sam/semaphore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test-connection v4: clean vars lookup, suppress deprecation noise

Browse Source
This commit is contained in:
Samuel James 2026-08-26 12:21:17 -04:00
parent 081700abee
commit bdd915dcfd
2 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ansible.cfg
View File

@ -7,6 +7,7 @@ retry_files_enabled = False
stdout_callback = default stdout_callback = default
result_format = yaml result_format = yaml
interpreter_python = auto_silent interpreter_python = auto_silent
deprecation_warnings = False
[ssh_connection] [ssh_connection]
pipelining = True pipelining = True

33
playbooks/test-connection.yml
View File

@ -1,8 +1,7 @@
--- ---
# ============================================================================ # ============================================================================
# test-connection.yml — diagnostic (no host changes). # test-connection.yml — diagnostic (no host changes). Repo pull + Infisical.
# Confirms repo pull + Infisical auth. Resolves Infisical creds safely from # Reads Infisical creds from env vars first, then falls back to extra-vars.
# env vars OR ansible vars (via the `vars` dict) without erroring on undefined.
# ============================================================================ # ============================================================================
- name: "Semaphore diagnostics — repo + Infisical" - name: "Semaphore diagnostics — repo + Infisical"
@ -14,28 +13,28 @@
ansible.builtin.find: ansible.builtin.find:
paths: "{{ playbook_dir | dirname }}" paths: "{{ playbook_dir | dirname }}"
excludes: ".git" excludes: ".git"
recurse: false recurse: true
register: repo_files register: repo_files
- name: "[repo] Repo pulled OK" - name: "[repo] Repo pulled OK"
ansible.builtin.debug: ansible.builtin.debug:
msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}" msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('regex_replace','^.*/repository_1_template_1/','') | list }}"
# Resolve creds: prefer env var, else look in the vars dict (extra-vars), else '' - name: "[resolve] Resolve Infisical creds (env var, else extra-var, else empty)"
- name: "[resolve] Gather Infisical creds from env or vars (no undefined errors)"
ansible.builtin.set_fact: ansible.builtin.set_fact:
infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') or (vars['INFISICAL_CLIENT_ID'] | default('')) }}" infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(lookup('vars','INFISICAL_CLIENT_ID', default=''), true) }}"
infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') or (vars['INFISICAL_CLIENT_SECRET'] | default('')) }}" infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(lookup('vars','INFISICAL_CLIENT_SECRET', default=''), true) }}"
infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') or (vars['INFISICAL_PROJECT_ID'] | default('')) }}" infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(lookup('vars','INFISICAL_PROJECT_ID', default=''), true) }}"
infisical_url: "{{ lookup('env','INFISICAL_URL') or (vars['INFISICAL_URL'] | default('http://192.168.122.41:8080')) }}" infisical_url: "{{ lookup('env','INFISICAL_URL') | default(lookup('vars','INFISICAL_URL', default='http://192.168.122.41:8080'), true) }}"
infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') or (vars['INFISICAL_ENV_SLUG'] | default('dev')) }}" infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(lookup('vars','INFISICAL_ENV_SLUG', default='dev'), true) }}"
- name: "[diag] Which channel carried the client id? (lengths only)" - name: "[diag] Cred source (lengths only, no secrets)"
ansible.builtin.debug: ansible.builtin.debug:
msg: msg:
- "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}" - "env INFISICAL_CLIENT_ID length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
- "vars-dict has key: {{ 'INFISICAL_CLIENT_ID' in vars }}" - "resolved client_id length: {{ infisical_client_id | length }}"
- "resolved id length: {{ infisical_client_id | length }}" - "resolved project_id length: {{ infisical_project_id | length }}"
- "url: {{ infisical_url }} env_slug: {{ infisical_env_slug }}"
- name: "[infisical] Assert creds resolved" - name: "[infisical] Assert creds resolved"
ansible.builtin.assert: ansible.builtin.assert:
@ -43,7 +42,7 @@
- infisical_client_id | length > 0 - infisical_client_id | length > 0
- infisical_client_secret | length > 0 - infisical_client_secret | length > 0
- infisical_project_id | length > 0 - infisical_project_id | length > 0
fail_msg: "Infisical creds not reaching playbook via env OR vars. See [diag] above." fail_msg: "Infisical creds still empty — see [diag]. If env length is 0, Semaphore isn't exporting the Variable Group as env vars."
- name: "[infisical] Log in" - name: "[infisical] Log in"
infisical.vault.login: infisical.vault.login: