feat: add supportedSplunkModinput output with python.version variants for Splunk 9.4

[dkaras-splunk]

Summary

• Adds SERVER_CONF_PYTHON_VERSIONS = python3,force_python3 to the [9.4] section of splunk_matrix.conf
• Adds new supportedSplunkModinput output: expands entries with SERVER_CONF_PYTHON_VERSIONS into separate matrix entries with serverConfPythonVersion field — used exclusively by modinput test jobs
• supportedSplunk output is unchanged and no longer expands variants — used by all other test types (btool, knowledge, ui, upgrade, scripted inputs, spl2)

Why

Splunk 9.4 introduced a python.version setting in server.conf [general] that controls whether Python 2 or Python 3 is used for scripted inputs. We need to test both python3 and force_python3 values to ensure add-on compatibility. Only modinput tests are relevant for this setting — other test types do not need duplicate runs.

Test plan

• Verify supportedSplunk output contains 4 entries (no 9.4 variants)
• Verify supportedSplunkModinput output contains 5 entries (9.4 appears twice with serverConfPythonVersion: python3 and serverConfPythonVersion: force_python3)
• Verify latestSplunk still returns single entry for 10.2

https://github.com/splunk/splunk-add-on-for-box/actions/runs/28085866490

[mkolasinski-splunk]

Review — supportedSplunkModinput matrix output

The core logic is correct: [GENERAL] is preserved (uppercase) so config["GENERAL"]["LATEST"] resolves, re.search(r"^\d+", section) correctly skips it, configparser lowercases keys so props["version"]/["server_conf_python_versions"] are right, and the latestSplunk loop is unaffected. A few things to address — see inline.

Notes:

• [IMPORTANT] GitHub reports this PR as CONFLICTING (branch cut from v3.2.0-era main; main is now v3.2.1). Please rebase before merge.
• [IMPORTANT] Add unit tests for the new function + de-duplicate it (inline).
• [IMPORTANT] image: 'Dockerfile' un-pinning (inline) — fine to ship but please follow up by publishing/pinning a new tag.

[mkolasinski-splunk]

[IMPORTANT] Maintainability + Tests — two things on this new function:

1. It's a near-verbatim copy of _generate_supported_splunk above; only the entry construction differs. Two copies of the EOL parse / feature filter / props loop will drift (a future fix to one won't reach the other). Consider factoring the shared parsing into a helper that yields (section, props) and building both outputs from it.
2. There are no unit tests for this logic. The PR test plan (9.4 → 2 entries with serverConfPythonVersion ∈ {python3, force_python3}; other versions → 1 entry; EOL/feature filtering still applies) is exactly what a unit test should assert. tests/ currently covers only the matrix-updater, not main.py.

[dkaras-splunk]

Done — factored the shared file-loading + EOL/feature-filtering loop into _load_splunk_config and _iter_splunk_sections. Both _generate_supported_splunk and _generate_supported_splunk_modinput now delegate to those helpers, eliminating the duplication.

Unit tests added in tests/test_main.py covering:

• 9.4 expands to exactly 2 entries with serverConfPythonVersion in {python3, force_python3}
• Versions without SERVER_CONF_PYTHON_VERSIONS appear once, without the extra field
• EOL versions are excluded from both outputs
• Invalid server_conf_python_versions values raise ValueError
• islatest / isoldest flags are set correctly

All 9 tests pass.

[mkolasinski-splunk]

[SUGGESTION] Maintainability — bare except: also catches KeyboardInterrupt/SystemExit. getboolean raises ValueError on non-bool, so except ValueError: is the precise catch. (Carried over from the original, but worth tightening in the new copy.)

[dkaras-splunk]

Fixed in the refactored version — the new _iter_splunk_sections helper uses except ValueError: instead of bare except:. The original _generate_supported_splunk still has the bare except (carried over); I've left it unchanged to keep the diff minimal, but happy to fix it there too if you'd like.

[mkolasinski-splunk]

[SUGGESTION] Security — this value (serverConfPythonVersion) is eventually string-concatenated into a sudo-run bash command in ta-automation-k8s-manifests with no escaping. It's repo-controlled today so not exploitable, but consider validating against an allowlist (python3, force_python3) here at the source, so a malformed splunk_matrix.conf value can't propagate into the postStart shell string downstream.

[dkaras-splunk]

Added an allowlist validation in _generate_supported_splunk_modinput: if any value from server_conf_python_versions is not in _ALLOWED_SERVER_CONF_PYTHON_VERSIONS = {"python3", "force_python3"}, a ValueError is raised with a clear message before the entry can propagate downstream. A dedicated test (test_invalid_python_version_raises) covers this path.

[mkolasinski-splunk]

[IMPORTANT] Reliability / Supply-chain — switching from a pinned, published image (v3.2.0) to image: 'Dockerfile' makes every consumer build from source on each run and loses image immutability/provenance. Understood that this is needed so the updated code is actually executed, but please follow up by publishing a new pinned tag (e.g. v3.3.0) and pointing the action back at it rather than leaving runtime builds permanently.