Enable hostkey checking and disable default forwarding

ansible.cfg

@@ -1,10 +1,10 @@
 [defaults]
-host_key_checking = false
+host_key_checking = true
 collections_path = .ansible
 inventory = inventory.yaml
 
 [ssh_connection]
-ssh_args = "-o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes"
+ssh_args = "-o ControlMaster=auto -o ControlPersist=60s"
 
 [inventory]
 enable_plugins = ansible.builtin.yaml

pyproject.toml

@@ -7,22 +7,21 @@ license = "MIT"
 
 [tool.poetry.dependencies]
 python = "^3.10"
-ansible-core = "^2.12.1"
+ansible-core = "^2.14.3"
-docker = "^4.2.0"
+docker = "^6.0.1"
-docker-compose = "^1.25.4"
 paramiko = "^2.7.1"
-jsondiff = "^1.2.0"
+jsondiff = "^2.0.0"
 netaddr = "^0.8.0"
 
 [tool.poetry.dev-dependencies]
-ansible-lint = "^4.2.0"
+ansible-lint = {version = "^6.14.0", markers = "platform_system != 'Windows'"}
-ipython = "^7.28.0"
+ipython = "^8.11.0"
-mdformat = "^0.7.9"
+mdformat = "^0.7.16"
-mdformat-gfm = "^0.3.3"
+mdformat-gfm = "^0.3.5"
-poetry = "^1.1.0"
+poetry = "^1.3.0"
-pre-commit = "^2.9.2"
+pre-commit = "^3.2.0"
-pre-commit-hooks = "^3.3.0"
+pre-commit-hooks = "^4.4.0"
-safety = "^1.9.0"
+safety = "^2.3.5"
 tox = "^3.20.1"
-tox-poetry-installer = {extras = ["poetry"], version = "^0.8.3"}
+tox-poetry-installer = {extras = ["poetry"], version = "^0.10.0"}
-yamllint = "^1.20.0"
+yamllint = "^1.29.0"

skylab/core/roles/workstation/tasks/environment.yml

@@ -133,3 +133,12 @@
     owner: "{{ item }}"
     group: "{{ item }}"
   loop: "{{ _local_human_users }}"
+
+- name: Link external media directory
+  become: true
+  ansible.builtin.file:
+    path: ~{{ item }}/Drives
+    src: /run/media/{{ item }}
+    state: link
+    force: true
+  loop: "{{ _local_human_users }}"

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = ansible, python, security
+envlist = ansible, security
 skipsdist = true
 
 [testenv]
@@ -36,7 +36,9 @@ locked_deps =
     poetry
     safety
 commands =
-    poetry export --format requirements.txt --without-hashes --dev --output {envtmpdir}/req.txt
+    poetry export --format requirements.txt --without-hashes --with dev --output {envtmpdir}/req.txt
-    safety check --json --file {envtmpdir}/req.txt \
+    safety check --output text --file {envtmpdir}/req.txt \
         # Ignore unfixed CVE-2021-3532 from ansible \
-        --ignore 42923
+        --ignore 42923 \
+        # https://github.com/pytest-dev/py/issues/287#issuecomment-1283567565
+        --ignore 51457