Merge pull request #1289 from moreati/issue1275-ssh_askpass

CI: Test SSH password authentication without sshpass command

.ci/install_sshpass

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+VERSION="$1"
+
+curl \
+    --fail \
+    --location \
+    --no-progress-meter \
+    --remote-name \
+    "https://downloads.sourceforge.net/project/sshpass/sshpass/${VERSION}/sshpass-${VERSION}.tar.gz"
+tar xvf "sshpass-${VERSION}.tar.gz"
+cd "sshpass-${VERSION}"
+./configure
+sudo make install

.ci/localhost_ansible_tests.py

@@ -17,17 +17,6 @@ with ci_lib.Fold('unit_tests'):
 
 with ci_lib.Fold('job_setup'):
     os.chmod(ci_lib.TESTS_SSH_PRIVATE_KEY_FILE, int('0600', 8))
-    # NOTE: sshpass v1.06 causes errors so pegging to 1.05 -> "msg": "Error when changing password","out": "passwd: DS error: eDSAuthFailed\n", 
-    # there's a checksum error with "brew install http://git.io/sshpass.rb" though, so installing manually
-    if not ci_lib.exists_in_path('sshpass'):
-        subprocess.check_call(
-                "curl -O -L  https://sourceforge.net/projects/sshpass/files/sshpass/1.05/sshpass-1.05.tar.gz && \
-                tar xvf sshpass-1.05.tar.gz && \
-                cd sshpass-1.05 && \
-                ./configure && \
-                sudo make install",
-                shell=True,
-        )
 
 
 with ci_lib.Fold('machine_prep'):

.github/workflows/tests.yml

@@ -274,9 +274,11 @@ jobs:
             tox_env: py313-mode_mitogen
 
           - name: Loc_313_11
+            sshpass_version: "1.10"
             tox_env: py313-mode_localhost-ansible11
 
           - name: Van_313_11
+            sshpass_version: "1.10"
             tox_env: py313-mode_localhost-ansible11-strategy_linear
 
           - name: Loc_313_12
@@ -317,6 +319,8 @@ jobs:
               # GitHub macOS 12 images: python2.7 is installed, but not on $PATH
               echo "/Library/Frameworks/Python.framework/Versions/2.7/bin/python2.7: sys.executable: $(/Library/Frameworks/Python.framework/Versions/2.7/bin/python2.7 -c 'import sys; print(sys.executable)')"
           fi
+      - run: .ci/install_sshpass ${{ matrix.sshpass_version }}
+        if: ${{ matrix.sshpass_version }}
       - name: Install tooling
         run: |
           set -o errexit -o nounset -o pipefail

docs/changelog.rst

@@ -34,6 +34,10 @@ to strategy plugins under :gh:issue:`1278`.
 
 * :gh:issue:`1285` CI: use `result_format = yaml` for Ansible test output,
   instead of deprecated `stdout_callback = yaml`
+* :gh:issue:`1293` CI: Fix ``ansible_version`` comparisons when an Ansible
+  release candidate is under test
+* :gh:issue:`1275` CI: Test ``ansible_ssh_password`` behaviour without
+  ``sshpass`` installed
 
 
 v0.3.25a2 (2025-06-21)

tests/ansible/hosts/group_vars/all.yml

@@ -1,4 +1,11 @@
 ---
+# Avoid `ansible_version.full is version(..., strict=True)` limitations.
+# Pre-release info (alpha/beta/rc) is intentionally ignored.
+# Behaviour that is present or expected in ansible-core 2.50.x should be
+# tested even if ansible-core 2.50.0a1 or 2.50.0rc1 is under test.
+ansible_version_major_minor: "{{ ansible_version.major }}.{{ ansible_version.minor }}"
+ansible_version_major_minor_patch: "{{ ansible_version.major }}.{{ ansible_version.minor }}.{{ ansible_version.revision | regex_search('^[0-9]+') }}"
+
 become_unpriv_available: >-
   {#
     Vanilla Ansible >= 4 (ansible-core >= 2.11) can use `setfacl` for
@@ -13,7 +20,7 @@ become_unpriv_available: >-
     (
       not is_mitogen
       and is_macos_controller
-      and ansible_version.full is version("2.11", ">=", strict=True)
+      and ansible_version_major_minor is version("2.11", ">=", strict=True)
     )
     or (
       is_mitogen
@@ -22,7 +29,7 @@ become_unpriv_available: >-
     or (
       is_mitogen
       and ansible_python_interpreter is not defined
-      and ansible_version.full is version("2.18", "<", strict=True)
+      and ansible_version_major_minor is version("2.18", "<", strict=True)
     )
   -}}
 

tests/ansible/integration/_expected_ssh_port.yml

@@ -11,8 +11,10 @@
 
 - set_fact:
     expected_ssh_port: null
-  when: ansible_version.full is version('2.11.1', '>=', strict=True)
+  when:
+    - ansible_version_major_minor_patch is version('2.11.1', '>=', strict=True)
 
 - set_fact:
     expected_ssh_port: 22
-  when: ansible_version.full is version('2.11.1', '<', strict=True)
+  when:
+    - ansible_version_major_minor_patch is version('2.11.1', '<', strict=True)

tests/ansible/integration/action/transfer_data.yml

@@ -6,7 +6,7 @@
       when:
         # Ansible >= 12 (ansible-core >= 2.19) only allows bytes|str through
         # `ansible.plugins.action.ActionBase._transfer_data()`.
-        - ansible_version.full is version('2.18.999', '>', strict=True)
+        - ansible_version_major_minor is version('2.19', '>=', strict=True)
         - not is_mitogen
 
     - name: Cleanup transfer data

tests/ansible/integration/async/result_shell_echo_hi.yml

@@ -35,8 +35,8 @@
         # | Ansible <= 3  | ansible-core <= 2.10      | present     | True  |
         # | Ansible 4 - 6 | ansible-core 2.11 - 2.13  | deprecated  | False |
         # | Ansible >= 7  | ansible-core >= 2.14      | absent      | n/a   |
-        - (ansible_version.full is version("2.14", ">=", strict=True) and async_out.invocation.module_args.warn is not defined)
-          or (ansible_version.full is version("2.11", ">=", strict=True) and async_out.invocation.module_args.warn == False)
+        - (ansible_version_major_minor is version("2.14", ">=", strict=True) and async_out.invocation.module_args.warn is not defined)
+          or (ansible_version_major_minor is version("2.11", ">=", strict=True) and async_out.invocation.module_args.warn == False)
           or (async_out.invocation.module_args.warn == True)
         - async_out.rc == 0
         - async_out.start.startswith("20")
@@ -53,7 +53,7 @@
       fail_msg: |
         async_out={{ async_out }}
     when:
-      - ansible_version.full is version('2.4', '>=', strict=True)
+      - ansible_version_major_minor is version('2.4', '>=', strict=True)
     vars:
       async_out: "{{result.content|b64decode|from_json}}"
   tags:

tests/ansible/integration/async/runner_one_job.yml

@@ -41,9 +41,9 @@
       - result1.changed == True
       # ansible/b72e989e1837ccad8dcdc926c43ccbc4d8cdfe44
       - |
-        (ansible_version.full is version('2.8', ">=", strict=True) and
+        (ansible_version_major_minor is version('2.8', ">=", strict=True) and
          result1.cmd == "echo alldone;\nsleep 1;\n") or
-        (ansible_version.full is version('2.8', '<', strict=True) and
+        (ansible_version_major_minor is version('2.8', '<', strict=True) and
          result1.cmd == "echo alldone;\n sleep 1;")
       - result1.delta|length == 14
       - result1.start|length == 26
@@ -61,7 +61,7 @@
       fail_msg: |
         result1={{ result1 }}
     when:
-      - ansible_version.full is version('2.8', '>', strict=True)  # ansible#51393
+      - ansible_version_major_minor is version('2.8', '>', strict=True)  # ansible#51393
 
   - assert:
       that:
@@ -69,6 +69,6 @@
       fail_msg: |
         result1={{ result1 }}
     when:
-      - ansible_version.full is version('2.4', '>', strict=True)
+      - ansible_version_major_minor is version('2.4', '>', strict=True)
   tags:
     - runner_one_job

tests/ansible/integration/async/runner_two_simultaneous_jobs.yml

@@ -66,6 +66,6 @@
       fail_msg: |
         result2={{ result2 }}
     when:
-      - ansible_version.full is version('2.8', '>=', strict=True)  # ansible#51393
+      - ansible_version_major_minor is version('2.8', '>=', strict=True)  # ansible#51393
   tags:
     - runner_two_simultaneous_jobs

tests/ansible/integration/connection/reset.yml

@@ -10,11 +10,11 @@
 
     - debug: msg="reset.yml skipped on Ansible<2.5.6"
       when:
-        - ansible_version.full is version('2.5.6', '<', strict=True)
+        - ansible_version_major_minor_patch is version('2.5.6', '<', strict=True)
 
     - meta: end_play
       when:
-        - ansible_version.full is version('2.5.6', '<', strict=True)
+        - ansible_version_major_minor_patch is version('2.5.6', '<', strict=True)
 
     - custom_python_detect_environment:
       register: out

tests/ansible/integration/connection/reset_become.yml

@@ -8,11 +8,11 @@
   tasks:
   - debug: msg="reset_become.yml skipped on Ansible<2.5.6"
     when:
-      - ansible_version.full is version('2.5.6', '<', strict=True)
+      - ansible_version_major_minor_patch is version('2.5.6', '<', strict=True)
 
   - meta: end_play
     when:
-      - ansible_version.full is version('2.5.6', '<', strict=True)
+      - ansible_version_major_minor_patch is version('2.5.6', '<', strict=True)
 
   - name: save pid of the become acct
     custom_python_detect_environment:

tests/ansible/integration/connection_delegation/delegate_to_template.yml

@@ -19,7 +19,7 @@
 
     - meta: end_play
       when:
-        - ansible_version.full is version('2.4', '<', strict=True)
+        - ansible_version_major_minor is version('2.4', '<', strict=True)
 
     - mitogen_get_stack:
       delegate_to: "{{ physical_host }}"

tests/ansible/integration/context_service/disconnect_cleanup.yml

@@ -8,7 +8,7 @@
 
   - meta: end_play
     when:
-      - ansible_version.full is version('2.5.6', '<', strict=True)
+      - ansible_version_major_minor_patch is version('2.5.6', '<', strict=True)
 
   # Start with a clean slate.
   - mitogen_shutdown_all:

tests/ansible/integration/interpreter_discovery/ansible_2_8_tests.yml

@@ -46,9 +46,9 @@
         '20': /usr/bin/python3.8
 
     discovered_interpreter_expected: >-
-      {%- if ansible_version.full is version('2.12', '<', strict=True) -%}
+      {%- if ansible_version_major_minor is version('2.12', '<', strict=True) -%}
       {{ DISCOVERED_INTERPRETER_EXPECTED_MAP__ANSIBLE_lt_2_12[distro][distro_major] }}
-      {%- elif ansible_version.full is version('2.17', '<', strict=True) -%}
+      {%- elif ansible_version_major_minor is version('2.17', '<', strict=True) -%}
       {{ DISCOVERED_INTERPRETER_EXPECTED_MAP__ANSIBLE_2_12_to_2_16[distro][distro_major] }}
       {%- else -%}
       {{ DISCOVERED_INTERPRETER_EXPECTED_MAP__ANSIBLE_ge_2_17[distro][distro_major] }}
@@ -141,7 +141,7 @@
             when:
               - legacy.ansible_facts.discovered_interpreter_python == '/usr/bin/python'
               - auto_out.ansible_facts.discovered_interpreter_python != '/usr/bin/python'
-              - ansible_version.full is version_compare('2.12.0', '<', strict=True)
+              - ansible_version_major_minor is version('2.12', '<', strict=True)
 
           - name: check for warning (only on platforms where auto result is not /usr/bin/python and legacy is) from ansible 2.12 on
             assert:
@@ -153,7 +153,7 @@
             when:
               - legacy.ansible_facts.discovered_interpreter_python == '/usr/bin/python'
               -  auto_out.ansible_facts.discovered_interpreter_python != '/usr/bin/python'
-              -  ansible_version.full is version_compare('2.12.0', '>=', strict=True)
+              -  ansible_version_major_minor is version('2.12', '>=', strict=True)
 
         - name: test that auto_silent never warns and got the same answer as auto
           block:
@@ -229,6 +229,6 @@
           always:
           - meta: clear_facts
       when:
-        - ansible_version.full is version_compare('2.8.0', '>=', strict=True)
+        - ansible_version_major_minor is version('2.8', '>=', strict=True)
   tags:
     - ansible_2_8_tests

tests/ansible/integration/interpreter_discovery/complex_args.yml

@@ -14,7 +14,7 @@
     - meta: end_play
       when:
         - not is_mitogen
-        - ansible_version.full is version('2.17.1', '>=', strict=True)
+        - ansible_version_major_minor_patch is version('2.17.1', '>=', strict=True)
 
     - name: create temp file to source
       file:

tests/ansible/integration/runner/custom_bash_hashbang_argument.yml

@@ -7,7 +7,7 @@
     - meta: end_play
       when:
         - not is_mitogen
-        - ansible_version.full is version('2.17.1', '>=', strict=True)
+        - ansible_version_major_minor_patch is version('2.17.1', '>=', strict=True)
 
     - custom_bash_old_style_module:
         foo: true

tests/ansible/integration/runner/custom_perl_json_args_module.yml

@@ -20,6 +20,6 @@
         fail_msg: |
           out={{ out }}
       when:
-        - ansible_version.full is version('2.4', '>=', strict=True)
+        - ansible_version_major_minor is version('2.4', '>=', strict=True)
   tags:
     - custom_perl_json_args_module

tests/ansible/integration/runner/custom_perl_want_json_module.yml

@@ -20,6 +20,6 @@
         fail_msg: |
           out={{ out }}
       when:
-        - ansible_version.full is version('2.4', '>=', strict=True)
+        - ansible_version_major_minor is version('2.4', '>=', strict=True)
   tags:
     - custom_perl_want_json_module

tests/ansible/integration/ssh/password.yml

@@ -31,6 +31,11 @@
     - assert:
         that:
           - ssh_no_password_result.unreachable == True
+          - >-
+            ssh_no_password_result.msg is search('SSH password was requested, but none specified')
+            or ssh_no_password_result.msg is search('SSH password is incorrect')
+            or ssh_no_password_result.msg is search('Invalid/incorrect password')
+            or ssh_no_password_result.msg is search('Permission denied \(publickey,password(,keyboard-interactive)?\)')
         fail_msg: |
           ssh_no_password_result={{ ssh_no_password_result }}
 
@@ -64,5 +69,9 @@
     - assert:
         that:
           - ssh_wrong_password_result.unreachable == True
+          - >-
+            ssh_wrong_password_result.msg is search('SSH password is incorrect')
+            or ssh_wrong_password_result.msg is search('Invalid/incorrect password')
+            or ssh_wrong_password_result.msg is search('Permission denied \(publickey,password(,keyboard-interactive)?\)')
         fail_msg: |
           ssh_wrong_password_result={{ ssh_wrong_password_result }}

tests/ansible/integration/ssh/templated_by_play_taskvar.yml

@@ -32,7 +32,7 @@
       when:
         # https://github.com/ansible/ansible/issues/84238
         - not is_mitogen
-        - ansible_version.full is version('2.19', '<', strict=True)
+        - ansible_version_major_minor is version('2.19', '<', strict=True)
     - meta: reset_connection
     - name: Templated variables in play, key authentication
       ping:

tests/ansible/integration/stub_connections/_end_play_if_not_sudo_linux.yml

@@ -9,7 +9,7 @@
 
 - command: sudo -n whoami
   args:
-    warn: "{{ False if ansible_version.full is version('2.10', '<=', strict=True) else omit }}"
+    warn: "{{ False if ansible_version_major_minor is version('2.10', '<=', strict=True) else omit }}"
   ignore_errors: true
   register: sudo_available
 

tests/ansible/integration/stub_connections/kubectl.yml

@@ -7,7 +7,7 @@
 
   - meta: end_play
     when:
-      - ansible_version.full is version('2.5', '<', strict=True)
+      - ansible_version_major_minor is version('2.5', '<', strict=True)
 
   - custom_python_detect_environment:
     vars:

tests/ansible/integration/stub_connections/setns_lxc.yml

@@ -32,7 +32,7 @@
         localhost
       args:
         chdir: ../..
-        warn: "{{ False if ansible_version.full is version('2.10', '<=', strict=True) else omit }}"
+        warn: "{{ False if ansible_version_major_minor is version('2.10', '<=', strict=True) else omit }}"
       register: result
 
     - assert:

tests/ansible/integration/stub_connections/setns_lxd.yml

@@ -32,7 +32,7 @@
         localhost
       args:
         chdir: ../..
-        warn: "{{ False if ansible_version.full is version('2.10', '<=', strict=True) else omit }}"
+        warn: "{{ False if ansible_version_major_minor is version('2.10', '<=', strict=True) else omit }}"
       register: result
 
     - assert:

tests/ansible/integration/transport_config/password.yml

@@ -11,11 +11,13 @@
   - assert_equal:
       left: out.result[0].kwargs.password
       right: null
-    when: ansible_version.full is version('2.18.999', '>=', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '>=', strict=True)
   - assert_equal:
       left: out.result[0].kwargs.password
       right: ""  # actually null, but assert_equal limitation
-    when: ansible_version.full is version('2.18.999', '<', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '<', strict=True)
   tags:
     - mitogen_only
 
@@ -31,11 +33,13 @@
   - assert_equal:
       left: out.result[1].kwargs.password
       right: null
-    when: ansible_version.full is version('2.18.999', '>=', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '>=', strict=True)
   - assert_equal:
       left: out.result[1].kwargs.password
       right: ""
-    when: ansible_version.full is version('2.18.999', '<', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '<', strict=True)
   tags:
     - mitogen_only
 
@@ -61,11 +65,13 @@
   - assert_equal:
       left: out.result[0].kwargs.password
       right: null
-    when: ansible_version.full is version('2.18.999', '>=', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '>=', strict=True)
   - assert_equal:
       left: out.result[0].kwargs.password
       right: ""
-    when: ansible_version.full is version('2.18.999', '<', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '<', strict=True)
   - assert_equal:
       left: out.result[1].kwargs.password
       right: "ansi-ssh-pass"
@@ -94,11 +100,13 @@
   - assert_equal:
       left: out.result[0].kwargs.password
       right: null
-    when: ansible_version.full is version('2.18.999', '>=', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '>=', strict=True)
   - assert_equal:
       left: out.result[0].kwargs.password
       right: ""
-    when: ansible_version.full is version('2.18.999', '<', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '<', strict=True)
   - assert_equal:
       left: out.result[1].kwargs.password
       right: "ansi-pass"
@@ -127,11 +135,13 @@
   - assert_equal:
       left: out.result[0].kwargs.password
       right: null
-    when: ansible_version.full is version('2.18.999', '>=', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '>=', strict=True)
   - assert_equal:
       left: out.result[0].kwargs.password
       right: ""
-    when: ansible_version.full is version('2.18.999', '<', strict=True)
+    when:
+      - ansible_version_major_minor is version('2.19', '<', strict=True)
   - assert_equal:
       left: out.result[1].kwargs.password
       right: "c.b.a"

tests/ansible/integration/transport_config/python_path.yml

@@ -12,7 +12,7 @@
   - include_tasks: ../_mitogen_only.yml
   - meta: end_play
     when:
-      - ansible_version.full is version('2.17', '>=', strict=True)
+      - ansible_version_major_minor is version('2.17', '>=', strict=True)
   - {mitogen_get_stack: {}, register: out}
   - assert_equal:
       left: out.result[0].kwargs.python_path
@@ -27,7 +27,7 @@
   - include_tasks: ../_mitogen_only.yml
   - meta: end_play
     when:
-      - ansible_version.full is version('2.17', '>=', strict=True)
+      - ansible_version_major_minor is version('2.17', '>=', strict=True)
   - {mitogen_get_stack: {}, register: out}
   - assert_equal:
       left: out.result[0].kwargs.python_path
@@ -57,7 +57,7 @@
   - include_tasks: ../_mitogen_only.yml
   - meta: end_play
     when:
-      - ansible_version.full is version('2.17', '>=', strict=True)
+      - ansible_version_major_minor is version('2.17', '>=', strict=True)
   - {mitogen_get_stack: {}, register: out}
   - assert_equal:
       left: out.result[0].kwargs.python_path
@@ -87,7 +87,7 @@
   - include_tasks: ../_mitogen_only.yml
   - meta: end_play
     when:
-      - ansible_version.full is version('2.17', '>=', strict=True)
+      - ansible_version_major_minor is version('2.17', '>=', strict=True)
   - {mitogen_get_stack: {}, register: out}
   - assert_equal:
       left: out.result[0].kwargs.python_path

tests/ansible/regression/issue_1066__add_host__host_key_checking.yml

@@ -31,7 +31,7 @@
     # FIXME https://github.com/mitogen-hq/mitogen/issues/1096
     - meta: end_play
       when:
-        - ansible_version.full is version('2.17', '>=', strict=True)
+        - ansible_version_major_minor is version('2.17', '>=', strict=True)
     - meta: reset_connection
 
     # The host key might be in ~/.ssh/known_hosts. If it's removed then no
@@ -65,7 +65,7 @@
       # ansible_host_key_checking don't work on Vanilla Ansible 2.10, even for
       # static inventory hosts (ansible/ansible#49254, ansible/ansible#73708).
       when:
-        - ansible_version.full is version('2.11', '>=', strict=True)
+        - ansible_version_major_minor is version('2.11', '>=', strict=True)
           or is_mitogen
   tags:
     - issue_1066

tests/ansible/regression/issue_109__target_has_old_ansible_installed.yml

@@ -7,7 +7,7 @@
   tasks:
     - meta: end_play
       when:
-        - ansible_version.full is version('2.6', '<', strict=True)
+        - ansible_version_major_minor is version('2.6', '<', strict=True)
 
     - name: Copy the naughty ansible into place
       copy:

tests/ansible/regression/issue_590__sys_modules_crap.yml

@@ -3,7 +3,7 @@
   tasks:
   - meta: end_play
     when:
-      - ansible_version.full is version('2.8', '<', strict=True)
+      - ansible_version_major_minor is version('2.8', '<', strict=True)
 
   - custom_python_uses_distro:
     register: out

tests/ansible/regression/issue_655__wait_for_connection_error.yml

@@ -22,7 +22,7 @@
       when:
         # Ansible 10 (ansible-core 2.17+) require Python 3.7+ on targets.
         # On CentOS 8 /usr/libexec/platform-python is Python 3.6
-        - ansible_version.full is version('2.17', '>=', strict=True)
+        - ansible_version_major_minor is version('2.17', '>=', strict=True)
 
     - name: set up test container and run tests inside it
       block:

tests/ansible/regression/issue_766__get_with_context.yml

@@ -25,15 +25,15 @@
         # with Ansible 4 (ansible-core 2.11) & associated collections.
         # ansible.module_utils.connection.ConnectionError: Method not found
         # https://github.com/mitogen-hq/mitogen/actions/runs/12854359099/job/35838635886
-        - ansible_version.full is version('2.11', '>=', strict=True)
-        - ansible_version.full is version('2.12', '<', strict=True)
+        - ansible_version_major_minor is version('2.11', '>=', strict=True)
+        - ansible_version_major_minor is version('2.12', '<', strict=True)
 
     - meta: end_play
       when:
         # TASK [Get running configuration and state data ]
         # Error: : Task failed: ActionBase._parse_returned_data() missing 1 required positional argument: 'profile'
         # https://github.com/ansible-collections/ansible.netcommon/issues/698#issuecomment-2910082548
-        - ansible_version.full is version('2.18.999', '>=', strict=True)
+        - ansible_version_major_minor is version('2.19', '>=', strict=True)
 
     - block:
         - name: Start container

tests/ansible/regression/issue_776__load_plugins_called_twice.yml

@@ -17,7 +17,7 @@
     # support Python 2.x on targets.
     - meta: end_play
       when:
-        - ansible_version.full is version('2.17', '>=', strict=True)
+        - ansible_version_major_minor is version('2.17', '>=', strict=True)
 
   roles:
     - role: package_manager

tests/image_prep/_container_setup.yml

@@ -66,7 +66,7 @@
           dnf: dnf clean all
       command: "{{ clean_command[ansible_pkg_mgr] }}"
       args:
-        warn: "{{ False if ansible_version.full is version('2.10', '<=', strict=True) else omit }}"
+        warn: "{{ False if ansible_version_major_minor is version('2.10', '<=', strict=True) else omit }}"
 
     - name: Clean up apt package lists
       shell: rm -rf {{item}}/*

tests/image_prep/group_vars/all.yml

@@ -1,3 +1,5 @@
+ansible_version_major_minor: "{{ ansible_version.major }}.{{ ansible_version.minor }}"
+
 common_packages:
   - openssh-server
   - rsync

tox.ini

@@ -88,10 +88,8 @@ deps =
     ansible9: ansible~=9.0
     ansible10: ansible~=10.0
     ansible11: ansible~=11.0
-    ansible12: ansible>=12.0a
-    # Avoid yaml callback bug, https://github.com/mitogen-hq/mitogen/issues/1284
-    ansible12: ansible!=12.0a6
-    ansible12: ansible-core!=2.19b6
+    ansible12: ansible>=12.0a7
+    ansible12: ansible-core>=2.19rc1
 install_command =
     python -m pip --no-python-version-warning --disable-pip-version-check install {opts} {packages}
 commands_pre =