diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 67d31d9..433c435 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,12 +1,12 @@
 name: Test the components of it
 
-on:
+"on":
   push:
   pull_request:
 
 jobs:
   validate:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
@@ -18,3 +18,45 @@ jobs:
           for vars in distros/*; do
             ~/bin/packerio validate -except=upload -var-file=${vars} sources/
           done
+
+  collect:
+    runs-on: ubuntu-latest
+    outputs:
+      scenarios: ${{ steps.collection.outputs.tox-envs }}
+      vagrant: ${{ steps.vagrant.outputs.tox-envs }}
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: 'recursive'
+      - name: Set up Python
+        uses: actions/setup-python@v2
+      - name: Install dependencies
+        run: |
+          set -ex
+          python -m pip install --upgrade tox
+      - name: Collect dependencies
+        id: collection
+        uses: greg-hellings/tox-list@v1
+        with:
+          tox-args: --ansible-driver docker --ansible-driver podman --ansible-driver containers
+      - id: vagrant
+        uses: greg-hellings/tox-list@v1
+        with:
+          tox-args: --ansible-driver vagrant
+
+  lint:
+    uses: devroles/meta_test/.github/workflows/lint.yml@master
+
+  vagrant_build:
+    needs:
+      - collect
+    uses: devroles/meta_test/.github/workflows/vagrant_build.yml@master
+    with:
+      scenarios: "${{ needs.collect.outputs.vagrant }}"
+
+  build:
+    needs:
+      - collect
+    uses: devroles/meta_test/.github/workflows/container_build.yml@master
+    with:
+      scenarios: "${{ needs.collect.outputs.scenarios }}"
diff --git a/ansible/ansible-lint.yml b/ansible/ansible-lint.yml
new file mode 100644
index 0000000..5d63c88
--- /dev/null
+++ b/ansible/ansible-lint.yml
@@ -0,0 +1,10 @@
+exclude_paths:
+  - ../.cache/
+  - .cache/
+  # Must not be relatively anchored
+  - /**/molecule/*/*.yml
+
+skip_list:
+  - "204"
+  - yaml
+use_default_rules: true
diff --git a/ansible/molecule.yml b/ansible/molecule.yml
new file mode 100644
index 0000000..76a6e7c
--- /dev/null
+++ b/ansible/molecule.yml
@@ -0,0 +1,28 @@
+dependency:
+  name: galaxy
+  options:
+    role-file: ../../requirements.yml  # relative to the role dir
+    requirements-file: ../../requirements.yml
+provisioner:
+  name: ansible
+  playbooks:  # These paths are relative to scenario dir
+    prepare: ../shared/prepare.yml
+    converge: ../shared/playbook.yml
+    cleanup: ../shared/cleanup.yml
+  config_options:
+    defaults:
+      stdout_callback: yaml
+      force_color: true
+      remote_tmp: /tmp/${USER}/ansible
+verifier:
+  name: testinfra
+  options:
+    # Add a -v so you see the individual test names,
+    # particularly useful with parameterized tests
+    v: true
+    junit-xml: junit.xml
+  # Using the shared directory is useful for sharing tests across scenarios,
+  # but is not a requirement. For scenario specific tests, add the appropriate
+  # file path to the test or test directory below
+  additional_files_or_dirs:
+    - ../../shared/tests  # relative to the scenario tests dir
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 43315af..1bec74c 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -3,22 +3,23 @@
   pre_tasks:
     - name: update all the things
       become: true
-      package:
+      ansible.builtin.package:  # noqa package-latest
         name: "*"
         state: latest
       when: ansible_facts.pkg_mgr not in ['atomic_container']
 
     - name: update atomic things
       become: true
-      command: rpm-ostree upgrade
+      ansible.builtin.command: rpm-ostree upgrade
       when: ansible_facts.pkg_mgr in ['atomic_container']
+      changed_when: false
   roles:
     - role: virtualbox
       when: packer_builder_type == 'virtualbox-iso'
     - role: vmware
       when: packer_builder_type == 'vmware-iso'
     - role: init
-    - role: epel
+    - role: devroles.system.epel
     - role: locale
     - role: vagrant
     - role: cleanup
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
new file mode 100644
index 0000000..e78bdcc
--- /dev/null
+++ b/ansible/requirements.yml
@@ -0,0 +1,2 @@
+collections:
+  - devroles.system
diff --git a/ansible/roles/cleanup/tasks/CentOS.yml b/ansible/roles/cleanup/tasks/CentOS.yml
index 5db6e35..a10106e 100644
--- a/ansible/roles/cleanup/tasks/CentOS.yml
+++ b/ansible/roles/cleanup/tasks/CentOS.yml
@@ -1,7 +1,8 @@
 - name: clean yum history
   become: true
-  shell: |-
+  ansible.builtin.shell: |-
     set -e
     yum --enablerepo=epel clean all
     yum history new
     truncate -c -s 0 /var/log/yum.log
+  changed_when: false
diff --git a/ansible/roles/cleanup/tasks/CentOS_6.yml b/ansible/roles/cleanup/tasks/CentOS_6.yml
index 1a1220f..5aa06a3 100644
--- a/ansible/roles/cleanup/tasks/CentOS_6.yml
+++ b/ansible/roles/cleanup/tasks/CentOS_6.yml
@@ -1,6 +1,6 @@
 - name: remove unnecessesary packages
   become: true
-  package:
+  ansible.builtin.package:
     name:
       - perl
       - gcc
diff --git a/ansible/roles/cleanup/tasks/CentOS_7.yml b/ansible/roles/cleanup/tasks/CentOS_7.yml
index b275005..4da16ef 100644
--- a/ansible/roles/cleanup/tasks/CentOS_7.yml
+++ b/ansible/roles/cleanup/tasks/CentOS_7.yml
@@ -1,6 +1,6 @@
 - name: remove unnecessesary packages
   become: true
-  package:
+  ansible.builtin.package:
     name:
       - make
       - perl
diff --git a/ansible/roles/cleanup/tasks/Fedora.yml b/ansible/roles/cleanup/tasks/Fedora.yml
index 3936d83..800f6ed 100644
--- a/ansible/roles/cleanup/tasks/Fedora.yml
+++ b/ansible/roles/cleanup/tasks/Fedora.yml
@@ -1,4 +1,5 @@
 - name: clean up Fedora
   become: true
-  command: dnf clean all
+  ansible.builtin.command: dnf clean all  # noqa command-instead-of-module
   when: ansible_facts.pkg_mgr not in ['atomic_container']
+  changed_when: false
diff --git a/ansible/roles/cleanup/tasks/Ubuntu.yml b/ansible/roles/cleanup/tasks/Ubuntu.yml
index b351b48..490a189 100644
--- a/ansible/roles/cleanup/tasks/Ubuntu.yml
+++ b/ansible/roles/cleanup/tasks/Ubuntu.yml
@@ -1,3 +1,4 @@
 - name: clean apt files
   become: true
-  command: apt-get clean
+  ansible.builtin.command: apt-get clean  # noqa command-instead-of-module
+  changed_when: false
diff --git a/ansible/roles/epel/tasks/main.yml b/ansible/roles/epel/tasks/main.yml
deleted file mode 100644
index 3b29424..0000000
--- a/ansible/roles/epel/tasks/main.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-- become: true
-  block:
-    - name: install epel-release
-      package:
-        name: epel-release
-        state: present
-
-    - name: disable epel
-      ini_file:
-        path: /etc/yum.repos.d/epel.repo
-        section: epel
-        option: enabled
-        value: "0"
-        create: false
-  when: >
-    ansible_facts['distribution'] in ['CentOS', 'RHEL']
diff --git a/ansible/roles/init/tasks/main.yml b/ansible/roles/init/tasks/main.yml
index 1da1292..4f72541 100644
--- a/ansible/roles/init/tasks/main.yml
+++ b/ansible/roles/init/tasks/main.yml
@@ -1,5 +1,5 @@
 - name: load version information
-  include_vars: "{{ item }}"
+  ansible.builtin.include_vars: "{{ item }}"
   loop:
     - "{{ role_path }}/vars/{{ ansible_facts['os_family'] }}.yml"
     - "{{ role_path }}/vars/{{ ansible_facts['distribution'] }}.yml"
@@ -9,7 +9,7 @@
 
 - name: modify init file
   become: true
-  replace:
+  ansible.builtin.replace:
     path: "{{ init_file }}"
     replace: "{{ init_replace }}"
     regexp: "{{ init_regexp }}"
diff --git a/ansible/roles/locale/tasks/main.yml b/ansible/roles/locale/tasks/main.yml
index c3dc5a3..6191e0e 100644
--- a/ansible/roles/locale/tasks/main.yml
+++ b/ansible/roles/locale/tasks/main.yml
@@ -1,7 +1,7 @@
 - name: update locale info
   become: true
-  shell: |
-    set -e
+  ansible.builtin.shell: |
+    set -eo pipefail
     localedef --list-archive | grep -a -v en_US.utf8 | xargs sudo localedef --delete-from-archive
     cp /usr/lib/locale/locale-archive{,.tmpl}
     build-locale-archive
diff --git a/ansible/roles/vagrant/tasks/main.yml b/ansible/roles/vagrant/tasks/main.yml
index 5d17617..5595b32 100644
--- a/ansible/roles/vagrant/tasks/main.yml
+++ b/ansible/roles/vagrant/tasks/main.yml
@@ -1,5 +1,5 @@
 - name: load vars, if needed
-  include_vars: "{{ item }}"
+  ansible.builtin.include_vars: "{{ item }}"
   loop:
     - "{{ role_path }}/vars/default.yml"
     - "{{ role_path }}/vars/{{ ansible_facts.distribution }}.yml"
@@ -8,14 +8,14 @@
 
 - name: remove cloud-init
   become: true
-  package:
+  ansible.builtin.package:
     name: cloud-init
     state: absent
   when: ansible_facts.pkg_mgr not in ['atomic_container']
 
 - name: get build time
   become: true
-  copy:
+  ansible.builtin.copy:
     content: "{{ ansible_facts.date_time.date }}"
     dest: /etc/vagrant_box_build_time
     owner: root
@@ -23,30 +23,30 @@
     mode: 0644
 
 - name: create .ssh directory
-  file:
+  ansible.builtin.file:
     path: "{{ ansible_user_dir }}/.ssh"
     state: directory
     mode: "0700"
 
 - name: fetch authorized_keys
-  get_url:
+  ansible.builtin.get_url:
     mode: "0600"
     dest: "{{ ansible_user_dir }}/.ssh/authorized_keys"
     url: https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub
 
 - block:
     - name: configure sshd
-      lineinfile:
+      ansible.builtin.lineinfile:
         line: UseDNS no
         path: /etc/ssh/sshd_config
 
     - name: check for the sshd_config.d directory
-      stat:
+      ansible.builtin.stat:
         path: /etc/ssh/sshd_config.d
       register: _vagrant_sshd_config_d
 
     - name: be sure that sshd is configured properly to accept the pubkey
-      copy:
+      ansible.builtin.copy:
         content: PubkeyAcceptedKeyTypes +ssh-rsa
         mode: "0600"
         owner: root
@@ -55,7 +55,7 @@
       when: _vagrant_sshd_config_d.stat.exists
 
     - name: enable sshd
-      service:
+      ansible.builtin.service:
         name: "{{ vagrant_ssh_service_name }}"
         state: started
         enabled: true
@@ -63,6 +63,7 @@
       # unable to determine state of the service. However, if we were able
       # to connect to it to run this Ansible, then we clearly are up
       # and running and we can safely ignore this error
+      # noqa ignore-errors
       ignore_errors: >-
         {{ ansible_facts.distribution == 'Fedora' and
         ansible_facts.distribution_major_version == '31' }}
diff --git a/ansible/roles/virtualbox/tasks/main.yml b/ansible/roles/virtualbox/tasks/main.yml
index 3e130a3..c026bd3 100644
--- a/ansible/roles/virtualbox/tasks/main.yml
+++ b/ansible/roles/virtualbox/tasks/main.yml
@@ -1,12 +1,12 @@
 - name: install build deps for virtualbox addons
   become: true
-  package:
+  ansible.builtin.package:
     name: "{{ virtualbox_packages }}"
     state: present
 
 - name: start services
   become: true
-  service:
+  ansible.builtin.service:
     name: "{{ item }}"
     state: started
     enabled: true
@@ -14,7 +14,7 @@
 
 - name: mount iso file
   become: true
-  command: "{{ item }}"
+  ansible.builtin.command: "{{ item }}"
   changed_when: false
   loop:
     - mount -o loop,ro {{ ansible_user_dir }}/VBoxGuestAdditions.iso /mnt
@@ -22,6 +22,6 @@
     - umount /mnt
 
 - name: remove iso
-  file:
+  ansible.builtin.file:
     name: "{{ ansible_user_dir }}/VBoxGuestAdditions.iso"
     state: absent
diff --git a/ansible/roles/vmware/tasks/has_package.yml b/ansible/roles/vmware/tasks/has_package.yml
index 4990d29..3a6a715 100644
--- a/ansible/roles/vmware/tasks/has_package.yml
+++ b/ansible/roles/vmware/tasks/has_package.yml
@@ -1,5 +1,6 @@
 - name: create hgfs dir
   become: true
-  file:
+  ansible.builtin.file:
     state: directory
     path: /mnt/hgfs
+    mode: 0700
diff --git a/ansible/roles/vmware/tasks/legacy.yml b/ansible/roles/vmware/tasks/legacy.yml
index 35357fd..204de52 100644
--- a/ansible/roles/vmware/tasks/legacy.yml
+++ b/ansible/roles/vmware/tasks/legacy.yml
@@ -1,20 +1,23 @@
 - name: create mount point
   become: true
-  file:
+  ansible.builtin.file:
     path: /mnt/vmware
     state: directory
+    mode: 0700
 
 - name: mount iso file
   become: true
-  command: mount -o loop,ro {{ ansible_user_dir }}/linux.iso /mnt/vmware
+  ansible.builtin.command: mount -o loop,ro {{ ansible_user_dir }}/linux.iso /mnt/vmware  # noqa command-instead-of-module
+  changed_when: false
 
 - name: create tmp dir
-  file:
+  ansible.builtin.file:
     path: /tmp/vmware
     state: directory
+    mode: 0700
 
 - name: untar tools
-  command: |
+  ansible.builtin.command: |
     set -ex
     tar zxf /mnt/vmware/VMWareTools-*.tar.gz -C /tmp/vmware
     sudo /tmp/vmware/vmware-tools-distrib/vmware-install.pl --default --force-install
@@ -24,7 +27,7 @@
 
 - name: remove files
   become: true
-  file:
+  ansible.builtin.file:
     path: "{{ item }}"
     state: absent
   loop:
@@ -32,7 +35,7 @@
     - "{{ ansible_user_dir }}/linux.iso"
 
 - name: add content to /etc/vmware-tools/locations
-  blockinfile:
+  ansible.builtin.blockinfile:
     block: |
       remove_answer ENABLE_VGAUTH
       answer ENABLE_VGAUTH no
@@ -41,5 +44,5 @@
 
 - name: finish up installs
   become: true
-  command: /usr/bin/vmware-config-tools.pl --default --skip-stop-abort
+  ansible.builtin.command: /usr/bin/vmware-config-tools.pl --default --skip-stop-abort
   changed_when: false
diff --git a/ansible/roles/vmware/tasks/main.yml b/ansible/roles/vmware/tasks/main.yml
index 2bc0fa8..b94bf2f 100644
--- a/ansible/roles/vmware/tasks/main.yml
+++ b/ansible/roles/vmware/tasks/main.yml
@@ -1,5 +1,5 @@
 - name: read variables
-  include_vars: "{{ item }}"
+  ansible.builtin.include_vars: "{{ item }}"
   loop:
     - "{{ role_path }}/vars/{{ ansible_facts.distribution }}.yml"
     - "{{ role_path }}/vars/{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml"
@@ -7,19 +7,19 @@
 
 - name: install vmware related packages
   become: true
-  package:
+  ansible.builtin.package:
     name: "{{ vmware_packages }}"
     state: present
 
 - name: modern systems
-  import_tasks: has_package.yml
+  ansible.builtin.import_tasks: has_package.yml
   when: >-
     ansible_distribution_name == 'fedora' or
     (ansible_distribution_name == 'debian' and
     ansible_distribution_major_version > '8')
 
 - name: legacy builds
-  import_tasks: legacy.yml
+  ansible.builtin.import_tasks: legacy.yml
   when: >-
     (ansible_distribution_name == 'debian' and
     ansible_distribution_major_version <= '8')
diff --git a/ansible/yamllint.yml b/ansible/yamllint.yml
new file mode 100644
index 0000000..cb9553d
--- /dev/null
+++ b/ansible/yamllint.yml
@@ -0,0 +1,17 @@
+extends: default
+
+rules:
+  line-length:
+    max: 120
+    level: warning
+  document-start:
+    present: false
+    level: error
+  comments:
+    require-starting-space: false
+
+ignore: |
+  .tox
+  samples/
+  .cache
+  plugins/ceph_ansible
diff --git a/sources/qemu.pkr.hcl b/sources/qemu.pkr.hcl
index 02c50fa..5944e89 100644
--- a/sources/qemu.pkr.hcl
+++ b/sources/qemu.pkr.hcl
@@ -94,6 +94,7 @@ build {
 
 	provisioner "ansible" {
 		playbook_file = "ansible/playbook.yml"
+		galaxy_file = "ansible/requirements.yml"
 	}
 
 	provisioner "shell" {
diff --git a/test.sh b/test.sh
index 976c4b7..7e81f1e 100755
--- a/test.sh
+++ b/test.sh
@@ -4,7 +4,8 @@ set -exo pipefail
 
 build="${1}"
 
-#packer build -var-file distros/${build}.pkrvars.hcl -except=upload sources/qemu.pkr.hcl
+packer build -var headless=false -var-file distros/${build}.pkrvars.hcl -except=upload sources/qemu.pkr.hcl
 vagrant box add -f --name test ${build}.box
 vagrant up
 vagrant ssh -c "ls -la ~/"
+vagrant destroy -f
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..02afe00
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,27 @@
+[tox]
+skip_dist = true
+minversion = 3.2
+envlist = lint_all
+requires = tox-ansible>=1.5
+
+[ansible]
+molecule_config_files = {toxinidir}/ansible/molecule.yml
+ansible_lint_config = {toxinidir}/ansible/ansible-lint.yml
+yamllint_config = {toxinidir}/ansible/yamllint.yml
+
+[testenv]
+parallel_show_output = true
+usedevelop = false
+skip_install = true
+passenv =
+    TERM
+    SHELL
+    XDG_RUNTIME_DIR
+    ANSIBLE_COLLECTIONS_PATH
+deps =
+    molecule
+
+[flake8]
+exclude =
+    http/fedora,
+    .tox