New pyats support

.github/workflows/test.yml

@@ -3,8 +3,6 @@ on:
   workflow_dispatch:
   pull_request:
   push:
-    branches:
-      - main
 
 jobs:
   security:
@@ -24,7 +22,7 @@ jobs:
         run: uv tool install bandit[toml]
 
       - name: Run bandit security scan
-        run: bandit -r nac_test/ -ll -f json -o bandit-security-report.json
+        run: bandit -c pyproject.toml -r nac_test/ -ll -f json -o bandit-security-report.json
 
       - name: Upload security report
         uses: actions/upload-artifact@v7
@@ -77,7 +75,7 @@ jobs:
   test:
     name: Tests
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     strategy:
       matrix:
         python:
@@ -100,18 +98,50 @@ jobs:
       - name: Test
         run: |
           uv sync --extra dev
-          uv run pytest
+          # Run tests in parallel (--dist loadscope keeps test classes together, this is critical for e2e tests)
+          uv run pytest -n auto --dist loadscope tests/
+
+  test-windows:
+    name: Tests (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 15
+    strategy:
+      matrix:
+        python:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python }}
+        run: uv python install ${{ matrix.python }}
+
+      - name: Test
+        run: |
+          uv sync --extra dev
+          # Explicit file list: Windows shell doesn't expand globs, and other integration
+          # tests import pyats which isn't available on Windows
+          uv run pytest -m windows -n auto --dist loadscope tests/e2e tests/integration/test_cli_basic.py tests/integration/test_cli_rendering.py tests/integration/test_cli_ordering.py tests/integration/test_cli_extra_args.py
+          uv run nac-test --version
 
   notification:
     name: Notification
     if: always() && github.event_name != 'pull_request'
-    needs: [security, lint, test]
+    needs: [security, lint, test, test-windows]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Check Job Success
         run: |
-          if [ ${{ needs.security.result }} == 'success' ] && [ ${{ needs.lint.result }} == 'success' ] && [ ${{ needs.test.result }} == 'success' ]; then
+          if [ ${{ needs.security.result }} == 'success' ] && [ ${{ needs.lint.result }} == 'success' ] && [ ${{ needs.test.result }} == 'success' ] && [ ${{ needs.test-windows.result }} == 'success' ]; then
             echo "All jobs succeeded"
             echo "jobSuccess=success" >> $GITHUB_ENV
           else

.gitignore

@@ -73,17 +73,32 @@ ENV/
 .vscode
 
 tmp/
+__nac_tmp_*
 
 .mypy_cache/
+.ruff_cache/
 
+# Application execution logs (including Claude Code logs)
 logs/
 
 # Robot artifacts
 output.xml
 log.html
 report.html
+pabot_results/
 
 # Pabot
 .pabotsuitenames
 
+# Claude configuration
 .claude/
+CLAUDE.md
+# Opencode/oh-my-opencode
+.sisyphus/
+AGENTS.md
+
+# bandit security report, if generated
+bandit-security-report.json
+
+# workspace for local testing
+/workspace

.pre-commit-config.yaml

@@ -6,22 +6,37 @@ repos:
         entry: ./scripts/license-headers.sh
         language: script
         types: [python]
-
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      # Kept: Checks not covered by Ruff
+      - id: check-json
+      - id: check-yaml
+        args: ['--unsafe']
+      - id: check-symlinks
+      - id: check-merge-conflict
+      - id: requirements-txt-fixer
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.12.12
     hooks:
       - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]
+        exclude: 'tests/fixtures/|tests/integration/fixtures/|tests/e2e/fixtures/'
       - id: ruff-format
-
+        exclude: 'tests/fixtures/|tests/integration/fixtures/|tests/e2e/fixtures/'
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: v1.17.1
     hooks:
       - id: mypy
-
+        exclude: 'tests/fixtures/|tests/integration/fixtures/|tests/e2e/fixtures/'
+        additional_dependencies:
+          - types-PyYAML>=6.0.12.20250822
+          - types-aiofiles>=24.1.0.20250822
+          - types-markdown>=3.8.0.20250809
+          - types-requests>=2.32.0.20250809
   - repo: https://github.com/PyCQA/bandit
     rev: 1.8.6
     hooks:
       - id: bandit
-        args: ['-r', 'nac_test/']
+        args: ['-c', 'pyproject.toml', '-r', 'nac_test/']
         exclude: ^tests/

CHANGELOG.md

@@ -1,3 +1,44 @@
+# 2.0.0
+
+_Note: This changelog covers all 2.0.0 alpha and beta releases._
+
+## Major Features
+
+- **pyATS Integration** (EXPERIMENTAL): Full support for pyATS operational test cases
+  - Initial support for ACI, SD-WAN, and Catalyst Center architectures
+  - IOS-XE Direct-to-Device (D2D) SSH tests for SD-WAN and Catalyst Center
+  - Experimental `--pyats` and `--robot` flags to limit test execution to one framework
+  - **Windows**: Robot tests only — PyATS libraries are not available on Windows. For PyATS tests, use WSL2 as an alternative.
+  - **macOS requires Python 3.12+**: Earlier Python versions have known fork/SSL incompatibilities causing crashes during pyATS execution.
+- **Combined Dashboard**: New `combined_summary.html` report linking Robot and pyATS summaries
+- **Merged xUnit Output**: Robot and pyATS results merged into single `xunit.xml` for CI/CD integration
+- **Diagnostic Collection**: `--diagnostic` flag wraps execution to collect troubleshooting info (env, packages, logs)
+- **Fail-Fast Authentication**: Controller authentication validated before pyATS test execution starts
+
+## Breaking Changes
+
+- **Robot artifacts moved**: Output files (`log.html`, `report.html`, etc.) now created in `robot_results/` subdirectory; links in root directory for backward compatibility
+- **Robot suite names changed**: Top-level Robot suite names now start with `Robot Results` instead of the output directory name. Use Robot's `--name MyProject` argument to override the top-level suite name when needed.
+- **RESTinstance removed from core dependencies**: The `RESTinstance` Robot library has been removed. Users who still need RESTinstance can install it separately alongside nac-test.
+
+## CLI Changes
+
+- **Added `--verbose`**: Enables verbose output for nac-test, Robot Framework, and pyATS execution
+- **Added `--loglevel`** (replaces `--verbosity`): Control log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
+- **Deprecated `--verbosity`**: Hidden alias for `--loglevel`, will be removed in future version
+
+## Environment Variable Changes
+
+- **Renamed**: `NO_TESTLEVELSPLIT` → `NAC_TEST_DISABLE_TESTLEVELSPLIT` (now requires explicit `true`/`yes`/`1`)
+- **Removed**: `NAC_VALIDATE_VERBOSITY` (was incorrectly named; use `NAC_TEST_LOGLEVEL`)
+
+## Other Improvements
+
+- Upgraded pabot to 5.2.2
+- Streamlined CLI output with cleaner progress reporting
+- `--minimal-reports` reduces pyATS HTML report size by 80-95% (only failed tests include full details)
+- Consolidated rendered Robot templates, pabot intermediate files, and Robot result files under `robot_results/` to avoid output-root namespace collisions
+
 # 1.2.3
 
 - Exclude jsonpath-ng 1.8.0 due to upstream regression (#603)