71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
name: Ansible - controle du code
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
controle:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Récupérer le dépôt
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Installer les outils
|
|
run: |
|
|
set -euo pipefail
|
|
if ! command -v pip3 >/dev/null; then
|
|
apt-get update -qq
|
|
apt-get install -y -qq python3-pip
|
|
fi
|
|
pip3 install --quiet --break-system-packages ansible-core ansible-lint yamllint
|
|
ansible-galaxy collection install -r collections/requirements.yml
|
|
ansible --version | head -n 1
|
|
|
|
- name: Contrôler la mise en forme YAML
|
|
run: yamllint .
|
|
|
|
- name: Vérifier la syntaxe du playbook
|
|
run: |
|
|
set -euo pipefail
|
|
# vault.yml est chiffré : un fichier de substitution suffit au syntax-check.
|
|
[ -f group_vars/all/vault.yml ] || cp group_vars/all/vault.yml.example group_vars/all/vault.yml
|
|
ansible-playbook site.yml --syntax-check
|
|
ansible-playbook site.yml --list-tasks > /dev/null
|
|
|
|
- name: Passer ansible-lint
|
|
run: ansible-lint
|
|
|
|
- name: Vérifier que les clés déclarées dans ssh_users existent
|
|
run: |
|
|
set -euo pipefail
|
|
manquants=0
|
|
for f in $(grep -oE 'keys: \[[^]]*\]' group_vars/all/main.yml | tr -d '[]' | sed 's/keys: //; s/,/ /g'); do
|
|
if [ -f "files/keys/$f" ]; then echo "files/keys/$f : ok"; else echo "files/keys/$f : ABSENT"; manquants=1; fi
|
|
done
|
|
[ "$manquants" -eq 0 ]
|
|
|
|
promouvoir:
|
|
# Semaphore suit la branche « valide » : elle n'avance que depuis « main », après contrôle réussi.
|
|
needs: controle
|
|
if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Récupérer le dépôt
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ secrets.TOKEN_PROMOTION }}
|
|
|
|
- name: Pousser main vers valide
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name "gitea-actions"
|
|
git config user.email "[email protected]"
|
|
git push origin HEAD:refs/heads/valide
|
|
echo "Branche valide -> $(git rev-parse --short HEAD)"
|