Skip to content

Commit 6d24677

Browse files
frederickw082922frederickw082922
authored
Merge pull request #186 from ansible-lockdown/devel
Release to main
2 parents 99aabb8 + 758db38 commit 6d24677

File tree

7 files changed

+272
-283
lines changed

7 files changed

+272
-283
lines changed

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 136 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44

55
on: # yamllint disable-line rule:truthy
66
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
- benchmark*
11-
paths:
12-
- '**.yml'
13-
- '**.sh'
14-
- '**.j2'
15-
- '**.ps1'
16-
- '**.cfg'
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
- benchmark*
11+
paths:
12+
- '**.yml'
13+
- '**.sh'
14+
- '**.j2'
15+
- '**.ps1'
16+
- '**.cfg'
1717
# Allow manual running of workflow
1818
workflow_dispatch:
1919

@@ -27,133 +27,131 @@
2727
# that can run sequentially or in parallel
2828
jobs:
2929
# This will create messages for first time contributers and direct them to the Discord server
30-
welcome:
31-
runs-on: ubuntu-latest
32-
33-
steps:
34-
- uses: actions/first-interaction@main
35-
with:
36-
repo-token: ${{ secrets.GITHUB_TOKEN }}
37-
pr-message: |-
38-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
39-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
40-
41-
# This workflow contains a single job that tests the playbook
42-
playbook-test:
43-
# The type of runner that the job will run on
44-
runs-on: self-hosted
45-
env:
46-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
47-
# Imported as a variable by terraform
48-
TF_VAR_repository: ${{ github.event.repository.name }}
49-
AWS_REGION: "us-east-1"
50-
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
51-
defaults:
52-
run:
53-
shell: bash
54-
working-directory: .github/workflows/github_linux_IaC
55-
# working-directory: .github/workflows
56-
57-
steps:
58-
59-
- name: Git clone the lockdown repository to test
60-
uses: actions/checkout@v4
61-
with:
62-
ref: ${{ github.event.pull_request.head.sha }}
63-
64-
- name: If a variable for IAC_BRANCH is set use that branch
65-
working-directory: .github/workflows
66-
run: |
67-
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
68-
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
69-
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
70-
else
71-
echo IAC_BRANCH=main >> $GITHUB_ENV
72-
fi
73-
74-
# Pull in terraform code for linux servers
75-
- name: Clone GitHub IaC plan
76-
uses: actions/checkout@v4
77-
with:
78-
repository: ansible-lockdown/github_linux_IaC
79-
path: .github/workflows/github_linux_IaC
80-
ref: ${{ env.IAC_BRANCH }}
81-
82-
# Uses dedicated restricted role and policy to enable this only for this task
83-
# No credentials are part of github for AWS auth
84-
- name: configure aws credentials
85-
uses: aws-actions/configure-aws-credentials@main
86-
with:
87-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
88-
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
89-
aws-region: ${{ env.AWS_REGION }}
90-
91-
- name: DEBUG - Show IaC files
92-
if: env.ENABLE_DEBUG == 'true'
93-
run: |
94-
echo "OSVAR = $OSVAR"
95-
echo "benchmark_type = $benchmark_type"
96-
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
97-
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
98-
pwd
99-
ls
100-
env:
101-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
102-
OSVAR: ${{ vars.OSVAR }}
103-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104-
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
105-
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
106-
107-
- name: Tofu init
108-
id: init
109-
run: tofu init
110-
env:
111-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
112-
OSVAR: ${{ vars.OSVAR }}
113-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
114-
115-
- name: Tofu validate
116-
id: validate
117-
run: tofu validate
118-
env:
119-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
120-
OSVAR: ${{ vars.OSVAR }}
121-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
122-
123-
- name: Tofu apply
124-
id: apply
125-
env:
126-
OSVAR: ${{ vars.OSVAR }}
127-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
128-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
129-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
130-
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
30+
welcome:
31+
runs-on: ubuntu-latest
32+
33+
steps:
34+
- uses: actions/first-interaction@main
35+
with:
36+
repo_token: ${{ secrets.GITHUB_TOKEN }}
37+
issue_message: |-
38+
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
39+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
40+
pr_message: |-
41+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
42+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
43+
44+
# This workflow contains a single job that tests the playbook
45+
playbook-test:
46+
# The type of runner that the job will run on
47+
runs-on: self-hosted
48+
env:
49+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
50+
# Imported as a variable by terraform
51+
TF_VAR_repository: ${{ github.event.repository.name }}
52+
AWS_REGION: "us-east-1"
53+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
54+
defaults:
55+
run:
56+
shell: bash
57+
working-directory: .github/workflows/github_linux_IaC
58+
# working-directory: .github/workflows
59+
60+
steps:
61+
62+
- name: Git clone the lockdown repository to test
63+
uses: actions/checkout@v4
64+
with:
65+
ref: ${{ github.event.pull_request.head.sha }}
66+
67+
- name: If a variable for IAC_BRANCH is set use that branch
68+
working-directory: .github/workflows
69+
run: |
70+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
71+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
72+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
73+
else
74+
echo IAC_BRANCH=main >> $GITHUB_ENV
75+
fi
76+
77+
# Pull in terraform code for linux servers
78+
- name: Clone GitHub IaC plan
79+
uses: actions/checkout@v4
80+
with:
81+
repository: ansible-lockdown/github_linux_IaC
82+
path: .github/workflows/github_linux_IaC
83+
ref: ${{ env.IAC_BRANCH }}
84+
85+
# Uses dedicated restricted role and policy to enable this only for this task
86+
# No credentials are part of github for AWS auth
87+
- name: configure aws credentials
88+
uses: aws-actions/configure-aws-credentials@main
89+
with:
90+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
91+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
92+
aws-region: ${{ env.AWS_REGION }}
93+
94+
- name: DEBUG - Show IaC files
95+
if: env.ENABLE_DEBUG == 'true'
96+
run: |
97+
echo "OSVAR = $OSVAR"
98+
echo "benchmark_type = $benchmark_type"
99+
pwd
100+
env:
101+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
102+
OSVAR: ${{ vars.OSVAR }}
103+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104+
105+
- name: Tofu init
106+
id: init
107+
run: tofu init
108+
env:
109+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
110+
OSVAR: ${{ vars.OSVAR }}
111+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
112+
113+
- name: Tofu validate
114+
id: validate
115+
run: tofu validate
116+
env:
117+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
118+
OSVAR: ${{ vars.OSVAR }}
119+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
120+
121+
- name: Tofu apply
122+
id: apply
123+
env:
124+
OSVAR: ${{ vars.OSVAR }}
125+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
126+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
127+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
128+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
131129

132130
## Debug Section
133-
- name: DEBUG - Show Ansible hostfile
134-
if: env.ENABLE_DEBUG == 'true'
135-
run: cat hosts.yml
136-
137-
# Aws deployments taking a while to come up insert sleep or playbook fails
138-
139-
- name: Sleep to allow system to come up
140-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
141-
142-
# Run the Ansible playbook
143-
- name: Run_Ansible_Playbook
144-
env:
145-
ANSIBLE_HOST_KEY_CHECKING: "false"
146-
ANSIBLE_DEPRECATION_WARNINGS: "false"
147-
run: |
148-
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
149-
150-
# Remove test system - User secrets to keep if necessary
151-
152-
- name: Tofu Destroy
153-
if: always() && env.ENABLE_DEBUG == 'false'
154-
env:
155-
OSVAR: ${{ vars.OSVAR }}
156-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
157-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
158-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
159-
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
131+
- name: DEBUG - Show Ansible hostfile
132+
if: env.ENABLE_DEBUG == 'true'
133+
run: cat hosts.yml
134+
135+
# Aws deployments taking a while to come up insert sleep or playbook fails
136+
137+
- name: Sleep to allow system to come up
138+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
139+
140+
# Run the Ansible playbook
141+
- name: Run_Ansible_Playbook
142+
env:
143+
ANSIBLE_HOST_KEY_CHECKING: "false"
144+
ANSIBLE_DEPRECATION_WARNINGS: "false"
145+
run: |
146+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
147+
148+
# Remove test system - User secrets to keep if necessary
149+
150+
- name: Tofu Destroy
151+
if: always() && env.ENABLE_DEBUG == 'false'
152+
env:
153+
OSVAR: ${{ vars.OSVAR }}
154+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
155+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
156+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
157+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)