From b64c42b20b4818d44d33fb831ec879a0a6138992 Mon Sep 17 00:00:00 2001
From: Jiri Jaburek <comps@nomail.dom>
Date: Tue, 15 Sep 2026 11:26:55 +0200
Subject: [PATCH] implement contest-atex-testingfarm based contest-all Packit
 test

Signed-off-by: Jiri Jaburek <comps@nomail.dom>
---
 .packit.yaml                              | 42 +++++++++++++++++++----
 docs/manual/developer/08_content_tests.md | 28 +++++++++++++++
 2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/.packit.yaml b/.packit.yaml
index f8726c4d54dd..3f4b5f3f952a 100644
--- a/.packit.yaml
+++ b/.packit.yaml
@@ -24,13 +24,19 @@ jobs:
   trigger: commit
   branch: "gh-readonly-queue/.*"
 
-- &contest-oscap
+# Contest-based /hardening/host-os testing
+# - this is a minimal set of tests that can run directly on the reserved OS
+#   by remediating + scanning it
+# - let Packit handle it natively by installing built scap-security-guide RPM
+#   and calling Contest to test that OS-installed RPM content
+
+- &contest-host-os-oscap
   job: tests
   trigger: pull_request
   fmf_url: https://github.com/RHSecurityCompliance/contest.git
   fmf_ref: main
   tmt_plan: /plans/upstream-parallel/oscap
-  identifier: contest-oscap
+  identifier: contest-host-os-oscap
   targets:
     centos-stream-8: {}
     centos-stream-9: {}
@@ -40,15 +46,37 @@ jobs:
       pipeline:
         parallel-limit: 32
 
-- <<: *contest-oscap
+- <<: *contest-host-os-oscap
   tmt_plan: /plans/upstream-parallel/ansible
-  identifier: contest-ansible
+  identifier: contest-host-os-ansible
 
-- <<: *contest-oscap
+- <<: *contest-host-os-oscap
   tmt_plan: /plans/upstream-parallel/other
-  identifier: contest-other
+  identifier: contest-host-os-other
+
+# Contest-based testing where the contest-atex-testingfarm is run via Packit
+# on a huge VM host, setting up many containers/VMs to parallelize the testing,
+# also allowing it to run tests that require VMs
+# - this effectively allows full Contest suite execution (all tests that make
+#   sense for PR testing here)
+
+- job: tests
+  trigger: pull_request
+  fmf_url: https://github.com/RHSecurityCompliance/contest-atex-testingfarm.git
+  fmf_ref: main
+  identifier: contest-all
+  targets: [fedora-latest-stable]
+  manual_trigger: true
+  skip_build: true
+  tf_extra_params:
+    # increase default, per README.md of the above repo
+    # - this includes time spent waiting in queued
+    settings:
+      pipeline:
+        timeout: 1200
 
-# when modifying anything below, modify also tests/tmt/
+# tests present locally in this repo, under tests/
+# - when modifying these, modify also tests/tmt/
 
 - job: tests
   trigger: pull_request
diff --git a/docs/manual/developer/08_content_tests.md b/docs/manual/developer/08_content_tests.md
index 53332264cf1f..762a5b0a93b1 100644
--- a/docs/manual/developer/08_content_tests.md
+++ b/docs/manual/developer/08_content_tests.md
@@ -104,3 +104,31 @@ You should replace `0.1.76` with the latest release of the project.
 
 The test `test_stig_rules_in_srg_gpos.py` ensures that all rules selected in RHEL 10 STIG profile are also selected in SRG GPOS control files.
 The test prevents data inconsistencies and verifies that the STIG profile remains based on SRG GPOS controls.
+
+## Packit (on Github)
+
+On Github, this project uses [Packit](https://packit.dev/) to build content as a scratch `scap-security-guide` RPM and run additional tests, all configured via `.packit.yaml` in the root of the repository.
+
+Some of these tests execute [Contest](https://github.com/RHSecurityCompliance/contest), an extensive test suite for RHEL / CentOS Stream. Simple test sets are run automatically on a Pull Request push, but bigger runs require manual triggering.
+
+To trigger a full set of Contest tests, write a comment that **begins with**:
+
+```
+/packit test -i contest-all
+```
+
+You can also parametrize it further with:
+
+- `PLAN` to override the default `/plans/daily` (tmt plan in Contest)
+- `TESTS` as comma-separated test name fmf-style expressions
+- `RERUNS` to override the default 1 automatic rerun of every failed test
+- `CONTEST_PR` to test a specific Contest PR instead of the `main` branch
+- `NO_EXCLUDES=1` to run even tests normally incompatible with containers or unsuitable for PR CI
+
+For example, to test all CIS profile variants (incl. non-daily):
+
+```
+/packit test -i contest-all --env RERUNS=0 --env PLAN=/plans/weekly --env TESTS=/cis$,/cis_server,/cis_workstation
+```
+
+Please **use this test sparingly** as it uses a LOT of resources and will take several hours to run, ideally run it only on a final version of a Pull Request, not on every small change. Limiting by `TESTS` helps only slightly - the bulk of the runtime is spent setting up the testing environment (a constant cost).