From b3f05c5f2d221a5a2d22b6abd0b2a655fc71653e Mon Sep 17 00:00:00 2001
From: Rasmus Wejlgaard <pez@pez.sh>
Date: Tue, 5 May 2026 21:10:49 +0100
Subject: [PATCH] ansible pr check

---
 .github/workflows/validate-ansible.yml | 80 ++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 .github/workflows/validate-ansible.yml

diff --git a/.github/workflows/validate-ansible.yml b/.github/workflows/validate-ansible.yml
new file mode 100644
index 0000000..11657ac
--- /dev/null
+++ b/.github/workflows/validate-ansible.yml
@@ -0,0 +1,80 @@
+name: Validate Ansible
+
+on:
+  pull_request:
+    paths:
+      - "ansible/**"
+      - ".github/workflows/validate-ansible.yml"
+
+# Requires these repository secrets:
+#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
+#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
+#   SSH_PRIVATE_KEY      — SSH key authorized on target hosts
+#   AGE_SECRET_KEY       — age private key for SOPS decryption
+
+jobs:
+  discover:
+    name: Discover hosts
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.discover.outputs.hosts }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Read hosts from inventory
+        id: discover
+        run: |
+          HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
+          echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"
+
+  check:
+    needs: discover
+    name: Check → ${{ matrix.host }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    strategy:
+      matrix:
+        host: ${{ fromJson(needs.discover.outputs.hosts) }}
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
+          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
+          tags: tag:ci
+
+      - name: Set up SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
+          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Install tools
+        run: |
+          pip install ansible
+          wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
+          sudo dpkg -i /tmp/sops.deb
+
+      - name: Install Ansible collections
+        run: ansible-galaxy install -r ansible/requirements.yml
+
+      - name: Decrypt secrets
+        env:
+          SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
+        run: |
+          find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
+            out="${f/.enc/}"
+            sops -d "$f" > "$out"
+          done
+
+      - name: Run playbook (check mode)
+        working-directory: ansible/
+        env:
+          ANSIBLE_HOST_KEY_CHECKING: "false"
+        run: ansible-playbook deploy.yml --limit "${{ matrix.host }}" --check --diff