Allow downstreams to enforce that the ansible_core ref must have a version specifier

src/ansible_builder/constants.py

@@ -48,3 +48,5 @@
 
 DEFAULT_EE_BASENAME = "execution-environment"
 YAML_FILENAME_EXTENSIONS = ('yml', 'yaml')
+
+REQUIRE_ANSIBLE_CORE_PIN = False

src/ansible_builder/user_definition.py

@@ -9,6 +9,7 @@
 from typing import Callable
 
 import yaml
+from packaging.requirements import InvalidRequirement, Requirement
 
 from . import constants
 from .exceptions import DefinitionError
@@ -158,7 +159,20 @@ def python_path(self):
 
     @property
     def ansible_core_ref(self):
-        return self.raw.get('dependencies', {}).get('ansible_core', {}).get('package_pip', None)
+        ref = self.raw.get('dependencies', {}).get('ansible_core', {}).get('package_pip', None)
+
+        if ref and constants.REQUIRE_ANSIBLE_CORE_PIN:
+            try:
+                req = Requirement(ref)
+            except InvalidRequirement as e:
+                raise DefinitionError("Invalid package requirement specified for 'ansible_core'") from e
+
+            if not req.specifier:
+                raise DefinitionError(
+                    "Value for 'ansible_core' must contain a version constraint, such as 'ansible-core==2.16.*'"
+                )
+
+        return ref
 
     @property
     def ansible_runner_ref(self):

test/unit/test_user_definition.py

@@ -173,17 +173,36 @@ def test_v3_ansible_install_refs(self, exec_env_definition_file):
             {'version': 3,
              'images': { 'base_image': {'name': 'base_image:latest'}},
              'dependencies': {
-                'ansible_core': {'package_pip': 'ansible-core==2.13'},
+                'ansible_core': {'package_pip': 'ansible-core'},
                 'ansible_runner': { 'package_pip': 'ansible-runner==2.3.1'}
              }
             }
             """
         )
         definition = UserDefinition(path)
         definition.validate()
-        assert definition.ansible_core_ref == "ansible-core==2.13"
+        assert definition.ansible_core_ref == "ansible-core"
         assert definition.ansible_runner_ref == "ansible-runner==2.3.1"
-        assert definition.ansible_ref_install_list == "ansible-core==2.13 ansible-runner==2.3.1"
+        assert definition.ansible_ref_install_list == "ansible-core ansible-runner==2.3.1"
+
+    def test_v3_ansible_install_ref_pin_required(self, monkeypatch, exec_env_definition_file):
+        path = exec_env_definition_file(
+            """
+            {'version': 3,
+             'images': { 'base_image': {'name': 'base_image:latest'}},
+             'dependencies': {
+                'ansible_core': {'package_pip': 'ansible-core'},
+                'ansible_runner': { 'package_pip': 'ansible-runner==2.3.1'}
+             }
+            }
+            """
+        )
+        monkeypatch.setattr(constants, 'REQUIRE_ANSIBLE_CORE_PIN', True)
+        definition = UserDefinition(path)
+        definition.validate()
+        with pytest.raises(DefinitionError) as error:
+            _ = definition.ansible_core_ref
+        assert "Value for 'ansible_core' must contain a version constraint" in str(error.value.args[0])
 
     def test_v3_inline_python(self, exec_env_definition_file):
         """