Finish simplifying the Seriatim role

README.md

@@ -2,7 +2,8 @@
 
 Installs [Seriatim](https://gitea.maximumdirect.net/eric/seriatim) from source
 on Ubuntu 26.04 (`x86_64` or `aarch64`). The role requires gathered facts and
-privilege escalation for its default paths and dependency installation.
+uses privilege escalation on tasks that install dependencies or manage
+root-owned application state.
 
 ## Variables
 
@@ -13,18 +14,21 @@ seriatim_source_dir: /usr/local/src/seriatim
 seriatim_binary_path: /usr/local/bin/seriatim
 seriatim_manage_build_dependencies: true
 seriatim_go_snap_channel: 1.26/stable
+seriatim_go_binary: /snap/bin/go
 ```
 
-When `seriatim_manage_build_dependencies` is `false`, Git and `/snap/bin/go`
+When `seriatim_manage_build_dependencies` is `false`, Git and the executable
-must already be available. Otherwise, the role installs Git with APT and the
+selected by `seriatim_go_binary` must already be available. Otherwise, the role
-classic Go Snap from `seriatim_go_snap_channel`.
+installs Git with APT and the classic Go Snap from
+`seriatim_go_snap_channel`.
 
 The checkout is authoritative: local source changes are discarded while
 selecting `seriatim_version`. The role builds `./cmd/seriatim` directly to
-`seriatim_binary_path` using `/snap/bin/go`, `CGO_ENABLED=0`, `GOWORK=off`,
+`seriatim_binary_path` using `seriatim_go_binary`, `CGO_ENABLED=0`, `GOWORK=off`,
 `GOTOOLCHAIN=local`, `-trimpath`, and release linker metadata. It rebuilds when
-the checkout changes, the binary is absent, or `seriatim --version` does not
+the checkout changes or the binary is absent. Exact version output is verified
-exactly match the selected version.
+by the repository-local integration suite rather than during production
+convergence.
 
 The source tree is recursively owned by `root:root`. The installed binary is a
 regular file owned by `root:root` with mode `0755`.
@@ -33,7 +37,6 @@ regular file owned by `root:root` with mode `0755`.
 
 ```yaml
 - hosts: seriatim_hosts
-  become: true
   roles:
     - role: ansible-role-seriatim
 ```
@@ -42,12 +45,12 @@ regular file owned by `root:root` with mode `0755`.
 
 The integration driver installs pinned collection dependencies, runs syntax
 checking and ansible-lint, and verifies the default release and idempotence. It
-also covers missing and wrong-version binaries, metadata drift without a
+also covers a missing binary, a caller-supplied Go executable with dependency
-rebuild, selection of the previous release, restoration of the default
+management disabled, metadata drift without a build, selection of the previous
-release, and platform failures before application state is created. The suite
+release, restoration of the default release, and platform failures before
-mutates only `/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths
+application state is created. The suite mutates only
-inside its private temporary directory, and leaves the default release
+`/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths inside its
-installed:
+private temporary directory, and leaves the default release installed:
 
 ```sh
 tests/integration

defaults/main.yml

@@ -5,3 +5,4 @@ seriatim_source_dir: /usr/local/src/seriatim
 seriatim_binary_path: /usr/local/bin/seriatim
 seriatim_manage_build_dependencies: true
 seriatim_go_snap_channel: 1.26/stable
+seriatim_go_binary: /snap/bin/go

meta/argument_specs.yml

@@ -27,3 +27,7 @@ argument_specs:
         type: str
         required: true
         description: Go Snap channel to install.
+      seriatim_go_binary:
+        type: path
+        required: true
+        description: Go executable used to build Seriatim.

tasks/main.yml

@@ -8,13 +8,16 @@
     fail_msg: Seriatim supports Ubuntu 26.04 on x86_64 or aarch64.
 
 - name: Install Git
+  become: true
   ansible.builtin.apt:
     name: git
     state: present
     update_cache: true
+    cache_valid_time: 3600
   when: seriatim_manage_build_dependencies
 
 - name: Install Go
+  become: true
   community.general.snap:
     name: go
     channel: "{{ seriatim_go_snap_channel }}"
@@ -23,6 +26,7 @@
   when: seriatim_manage_build_dependencies
 
 - name: Create installation parent directories
+  become: true
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
@@ -34,6 +38,7 @@
     - "{{ seriatim_binary_path | dirname }}"
 
 - name: Check out Seriatim source
+  become: true
   ansible.builtin.git:
     repo: "{{ seriatim_repository_url }}"
     dest: "{{ seriatim_source_dir }}"
@@ -46,20 +51,11 @@
     path: "{{ seriatim_binary_path }}"
   register: seriatim_binary
 
-- name: Read the installed Seriatim version
-  ansible.builtin.command:
-    argv:
-      - "{{ seriatim_binary_path }}"
-      - --version
-  register: seriatim_installed_version
-  changed_when: false
-  failed_when: false
-  when: seriatim_binary.stat.exists
-
 - name: Build Seriatim
+  become: true
   ansible.builtin.command:
     argv:
-      - /snap/bin/go
+      - "{{ seriatim_go_binary }}"
       - build
       - -trimpath
       - -ldflags
@@ -72,15 +68,13 @@
     CGO_ENABLED: "0"
     GOTOOLCHAIN: local
     GOWORK: "off"
-  register: seriatim_build
   changed_when: true
   when: >-
     seriatim_checkout.changed or
-    not seriatim_binary.stat.exists or
+    not seriatim_binary.stat.exists
-    seriatim_installed_version.rc | default(1) != 0 or
-    seriatim_installed_version.stdout | default('') != 'seriatim version ' ~ seriatim_version
 
 - name: Converge installed metadata
+  become: true
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: "{{ item.state }}"
@@ -95,15 +89,3 @@
     - path: "{{ seriatim_binary_path }}"
       state: file
       mode: "0755"
-
-- name: Validate the built Seriatim version  # noqa no-handler
-  ansible.builtin.command:
-    argv:
-      - "{{ seriatim_binary_path }}"
-      - --version
-  register: seriatim_built_version
-  changed_when: false
-  failed_when: >-
-    seriatim_built_version.rc != 0 or
-    seriatim_built_version.stdout != 'seriatim version ' ~ seriatim_version
-  when: seriatim_build.changed

tests/converge.yml

@@ -2,6 +2,5 @@
 - name: Converge Seriatim role
   hosts: seriatim
   gather_facts: true
-  become: true
   roles:
     - role: ansible-role-seriatim

tests/integration

@@ -74,14 +74,21 @@ missing_binary_repeat_log="$test_tmp/missing-binary-repeat.log"
 run_converge "$missing_binary_repeat_log"
 require_clean_recap "$missing_binary_repeat_log"
 
-sudo cp -- /bin/false "$binary_path"
+custom_go_binary="$test_tmp/go"
-wrong_version_log="$test_tmp/wrong-version.log"
+ln -s /snap/bin/go "$custom_go_binary"
-run_converge "$wrong_version_log"
+sudo rm -f -- "$binary_path"
-require_changed_recap "$wrong_version_log"
+custom_go_log="$test_tmp/custom-go.log"
-grep -A1 -E 'TASK .*Build Seriatim' "$wrong_version_log" | grep -q '^changed:'
+run_converge "$custom_go_log" \
-wrong_version_repeat_log="$test_tmp/wrong-version-repeat.log"
+  -e '{"seriatim_manage_build_dependencies": false}' \
-run_converge "$wrong_version_repeat_log"
+  -e "seriatim_go_binary=$custom_go_binary"
-require_clean_recap "$wrong_version_repeat_log"
+require_changed_recap "$custom_go_log"
+grep -A1 -E 'TASK .*Build Seriatim' "$custom_go_log" | grep -q '^changed:'
+verify_release v1.5.0 "$default_commit"
+custom_go_repeat_log="$test_tmp/custom-go-repeat.log"
+run_converge "$custom_go_repeat_log" \
+  -e '{"seriatim_manage_build_dependencies": false}' \
+  -e "seriatim_go_binary=$custom_go_binary"
+require_clean_recap "$custom_go_repeat_log"
 
 sudo chmod 0700 "$binary_path"
 metadata_log="$test_tmp/metadata.log"

tests/unsupported.yml

@@ -2,7 +2,6 @@
 - name: Exercise Seriatim platform mutation guard
   hosts: seriatim
   gather_facts: false
-  become: true
   vars:
     ansible_facts:
       distribution: "{{ test_distribution }}"