From c993f5eaf1f6af09c324d03203db4c5c5b1d3140 Mon Sep 17 00:00:00 2001
From: Sam <samueljamesinc@gmail.com>
Date: Wed, 26 Aug 2026 12:02:52 -0400
Subject: [PATCH] Add test-connection.yml diagnostic (repo file list +
 Infisical auth check)

---
 playbooks/test-connection.yml | 79 +++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 playbooks/test-connection.yml

diff --git a/playbooks/test-connection.yml b/playbooks/test-connection.yml
new file mode 100644
index 0000000..9bbedca
--- /dev/null
+++ b/playbooks/test-connection.yml
@@ -0,0 +1,79 @@
+---
+# ============================================================================
+# test-connection.yml — diagnostic playbook (makes NO changes to any host)
+# ============================================================================
+# Confirms the Semaphore pipeline works end to end:
+#   1. Repo pulled OK over SSH  -> list files in the checked-out repo
+#   2. Infisical reachable + auth works -> login + read secret KEYS (not values)
+#
+# Runs entirely on the Semaphore runner (localhost). No target hosts touched.
+#
+# Requires (Semaphore Variable Group 'infisical-dev' as env vars):
+#   INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID
+#   INFISICAL_URL (default http://192.168.122.41:8080), INFISICAL_ENV_SLUG (default dev)
+#
+# Usage: Task Template -> playbook playbooks/test-connection.yml, env infisical-dev
+# ============================================================================
+
+- name: "Semaphore diagnostics — repo + Infisical"
+  hosts: localhost
+  gather_facts: false
+  vars:
+    infisical_url: "{{ lookup('env','INFISICAL_URL') | default('http://192.168.122.41:8080', true) }}"
+    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('dev', true) }}"
+
+  tasks:
+    # ---------- 1. REPO CHECK (proves SSH clone worked) ----------
+    - name: "[repo] Where is the checked-out repo?"
+      ansible.builtin.set_fact:
+        repo_dir: "{{ playbook_dir | dirname }}"
+
+    - name: "[repo] List files in the repository"
+      ansible.builtin.find:
+        paths: "{{ repo_dir }}"
+        recurse: true
+        excludes: ".git"
+      register: repo_files
+
+    - name: "[repo] Repo contents"
+      ansible.builtin.debug:
+        msg: >-
+          Repo pulled OK at {{ repo_dir }} —
+          {{ repo_files.files | map(attribute='path') | map('regex_replace', '^'+repo_dir+'/', '') | list }}
+
+    # ---------- 2. INFISICAL CHECK (proves auth + read works) ----------
+    - name: "[infisical] Auth vars present?"
+      ansible.builtin.assert:
+        that:
+          - lookup('env','INFISICAL_CLIENT_ID') | length > 0
+          - lookup('env','INFISICAL_CLIENT_SECRET') | length > 0
+          - lookup('env','INFISICAL_PROJECT_ID') | length > 0
+        fail_msg: "Missing INFISICAL_CLIENT_ID / _SECRET / _PROJECT_ID (set them in the Variable Group)."
+        success_msg: "Infisical auth vars present."
+
+    - name: "[infisical] Log in (universal auth)"
+      infisical.vault.login:
+        url: "{{ infisical_url }}"
+        auth_method: universal_auth
+        universal_auth_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
+        universal_auth_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
+      register: infisical_login
+
+    - name: "[infisical] Read secrets from project/env"
+      infisical.vault.read_secrets:
+        login_data: "{{ infisical_login.login_data }}"
+        project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
+        env_slug: "{{ infisical_env_slug }}"
+        path: "/"
+        as_dict: true
+      register: infisical_secrets
+
+    - name: "[infisical] Show which secret KEYS are visible (values hidden)"
+      ansible.builtin.debug:
+        msg: >-
+          Infisical OK ({{ infisical_url }}, env={{ infisical_env_slug }}) —
+          secret keys available: {{ infisical_secrets.secrets.keys() | list }}
+
+    - name: "[result] ALL CHECKS PASSED"
+      ansible.builtin.debug:
+        msg: "SSH repo pull ✓  |  Infisical auth + read ✓  — pipeline is ready."