ci: update integration and coverage workflow python version

[brahmanim]

Resolves

ACA-6690

SUMMARY

Updates Python version to 3.13 in integration and coverage test workflows.

Changes:

• Set PYTHON_VERSION to 3.13 in coverage_test.yml
• Set PYTHON_VERSION to 3.13 in integration.yml
• Install community.general tests dependancy.
• The AMI lookup for Fedora-Cloud-Base-39-* returned no images — those Fedora 39 AMIs are no longer available in AWS. Updated AMI filters Owner: 125523088429 (CentOS Community Platform Engineering)
  Name: Fedora-Cloud-Base-.x86_64-4 (matches current Fedora 4x images, excludes ELN/Rawhide)
• Update coverage_test to run only on push, instead of each pull_request.
• Fix integration test test_backup_select_resources - update iam create role to include ansible-test prefix.
• Fix integration test test_deploy_flask_app - Gather information about RDS engine version instead of using a constant var value.
• Fix integration test test_deploy_flask_app - update bastion_host_iam_role iam create role to include ansible-test prefix.
• Fix integration test test_move_objects_between_buckets - The failure comes from stricter validation in amazon.aws.s3_object: object keys must not start with /, the integration test was putting an object at /template/test.txt, but the rest of the test already expects template/test.txt (no leading slash)
• Fix integration test test_customized_ami - use setup_rsa_keys__path with ansible.builtin.file instead of tempfile.
• Update roles/deploy_flask_app - Move key path from /tmp/id_rsa → ~/.ssh/workers_id_rsa
• Fix integration test test_deploy_flask_app - Fixing bastion user_data in test_deploy_flask_app to use dnf and Fedora-appropriate packages.
• Update roles roles/customized_ami/tasks/create_ec2_resources.yaml and roles/deploy_flask_app/tasks/setup_infra.yaml - to install coverage on the bastion host for coverage collection.
• Updated test_customized_ami to use a package we control, ngnix, instead of relying on podman being absent from the Fedora 4x base image.
• Updated Sanity workflow - I added the missing { so the entry is valid JSON again. The matrix_exclude array now parses with all 13 entries.
• Updated roles/manage_transit_gateway - updated debug message.

ISSUE TYPE

Test Pull Request

COMPONENT NAME

CI/CD workflows

Reported CI Issues

Integration tests #184

Assisted-by: Claude Sonnet 4.5 (claude-sonnet-4-5@20250929)

[abikouo]

why do you remove this?

[brahmanim]

We decided that the coverage test should run on a PR push, not on each PR commit.
Please see the Slack chat: https://redhat-internal.slack.com/archives/CGUMLTNLS/p1783492350136339?thread_ts=1783440020.417639&cid=CGUMLTNLS

[abikouo]

This appears to be a breaking change. Why are you changing this?

[brahmanim]

Integration tests target test_deploy_flask_app, failed with error:

TASK [cloud.aws_ops.deploy_flask_app : Ensure SSH directory exists on bastion host] ***
[ERROR]: Task failed: Module failed: [Errno 1] Operation not permitted: b'/tmp'
Origin: /Users/brahmani/.ansible/collections/ansible_collections/cloud/aws_ops/roles/deploy_flask_app/tasks/setup_infra.yaml:40:3

38   register: deploy_flask_app__keypair_result
39
40 - name: Ensure SSH directory exists on bastion host
     ^ column 3

fatal: [localhost -> ec2-18-212-199-252-bastion(18.212.199.252)]: FAILED! => {"changed": false, "msg": "Task failed: Module failed: [Errno 1] Operation not permitted: b'/tmp'"}

AI suggested changing the deploy_flask_app_workers_ssh_private_key value to ~/.ssh/workers_id_rsa.
Do you have a solution that won't be a breaking change ( I will try to find one)?

[brahmanim]

I override the integration test vars, tests/integration/targets/test_deploy_flask_app/roles/run_deploy_flask_app/vars/main.yaml, — not in role defaults — so existing consumers of /tmp/id_rsa are unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud