tests/test_app.py

@@ -235,6 +235,31 @@ def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypa
     assert len(calls) == 1
 
 
+def test_ansible_run_supports_scoped_nfs_action(monkeypatch):
+    calls = []
+
+    def fake_ssh(host, command, timeout=600):
+        calls.append((host, command, timeout))
+        return 0, "changed=1 failed=0", ""
+
+    monkeypatch.setattr(app, "_ssh", fake_ssh)
+    with TestClient(app.app) as client:
+        response = client.post(
+            "/ansible/run",
+            headers={"Authorization": "Bearer test-token"},
+            json={"hostname": "arrapps", "action": "nfs"},
+        )
+    assert response.status_code == 200
+    assert response.json()["action"] == "nfs"
+    command = calls[0][1]
+    assert "mkdir -p roles/nfs_stability/tasks" in command
+    assert "git show origin/master:roles/nfs_stability/tasks/main.yml" in command
+    assert "git show origin/master:nfs-stability.yml" in command
+    assert "bash pfannkuchen.sh nfs arrapps" in command
+    assert "git pull --ff-only" not in command
+    assert len(calls) == 1
+
+
 def test_ansible_run_rejects_unknown_action_and_shell_metacharacters(monkeypatch):
     monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
     with TestClient(app.app) as client: