedStr]
 data: ["a", "b", "c"]
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
 
-# Dictionary. All keys are AnsibleUnicode. All values are AnsibleUnicode.
-dtype: dict[AnsibleUnicode, AnsibleUnicode]
+# Dictionary. All keys and values are AnsibleUnicode/_AnsibleTaggedStr.
+dtype:
+  - dict[AnsibleUnicode, AnsibleUnicode]
+  - dict[_AnsibleTaggedStr, _AnsibleTaggedStr]
 data: {"a": "foo", "b": "bar", "c": "baz"}
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
@@ -99,32 +105,46 @@ dtype: dict[str, int]
 result: '{{ {"a": 1, "b": 2} is community.general.ansible_type(dtype) }}'
 # result => true
 
-# Type of strings is AnsibleUnicode or str
-# ----------------------------------------
+# Type of strings is AnsibleUnicode, _AnsibleTaggedStr, or str
+# ------------------------------------------------------------
 
 # Dictionary. The keys are integers or strings. All values are strings.
-alias: {"AnsibleUnicode": "str"}
+alias:
+  AnsibleUnicode: str
+  _AnsibleTaggedStr: str
+  _AnsibleTaggedInt: int
 dtype: dict[int|str, str]
 data: {1: 'a', 'b': 'b'}
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # result => true
 
 # Dictionary. All keys are integers. All values are keys.
-alias: {"AnsibleUnicode": "str"}
+alias:
+  AnsibleUnicode: str
+  _AnsibleTaggedStr: str
+  _AnsibleTaggedInt: int
 dtype: dict[int, str]
 data: {1: 'a', 2: 'b'}
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # result => true
 
 # Dictionary. All keys are strings. Multiple types values.
-alias: {"AnsibleUnicode": "str"}
+alias:
+  AnsibleUnicode: str
+  _AnsibleTaggedStr: str
+  _AnsibleTaggedInt: int
+  _AnsibleTaggedFloat: float
 dtype: dict[str, bool|dict|float|int|list|str]
 data: {'a': 1, 'b': 1.1, 'c': 'abc', 'd': True, 'e': ['x', 'y', 'z'], 'f': {'x': 1, 'y': 2}}
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # result => true
 
 # List. Multiple types items.
-alias: {"AnsibleUnicode": "str"}
+alias:
+  AnsibleUnicode: str
+  _AnsibleTaggedStr: str
+  _AnsibleTaggedInt: int
+  _AnsibleTaggedFloat: float
 dtype: list[bool|dict|float|int|list|str]
 data: [1, 2, 1.1, 'abc', True, ['x', 'y', 'z'], {'x': 1, 'y': 2}]
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
@@ -133,20 +153,20 @@ result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # Option dtype is list
 # --------------------
 
-# AnsibleUnicode or str
-dtype: ['AnsibleUnicode', 'str']
+# AnsibleUnicode, _AnsibleTaggedStr, or str
+dtype: ['AnsibleUnicode', '_AnsibleTaggedStr', 'str']
 data: abc
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
 
 # float or int
-dtype: ['float', 'int']
+dtype: ['float', 'int', "_AnsibleTaggedInt", "_AnsibleTaggedFloat"]
 data: 123
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
 
 # float or int
-dtype: ['float', 'int']
+dtype: ['float', 'int', "_AnsibleTaggedInt", "_AnsibleTaggedFloat"]
 data: 123.45
 result: '{{ data is community.general.ansible_type(dtype) }}'
 # result => true
@@ -155,14 +175,22 @@ result: '{{ data is community.general.ansible_type(dtype) }}'
 # --------------
 
 # int alias number
-alias: {"int": "number", "float": "number"}
+alias:
+    int: number
+    float: number
+    _AnsibleTaggedInt: number
+    _AnsibleTaggedFloat: float
 dtype: number
 data: 123
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
 # result => true
 
 # float alias number
-alias: {"int": "number", "float": "number"}
+alias:
+    int: number
+    float: number
+    _AnsibleTaggedInt: number
+    _AnsibleTaggedFloat: float
 dtype: number
 data: 123.45
 result: '{{ data is community.general.ansible_type(dtype, alias) }}'
@@ -192,6 +220,7 @@ def ansible_type(data, dtype, alias=None):
     else:
         data_types = dtype
 
+    # TODO: expose use_native_type parameter
     return _ansible_type(data, alias) in data_types
 
 

tests/integration/targets/alternatives/tasks/subcommands.yml

@@ -89,7 +89,7 @@
   assert:
     that:
       - cmd.rc == 2
-      - '"No such file" in cmd.msg'
+      - '"No such file" in cmd.msg or "Error executing command." == cmd.msg'
 
 - name: Get dummymain alternatives output
   command:
@@ -172,7 +172,7 @@
   assert:
     that:
       - cmd.rc == 2
-      - '"No such file" in cmd.msg'
+      - '"No such file" in cmd.msg or "Error executing command." == cmd.msg'
 
 - name: Get dummymain alternatives output
   command:

tests/integration/targets/apache2_module/tasks/actualtest.yml

@@ -186,7 +186,7 @@
   - name: ensure configcheck fails task with when run without mpm modules
     assert:
       that:
-        - "{{ item.failed }}"
+        - item is failed
     with_items: "{{ remove_with_configcheck.results }}"
 
   - name: try to disable all mpm modules without configcheck

tests/integration/targets/callback/filter_plugins/helper.py

@@ -0,0 +1,54 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.module_utils.six import string_types
+
+
+def callback_results_extractor(outputs_results):
+    results = []
+    for result in outputs_results:
+        differences = []
+        expected_output = result['test']['expected_output']
+        stdout_lines = result['stdout_lines']
+        for i in range(max(len(expected_output), len(stdout_lines))):
+            line = "line_%s" % (i + 1)
+            test_line = stdout_lines[i] if i < len(stdout_lines) else None
+            expected_lines = expected_output[i] if i < len(expected_output) else None
+            if not isinstance(expected_lines, string_types) and expected_lines is not None:
+                if test_line not in expected_lines:
+                    differences.append({
+                        'line': {
+                            'expected_one_of': expected_lines,
+                            'got': test_line,
+                        }
+                    })
+            else:
+                if test_line != expected_lines:
+                    differences.append({
+                        'line': {
+                            'expected': expected_lines,
+                            'got': test_line,
+                        }
+                    })
+        results.append({
+            'name': result['test']['name'],
+            'output': {
+                'differences': differences,
+                'expected': expected_output,
+                'got': stdout_lines,
+            },
+        })
+    return results
+
+
+class FilterModule:
+    ''' Jinja2 compat filters '''
+
+    def filters(self):
+        return {
+            'callback_results_extractor': callback_results_extractor,
+        }

tests/integration/targets/callback/tasks/main.yml

@@ -30,7 +30,7 @@
       label: "{{ test.name }}"
 
   - name: Collect outputs
-    command: "ansible-playbook -i {{ inventory }} {{ playbook }}"
+    command: "ansible-playbook -i {{ inventory }} {{ playbook }} {{ test.extra_cli_arguments | default('') }}"
     environment: "{{ test.environment }}"
     loop: "{{ tests }}"
     loop_control:
@@ -50,44 +50,11 @@
   - name: Assert test output equals expected output
     assert:
       that: result.output.differences | length == 0
-    loop: "{{ results }}"
+    loop: "{{ outputs.results | callback_results_extractor }}"
     loop_control:
       loop_var: result
       label: "{{ result.name }}"
     register: assertions
-    vars:
-      results: >-
-        {%- set results = []                                                                           -%}
-        {%- for result in outputs.results                                                              -%}
-        {%-   set differences = []                                                                     -%}
-        {%-   for i in range([result.test.expected_output | count, result.stdout_lines | count] | max) -%}
-        {%-     set line = "line_%s" | format(i+1)                                                     -%}
-        {%-     set test_line = result.stdout_lines[i] | default(none)                                 -%}
-        {%-     set expected_lines = result.test.expected_output[i] | default(none)                    -%}
-        {%-     if expected_lines is not string and expected_lines is not none                         -%}
-        {%-       if test_line not in expected_lines                                                   -%}
-        {{-         differences.append({
-                      line: {
-                        'expected_one_of': expected_lines,
-                        'got': test_line }})                                                           -}}
-        {%-       endif                                                                                -%}
-        {%-     else                                                                                   -%}
-        {%-       if expected_lines != test_line                                                       -%}
-        {{-         differences.append({
-                      line: {
-                        'expected': expected_lines,
-                        'got': test_line }})                                                           -}}
-        {%-       endif                                                                                -%}
-        {%-     endif                                                                                  -%}
-        {%-   endfor                                                                                   -%}
-        {{-   results.append({
-                'name': result.test.name,
-                'output': {
-                    'differences': differences,
-                    'expected': result.test.expected_output,
-                    'got': result.stdout_lines }})                                                     -}}
-        {%- endfor                                                                                     -%}
-        {{- results                                                                                    -}}
 
   always:
   - name: Remove temporary playbooks

tests/integration/targets/callback_diy/tasks/main.yml

@@ -460,3 +460,63 @@
           "PLAY RECAP *********************************************************************",
           "testhost                   : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   "
         ]
+
+      - name: Set on_any_msg
+        environment:
+          ANSIBLE_NOCOLOR: 'true'
+          ANSIBLE_FORCE_COLOR: 'false'
+          ANSIBLE_STDOUT_CALLBACK: community.general.diy
+          ANSIBLE_CALLBACK_DIY_ON_ANY_MSG: foo
+        playbook: !unsafe |
+          - hosts: testhost
+            gather_facts: false
+            tasks:
+              - name: A loop
+                debug:
+                  msg: "{{ item }}"
+                loop:
+                  - 1
+                  - 2
+              - name: Sample task name
+                debug:
+                  msg: sample debug msg
+              - name: Skipped task
+                command: ls /
+                when: false
+        expected_output:
+          - "foo"
+          - ""
+          - "PLAY [testhost] ****************************************************************"
+          - "foo"
+          - ""
+          - "TASK [A loop] ******************************************************************"
+          - "foo"
+          - "foo"
+          - "ok: [testhost] => (item=1) => {"
+          - "    \"msg\": 1"
+          - "}"
+          - "foo"
+          - "ok: [testhost] => (item=2) => {"
+          - "    \"msg\": 2"
+          - "}"
+          - "foo"
+          - "foo"
+          - ""
+          - "TASK [Sample task name] ********************************************************"
+          - "foo"
+          - "foo"
+          - "ok: [testhost] => {"
+          - "    \"msg\": \"sample debug msg\""
+          - "}"
+          - "foo"
+          - ""
+          - "TASK [Skipped task] ************************************************************"
+          - "foo"
+          - "foo"
+          - "skipping: [testhost]"
+          - "foo"
+          - ""
+          - "PLAY RECAP *********************************************************************"
+          - "testhost                   : ok=2    changed=0    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0   "
+          - ""
+          - "foo"

tests/integration/targets/callback_log_plays/runme.sh

@@ -17,5 +17,5 @@ ansible-playbook ping_log.yml -v "$@"
 # now force it to fail
 export ANSIBLE_LOG_FOLDER="logit.file"
 touch "${ANSIBLE_LOG_FOLDER}"
-ansible-playbook ping_log.yml -v "$@" 2>&1| grep 'Failure using method (v2_runner_on_ok) in callback plugin'
+ansible-playbook ping_log.yml -v "$@" 2>&1| grep -E "(Failure using method \(v2_runner_on_ok\) in callback plugin|Callback dispatch 'v2_runner_on_ok' failed for plugin)"
 [[ ! -f "${ANSIBLE_LOG_FOLDER}/localhost" ]]

tests/integration/targets/callback_yaml/meta/main.yml

@@ -0,0 +1,7 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+dependencies:
+  - setup_remote_tmp_dir

tests/integration/targets/callback_yaml/tasks/main.yml

@@ -8,6 +8,11 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+- name: Write vault password to disk
+  ansible.builtin.copy:
+    dest: "{{ remote_tmp_dir }}/vault-password"
+    content: asdf
+
 - name: Run tests
   include_role:
     name: callback
@@ -67,7 +72,7 @@
           ANSIBLE_NOCOLOR: 'true'
           ANSIBLE_FORCE_COLOR: 'false'
           ANSIBLE_STDOUT_CALLBACK: community.general.yaml
-        playbook: |
+        playbook: !unsafe |
           - hosts: testhost
             gather_facts: false
             vars:
@@ -78,9 +83,7 @@
             tasks:
               - name: Test to_yaml
                 debug:
-                  msg: "{{ '{{' }}'{{ '{{' }}'{{ '}}' }} data | to_yaml {{ '{{' }}'{{ '}}' }}'{{ '}}' }}"
-        # The above should be:   msg: "{{ data | to_yaml }}"
-        # Unfortunately, the way Ansible handles templating, we need to do some funny 'escaping' tricks...
+                  msg: "{{ data | to_yaml }}"
         expected_output: [
           "",
           "PLAY [testhost] ****************************************************************",
@@ -99,3 +102,43 @@
           "PLAY RECAP *********************************************************************",
           "testhost                   : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   "
         ]
+      - name: Some more fun with data tagging
+        environment:
+          ANSIBLE_NOCOLOR: 'true'
+          ANSIBLE_FORCE_COLOR: 'false'
+          ANSIBLE_STDOUT_CALLBACK: community.general.yaml
+        extra_cli_arguments: "--vault-password-file {{ remote_tmp_dir }}/vault-password"
+        playbook: !unsafe |
+          - hosts: testhost
+            gather_facts: false
+            vars:
+              foo: bar
+              baz: !vault |
+                $ANSIBLE_VAULT;1.1;AES256
+                30393064316433636636373336363538663034643135363938646665393661353833633865313765
+                3835366434646339313337663335393865336163663434310a316161313662666466333332353731
+                64663064366461643162666137303737643164376134303034306366383830336232363837636638
+                3830653338626130360a313639623231353931356563313065373661303262646337383534663932
+                64353461663065333362346264326335373032313333343539646661656634653138646332313639
+                3566313765626464613734623664663266336237646139373935
+            tasks:
+              - name: Test regular string
+                debug:
+                  var: foo
+              - name: Test vaulted string
+                debug:
+                  var: baz
+        expected_output:
+          - ""
+          - "PLAY [testhost] ****************************************************************"
+          - ""
+          - "TASK [Test regular string] *****************************************************"
+          - "ok: [testhost] => "
+          - "  foo: bar"
+          - ""
+          - "TASK [Test vaulted string] *****************************************************"
+          - "ok: [testhost] => "
+          - "  baz: aBcDeFgHiJkLmNoPqRsTuVwXyZ012345"
+          - ""
+          - "PLAY RECAP *********************************************************************"
+          - "testhost                   : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   "

tests/integration/targets/cargo/tasks/main.yml

@@ -20,4 +20,4 @@
   environment: "{{ cargo_environment }}"
   when: has_cargo | default(false)
 - import_tasks: test_rustup_cargo.yml
-  when: rustup_cargo_bin | default(false)
+  when: (rustup_cargo_bin | default(false)) is truthy

tests/integration/targets/cmd_runner/action_plugins/_unsafe_assert.py

@@ -9,6 +9,12 @@ from ansible.errors import AnsibleError
 from ansible.playbook.conditional import Conditional
 from ansible.plugins.action import ActionBase
 
+try:
+    from ansible.utils.datatag import trust_value as _trust_value
+except ImportError:
+    def _trust_value(input):
+        return input
+
 
 class ActionModule(ActionBase):
     ''' Fail with custom message '''
@@ -36,12 +42,16 @@ class ActionModule(ActionBase):
 
         thats = self._task.args['that']
 
-        cond = Conditional(loader=self._loader)
         result['_ansible_verbose_always'] = True
 
         for that in thats:
-            cond.when = [str(self._make_safe(that))]
-            test_result = cond.evaluate_conditional(templar=self._templar, all_vars=task_vars)
+            if hasattr(self._templar, 'evaluate_conditional'):
+                trusted_that = _trust_value(that) if _trust_value else that
+                test_result = self._templar.evaluate_conditional(conditional=trusted_that)
+            else:
+                cond = Conditional(loader=self._loader)
+                cond.when = [str(self._make_safe(that))]
+                test_result = cond.evaluate_conditional(templar=self._templar, all_vars=task_vars)
             if not test_result:
                 result['failed'] = True
                 result['evaluated_to'] = test_result

tests/integration/targets/cmd_runner/library/cmd_echo.py

@@ -7,6 +7,8 @@
 from __future__ import absolute_import, division, print_function
 __metaclass__ = type
 
+import traceback
+
 
 DOCUMENTATION = ""
 
@@ -43,15 +45,18 @@ def main():
 
         arg_formats[arg] = func(*args)
 
-    runner = CmdRunner(module, [module.params["cmd"], '--'], arg_formats=arg_formats, path_prefix=module.params["path_prefix"])
+    try:
+        runner = CmdRunner(module, [module.params["cmd"], '--'], arg_formats=arg_formats, path_prefix=module.params["path_prefix"])
 
-    with runner.context(p['arg_order'], check_mode_skip=p['check_mode_skip']) as ctx:
-        result = ctx.run(**p['arg_values'])
-        info = ctx.run_info
-    check = "check"
-    rc, out, err = result if result is not None else (None, None, None)
+        with runner.context(p['arg_order'], check_mode_skip=p['check_mode_skip']) as ctx:
+            result = ctx.run(**p['arg_values'])
+            info = ctx.run_info
+        check = "check"
+        rc, out, err = result if result is not None else (None, None, None)
 
-    module.exit_json(rc=rc, out=out, err=err, info=info)
+        module.exit_json(rc=rc, out=out, err=err, info=info)
+    except Exception as exc:
+        module.fail_json(rc=1, module_stderr=traceback.format_exc(), msg="Module crashed with exception")
 
 
 if __name__ == '__main__':

tests/integration/targets/cmd_runner/vars/main.yml

@@ -260,3 +260,5 @@ cmd_echo_tests:
     assertions:
       - >
         "No such file or directory" in test_result.msg
+        or
+        "Error executing command." == test_result.msg

tests/integration/targets/consul/tasks/consul_binding_rule.yml

@@ -33,7 +33,7 @@
     that:
       - result is changed
       - result.binding_rule.AuthMethod == 'test'
-      - result.binding.Description == 'test-binding: my description'
+      - "result.binding_rule.Description == 'test-binding: my description'"
       - result.operation == 'create'
 
 - name: Update a binding rule
@@ -46,7 +46,7 @@
 - assert:
     that:
       - result is changed
-      - result.binding.Description == 'test-binding: my description'
+      - "result.binding_rule.Description == 'test-binding: my description'"
       - result.operation == 'update'
 
 - name: Update a binding rule (noop)
@@ -58,7 +58,7 @@
 - assert:
     that:
       - result is not changed
-      - result.binding.Description == 'test-binding: my description'
+      - "result.binding_rule.Description == 'test-binding: my description'"
       - result.operation is not defined
 
 - name: Delete a binding rule

tests/integration/targets/consul/tasks/consul_token.yml

@@ -22,7 +22,7 @@
 - assert:
     that:
       - simple_create_result is changed
-      - simple_create_result.token.AccessorID
+      - simple_create_result.token.AccessorID is truthy
       - simple_create_result.operation == 'create'
 
 - name: Create token
@@ -67,7 +67,7 @@
     state: present
     accessor_id: 07a7de84-c9c7-448a-99cc-beaf682efd21
     policies:
-      - id: "{{ create_result.token.Policies[-1].ID }}"
+      - name: foo-access2
   register: result
 
 - assert:
@@ -84,5 +84,5 @@
 - assert:
     that:
       - result is changed
-      - not result.token
+      - result.token is falsy
       - result.operation == 'remove'