feat: Improve github CI and linting #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| name: Ansible validation | |
| on: | |
| pull_request: {} | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.13' | |
| - name: Install Ansible tooling | |
| run: python -m pip install --requirement requirements.txt | |
| - name: Install Ansible collections | |
| run: ansible-galaxy collection install --requirements-file requirements.yml | |
| - name: Lint YAML | |
| run: yamllint . | |
| - name: Lint Ansible | |
| run: ansible-lint | |
| - name: Syntax check playbooks | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| playbooks=(playbooks/*.yml playbooks/*.yaml) | |
| if (( ${#playbooks[@]} == 0 )); then | |
| echo "No playbooks found." >&2 | |
| exit 1 | |
| fi | |
| for playbook in "${playbooks[@]}"; do | |
| ansible-playbook --syntax-check --inventory 'localhost,' "$playbook" | |
| done | |
| - name: Test Dawarich role | |
| env: | |
| ANSIBLE_ALLOW_BROKEN_CONDITIONALS: 'true' | |
| run: molecule test --scenario-name dawarich | |
| validate-vault: | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| environment: ansible-validation | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.13' | |
| - name: Install Ansible tooling | |
| run: python -m pip install --requirement requirements.txt | |
| - name: Create temporary Vault password file | |
| shell: bash | |
| env: | |
| ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "$ANSIBLE_VAULT_PASSWORD" ]]; then | |
| echo "ANSIBLE_VAULT_PASSWORD is not configured for the ansible-validation environment." >&2 | |
| exit 1 | |
| fi | |
| umask 077 | |
| printf '%s' "$ANSIBLE_VAULT_PASSWORD" > "$RUNNER_TEMP/ansible-vault-password" | |
| - name: Validate Vault decryption | |
| env: | |
| ANSIBLE_VAULT_PASSWORD_FILE: ${{ runner.temp }}/ansible-vault-password | |
| run: python scripts/validate_vault.py | |
| - name: Remove temporary Vault password file | |
| if: always() | |
| shell: bash | |
| run: rm -f "$RUNNER_TEMP/ansible-vault-password" |