fix: modernize setup.sh and CI workflows for Python 3.12+

.github/workflows/ansible-lint-roles.yml

@@ -5,20 +5,22 @@ on:
   - pull_request
 jobs:
   lint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
 
       - name: check out repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: "${{ github.repository }}"
 
       - name: set up python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.9"
+          python-version: "3.10"
 
       - name: install dependencies
+        # ansible-lint 5.4.0 requires ansible-core <=2.12 (ansible 4.x/5.x)
+        # TODO: upgrade ansible-lint to 24.x for ansible 9.x+ compatibility
         run: |
           python3 -m pip install --upgrade pip
           python3 -m pip install ansible-lint==5.4.0 ansible==4.8.0

.github/workflows/codeql.yml

@@ -24,18 +24,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/molecule.yml

@@ -5,7 +5,7 @@ on:
   - pull_request
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       max-parallel: 4
       matrix:
@@ -28,18 +28,18 @@ jobs:
           - spack
     steps:
       - name: check out repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: "${{ github.repository }}"
       - name: set up python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.9"
+          python-version: "3.12"
       - name: install dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansible==4.8.0
-          python3 -m pip install molecule[docker] docker
+          python3 -m pip install ansible==9.13.0
+          python3 -m pip install molecule molecule-plugins[docker] docker
       - name: run molecule test
         run: |
           cd "${{ github.repository }}/roles"

.github/workflows/setup.yml

@@ -0,0 +1,25 @@
+---
+name: test setup.sh
+on:
+  - push
+  - pull_request
+jobs:
+  setup:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+    steps:
+      - name: check out repo
+        uses: actions/checkout@v4
+
+      - name: run setup.sh
+        run: bash scripts/setup.sh
+
+      - name: verify ansible in venv
+        run: |
+          source /opt/deepops/env/bin/activate
+          ansible --version
+          python3 -c "from packaging.version import Version; print('packaging OK')"

.github/workflows/stale.yml

@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v3
+    - uses: actions/stale@v9
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue is stale because it has been open for 60 days with no activity. Please update the issue or it will be closed in 7 days.'

.gitignore

@@ -4,6 +4,13 @@
 # misc.
 .*.swp
 
+# virtualenv
+/.venv/
+
+# claude code
+/CLAUDE.md
+/tasks/
+
 # project-specific
 /admin.conf
 /config*/

scripts/setup.sh

@@ -18,7 +18,7 @@ ANSIBLE_LINT_VERSION="${ANSIBLE_LINT_VERSION:-5.4.0}"
 CONFIG_DIR="${CONFIG_DIR:-${ROOT_DIR}/config}"            # Default configuration directory location
 DEEPOPS_TAG="${1:-master}"                      # DeepOps branch to set up
 JINJA2_VERSION="${JINJA2_VERSION:-3.1.5}"      # Jinja2 required version
-JMESPATH_VERSION="${JMESPATH_VERSION:-0.10.0}"    # jmespath pegged version, actual version probably not that crucial
+JMESPATH_VERSION="${JMESPATH_VERSION:-1.0.1}"    # jmespath version (matches kubespray requirements)
 MARKUPSAFE_VERSION="${MARKUPSAFE_VERSION:-3.0.2}"  # MarkupSafe version
 PIP="${PIP:-pip3}"                              # Pip binary to use
 PYTHON_BIN="${PYTHON_BIN:-/usr/bin/python3}"    # Python3 path
@@ -100,12 +100,12 @@ if command -v virtualenv &> /dev/null ; then
     if pip show ansible 2>&1 >/dev/null; then
         current_version=$(pip show ansible | grep Version | awk '{print $2}')
 	echo "Current version of Ansible is ${current_version}"
-	if "${PYTHON_BIN}" -c "from distutils.version import LooseVersion; print(LooseVersion('$current_version') >= LooseVersion('$ANSIBLE_TOO_NEW'))" | grep True 2>&1 >/dev/null; then
+	if "${VENV_DIR}/bin/python3" -c "from packaging.version import Version; print(Version('$current_version') >= Version('$ANSIBLE_TOO_NEW'))" | grep True 2>&1 >/dev/null; then
             echo "Ansible version ${current_version} too new for DeepOps"
 	    echo "Please uninstall any ansible, ansible-base, and ansible-core packages and re-run this script"
 	    exit 1
 	fi
-	if "${PYTHON_BIN}" -c "from distutils.version import LooseVersion; print(LooseVersion('$current_version') < LooseVersion('$ANSIBLE_VERSION'))" | grep True 2>&1 >/dev/null; then
+	if "${VENV_DIR}/bin/python3" -c "from packaging.version import Version; print(Version('$current_version') < Version('$ANSIBLE_VERSION'))" | grep True 2>&1 >/dev/null; then
 	    echo "Ansible will be upgraded from ${current_version} to ${ANSIBLE_VERSION}"
 	fi
     fi
@@ -115,6 +115,7 @@ if command -v virtualenv &> /dev/null ; then
 	ansible-lint==${ANSIBLE_LINT_VERSION} \
         Jinja2==${JINJA2_VERSION} \
         netaddr \
+        packaging \
         ruamel.yaml \
         PyMySQL \
         paramiko \