Skip to content

Commit b6df58d

Browse files
uk-bollyuk-bolly
authored
Merge pull request #499 from ansible-lockdown/devel
v3r15 - devel to main - Final Release
2 parents 3de8836 + a3d78cf commit b6df58d

File tree

13 files changed

+591
-580
lines changed

13 files changed

+591
-580
lines changed

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 133 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,16 @@
44

55
on: # yamllint disable-line rule:truthy
66
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
paths:
11-
- '**.yml'
12-
- '**.sh'
13-
- '**.j2'
14-
- '**.ps1'
15-
- '**.cfg'
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
- benchmark*
11+
paths:
12+
- '**.yml'
13+
- '**.sh'
14+
- '**.j2'
15+
- '**.ps1'
16+
- '**.cfg'
1617
# Allow manual running of workflow
1718
workflow_dispatch:
1819

@@ -26,133 +27,128 @@
2627
# that can run sequentially or in parallel
2728
jobs:
2829
# This will create messages for first time contributers and direct them to the Discord server
29-
welcome:
30-
runs-on: ubuntu-latest
31-
32-
steps:
33-
- uses: actions/first-interaction@main
34-
with:
35-
repo-token: ${{ secrets.GITHUB_TOKEN }}
36-
pr-message: |-
37-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
38-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
39-
40-
# This workflow contains a single job that tests the playbook
41-
playbook-test:
42-
# The type of runner that the job will run on
43-
runs-on: self-hosted
44-
env:
45-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
46-
# Imported as a variable by terraform
47-
TF_VAR_repository: ${{ github.event.repository.name }}
48-
AWS_REGION: "us-east-1"
49-
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
50-
defaults:
51-
run:
52-
shell: bash
53-
working-directory: .github/workflows/github_linux_IaC
54-
# working-directory: .github/workflows
55-
56-
steps:
57-
58-
- name: Git clone the lockdown repository to test
59-
uses: actions/checkout@v4
60-
with:
61-
ref: ${{ github.event.pull_request.head.sha }}
62-
63-
- name: If a variable for IAC_BRANCH is set use that branch
64-
working-directory: .github/workflows
65-
run: |
66-
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
67-
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
68-
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
69-
else
70-
echo IAC_BRANCH=main >> $GITHUB_ENV
71-
fi
72-
73-
# Pull in terraform code for linux servers
74-
- name: Clone GitHub IaC plan
75-
uses: actions/checkout@v4
76-
with:
77-
repository: ansible-lockdown/github_linux_IaC
78-
path: .github/workflows/github_linux_IaC
79-
ref: ${{ env.IAC_BRANCH }}
80-
81-
# Uses dedicated restricted role and policy to enable this only for this task
82-
# No credentials are part of github for AWS auth
83-
- name: configure aws credentials
84-
uses: aws-actions/configure-aws-credentials@main
85-
with:
86-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
87-
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
88-
aws-region: ${{ env.AWS_REGION }}
89-
90-
- name: DEBUG - Show IaC files
91-
if: env.ENABLE_DEBUG == 'true'
92-
run: |
93-
echo "OSVAR = $OSVAR"
94-
echo "benchmark_type = $benchmark_type"
95-
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
96-
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
97-
pwd
98-
ls
99-
env:
100-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
101-
OSVAR: ${{ vars.OSVAR }}
102-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
103-
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
104-
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
105-
106-
- name: Tofu init
107-
id: init
108-
run: tofu init
109-
env:
110-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
111-
OSVAR: ${{ vars.OSVAR }}
112-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
113-
114-
- name: Tofu validate
115-
id: validate
116-
run: tofu validate
117-
env:
118-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
119-
OSVAR: ${{ vars.OSVAR }}
120-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
121-
122-
- name: Tofu apply
123-
id: apply
124-
env:
125-
OSVAR: ${{ vars.OSVAR }}
126-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
127-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
128-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
129-
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
30+
welcome:
31+
runs-on: ubuntu-latest
32+
33+
steps:
34+
- uses: actions/first-interaction@main
35+
with:
36+
repo-token: ${{ secrets.GITHUB_TOKEN }}
37+
pr-message: |-
38+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
39+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
40+
41+
# This workflow contains a single job that tests the playbook
42+
playbook-test:
43+
# The type of runner that the job will run on
44+
runs-on: self-hosted
45+
env:
46+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
47+
# Imported as a variable by terraform
48+
TF_VAR_repository: ${{ github.event.repository.name }}
49+
AWS_REGION: "us-east-1"
50+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
51+
defaults:
52+
run:
53+
shell: bash
54+
working-directory: .github/workflows/github_linux_IaC
55+
# working-directory: .github/workflows
56+
57+
steps:
58+
59+
- name: Git clone the lockdown repository to test
60+
uses: actions/checkout@v4
61+
with:
62+
ref: ${{ github.event.pull_request.head.sha }}
63+
64+
- name: If a variable for IAC_BRANCH is set use that branch
65+
working-directory: .github/workflows
66+
run: |
67+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
68+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
69+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
70+
else
71+
echo IAC_BRANCH=main >> $GITHUB_ENV
72+
fi
73+
74+
# Pull in terraform code for linux servers
75+
- name: Clone GitHub IaC plan
76+
uses: actions/checkout@v4
77+
with:
78+
repository: ansible-lockdown/github_linux_IaC
79+
path: .github/workflows/github_linux_IaC
80+
ref: ${{ env.IAC_BRANCH }}
81+
82+
# Uses dedicated restricted role and policy to enable this only for this task
83+
# No credentials are part of github for AWS auth
84+
- name: configure aws credentials
85+
uses: aws-actions/configure-aws-credentials@main
86+
with:
87+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
88+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
89+
aws-region: ${{ env.AWS_REGION }}
90+
91+
- name: DEBUG - Show IaC files
92+
if: env.ENABLE_DEBUG == 'true'
93+
run: |
94+
echo "OSVAR = $OSVAR"
95+
echo "benchmark_type = $benchmark_type"
96+
pwd
97+
env:
98+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
99+
OSVAR: ${{ vars.OSVAR }}
100+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
101+
102+
- name: Tofu init
103+
id: init
104+
run: tofu init
105+
env:
106+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
107+
OSVAR: ${{ vars.OSVAR }}
108+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
109+
110+
- name: Tofu validate
111+
id: validate
112+
run: tofu validate
113+
env:
114+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
115+
OSVAR: ${{ vars.OSVAR }}
116+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
117+
118+
- name: Tofu apply
119+
id: apply
120+
env:
121+
OSVAR: ${{ vars.OSVAR }}
122+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
123+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
124+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
125+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
130126

131127
## Debug Section
132-
- name: DEBUG - Show Ansible hostfile
133-
if: env.ENABLE_DEBUG == 'true'
134-
run: cat hosts.yml
135-
136-
# Aws deployments taking a while to come up insert sleep or playbook fails
137-
138-
- name: Sleep to allow system to come up
139-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
140-
141-
# Run the Ansible playbook
142-
- name: Run_Ansible_Playbook
143-
env:
144-
ANSIBLE_HOST_KEY_CHECKING: "false"
145-
ANSIBLE_DEPRECATION_WARNINGS: "false"
146-
run: |
147-
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
148-
149-
# Remove test system - User secrets to keep if necessary
150-
151-
- name: Tofu Destroy
152-
if: always() && env.ENABLE_DEBUG == 'false'
153-
env:
154-
OSVAR: ${{ vars.OSVAR }}
155-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
156-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
157-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
158-
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
128+
- name: DEBUG - Show Ansible hostfile
129+
if: env.ENABLE_DEBUG == 'true'
130+
run: cat hosts.yml
131+
132+
# Aws deployments taking a while to come up insert sleep or playbook fails
133+
134+
- name: Sleep to allow system to come up
135+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
136+
137+
# Run the Ansible playbook
138+
- name: Run_Ansible_Playbook
139+
env:
140+
ANSIBLE_HOST_KEY_CHECKING: "false"
141+
ANSIBLE_DEPRECATION_WARNINGS: "false"
142+
run: |
143+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
144+
145+
# Remove test system - User secrets to keep if necessary
146+
147+
- name: Tofu Destroy
148+
if: always() && env.ENABLE_DEBUG == 'false'
149+
env:
150+
OSVAR: ${{ vars.OSVAR }}
151+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
152+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
153+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
154+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)