fix: skip 'no-ci' tasks in Molecule and install tools in prepare stage instead

.gitlab-ci.yml

@@ -30,6 +30,6 @@ test-job:
     - molecule syntax --scenario-name default
     - molecule lint --scenario-name default
     - molecule create --scenario-name default
-    - molecule converge --scenario-name default
-    - molecule idempotence --scenario-name default
+    - molecule converge --scenario-name default -- --skip-tags no-ci
+    - molecule idempotence --scenario-name default -- --skip-tags no-ci
     # - molecule verify --scenario-name default

molecule/resources/playbooks/converge.yml

@@ -14,4 +14,4 @@
       become: true
       when: ansible_os_family == "RedHat"
   roles:
-    - {role: "ansible_lza_repair", become: true}
+    - {role: "ansible_lza_repair", become: true, skip-tags: "no-ci"}

molecule/resources/playbooks/prepare.yml

@@ -27,6 +27,15 @@
             mode: "0644"
           become: true
       when: ansible_os_family == "Debian"
+    - name: install tooling before running the actual tests, so we're not bound by the fixed versions
+      ansible.builtin.apt:
+        name: [
+          "checkit-tiff*",
+          "fixit-tiff",
+        ]
+        state: latest
+        update_cache: true
+      become: true
 
     - name: configure additional package repositories for RedHat
       block: