[imaqsood]

Delete the SLES-only exec in apache::mod::php that ran zypper ar ... --gpg-auto-import-keys and zypper refresh to add an EOL openSUSE Leap repo, along with the require on it. Keep the SLES apache::mod branch, which needs the mod_${mod}.so lib path. The acceptance harness (spec/setup_acceptance_node.pp) already adds the fallback repo before the suite runs, so CI keeps its package source. Add a Suse unit spec checking that the class has no zypper exec.

Jira: https://perforce.atlassian.net/browse/MODULES-12075

Approach

A module should never change a customer's package sources, and the old exec auto-trusted GPG keys from an EOL repo. The repo was only there for unregistered GCP BYOS CI images, and spec/setup_acceptance_node.pp already sets it up through an exec run before the suite. That keeps acceptance working while removing the side effect from the shipped code. The patch release is a release-pipeline step; per the repo rules, the patch does not touch metadata.json or the CHANGELOG.

Acceptance criteria

• apache::mod::php no longer adds or refreshes any zypper repo.: manifests/mod/php.pp, spec/classes/mod/php_spec.rb
• Apache SLES-12/15 acceptance is still green with the repo set up in the harness.: spec/setup_acceptance_node.pp (unchanged; already sets up the repo), spec/acceptance (SLES 12/15 litmus run)
• A patch release is out.: Not covered by this patch: needs a release-prep PR (metadata.json version and CHANGELOG) after merge

Local checks

cat-module (static, unit; full suite): pass, 15706 passed, 0 failed
🤖 Generated with Claude Code