chore: add Molecule tests for all roles, enforce lint, remove dead code

- Add Molecule tests for common and restic_backup roles
- Run Molecule tests in CI as a matrix job across all 3 roles
- Change ansible-lint to block merges on failure
- Remove unused roles/restic/tasks/schedule.yml

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: thewismit

.github/workflows/ci.yml

@@ -55,4 +55,36 @@ jobs:
       - name: ansible-lint
         run: |
           ansible-lint playbooks/ remediation/ roles/
-        continue-on-error: true   # lint findings are advisory; don't block merge
+        continue-on-error: false
+
+  molecule:
+    name: Molecule Tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        role:
+          - common
+          - restic
+          - restic_backup
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Ansible + Molecule
+        run: |
+          pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Run Molecule
+        run: |
+          cd roles/${{ matrix.role }}
+          molecule test
+        env:
+          ANSIBLE_FORCE_COLOR: "1"

roles/common/molecule/default/converge.yml

@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  roles:
+    - role: common

roles/common/molecule/default/molecule.yml

@@ -0,0 +1,39 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: common-debian-bookworm
+    image: geerlingguy/docker-debian12-ansible:latest
+    pre_build_image: true
+    privileged: true
+    command: /lib/systemd/systemd
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+
+verifier:
+  name: ansible
+
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotency
+    - verify
+    - cleanup
+    - destroy

roles/common/molecule/default/verify.yml

@@ -0,0 +1,32 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  tasks:
+
+    - name: VERIFY | Sudoers drop-in exists
+      ansible.builtin.stat:
+        path: "/etc/sudoers.d/{{ ansible_user_id }}"
+      register: sudoers_file
+
+    - name: VERIFY | Assert sudoers file present with correct permissions
+      ansible.builtin.assert:
+        that:
+          - sudoers_file.stat.exists
+          - sudoers_file.stat.mode == '0440'
+        fail_msg: "Sudoers drop-in missing or has wrong permissions"
+
+    - name: VERIFY | Read sudoers file content
+      ansible.builtin.slurp:
+        src: "/etc/sudoers.d/{{ ansible_user_id }}"
+      register: sudoers_content
+
+    - name: VERIFY | Assert NOPASSWD rule is present
+      ansible.builtin.assert:
+        that:
+          - "'NOPASSWD' in (sudoers_content.content | b64decode)"
+        fail_msg: "NOPASSWD rule not found in sudoers drop-in"
+
+    - name: VERIFY | Report
+      ansible.builtin.debug:
+        msg: "common role verified: passwordless sudo configured for {{ ansible_user_id }}"

roles/restic/tasks/schedule.yml

@@ -0,0 +1,35 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  tasks:
+    - name: Install restic binary
+      ansible.builtin.apt:
+        name: restic
+        state: present
+        update_cache: true
+
+    - name: Create restic env file
+      ansible.builtin.copy:
+        dest: "{{ restic_env_file }}"
+        content: |
+          RESTIC_REPOSITORY={{ restic_repo_path }}
+          RESTIC_PASSWORD={{ restic_password }}
+        mode: "0600"
+
+    - name: Create restic password file
+      ansible.builtin.copy:
+        dest: "{{ restic_password_file }}"
+        content: "{{ restic_password }}"
+        mode: "0600"
+
+    - name: Initialize restic repository
+      ansible.builtin.command: >
+        restic init
+        --repo {{ restic_repo_path }}
+        --password-file {{ restic_password_file }}
+      args:
+        creates: "{{ restic_repo_path }}/config"
+
+  roles:
+    - role: restic_backup

roles/restic_backup/molecule/default/converge.yml

@@ -0,0 +1,52 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: restic-backup-debian-bookworm
+    image: geerlingguy/docker-debian12-ansible:latest
+    pre_build_image: true
+    privileged: true
+    command: /lib/systemd/systemd
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+  inventory:
+    host_vars:
+      restic-backup-debian-bookworm:
+        restic_repo_path: /tmp/test-restic-repo
+        restic_password_file: /tmp/restic_pass
+        restic_password: "molecule-test-password"
+        restic_backup_paths:
+          - /etc
+        restic_exclude_paths:
+          - /tmp
+          - /var/cache
+        restic_pause_services: []
+        restic_env_file: /tmp/restic.env
+
+verifier:
+  name: ansible
+
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotency
+    - verify
+    - cleanup
+    - destroy

roles/restic_backup/molecule/default/molecule.yml

@@ -0,0 +1,61 @@
+---
+- name: Verify
+  hosts: all
+  become: true
+  tasks:
+
+    - name: VERIFY | Service unit exists
+      ansible.builtin.stat:
+        path: /etc/systemd/system/restic-backup.service
+      register: service_unit
+
+    - name: VERIFY | Timer unit exists
+      ansible.builtin.stat:
+        path: /etc/systemd/system/restic-backup.timer
+      register: timer_unit
+
+    - name: VERIFY | Assert units are deployed
+      ansible.builtin.assert:
+        that:
+          - service_unit.stat.exists
+          - timer_unit.stat.exists
+        fail_msg: "Service or timer unit not deployed"
+
+    - name: VERIFY | Drop-in directory exists
+      ansible.builtin.stat:
+        path: /etc/systemd/system/restic-backup.service.d
+      register: dropin_dir
+
+    - name: VERIFY | Assert drop-in directory present
+      ansible.builtin.assert:
+        that:
+          - dropin_dir.stat.exists
+          - dropin_dir.stat.isdir
+        fail_msg: "Drop-in directory not created"
+
+    - name: VERIFY | Root override drop-in exists
+      ansible.builtin.stat:
+        path: /etc/systemd/system/restic-backup.service.d/10-user-root.conf
+      register: root_dropin
+
+    - name: VERIFY | Assert root drop-in present
+      ansible.builtin.assert:
+        that:
+          - root_dropin.stat.exists
+        fail_msg: "Root user drop-in not created"
+
+    - name: VERIFY | Timer is enabled
+      ansible.builtin.command: systemctl is-enabled restic-backup.timer
+      register: timer_enabled
+      changed_when: false
+      failed_when: timer_enabled.rc != 0
+
+    - name: VERIFY | Service unit contains correct repo path
+      ansible.builtin.command: grep "RESTIC_REPOSITORY={{ restic_repo_path }}" /etc/systemd/system/restic-backup.service
+      register: repo_check
+      changed_when: false
+      failed_when: repo_check.rc != 0
+
+    - name: VERIFY | Report
+      ansible.builtin.debug:
+        msg: "restic_backup role verified: service, timer, and drop-ins deployed correctly"