ansible.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Ansible validation

on:
  pull_request: {}
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: '3.13'
      - name: Install Ansible tooling
        run: python -m pip install --requirement requirements.txt
      - name: Install Ansible collections
        run: ansible-galaxy collection install --requirements-file requirements.yml
      - name: Lint YAML
        run: yamllint .
      - name: Lint Ansible
        run: ansible-lint
      - name: Syntax check playbooks
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          playbooks=(playbooks/*.yml playbooks/*.yaml)
          if (( ${#playbooks[@]} == 0 )); then
            echo "No playbooks found." >&2
            exit 1
          fi
          for playbook in "${playbooks[@]}"; do
            ansible-playbook --syntax-check --inventory 'localhost,' "$playbook"
          done
      - name: Test Dawarich role
        env:
          ANSIBLE_ALLOW_BROKEN_CONDITIONALS: 'true'
        run: molecule test --scenario-name dawarich

  validate-vault:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: validate
    runs-on: ubuntu-latest
    environment: ansible-validation
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: '3.13'
      - name: Install Ansible tooling
        run: python -m pip install --requirement requirements.txt
      - name: Create temporary Vault password file
        shell: bash
        env:
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
        run: |
          set -euo pipefail
          if [[ -z "$ANSIBLE_VAULT_PASSWORD" ]]; then
            echo "ANSIBLE_VAULT_PASSWORD is not configured for the ansible-validation environment." >&2
            exit 1
          fi
          umask 077
          printf '%s' "$ANSIBLE_VAULT_PASSWORD" > "$RUNNER_TEMP/ansible-vault-password"
      - name: Validate Vault decryption
        env:
          ANSIBLE_VAULT_PASSWORD_FILE: ${{ runner.temp }}/ansible-vault-password
        run: python scripts/validate_vault.py
      - name: Remove temporary Vault password file
        if: always()
        shell: bash
        run: rm -f "$RUNNER_TEMP/ansible-vault-password"