MODULES-11721: Add Puppet 9 support

.github/workflows/ci.yml

@@ -9,11 +9,21 @@ on:
 jobs:
   Spec:
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_ci.yml@main"
+    with:
+      # voxpupuli-puppet-lint-plugins 7.0 (needed for Puppet 9 support) requires
+      # ruby >= 3.2; the default (3.1) can no longer resolve the :development group.
+      ruby_version: "3.2"
+      # puppet_litmus -> bolt 4.x -> faraday-patron -> patron builds a libcurl native extension;
+      # the runner has no libcurl headers, so install them before bundle (Puppet 9 lane, Ruby 4).
+      additional_packages: "libcurl4-openssl-dev"
     secrets: "inherit"
 
   Acceptance:
     needs: Spec
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
     secrets: "inherit"
     with:
-      flags: "--nightly"
+      flags: "--nightly --collection-platform-exclude 9:redhat-7 --collection-platform-exclude 9:centos-7 --collection-platform-exclude 9:oraclelinux-7 --collection-platform-exclude 9:scientific-7 --collection-platform-exclude 9:debian-10 --collection-platform-exclude 9:ubuntu-18.04 --collection-platform-exclude 9:ubuntu-20.04"
+      # voxpupuli-puppet-lint-plugins 7.0 (needed for Puppet 9 support) requires
+      # ruby >= 3.2; the default (3.1) can no longer resolve the :development group.
+      ruby_version: "3.2"

.github/workflows/mend.yml

@@ -12,4 +12,8 @@ jobs:
 
   mend:
     uses: "puppetlabs/cat-github-actions/.github/workflows/mend_ruby.yml@main"
+    with:
+      # voxpupuli-puppet-lint-plugins 7.0 (needed for Puppet 9 support) requires
+      # ruby >= 3.2; `bundle lock` resolves all groups at the default ruby (3.1).
+      ruby_version: "3.2"
     secrets: "inherit"

.github/workflows/nightly.yml

@@ -8,11 +8,19 @@ on:
 jobs:
   Spec:
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_ci.yml@main"
+    with:
+      # voxpupuli-puppet-lint-plugins 7.0 (needed for Puppet 9 support) requires
+      # ruby >= 3.2; the default (3.1) can no longer resolve the :development group.
+      ruby_version: "3.2"
+      # puppet_litmus -> bolt 4.x -> faraday-patron -> patron builds a libcurl native extension;
+      # the runner has no libcurl headers, so install them before bundle (Puppet 9 lane, Ruby 4).
+      additional_packages: "libcurl4-openssl-dev"
     secrets: "inherit"
 
   Acceptance:
     needs: Spec
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
     secrets: "inherit"
     with:
-      flags: "--nightly"
+      flags: "--nightly --collection-platform-exclude 9:redhat-7 --collection-platform-exclude 9:centos-7 --collection-platform-exclude 9:oraclelinux-7 --collection-platform-exclude 9:scientific-7 --collection-platform-exclude 9:debian-10 --collection-platform-exclude 9:ubuntu-18.04 --collection-platform-exclude 9:ubuntu-20.04"
+      ruby_version: "3.2"

.sync.yml

@@ -17,10 +17,35 @@ spec/spec_helper.rb:
   unmanaged: false
 .github/workflows/auto_release.yml:
   unmanaged: false
+# MODULES-11721: ci.yml and nightly.yml are maintained by hand because they carry
+# Puppet 9 customisations that pdk-templates cannot express -- the `ruby_version`
+# input (no such key in the templates) and the `--collection-platform-exclude` flags
+# on the Acceptance job. Leaving them managed means the scheduled `pdk update` PR
+# silently reverts Puppet 9 support. acceptance_flags below is kept in step with the
+# hand-written `flags:` so these can go back to template management once
+# pdk-templates supports those inputs.
 .github/workflows/ci.yml:
-  unmanaged: false
+  unmanaged: true
+  acceptance_flags:
+    - '--nightly'
+    - '--collection-platform-exclude 9:redhat-7'
+    - '--collection-platform-exclude 9:centos-7'
+    - '--collection-platform-exclude 9:oraclelinux-7'
+    - '--collection-platform-exclude 9:scientific-7'
+    - '--collection-platform-exclude 9:debian-10'
+    - '--collection-platform-exclude 9:ubuntu-18.04'
+    - '--collection-platform-exclude 9:ubuntu-20.04'
 .github/workflows/nightly.yml:
-  unmanaged: false
+  unmanaged: true
+  acceptance_flags:
+    - '--nightly'
+    - '--collection-platform-exclude 9:redhat-7'
+    - '--collection-platform-exclude 9:centos-7'
+    - '--collection-platform-exclude 9:oraclelinux-7'
+    - '--collection-platform-exclude 9:scientific-7'
+    - '--collection-platform-exclude 9:debian-10'
+    - '--collection-platform-exclude 9:ubuntu-18.04'
+    - '--collection-platform-exclude 9:ubuntu-20.04'
 .github/workflows/release.yml:
   unmanaged: false
 .travis.yml:

Gemfile

@@ -18,7 +18,7 @@ group :development do
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "racc", '~> 1.4.0',                        require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "deep_merge", '~> 1.2.2',                  require: false
-  gem "voxpupuli-puppet-lint-plugins", '~> 5.0', require: false
+  gem "voxpupuli-puppet-lint-plugins", '~> 7.0', require: false
   gem "facterdb", '~> 2.1',                      require: false if Gem::Requirement.create(['< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "facterdb", '~> 3.0',                      require: false if Gem::Requirement.create(['>= 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "metadata-json-lint", '~> 4.0',            require: false
@@ -39,12 +39,21 @@ group :development do
 end
 group :development, :release_prep do
   gem "puppet-strings", '~> 4.0',         require: false
-  gem "puppetlabs_spec_helper", '~> 8.0', require: false
+  # TODO(MODULES-11721): temporary — the latest release (8.0.0) still pins puppet-lint
+  # ~> 4.0, which conflicts with voxpupuli-puppet-lint-plugins ~> 7.0 (puppet-lint ~> 5.1,
+  # needed for Puppet 9). main already relaxed this to puppet-lint ~> 5.0 but hasn't been
+  # released yet. Swap back to a released gem once it ships.
+  gem "puppetlabs_spec_helper", git: 'https://github.com/puppetlabs/puppetlabs_spec_helper.git', branch: 'main', require: false
   gem "puppet-blacksmith", '~> 7.0',      require: false
 end
 group :system_tests do
-  gem "puppet_litmus", '~> 2.0',   require: false, platforms: [:ruby, :x64_mingw] if !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
-  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw] if ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
+  # TODO(MODULES-11721): temporary — depends on an unmerged puppet_litmus branch that adds
+  # --collection-platform-exclude to matrix_from_metadata_v3 (keeps a platform in the Puppet 8
+  # acceptance lane while dropping it from Puppet 9, for platforms Puppet 9 doesn't ship an
+  # agent for). Pinned unconditionally: the acceptance matrix passes that flag on every run, so
+  # falling back to a released gem would fail the job on an unrecognised option. Swap back once
+  # that support ships.
+  gem "puppet_litmus", git: 'https://github.com/puppetlabs/puppet_litmus.git', branch: 'main', require: false, platforms: [:ruby, :x64_mingw]
   gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
   gem "serverspec", '~> 2.41',     require: false
 end
@@ -61,7 +70,33 @@ hiera_version = ENV.fetch('HIERA_GEM_VERSION', nil)
 
 # If PUPPET_FORGE_TOKEN is set then use authenticated source for both puppet and facter, since facter is a transitive dependency of puppet
 # Otherwise, do as before and use location_for to fetch gems from the default source
-if !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
+if puppet_version.to_s.match?(/\A(?:~>\s*)?(?:8\.99|9)/)
+  # Puppet 9 (8.99.x) prereleases are served from an internal source injected via
+  # PUPPET_GEM_SOURCE (see cat-github-actions module_ci.yml, which fetches it over
+  # Twingate); '' is truthy in Ruby, so guard on emptiness rather than falling back
+  # with `||`. Falls back to puppetcore for local runs without the secret.
+  puppet9_source = ENV['PUPPET_GEM_SOURCE'].to_s.empty? ? 'https://rubygems-puppetcore.puppet.com' : ENV['PUPPET_GEM_SOURCE']
+  if ENV['PUPPET_GEM_SOURCE'].to_s.empty?
+    # No public source publishes an 8.99.x/9.x gem, so resolution below is certain to
+    # fail. Say so plainly: without this, bundler reports only "Could not find gem
+    # 'puppet (>= 8.99.0.a, < 9)'" followed by every 7.x/8.x version it did find,
+    # which reads like a version-constraint bug rather than a missing setting.
+    warn 'WARNING: PUPPET_GEM_SOURCE is not set, so the Puppet 9 (8.99.x) prerelease ' \
+         "cannot be resolved (falling back to #{puppet9_source}, which does not carry it). " \
+         'In CI this secret must be configured on the repository; see MODULES-11721.'
+  end
+  puppet9_req = puppet_version.to_s.match?(/\d+\.\d+\.\d/) ? [puppet_version] : ['>= 8.99.0.a', '< 9']
+  gems['puppet'] = [*puppet9_req, { require: false, source: puppet9_source }]
+  # Honour FACTER_GEM_VERSION when the workflow sets one (module_ci.yml passes '~> 4.10');
+  # only fall back to a floor when it is unset. Don't hardcode a floor above the newest
+  # published facter -- that is unsatisfiable whenever puppet9_source is the puppetcore
+  # fallback rather than the internal prerelease source.
+  gems['facter'] = if facter_version.to_s.empty?
+                     ['>= 4.10', { require: false, source: puppet9_source }]
+                   else
+                     [facter_version, { require: false, source: puppet9_source }]
+                   end
+elsif !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
   gems['puppet'] = ['~> 8.11', { require: false, source: 'https://rubygems-puppetcore.puppet.com' }]
   gems['facter'] = ['~> 4.11', { require: false, source: 'https://rubygems-puppetcore.puppet.com' }]
 else

metadata.json

@@ -100,7 +100,7 @@
   "requirements": [
     {
       "name": "puppet",
-      "version_requirement": ">= 8.0.0 < 9.0.0"
+      "version_requirement": ">= 8.0.0 < 10.0.0"
     }
   ],
   "description": "Uses a combination of keytool and Ruby openssl library to manage entries in a Java keystore.",