Repository navigation
Add AC-3 retest evidence (#32) #73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: validate | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| # Read-only rendering only: satisfies the state-encryption config and | |
| # its >=16-char validation. No state is created or read in CI. | |
| TF_VAR_state_passphrase: ci-dummy-passphrase-render-only | |
| # The same path tofu.env sets locally, so scripts/install-collections.sh | |
| # and every ansible command after it agree on one location. github is | |
| # available in a job env: block; runner is not - naming runner.temp in | |
| # an expression here makes the whole workflow file invalid, and no | |
| # pull_request run is created at all. | |
| ANSIBLE_COLLECTIONS_PATH: ${{ github.workspace }}/.venv/share/ansible/collections | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: opentofu/setup-opentofu@v1 | |
| # Exact tag: setup-uv stopped publishing moving major aliases after | |
| # v8, so @v10 does not resolve. | |
| - uses: astral-sh/setup-uv@v10.0.1 | |
| - name: Install validation dependencies | |
| run: | | |
| # The same environment README.md tells an operator to build, from the | |
| # same pinned file: requirements.txt is a uv pip freeze, so CI and a | |
| # workstation run identical versions on identical Python. That | |
| # matters because requirements.txt pins ansible-core, which ships no | |
| # collections - both sides get theirs from ansible/requirements.yml | |
| # via the script below, and an unpinned community.* module therefore | |
| # fails in both places rather than only here. | |
| uv venv --python 3.14 --managed-python | |
| uv pip install -r requirements.txt | |
| # PATH, not activate: the venv has to outlive this step, and each | |
| # step is its own shell. This also puts it ahead of the runner | |
| # image's own preinstalled ansible. | |
| echo "$PWD/.venv/bin" >>"$GITHUB_PATH" | |
| ./scripts/install-collections.sh | |
| - name: copy examples | |
| run: | | |
| cp .sops.yaml.example .sops.yaml | |
| cp guards.tofu.example guards.tofu | |
| cp variables.tofu.example variables.tofu | |
| cp inventory-example.yaml inventory/example.yaml | |
| - name: tofu init and validate | |
| run: | | |
| tofu init -input=false | |
| tofu validate | |
| # check-ansible.sh needs an applied tofu state (it inspects the live | |
| # dynamic inventory), so CI runs only its state-independent parts. | |
| - name: ansible syntax check | |
| run: ansible-playbook ansible/site.yaml --syntax-check -i localhost, | |
| - name: ansible-lint | |
| working-directory: ansible | |
| run: ansible-lint |