ci(ansible): trigger molecule filter on template-render test changes

[openbao-service-broker]

Problem

The molecule path filter gates the molecule job — and, for callers that keep a local molecule workflow, their template-render job hangs off the same output. The filter covers roles/**, molecule/**, .config/molecule/** and requirements.yml, but not the render-test playbooks that consume those roles.

So a PR that changes only tests/template_render/ reports green without that job ever running.

That is not hypothetical. dryvist/ansible-proxmox-apps#1258 changed the render playbook's privilege handling, merged unexercised because of this gap, and broke the template-render job on every self-hosted runner — the unprivileged render could no longer overwrite root-owned leftovers at its fixed /tmp paths. The root-cause fix is dryvist/ansible-proxmox-apps#PLACEHOLDER; this closes the hole that let it land unseen.

Change

One pattern added to the molecule filter:

- 'tests/template_render/**'

Effect on other consumers

_ansible-ci.yml is consumed by four repos. Checked each for a tests/template_render/ directory:

Consumer	Has tests/template_render/	Effect
ansible-proxmox-apps	yes	render-test changes now trigger its local molecule workflow — the intended fix
ansible-proxmox	no	none — pattern cannot match
ansible-proxmox-ai	no	none — pattern cannot match
ansible-splunk	no (has tests/templates/, a different path)	none — pattern cannot match

The two repos that use the shared molecule job (ansible-proxmox, ansible-splunk) are unaffected: the path does not exist in either, so the filter output cannot change for them. A broader tests/** pattern would have changed their gating, which is why this is scoped to the one directory.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kqn6PLZhCzVdfLt7E7EFMg

[openbao-service-broker]

Closing as a duplicate of #119, which fixes the same gap with a broader filter.

Two agents reached this independently, which is good corroboration that the blind spot is real. Keeping the broader form because this narrower one is already provably insufficient: ansible-proxmox-apps gained tests/nautobot_seed/ today, which runs as Molecule / Nautobot Seed Bundle Tests and would not be matched by tests/template_render/**. The failure mode here is a filter that is too narrow, so tests/** avoids re-learning this the next time a suite is added.

Your comment explaining why the entry exists was better than mine and I have carried the substance of it across.