From 081700abee29dce4defdffb1453f51f89af0d17b Mon Sep 17 00:00:00 2001
From: Sam <samueljamesinc@gmail.com>
Date: Wed, 26 Aug 2026 12:16:01 -0400
Subject: [PATCH] test-connection v3: resolve creds via set_fact (no
 undefined-var abort)

---
 playbooks/test-connection.yml | 39 +++++++++++++++++------------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/playbooks/test-connection.yml b/playbooks/test-connection.yml
index 4a41c17..4af006f 100644
--- a/playbooks/test-connection.yml
+++ b/playbooks/test-connection.yml
@@ -1,23 +1,16 @@
 ---
 # ============================================================================
-# test-connection.yml — diagnostic (no host changes). Confirms repo pull +
-# Infisical auth. Reads Infisical creds from EITHER env vars OR ansible vars,
-# so it works regardless of which Semaphore Variable-Group section they're in.
+# test-connection.yml — diagnostic (no host changes).
+# Confirms repo pull + Infisical auth. Resolves Infisical creds safely from
+# env vars OR ansible vars (via the `vars` dict) without erroring on undefined.
 # ============================================================================
 
 - name: "Semaphore diagnostics — repo + Infisical"
   hosts: localhost
   gather_facts: false
-  vars:
-    # Accept creds from env var OR extra/ansible var (whichever Semaphore provides)
-    infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(INFISICAL_CLIENT_ID | default(''), true) }}"
-    infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(INFISICAL_CLIENT_SECRET | default(''), true) }}"
-    infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(INFISICAL_PROJECT_ID | default(''), true) }}"
-    infisical_url: "{{ lookup('env','INFISICAL_URL') | default(INFISICAL_URL | default('http://192.168.122.41:8080'), true) }}"
-    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(INFISICAL_ENV_SLUG | default('dev'), true) }}"
 
   tasks:
-    - name: "[repo] Locate + list repo files"
+    - name: "[repo] List repo files"
       ansible.builtin.find:
         paths: "{{ playbook_dir | dirname }}"
         excludes: ".git"
@@ -26,25 +19,31 @@
 
     - name: "[repo] Repo pulled OK"
       ansible.builtin.debug:
-        msg: "Repo at {{ playbook_dir | dirname }} — files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
+        msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
 
-    # DIAGNOSTIC: show what channels actually carried the value (lengths only, no secrets)
-    - name: "[diag] Which channel carried INFISICAL_CLIENT_ID?"
+    # Resolve creds: prefer env var, else look in the vars dict (extra-vars), else ''
+    - name: "[resolve] Gather Infisical creds from env or vars (no undefined errors)"
+      ansible.builtin.set_fact:
+        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') or (vars['INFISICAL_CLIENT_ID'] | default('')) }}"
+        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') or (vars['INFISICAL_CLIENT_SECRET'] | default('')) }}"
+        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') or (vars['INFISICAL_PROJECT_ID'] | default('')) }}"
+        infisical_url: "{{ lookup('env','INFISICAL_URL') or (vars['INFISICAL_URL'] | default('http://192.168.122.41:8080')) }}"
+        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') or (vars['INFISICAL_ENV_SLUG'] | default('dev')) }}"
+
+    - name: "[diag] Which channel carried the client id? (lengths only)"
       ansible.builtin.debug:
         msg:
           - "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
-          - "ansible var defined: {{ INFISICAL_CLIENT_ID is defined }}"
+          - "vars-dict has key: {{ 'INFISICAL_CLIENT_ID' in vars }}"
           - "resolved id length: {{ infisical_client_id | length }}"
 
-    - name: "[infisical] Auth vars present (via env or var)?"
+    - name: "[infisical] Assert creds resolved"
       ansible.builtin.assert:
         that:
           - infisical_client_id | length > 0
           - infisical_client_secret | length > 0
           - infisical_project_id | length > 0
-        fail_msg: >-
-          Infisical creds not reaching the playbook via EITHER env vars or ansible vars.
-          Check the Variable Group values are non-empty and the group is attached.
+        fail_msg: "Infisical creds not reaching playbook via env OR vars. See [diag] above."
 
     - name: "[infisical] Log in"
       infisical.vault.login:
@@ -69,4 +68,4 @@
 
     - name: "[result] ALL CHECKS PASSED"
       ansible.builtin.debug:
-        msg: "SSH repo pull ✓ | Infisical auth + read ✓ — pipeline ready."
+        msg: "SSH repo pull OK | Infisical auth + read OK — pipeline ready."