mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-05-06 04:14:43 +00:00
Rasmus Wejlgaard
98f8d42343
Both deploy-on-merge.yml and deploy.yml install ansible via pip but never install the required Galaxy collections (community.docker, community.general, ansible.posix) from ansible/requirements.yml. This works by accident because the pip ansible package bundles some collections, but it's fragile — a pip upgrade or runner image change could break deploys silently. Fixes PESO-110
59 lines
1.8 KiB
YAML
59 lines
1.8 KiB
YAML
name: Deploy (on merge)
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths-ignore:
|
|
- 'terraform/**'
|
|
|
|
# Requires these repository secrets:
|
|
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
|
|
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
|
|
# AGE_SECRET_KEY — age private key for SOPS decryption
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy to all
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Tailscale
|
|
uses: tailscale/github-action@v3
|
|
with:
|
|
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
|
|
|
- name: Set up SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
- name: Install tools
|
|
run: |
|
|
pip install ansible
|
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
|
sudo dpkg -i /tmp/sops.deb
|
|
|
|
- name: Install Ansible collections
|
|
run: ansible-galaxy install -r ansible/requirements.yml
|
|
|
|
- name: Decrypt secrets
|
|
env:
|
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
|
run: |
|
|
# Decrypt all .enc. files to their plaintext counterparts
|
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
|
out="${f/.enc/}"
|
|
sops -d "$f" > "$out"
|
|
echo "Decrypted: $f -> $out"
|
|
done
|
|
|
|
- name: Run playbook
|
|
working-directory: ansible/
|
|
env:
|
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
|
run: ansible-playbook deploy.yml
|