start

.gitea/workflows/ansible-lint.yml

@@ -0,0 +1,73 @@
+name: Ansible - controle du code
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  controle:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Récupérer le dépôt
+        uses: actions/checkout@v4
+
+      - name: Installer les outils
+        run: |
+          set -euo pipefail
+          if ! command -v pip3 >/dev/null; then
+            apt-get update -qq
+            apt-get install -y -qq python3-pip
+          fi
+          pip3 install --quiet --break-system-packages ansible-core ansible-lint yamllint
+          ansible-galaxy collection install -r collections/requirements.yml -p collections
+          ansible --version | head -n 1
+
+      - name: Contrôler la mise en forme YAML
+        run: yamllint .
+
+      - name: Vérifier la syntaxe du playbook
+        run: |
+          set -euo pipefail
+          # vault.yml est chiffré : un fichier de substitution suffit au syntax-check.
+          [ -f group_vars/all/vault.yml ] || cp group_vars/all/vault.yml.example group_vars/all/vault.yml
+          ansible-playbook site.yml --syntax-check
+          ansible-playbook site.yml --list-tasks > /dev/null
+
+      - name: Passer ansible-lint
+        run: ansible-lint
+
+      - name: Vérifier que chaque compte SSH a au moins une clé
+        run: |
+          set -euo pipefail
+          manquants=0
+          for d in files/keys/*/; do
+            [ -d "$d" ] || continue
+            n=$(find "$d" -name '*.pub' | wc -l)
+            echo "$(basename "$d") : $n clé(s)"
+            [ "$n" -gt 0 ] || manquants=1
+          done
+          [ "$manquants" -eq 0 ] || { echo "Un répertoire de files/keys/ est vide"; exit 1; }
+
+  promouvoir:
+    # Semaphore suit la branche « valide » : elle n'avance que depuis « main », après contrôle réussi.
+    needs: controle
+    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Récupérer le dépôt
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITEA_TOKEN_PROMOTION }}
+
+      - name: Pousser main vers valide
+        run: |
+          set -euo pipefail
+          git config user.name "gitea-actions"
+          git config user.email "[email protected]"
+          git push origin HEAD:refs/heads/valide
+          echo "Branche valide -> $(git rev-parse --short HEAD)"

.gitea/workflows/ci.yml

@@ -1,36 +0,0 @@
-name: Run ansible
-on:
-  push:
-  schedule:
-    - cron: "0 */12 * * *"
-
-jobs:
-  run-ansible-playbook:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v4
-      - name: Install ansible
-        run: |
-          apt update && apt install ansible -y
-      - name: Run playbook
-        uses: dawidd6/action-ansible-playbook@v2
-        with:
-          playbook: playbooks/main.yml
-          requirements: requirements.yml
-          options: |
-            --inventory inventory
-      - name: Send failure notification
-        uses: dawidd6/action-send-mail@v3
-        if: always() && failure()
-        with:
-          server_address: smtp.gmail.com
-          server_port: 465
-          secure: true
-          username: myuser
-          password: ${{ secrets.MAIL_PASSWORD }}
-          subject: ansible runbook failed
-          to: [email protected]
-          from: RFD Notify
-          body: |
-            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}