Sergei Poljanski
ba2e3cbde8
Some checks failed
deploy.yaml / ci: name deploy runs "dry run" or "apply" (push) Failing after 0s
Every run was listed as "deploy", so dry runs on Renovate branches looked like deployments. Name each run after what it does and the branch it ran on. Assisted-by: Claude:opus-5-5
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
name: deploy
|
|
|
|
# main: dry run, then apply ansible/site.yaml to both servers
|
|
# other branches: dry run only
|
|
#
|
|
# Secrets: SSH_DEPLOY_KEY (user deploy on both servers) and
|
|
# ANSIBLE_VAULT_PASSWORD (decrypts inventory/group_vars/all/vault.yaml).
|
|
|
|
run-name: ${{ github.ref == 'refs/heads/main' && 'apply' || 'dry run' }}: ${{ github.ref_name }}
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'ansible/**'
|
|
- '.forgejo/workflows/deploy.yaml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
ansible:
|
|
runs-on: nix-latest
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
build-users-group =
|
|
sandbox = false
|
|
# Pinned so CI runs the same Ansible on every run
|
|
NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
|
|
ANSIBLE_HOST_KEY_CHECKING: "True"
|
|
ANSIBLE_FORCE_COLOR: "1"
|
|
steps:
|
|
- name: Prepare container for actions
|
|
run: nix-env -iA nixpkgs.nodejs_22
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up credentials
|
|
env:
|
|
SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
|
|
ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
|
run: |
|
|
if [ -z "$SSH_DEPLOY_KEY" ] || [ -z "$ANSIBLE_VAULT_PASSWORD" ]; then
|
|
echo "SSH_DEPLOY_KEY and ANSIBLE_VAULT_PASSWORD must be set as repository secrets" >&2
|
|
exit 1
|
|
fi
|
|
umask 077
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
cp ansible/known_hosts ~/.ssh/known_hosts
|
|
printf '%s\n' "$ANSIBLE_VAULT_PASSWORD" > ansible/.vault_pass
|
|
|
|
- name: Dry run
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml --check
|
|
|
|
- name: Apply
|
|
if: github.ref == 'refs/heads/main'
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml
|
|
|
|
- name: Remove credentials
|
|
if: always()
|
|
run: rm -f ~/.ssh/id_ed25519 ansible/.vault_pass
|