Add shippable tests. (#4)

shippable.yml

@@ -0,0 +1,54 @@
+language: python
+
+env:
+  matrix:
+    - T=none
+
+matrix:
+  exclude:
+    - env: T=none
+  include:
+    - env: T=sanity/1
+
+    - env: T=units/2.7/1
+    - env: T=units/3.5/1
+    - env: T=units/3.6/1
+    - env: T=units/3.7/1
+    - env: T=units/3.8/1
+    - env: T=units/3.9/1
+
+    - env: T=osx/10.11/1
+    - env: T=rhel/7.6/1
+    - env: T=rhel/8.1/1
+    - env: T=freebsd/11.1/1
+    - env: T=freebsd/12.1/1
+    - env: T=linux/centos6/1
+    - env: T=linux/centos7/1
+    - env: T=linux/centos8/1
+    - env: T=linux/fedora30/1
+    - env: T=linux/fedora31/1
+    - env: T=linux/opensuse15py2/1
+    - env: T=linux/opensuse15/1
+    - env: T=linux/ubuntu1604/1
+    - env: T=linux/ubuntu1804/1
+
+    - env: T=cloud/2.7/1
+    - env: T=cloud/3.6/1
+
+branches:
+  except:
+    - "*-patch-*"
+    - "revert-*-*"
+
+build:
+  ci:
+    - tests/utils/shippable/timing.sh tests/utils/shippable/shippable.sh $T
+
+integrations:
+  notifications:
+    - integrationName: email
+      type: email
+      on_success: never
+      on_failure: never
+      on_start: never
+      on_pull_request: never

tests/integration/targets/certificate_complete_chain/aliases

@@ -1,2 +1 @@
 shippable/posix/group1
-skip/aix

tests/integration/targets/get_certificate/aliases

@@ -1,4 +1,3 @@
 shippable/posix/group1
 destructive
 needs/httptester
-skip/aix

tests/integration/targets/incidental_setup_openssl/aliases

@@ -1,2 +1 @@
 hidden
-

tests/integration/targets/incidental_x509_crl/aliases

@@ -1,4 +1,3 @@
 x509_crl_info
 shippable/posix/incidental
 destructive
-skip/aix

tests/integration/targets/luks_device/aliases

@@ -1,5 +1,4 @@
 shippable/posix/group4
-skip/aix
 skip/osx
 skip/freebsd
 skip/docker

tests/integration/targets/openssh_cert/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssh_keypair/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_certificate/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group5
 destructive
-skip/aix

tests/integration/targets/openssl_certificate_info/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_csr/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_csr_info/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_dhparam/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_pkcs12/aliases

@@ -1,4 +1,3 @@
 destructive
 needs/root
 shippable/posix/group1
-skip/aix

tests/integration/targets/openssl_privatekey/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_privatekey_info/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/openssl_publickey/aliases

@@ -1,3 +1,2 @@
 shippable/posix/group1
 destructive
-skip/aix

tests/integration/targets/prepare_http_tests/tasks/main.yml

@@ -20,5 +20,3 @@
           - "default.yml"
   when:
   - has_httptester|bool
-  # skip the setup if running on Windows Server 2008 as httptester is not available
-  - ansible_os_family != 'Windows' or (ansible_os_family == 'Windows' and not ansible_distribution_version.startswith("6.0."))

tests/integration/targets/prepare_http_tests/tasks/windows.yml

@@ -1,26 +0,0 @@
-- name: Windows - make sure the port forwarder is active
-  ansible.windows.win_wait_for:
-    host: ansible.http.tests
-    port: 80
-    state: started
-    timeout: 300
-- name: Windows - Get client cert/key
-  register: win_download
-  retries: 5
-  until: win_download is successful
-  with_items:
-  - client.pem
-  - client.key
-  ansible.windows.win_get_url:
-    url: http://ansible.http.tests/{{ item }}
-    dest: '{{ remote_tmp_dir }}\{{ item }}'
-- name: Windows - Retrieve test cacert
-  ansible.windows.win_get_url:
-    url: http://ansible.http.tests/cacert.pem
-    dest: '{{ remote_tmp_dir }}\cacert.pem'
-- name: Windows - Update ca trust
-  ansible.windows.win_certificate_store:
-    path: '{{ remote_tmp_dir }}\cacert.pem'
-    state: present
-    store_location: LocalMachine
-    store_name: Root

tests/integration/targets/setup_remote_tmp_dir/handlers/main.yml

@@ -1,5 +1,2 @@
 - name: delete temporary directory
   include_tasks: default-cleanup.yml
-
-- name: delete temporary directory (windows)
-  include_tasks: windows-cleanup.yml

tests/integration/targets/setup_remote_tmp_dir/tasks/windows-cleanup.yml

@@ -1,4 +0,0 @@
-- name: delete temporary directory (windows)
-  ansible.windows.win_file:
-    path: '{{ remote_tmp_dir }}'
-    state: absent

tests/integration/targets/setup_remote_tmp_dir/tasks/windows.yml

@@ -1,10 +0,0 @@
-- name: create temporary directory
-  register: remote_tmp_dir
-  notify:
-  - delete temporary directory (windows)
-  ansible.windows.win_tempfile:
-    state: directory
-    suffix: .test
-- name: record temporary directory
-  set_fact:
-    remote_tmp_dir: '{{ remote_tmp_dir.path }}'

tests/integration/targets/x509_crl/aliases

@@ -1,4 +1,3 @@
 x509_crl_info
 shippable/posix/group1
 destructive
-skip/aix

tests/requirements.yml

@@ -1,4 +1,3 @@
 integration_tests_dependencies:
 - community.general
-- ansible.windows
 unit_tests_dependencies: []

tests/utils/constraints.txt

@@ -0,0 +1,51 @@
+coverage >= 4.2, < 5.0.0, != 4.3.2 ; python_version <= '3.7' # features in 4.2+ required, avoid known bug in 4.3.2 on python 2.6, coverage 5.0+ incompatible
+coverage >= 4.5.4, < 5.0.0 ; python_version > '3.7' # coverage had a bug in < 4.5.4 that would cause unit tests to hang in Python 3.8, coverage 5.0+ incompatible
+cryptography < 2.2 ; python_version < '2.7' # cryptography 2.2 drops support for python 2.6
+deepdiff < 4.0.0 ; python_version < '3' # deepdiff 4.0.0 and later require python 3
+jinja2 < 2.11 ; python_version < '2.7' # jinja2 2.11 and later require python 2.7 or later
+urllib3 < 1.24 ; python_version < '2.7' # urllib3 1.24 and later require python 2.7 or later
+pywinrm >= 0.3.0 # message encryption support
+sphinx < 1.6 ; python_version < '2.7' # sphinx 1.6 and later require python 2.7 or later
+sphinx < 1.8 ; python_version >= '2.7' # sphinx 1.8 and later are currently incompatible with rstcheck 3.3
+pygments >= 2.4.0 # Pygments 2.4.0 includes bugfixes for YAML and YAML+Jinja lexers
+wheel < 0.30.0 ; python_version < '2.7' # wheel 0.30.0 and later require python 2.7 or later
+yamllint != 1.8.0, < 1.14.0 ; python_version < '2.7' # yamllint 1.8.0 and 1.14.0+ require python 2.7+
+pycrypto >= 2.6 # Need features found in 2.6 and greater
+ncclient >= 0.5.2 # Need features added in 0.5.2 and greater
+idna < 2.6, >= 2.5 # linode requires idna < 2.9, >= 2.5, requests requires idna < 2.6, but cryptography will cause the latest version to be installed instead
+paramiko < 2.4.0 ; python_version < '2.7' # paramiko 2.4.0 drops support for python 2.6
+pytest < 3.3.0 ; python_version < '2.7' # pytest 3.3.0 drops support for python 2.6
+pytest < 5.0.0 ; python_version == '2.7' # pytest 5.0.0 and later will no longer support python 2.7
+pytest-forked < 1.0.2 ; python_version < '2.7' # pytest-forked 1.0.2 and later require python 2.7 or later
+pytest-forked >= 1.0.2 ; python_version >= '2.7' # pytest-forked before 1.0.2 does not work with pytest 4.2.0+ (which requires python 2.7+)
+ntlm-auth >= 1.3.0 # message encryption support using cryptography
+requests < 2.20.0 ; python_version < '2.7' # requests 2.20.0 drops support for python 2.6
+requests-ntlm >= 1.1.0 # message encryption support
+requests-credssp >= 0.1.0 # message encryption support
+voluptuous >= 0.11.0 # Schema recursion via Self
+openshift >= 0.6.2, < 0.9.0 # merge_type support
+virtualenv < 16.0.0 ; python_version < '2.7' # virtualenv 16.0.0 and later require python 2.7 or later
+pathspec < 0.6.0 ; python_version < '2.7' # pathspec 0.6.0 and later require python 2.7 or later
+pyopenssl < 18.0.0 ; python_version < '2.7' # pyOpenSSL 18.0.0 and later require python 2.7 or later
+pyfmg == 0.6.1 # newer versions do not pass current unit tests
+pyyaml < 5.1 ; python_version < '2.7' # pyyaml 5.1 and later require python 2.7 or later
+pycparser < 2.19 ; python_version < '2.7' # pycparser 2.19 and later require python 2.7 or later
+mock >= 2.0.0 # needed for features backported from Python 3.6 unittest.mock (assert_called, assert_called_once...)
+pytest-mock >= 1.4.0 # needed for mock_use_standalone_module pytest option
+xmltodict < 0.12.0 ; python_version < '2.7' # xmltodict 0.12.0 and later require python 2.7 or later
+lxml < 4.3.0 ; python_version < '2.7' # lxml 4.3.0 and later require python 2.7 or later
+pyvmomi < 6.0.0 ; python_version < '2.7' # pyvmomi 6.0.0 and later require python 2.7 or later
+pyone == 1.1.9 # newer versions do not pass current integration tests
+boto3 < 1.11 ; python_version < '2.7' # boto3 1.11 drops Python 2.6 support
+botocore >= 1.10.0, < 1.14 ; python_version < '2.7' # adds support for the following AWS services: secretsmanager, fms, and acm-pca; botocore 1.14 drops Python 2.6 support
+botocore >= 1.10.0 ; python_version >= '2.7' # adds support for the following AWS services: secretsmanager, fms, and acm-pca
+setuptools < 45 ; python_version <= '2.7' # setuptools 45 and later require python 3.5 or later
+
+# freeze pylint and its requirements for consistent test results
+astroid == 2.2.5
+isort == 4.3.15
+lazy-object-proxy == 1.3.1
+mccabe == 0.6.1
+pylint == 2.3.1
+typed-ast == 1.4.0  # 1.4.0 is required to compile on Python 3.8
+wrapt == 1.11.1

tests/utils/shippable/check_matrix.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python
+"""Verify the currently executing Shippable test matrix matches the one defined in the "shippable.yml" file."""
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import datetime
+import json
+import os
+import re
+import sys
+import time
+
+try:
+    from typing import NoReturn
+except ImportError:
+    NoReturn = None
+
+try:
+    # noinspection PyCompatibility
+    from urllib2 import urlopen  # pylint: disable=ansible-bad-import-from
+except ImportError:
+    # noinspection PyCompatibility
+    from urllib.request import urlopen
+
+
+def main():  # type: () -> None
+    """Main entry point."""
+    repo_full_name = os.environ['REPO_FULL_NAME']
+    required_repo_full_name = 'ansible-collections/general'
+
+    if repo_full_name != required_repo_full_name:
+        sys.stderr.write('Skipping matrix check on repo "%s" which is not "%s".\n' % (repo_full_name, required_repo_full_name))
+        return
+
+    with open('shippable.yml', 'rb') as yaml_file:
+        yaml = yaml_file.read().decode('utf-8').splitlines()
+
+    defined_matrix = [match.group(1) for match in [re.search(r'^ *- env: T=(.*)$', line) for line in yaml] if match and match.group(1) != 'none']
+
+    if not defined_matrix:
+        fail('No matrix entries found in the "shippable.yml" file.',
+             'Did you modify the "shippable.yml" file?')
+
+    run_id = os.environ['SHIPPABLE_BUILD_ID']
+    sleep = 1
+    jobs = []
+
+    for attempts_remaining in range(4, -1, -1):
+        try:
+            jobs = json.loads(urlopen('https://api.shippable.com/jobs?runIds=%s' % run_id).read())
+
+            if not isinstance(jobs, list):
+                raise Exception('Shippable run %s data is not a list.' % run_id)
+
+            break
+        except Exception as ex:
+            if not attempts_remaining:
+                fail('Unable to retrieve Shippable run %s matrix.' % run_id,
+                     str(ex))
+
+            sys.stderr.write('Unable to retrieve Shippable run %s matrix: %s\n' % (run_id, ex))
+            sys.stderr.write('Trying again in %d seconds...\n' % sleep)
+            time.sleep(sleep)
+            sleep *= 2
+
+    if len(jobs) != len(defined_matrix):
+        if len(jobs) == 1:
+            hint = '\n\nMake sure you do not use the "Rebuild with SSH" option.'
+        else:
+            hint = ''
+
+        fail('Shippable run %s has %d jobs instead of the expected %d jobs.' % (run_id, len(jobs), len(defined_matrix)),
+             'Try re-running the entire matrix.%s' % hint)
+
+    actual_matrix = dict((job.get('jobNumber'), dict(tuple(line.split('=', 1)) for line in job.get('env', [])).get('T', '')) for job in jobs)
+    errors = [(job_number, test, actual_matrix.get(job_number)) for job_number, test in enumerate(defined_matrix, 1) if actual_matrix.get(job_number) != test]
+
+    if len(errors):
+        error_summary = '\n'.join('Job %s expected "%s" but found "%s" instead.' % (job_number, expected, actual) for job_number, expected, actual in errors)
+
+        fail('Shippable run %s has a job matrix mismatch.' % run_id,
+             'Try re-running the entire matrix.\n\n%s' % error_summary)
+
+
+def fail(message, output):  # type: (str, str) -> NoReturn
+    # Include a leading newline to improve readability on Shippable "Tests" tab.
+    # Without this, the first line becomes indented.
+    output = '\n' + output.strip()
+
+    timestamp = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
+
+    # hack to avoid requiring junit-xml, which isn't pre-installed on Shippable outside our test containers
+    xml = '''
+<?xml version="1.0" encoding="utf-8"?>
+<testsuites disabled="0" errors="1" failures="0" tests="1" time="0.0">
+\t<testsuite disabled="0" errors="1" failures="0" file="None" log="None" name="ansible-test" skipped="0" tests="1" time="0" timestamp="%s" url="None">
+\t\t<testcase classname="timeout" name="timeout">
+\t\t\t<error message="%s" type="error">%s</error>
+\t\t</testcase>
+\t</testsuite>
+</testsuites>
+''' % (timestamp, message, output)
+
+    path = 'shippable/testresults/check-matrix.xml'
+    dir_path = os.path.dirname(path)
+
+    if not os.path.exists(dir_path):
+        os.makedirs(dir_path)
+
+    with open(path, 'w') as junit_fd:
+        junit_fd.write(xml.lstrip())
+
+    sys.stderr.write(message + '\n')
+    sys.stderr.write(output + '\n')
+
+    sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()

tests/utils/shippable/cloud.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+cloud="${args[0]}"
+python="${args[1]}"
+group="${args[2]}"
+
+target="shippable/${cloud}/group${group}/"
+
+stage="${S:-prod}"
+
+changed_all_target="shippable/${cloud}/smoketest/"
+
+if ! ansible-test integration "${changed_all_target}" --list-targets > /dev/null 2>&1; then
+    # no smoketest tests are available for this cloud
+    changed_all_target="none"
+fi
+
+if [ "${group}" == "1" ]; then
+    # only run smoketest tests for group1
+    changed_all_mode="include"
+else
+    # smoketest tests already covered by group1
+    changed_all_mode="exclude"
+fi
+
+# shellcheck disable=SC2086
+ansible-test integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
+    --remote-terminate always --remote-stage "${stage}" \
+    --docker --python "${python}" --changed-all-target "${changed_all_target}" --changed-all-mode "${changed_all_mode}"

tests/utils/shippable/freebsd.sh

@@ -0,0 +1 @@
+remote.sh

tests/utils/shippable/linux.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+image="${args[1]}"
+
+if [ "${#args[@]}" -gt 2 ]; then
+    target="shippable/posix/group${args[2]}/"
+else
+    target="shippable/posix/"
+fi
+
+# shellcheck disable=SC2086
+ansible-test integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
+    --docker "${image}"

tests/utils/shippable/osx.sh

@@ -0,0 +1 @@
+remote.sh

tests/utils/shippable/remote.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+platform="${args[0]}"
+version="${args[1]}"
+
+if [ "${#args[@]}" -gt 2 ]; then
+    target="shippable/posix/group${args[2]}/"
+else
+    target="shippable/posix/"
+fi
+
+stage="${S:-prod}"
+provider="${P:-default}"
+
+# shellcheck disable=SC2086
+ansible-test integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
+    --remote "${platform}/${version}" --remote-terminate always --remote-stage "${stage}" --remote-provider "${provider}"

tests/utils/shippable/rhel.sh

@@ -0,0 +1 @@
+remote.sh

tests/utils/shippable/sanity.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+group="${args[1]}"
+
+if [ "${BASE_BRANCH:-}" ]; then
+    base_branch="origin/${BASE_BRANCH}"
+else
+    base_branch=""
+fi
+
+# shellcheck disable=SC2086
+ansible-test sanity --color -v --junit ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} \
+    --docker --base-branch "${base_branch}" \
+    --exclude shippable.yml --exclude tests/utils/ \
+    --allow-disabled

tests/utils/shippable/shippable.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+script="${args[0]}"
+
+test="$1"
+
+docker images ansible/ansible
+docker images quay.io/ansible/*
+docker ps
+
+for container in $(docker ps --format '{{.Image}} {{.ID}}' | grep -v '^drydock/' | sed 's/^.* //'); do
+    docker rm -f "${container}" || true  # ignore errors
+done
+
+docker ps
+
+if [ -d /home/shippable/cache/ ]; then
+    ls -la /home/shippable/cache/
+fi
+
+command -v python
+python -V
+
+function retry
+{
+    for repetition in 1 2 3; do
+        set +e
+        "$@"
+        result=$?
+        set -e
+        if [ ${result} == 0 ]; then
+            return ${result}
+        fi
+        echo "$@ -> ${result}"
+    done
+    echo "Command '$@' failed 3 times!"
+    exit -1
+}
+
+command -v pip
+pip --version
+pip list --disable-pip-version-check
+retry pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
+
+export ANSIBLE_COLLECTIONS_PATHS="${HOME}/.ansible"
+SHIPPABLE_RESULT_DIR="$(pwd)/shippable"
+TEST_DIR="${ANSIBLE_COLLECTIONS_PATHS}/ansible_collections/community/crypto"
+mkdir -p "${TEST_DIR}"
+cp -aT "${SHIPPABLE_BUILD_DIR}" "${TEST_DIR}"
+cd "${TEST_DIR}"
+
+# STAR: HACK install integration test dependencies
+if [ "${script}" != "units" ] && [ "${script}" != "sanity" ]; then
+    retry ansible-galaxy -vvv collection install community.general
+fi
+# END: HACK
+
+
+export PYTHONIOENCODING='utf-8'
+
+if [ "${JOB_TRIGGERED_BY_NAME:-}" == "nightly-trigger" ]; then
+    COVERAGE=yes
+    COMPLETE=yes
+fi
+
+if [ -n "${COVERAGE:-}" ]; then
+    # on-demand coverage reporting triggered by setting the COVERAGE environment variable to a non-empty value
+    export COVERAGE="--coverage"
+elif [[ "${COMMIT_MESSAGE}" =~ ci_coverage ]]; then
+    # on-demand coverage reporting triggered by having 'ci_coverage' in the latest commit message
+    export COVERAGE="--coverage"
+else
+    # on-demand coverage reporting disabled (default behavior, always-on coverage reporting remains enabled)
+    export COVERAGE="--coverage-check"
+fi
+
+if [ -n "${COMPLETE:-}" ]; then
+    # disable change detection triggered by setting the COMPLETE environment variable to a non-empty value
+    export CHANGED=""
+elif [[ "${COMMIT_MESSAGE}" =~ ci_complete ]]; then
+    # disable change detection triggered by having 'ci_complete' in the latest commit message
+    export CHANGED=""
+else
+    # enable change detection (default behavior)
+    export CHANGED="--changed"
+fi
+
+if [ "${IS_PULL_REQUEST:-}" == "true" ]; then
+    # run unstable tests which are targeted by focused changes on PRs
+    export UNSTABLE="--allow-unstable-changed"
+else
+    # do not run unstable tests outside PRs
+    export UNSTABLE=""
+fi
+
+# remove empty core/extras module directories from PRs created prior to the repo-merge
+find plugins -type d -empty -print -delete
+
+function cleanup
+{
+    # for complete on-demand coverage generate a report for all files with no coverage on the "sanity/5" job so we only have one copy
+    if [ "${COVERAGE}" == "--coverage" ] && [ "${CHANGED}" == "" ] && [ "${test}" == "sanity/5" ]; then
+        stub="--stub"
+        # trigger coverage reporting for stubs even if no other coverage data exists
+        mkdir -p tests/output/coverage/
+    else
+        stub=""
+    fi
+
+    if [ -d tests/output/coverage/ ]; then
+        if find tests/output/coverage/ -mindepth 1 -name '.*' -prune -o -print -quit | grep -q .; then
+            process_coverage='yes'  # process existing coverage files
+        elif [ "${stub}" ]; then
+            process_coverage='yes'  # process coverage when stubs are enabled
+        else
+            process_coverage=''
+        fi
+
+        if [ "${process_coverage}" ]; then
+            # use python 3.7 for coverage to avoid running out of memory during coverage xml processing
+            # only use it for coverage to avoid the additional overhead of setting up a virtual environment for a potential no-op job
+            virtualenv --python /usr/bin/python3.7 ~/ansible-venv
+            set +ux
+            . ~/ansible-venv/bin/activate
+            set -ux
+
+            # shellcheck disable=SC2086
+            ansible-test coverage xml --color --requirements --group-by command --group-by version ${stub:+"$stub"}
+            cp -a tests/output/reports/coverage=*.xml "$SHIPPABLE_RESULT_DIR/codecoverage/"
+
+            # analyze and capture code coverage aggregated by integration test target
+            ansible-test coverage analyze targets generate -v "$SHIPPABLE_RESULT_DIR/testresults/coverage-analyze-targets.json"
+
+            # upload coverage report to codecov.io only when using complete on-demand coverage
+            if [ "${COVERAGE}" == "--coverage" ] && [ "${CHANGED}" == "" ]; then
+                for file in tests/output/reports/coverage=*.xml; do
+                    flags="${file##*/coverage=}"
+                    flags="${flags%-powershell.xml}"
+                    flags="${flags%.xml}"
+                    # remove numbered component from stub files when converting to tags
+                    flags="${flags//stub-[0-9]*/stub}"
+                    flags="${flags//=/,}"
+                    flags="${flags//[^a-zA-Z0-9_,]/_}"
+
+                    bash <(curl -s https://codecov.io/bash) \
+                        -f "${file}" \
+                        -F "${flags}" \
+                        -n "${test}" \
+                        -t 20636cf5-4d6a-4b9a-8d2d-6f22ebbaa752 \
+                        -X coveragepy \
+                        -X gcov \
+                        -X fix \
+                        -X search \
+                        -X xcode \
+                    || echo "Failed to upload code coverage report to codecov.io: ${file}"
+                done
+            fi
+        fi
+    fi
+
+    if [ -d  tests/output/junit/ ]; then
+      cp -aT tests/output/junit/ "$SHIPPABLE_RESULT_DIR/testresults/"
+    fi
+
+    if [ -d tests/output/data/ ]; then
+      cp -a tests/output/data/ "$SHIPPABLE_RESULT_DIR/testresults/"
+    fi
+
+    if [ -d  tests/output/bot/ ]; then
+      cp -aT tests/output/bot/ "$SHIPPABLE_RESULT_DIR/testresults/"
+    fi
+}
+
+trap cleanup EXIT
+
+if [[ "${COVERAGE:-}" == "--coverage" ]]; then
+    timeout=60
+else
+    timeout=50
+fi
+
+ansible-test env --dump --show --timeout "${timeout}" --color -v
+
+"tests/utils/shippable/check_matrix.py"
+"tests/utils/shippable/${script}.sh" "${test}"

tests/utils/shippable/timing.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3.7
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import sys
+import time
+
+start = time.time()
+
+sys.stdin.reconfigure(errors='surrogateescape')
+sys.stdout.reconfigure(errors='surrogateescape')
+
+for line in sys.stdin:
+    seconds = time.time() - start
+    sys.stdout.write('%02d:%02d %s' % (seconds // 60, seconds % 60, line))
+    sys.stdout.flush()

tests/utils/shippable/timing.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eu
+
+"$@" 2>&1 | "$(dirname "$0")/timing.py"

tests/utils/shippable/units.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -o pipefail -eux
+
+declare -a args
+IFS='/:' read -ra args <<< "$1"
+
+version="${args[1]}"
+group="${args[2]}"
+
+if [[ "${COVERAGE:-}" == "--coverage" ]]; then
+    timeout=90
+else
+    timeout=30
+fi
+
+ansible-test env --timeout "${timeout}" --color -v
+
+# shellcheck disable=SC2086
+ansible-test units --color -v --docker default --python "${version}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} \