# Write Molecule Tests for an Ansible Role

Yes. An agent extends Molecule verify to assert Docker install, service state, group membership and Compose, runs molecule test, and opens a pull request.

[Run this on Rush](https://cloud.getrush.ai/run/write-molecule-tests/ansible/), in a Project that has your repository.

## What the agent does

The agent reads the role's defaults and existing Molecule layout first. In geerlingguy/ansible-role-docker, `defaults/main.yml` sets `docker_edition: 'ce'`, package lists for `docker-ce` / cli / rootless / `containerd.io` / buildx, `docker_service_manage: true`, `docker_service_state: started`, `docker_service_enabled: true`, `docker_install_compose_plugin: true` with `docker_compose_package: docker-compose-plugin`, optional legacy Compose at `docker_compose_path: /usr/local/bin/docker-compose`, and `docker_users: []`. Tasks in `tasks/docker-users.yml` append listed users to the `docker` group.

Molecule already exists at `molecule/default/`: `molecule.yml` uses the Docker driver with `geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest`, privileged mode and cgroup mounts; `converge.yml` applies the role; `verify.yml` currently runs `docker version`, `systemctl is-active docker` when systemd is the service manager, and `docker pull hello-world`, with `docker run` left commented because of Docker-in-Docker quirks on GitHub Actions. It does not yet assert `docker_users` group membership, `systemctl is-enabled docker`, or that `docker compose version` / the compose plugin works.

The agent extends `verify.yml` (and converge vars if needed) so a scenario that sets `docker_users` to a test account checks `/etc/group` or `id` for the `docker` group, asserts the unit is enabled when `docker_service_enabled` is true, and runs `docker compose version` when the compose plugin is installed. It keeps the existing version/service/pull checks and documents any step that must stay skipped under DinD.

It runs `molecule test` in the sandbox (with `MOLECULE_DISTRO` matching CI if the role documents one), iterates on verify failures, and opens a pull request that only touches Molecule playbooks and role defaults samples used by the scenario. It reads `tasks/main.yml` conditionals around `docker_users | length > 0` and the compose plugin install path so verify assertions only fire when converge enabled those features. If the scenario needs a non-empty `docker_users` list, it sets that in `molecule/default/converge.yml` or a scenario vars file rather than changing role defaults for everyone.

## Start it with one API call

`POST https://api.prix.dev/o/{org}/sessions`

```json
{
  "agent": "claude",
  "input": "Add Molecule verify tests to this Ansible role that check Docker is installed, the service is running and enabled, the configured users are in the docker group and Compose works. Run molecule test in the sandbox and open a pull request.",
  "resources": [
    {
      "url": "https://github.com/your-org/your-ansible-role"
    }
  ]
}
```

1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.

## What comes back

What comes back is a pull request updating `molecule/default/verify.yml` and, if required, `converge.yml` or scenario vars to exercise `docker_users` and Compose. Role task files under `tasks/` stay unchanged unless a clear bug blocks verification.

The pull request description names the `molecule test` command and distro image used, and calls out any assertion still skipped under Docker-in-Docker. The trajectory stores molecule's create/converge/verify/destroy logs for review.

Before merging, a reviewer checks that verify tasks use `changed_when: false` where appropriate, that group checks match `tasks/docker-users.yml`, and that CI's Molecule workflow still passes on the distros the role claims to support.

## Run it on every role tasks or defaults changed

When a pull request edits `tasks/*.yml` or `defaults/main.yml`, POST this session request so verify coverage tracks new options (edition, rootless, compose plugin) in an isolated privileged sandbox.

Send Rush `run.completed` webhooks to your Ansible channel with the session URL. Queue runs when you exceed the key's `max_concurrent` limit; privileged Molecule containers are not something to overlap carelessly on one host key.

## Why run it on Rush?

Molecule for this role needs a privileged Docker-backed instance and a full converge. That is heavy and slow on a laptop, and easy to leave half-destroyed. Rush gives the agent a sandbox where `molecule test` can create, converge, verify and destroy without touching your local Docker contexts. Galaxy metadata under `meta/` is left alone; the pull request is about verify strength, not role packaging.

The pull request proves behaviour with verify asserts, not just "converge exited 0". Reviewers see group and Compose checks next to the existing hello-world pull, and several distros can be covered as separate runs.

## Frequently asked questions

### Does it replace my existing verify.yml?

It extends it. The docker version, active service and hello-world pull stay; enabled state, `docker_users` and Compose checks are added. Commented DinD-unsafe steps stay commented unless the sandbox can run them safely.

### Which distro image is used?

The one in `molecule/default/molecule.yml`: `geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest` unless you set `MOLECULE_DISTRO` in the prompt. The agent records the value it used in the pull request.

### Will it modify tasks/main.yml?

Only if verify cannot pass without fixing a real bug in the role. The default job is test-only; production task changes are called out explicitly in the pull request body.

### How does it test Compose?

By asserting the compose plugin or binary the role installs (`docker compose version` or `docker-compose` at `docker_compose_path`) after converge with `docker_install_compose_plugin` enabled, matching `defaults/main.yml`.