enroll/puppet.py

@@ -828,6 +828,10 @@ def _collect_puppet_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
+        packages = [
+            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+        ]
+        if has_fw or packages or fw.get("notes"):
             if has_fw:
                 runtime_role = ensure_role("enroll_runtime")
                 runtime_role.add_managed_dir(

enroll/salt.py

@@ -884,6 +884,10 @@ def _collect_salt_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
+        packages = [
+            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+        ]
+        if has_fw or packages or fw.get("notes"):
             if has_fw:
                 runtime_role = ensure_role("enroll_runtime")
                 runtime_role.add_managed_dir(

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "enroll"
-version = "0.7.0b3"
+version = "0.7.0b1"
 description = "Enroll a server's running state retrospectively into Ansible"
 authors = ["Miguel Jacq <mig@mig5.net>"]
 license = "GPL-3.0-or-later"

tests/test_manifest_puppet.py

@@ -798,37 +798,3 @@ def test_manifest_puppet_renders_firewall_runtime_resources(tmp_path: Path):
     ).read_text(encoding="utf-8")
     assert "Hash $firewall_runtime = {}" in fqdn_pp
     assert "$firewall_runtime['ipset_restore_cmd']" in fqdn_pp
-
-
-def test_manifest_puppet_omits_firewall_runtime_when_no_rules_were_sampled(
-    tmp_path: Path,
-):
-    bundle = tmp_path / "bundle"
-    out = tmp_path / "puppet"
-    state = {
-        "schema_version": 3,
-        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
-        "inventory": {"packages": {}},
-        "roles": {
-            "firewall_runtime": {
-                "role_name": "firewall_runtime",
-                "packages": [],
-                "ipset_save": None,
-                "ipset_sets": [],
-                "iptables_v4_save": None,
-                "iptables_v6_save": None,
-                "notes": [
-                    "not running as root; live firewall runtime was not captured"
-                ],
-            }
-        },
-    }
-    _write_state(bundle, state)
-
-    manifest.manifest(str(bundle), str(out), target="puppet")
-
-    site_pp = (out / "manifests" / "site.pp").read_text(encoding="utf-8")
-    assert "include enroll_runtime" not in site_pp
-    assert "include firewall_runtime" not in site_pp
-    assert not (out / "modules" / "enroll_runtime").exists()
-    assert not (out / "modules" / "firewall_runtime").exists()

tests/test_manifest_salt.py

@@ -624,37 +624,3 @@ def test_manifest_salt_renders_firewall_runtime_states(tmp_path: Path):
         fqdn_out / "states" / "roles" / "firewall_runtime" / "init.sls"
     ).read_text(encoding="utf-8")
     assert "firewall_runtime.get('ipset_restore_cmd')" in fqdn_sls
-
-
-def test_manifest_salt_omits_firewall_runtime_when_no_rules_were_sampled(
-    tmp_path: Path,
-):
-    bundle = tmp_path / "bundle"
-    out = tmp_path / "salt"
-    state = {
-        "schema_version": 3,
-        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
-        "inventory": {"packages": {}},
-        "roles": {
-            "firewall_runtime": {
-                "role_name": "firewall_runtime",
-                "packages": [],
-                "ipset_save": None,
-                "ipset_sets": [],
-                "iptables_v4_save": None,
-                "iptables_v6_save": None,
-                "notes": [
-                    "not running as root; live firewall runtime was not captured"
-                ],
-            }
-        },
-    }
-    _write_state(bundle, state)
-
-    manifest.manifest(str(bundle), str(out), target="salt")
-
-    top = yaml.safe_load((out / "states" / "top.sls").read_text(encoding="utf-8"))
-    assert "roles.enroll_runtime" not in top["base"]["*"]
-    assert "roles.firewall_runtime" not in top["base"]["*"]
-    assert not (out / "states" / "roles" / "enroll_runtime").exists()
-    assert not (out / "states" / "roles" / "firewall_runtime").exists()