|
1 | 1 | --- |
2 | 2 |
|
3 | | - name: Devel pipeline |
4 | | - |
5 | | - on: # yamllint disable-line rule:truthy |
6 | | - pull_request_target: |
7 | | - types: [opened, reopened, synchronize] |
8 | | - branches: |
9 | | - - devel |
10 | | - paths: |
11 | | - - '**.yml' |
12 | | - - '**.sh' |
13 | | - - '**.j2' |
14 | | - - '**.ps1' |
15 | | - - '**.cfg' |
16 | | - |
17 | | - # A workflow run is made up of one or more jobs |
18 | | - # that can run sequentially or in parallel |
19 | | - jobs: |
20 | | - # This will create messages for first time contributers and direct them to the Discord server |
21 | | - welcome: |
22 | | - runs-on: ubuntu-latest |
23 | | - |
24 | | - steps: |
25 | | - - uses: actions/first-interaction@main |
26 | | - with: |
27 | | - repo-token: ${{ secrets.GITHUB_TOKEN }} |
28 | | - pr-message: |- |
29 | | - Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! |
30 | | - Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well. |
31 | | -
|
32 | | - # This workflow contains a single job that tests the playbook |
33 | | - playbook-test: |
34 | | - # The type of runner that the job will run on |
35 | | - runs-on: ubuntu-latest |
36 | | - env: |
37 | | - ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }} |
38 | | - # Imported as a variable by terraform |
39 | | - TF_VAR_repository: ${{ github.event.repository.name }} |
40 | | - defaults: |
41 | | - run: |
42 | | - shell: bash |
43 | | - working-directory: .github/workflows/github_linux_IaC |
44 | | - |
45 | | - steps: |
46 | | - - name: Clone ${{ github.event.repository.name }} |
47 | | - uses: actions/checkout@v4 |
| 3 | + name: Devel pipeline |
| 4 | + |
| 5 | + on: # yamllint disable-line rule:truthy |
| 6 | + pull_request_target: |
| 7 | + types: [opened, reopened, synchronize] |
| 8 | + branches: |
| 9 | + - devel |
| 10 | + paths: |
| 11 | + - '**.yml' |
| 12 | + - '**.sh' |
| 13 | + - '**.j2' |
| 14 | + - '**.ps1' |
| 15 | + - '**.cfg' |
| 16 | + # Allow manual running of workflow |
| 17 | + workflow_dispatch: |
| 18 | + |
| 19 | + # Allow permissions for AWS auth |
| 20 | + permissions: |
| 21 | + id-token: write |
| 22 | + contents: read |
| 23 | + pull-requests: read |
| 24 | + |
| 25 | + # A workflow run is made up of one or more jobs |
| 26 | + # that can run sequentially or in parallel |
| 27 | + jobs: |
| 28 | + # This will create messages for first time contributers and direct them to the Discord server |
| 29 | + welcome: |
| 30 | + runs-on: self-hosted |
| 31 | + |
| 32 | + steps: |
| 33 | + - uses: actions/first-interaction@main |
48 | 34 | with: |
49 | | - ref: ${{ github.event.pull_request.head.sha }} |
50 | | - |
51 | | - # Pull in terraform code for linux servers |
52 | | - - name: Clone GitHub IaC plan |
53 | | - uses: actions/checkout@v4 |
54 | | - with: |
55 | | - repository: ansible-lockdown/github_linux_IaC |
56 | | - path: .github/workflows/github_linux_IaC |
57 | | - |
58 | | - - name: Add_ssh_key |
59 | | - working-directory: .github/workflows |
60 | | - env: |
61 | | - SSH_AUTH_SOCK: /tmp/ssh_agent.sock |
62 | | - PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}" |
63 | | - run: | |
64 | | - mkdir .ssh |
65 | | - chmod 700 .ssh |
66 | | - echo $PRIVATE_KEY > .ssh/github_actions.pem |
67 | | - chmod 600 .ssh/github_actions.pem |
68 | | -
|
69 | | - - name: DEBUG - Show IaC files |
70 | | - if: env.ENABLE_DEBUG == 'true' |
71 | | - run: | |
72 | | - echo "OSVAR = $OSVAR" |
73 | | - echo "benchmark_type = $benchmark_type" |
74 | | - pwd |
75 | | - ls |
76 | | - env: |
77 | | - # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
78 | | - OSVAR: ${{ vars.OSVAR }} |
79 | | - benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
80 | | - |
81 | | - - name: Terraform_Init |
82 | | - id: init |
83 | | - run: terraform init |
84 | | - env: |
85 | | - # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
86 | | - OSVAR: ${{ vars.OSVAR }} |
87 | | - TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
88 | | - |
89 | | - - name: Terraform_Validate |
90 | | - id: validate |
91 | | - run: terraform validate |
92 | | - env: |
93 | | - # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
94 | | - OSVAR: ${{ vars.OSVAR }} |
95 | | - TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
96 | | - |
97 | | - - name: Terraform_Apply |
98 | | - id: apply |
99 | | - env: |
100 | | - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} |
101 | | - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |
102 | | - OSVAR: ${{ vars.OSVAR }} |
103 | | - TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
104 | | - run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false |
105 | | - |
106 | | - ## Debug Section |
107 | | - - name: DEBUG - Show Ansible hostfile |
108 | | - if: env.ENABLE_DEBUG == 'true' |
109 | | - run: cat hosts.yml |
110 | | - |
111 | | - # Aws deployments taking a while to come up insert sleep or playbook fails |
112 | | - |
113 | | - - name: Sleep for 60 seconds |
114 | | - run: sleep ${{ vars.BUILD_SLEEPTIME }} |
115 | | - |
116 | | - # Run the Ansible playbook |
117 | | - - name: Run_Ansible_Playbook |
118 | | - uses: arillso/action.playbook@master |
119 | | - with: |
120 | | - playbook: site.yml |
121 | | - inventory: .github/workflows/github_linux_IaC/hosts.yml |
122 | | - galaxy_file: collections/requirements.yml |
123 | | - private_key: ${{ secrets.SSH_PRV_KEY }} |
124 | | - # verbose: 3 |
125 | | - env: |
126 | | - ANSIBLE_HOST_KEY_CHECKING: "false" |
127 | | - ANSIBLE_DEPRECATION_WARNINGS: "false" |
128 | | - |
129 | | - # Remove test system - User secrets to keep if necessary |
130 | | - |
131 | | - - name: Terraform_Destroy |
132 | | - if: always() && env.ENABLE_DEBUG == 'false' |
133 | | - env: |
134 | | - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} |
135 | | - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |
136 | | - OSVAR: ${{ vars.OSVAR }} |
137 | | - TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
138 | | - run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false |
| 35 | + repo-token: ${{ secrets.GITHUB_TOKEN }} |
| 36 | + pr-message: |- |
| 37 | + Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! |
| 38 | + Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well. |
| 39 | +
|
| 40 | + # This workflow contains a single job that tests the playbook |
| 41 | + playbook-test: |
| 42 | + # The type of runner that the job will run on |
| 43 | + runs-on: self-hosted |
| 44 | + env: |
| 45 | + ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }} |
| 46 | + # Imported as a variable by terraform |
| 47 | + TF_VAR_repository: ${{ github.event.repository.name }} |
| 48 | + AWS_REGION: "us-east-1" |
| 49 | + ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }} |
| 50 | + defaults: |
| 51 | + run: |
| 52 | + shell: bash |
| 53 | + working-directory: .github/workflows/github_linux_IaC |
| 54 | + # working-directory: .github/workflows |
| 55 | + |
| 56 | + steps: |
| 57 | + |
| 58 | + - name: Git clone the lockdown repository to test |
| 59 | + uses: actions/checkout@v4 |
| 60 | + with: |
| 61 | + ref: ${{ github.event.pull_request.head.sha }} |
| 62 | + |
| 63 | + - name: If a variable for IAC_BRANCH is set use that branch |
| 64 | + working-directory: .github/workflows |
| 65 | + run: | |
| 66 | + if [ ${{ vars.IAC_BRANCH }} != '' ]; then |
| 67 | + echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV |
| 68 | + echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}" |
| 69 | + else |
| 70 | + echo IAC_BRANCH=main >> $GITHUB_ENV |
| 71 | + fi |
| 72 | +
|
| 73 | +
|
| 74 | + # Pull in terraform code for linux servers |
| 75 | + - name: Clone GitHub IaC plan |
| 76 | + uses: actions/checkout@v4 |
| 77 | + with: |
| 78 | + repository: ansible-lockdown/github_linux_IaC |
| 79 | + path: .github/workflows/github_linux_IaC |
| 80 | + ref: ${{ env.IAC_BRANCH }} |
| 81 | + |
| 82 | + # Uses dedicated restricted role and policy to enable this only for this task |
| 83 | + # No credentials are part of github for AWS auth |
| 84 | + - name: configure aws credentials |
| 85 | + uses: aws-actions/configure-aws-credentials@main |
| 86 | + with: |
| 87 | + role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }} |
| 88 | + role-session-name: ${{ secrets.AWS_ROLE_SESSION }} |
| 89 | + aws-region: ${{ env.AWS_REGION }} |
| 90 | + |
| 91 | + - name: DEBUG - Show IaC files |
| 92 | + if: env.ENABLE_DEBUG == 'true' |
| 93 | + run: | |
| 94 | + echo "OSVAR = $OSVAR" |
| 95 | + echo "benchmark_type = $benchmark_type" |
| 96 | + echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID" |
| 97 | + echo "VPC_ID" = $AWS_VPC_SECGRP_ID" |
| 98 | + pwd |
| 99 | + ls |
| 100 | + env: |
| 101 | + # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
| 102 | + OSVAR: ${{ vars.OSVAR }} |
| 103 | + benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
| 104 | + PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }} |
| 105 | + VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }} |
| 106 | + |
| 107 | + - name: Tofu init |
| 108 | + id: init |
| 109 | + run: tofu init |
| 110 | + env: |
| 111 | + # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
| 112 | + OSVAR: ${{ vars.OSVAR }} |
| 113 | + TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
| 114 | + |
| 115 | + - name: Tofu validate |
| 116 | + id: validate |
| 117 | + run: tofu validate |
| 118 | + env: |
| 119 | + # Imported from GitHub variables this is used to load the relevant OS.tfvars file |
| 120 | + OSVAR: ${{ vars.OSVAR }} |
| 121 | + TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
| 122 | + |
| 123 | + - name: Tofu apply |
| 124 | + id: apply |
| 125 | + env: |
| 126 | + OSVAR: ${{ vars.OSVAR }} |
| 127 | + TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
| 128 | + TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} |
| 129 | + TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} |
| 130 | + run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false |
| 131 | + |
| 132 | +## Debug Section |
| 133 | + - name: DEBUG - Show Ansible hostfile |
| 134 | + if: env.ENABLE_DEBUG == 'true' |
| 135 | + run: cat hosts.yml |
| 136 | + |
| 137 | + # Aws deployments taking a while to come up insert sleep or playbook fails |
| 138 | + |
| 139 | + - name: Sleep to allow system to come up |
| 140 | + run: sleep ${{ vars.BUILD_SLEEPTIME }} |
| 141 | + |
| 142 | + # Run the Ansible playbook |
| 143 | + - name: Run_Ansible_Playbook |
| 144 | + env: |
| 145 | + ANSIBLE_HOST_KEY_CHECKING: "false" |
| 146 | + ANSIBLE_DEPRECATION_WARNINGS: "false" |
| 147 | + run: | |
| 148 | + /opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml |
| 149 | +
|
| 150 | + # Remove test system - User secrets to keep if necessary |
| 151 | + |
| 152 | + - name: Tofu Destroy |
| 153 | + if: always() && env.ENABLE_DEBUG == 'false' |
| 154 | + env: |
| 155 | + OSVAR: ${{ vars.OSVAR }} |
| 156 | + TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} |
| 157 | + TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} |
| 158 | + TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} |
| 159 | + run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false |
![pre-commit-ci[bot]](https://avatars.githubusercontent.com/in/68672?v=4&size=40){kind=avatar}
0 commit comments