CI: Add ansible-lint workflow for Ansible playbooks

.ansible-lint

@@ -0,0 +1,2 @@
+skip_list:
+  - yaml

.github/ansible/production/nest.yaml

@@ -8,7 +8,7 @@
           mode: '0644'
 
       - name: Sync Makefile structure
-        ansible.builtin.synchronize:
+        ansible.posix.synchronize:
           src: '{{ github_workspace }}/'
           dest: '~/'
           recursive: yes
@@ -20,14 +20,15 @@
             - '--include=*/**/**/Makefile'
             - '--exclude=*'
 
-      - name: Update Makefiles for production environment
-        shell: |
+      - name: Update Makefiles for production environment # noqa: command-instead-of-module risky-shell-pipe
+        ansible.builtin.shell: |
           sed -i '/e2e-\|fuzz-/! s/\bnest-backend\b/production-nest-backend/g' ~/backend/Makefile
           sed -i '/e2e-\|fuzz-/! s/\bnest-db\b/production-nest-db/g' ~/backend/Makefile
           sed -i 's/\bnest-frontend\b/production-nest-frontend/g' ~/frontend/Makefile
+        changed_when: false
 
       - name: Copy secrets
-        copy:
+        ansible.builtin.copy:
           src: '{{ github_workspace }}/{{ item }}'
           dest: ~/
           mode: '0400'
@@ -38,9 +39,9 @@
           - .env.frontend
           - .github.pem
 
-      - name: Clean up secrets
+      - name: Clean up secrets  # noqa: run-once
         delegate_to: localhost
-        file:
+        ansible.builtin.file:
           path: '{{ github_workspace }}/{{ item }}'
           state: absent
         loop:
@@ -52,25 +53,29 @@
         run_once: true
 
       - name: Copy crontab
-        copy:
+        ansible.builtin.copy:
           src: '{{ github_workspace }}/cron/production'
           dest: /tmp/production_crontab
           mode: '0600'
 
       - name: Install crontab
         ansible.builtin.command:
           cmd: crontab /tmp/production_crontab
+        changed_when: false
 
       - name: Restart services
-        shell:
+        ansible.builtin.command:
           cmd: docker compose up -d --pull always
+        changed_when: false
 
       - name: Prune docker images
-        shell:
+        ansible.builtin.command:
           cmd: docker image prune -f
+        changed_when: false
 
       - name: Index data
         async: 1800 # 30 minutes
         poll: 0
-        shell: |
+        ansible.builtin.shell: |
           make index-data > /var/log/nest/production/index-data.log 2>&1
+        changed_when: false

.github/ansible/production/proxy.yaml

@@ -2,7 +2,7 @@
   hosts: production_nest_proxy
   tasks:
     - name: Copy proxy configuration files
-      copy:
+      ansible.builtin.copy:
         src: '{{ github_workspace }}/proxy/{{ item }}'
         dest: ~/
         mode: '0644'
@@ -15,15 +15,17 @@
         - redirects.conf
 
     - name: Copy docker compose file
-      copy:
+      ansible.builtin.copy:
         src: '{{ github_workspace }}/docker-compose/proxy/compose.yaml'
         dest: ~/docker-compose.yaml
         mode: '0644'
 
     - name: Restart services
-      shell:
+      ansible.builtin.shell:
         cmd: docker compose up -d --pull always && docker compose restart
+      changed_when: false
 
     - name: Prune docker images
-      shell:
+      ansible.builtin.command:
         cmd: docker image prune -f
+      changed_when: false

.github/ansible/staging/nest.yaml

@@ -8,7 +8,7 @@
           mode: '0644'
 
       - name: Sync Makefile structure
-        ansible.builtin.synchronize:
+        ansible.posix.synchronize:
           src: '{{ github_workspace }}/'
           dest: '~/'
           recursive: yes
@@ -20,11 +20,12 @@
             - '--include=*/**/**/Makefile'
             - '--exclude=*'
 
-      - name: Update Makefiles for staging environment
-        shell: |
+      - name: Update Makefiles for staging environment  # noqa: command-instead-of-module risky-shell-pipe
+        ansible.builtin.shell: |
           sed -i '/e2e-\|fuzz-/! s/\bnest-backend\b/staging-nest-backend/g' ~/backend/Makefile
           sed -i '/e2e-\|fuzz-/! s/\bnest-db\b/staging-nest-db/g' ~/backend/Makefile
           sed -i 's/\bnest-frontend\b/staging-nest-frontend/g' ~/frontend/Makefile
+        changed_when: false
 
       - name: Ensure data directory exists
         ansible.builtin.file:
@@ -33,7 +34,7 @@
           mode: '0755'
 
       - name: Copy secrets
-        copy:
+        ansible.builtin.copy:
           src: '{{ github_workspace }}/{{ item }}'
           dest: ~/
           mode: '0400'
@@ -43,9 +44,9 @@
           - .env.db
           - .env.frontend
 
-      - name: Clean up secrets
+      - name: Clean up secrets  # noqa: run-once
         delegate_to: localhost
-        file:
+        ansible.builtin.file:
           path: '{{ github_workspace }}/{{ item }}'
           state: absent
         loop:
@@ -56,25 +57,29 @@
         run_once: true
 
       - name: Copy crontab
-        copy:
+        ansible.builtin.copy:
           src: '{{ github_workspace }}/cron/staging'
           dest: /tmp/staging_crontab
           mode: '0600'
 
       - name: Install crontab
         ansible.builtin.command:
           cmd: crontab /tmp/staging_crontab
+        changed_when: false
 
       - name: Restart services
-        shell:
+        ansible.builtin.command:
           cmd: docker compose up -d --pull always
+        changed_when: false
 
       - name: Prune docker images
-        shell:
+        ansible.builtin.command:
           cmd: docker image prune -f
+        changed_when: false
 
       - name: Index data
         async: 1800 # 30 minutes
         poll: 0
-        shell: |
+        ansible.builtin.shell: |
           make index-data > /var/log/nest/staging/index-data.log 2>&1
+        changed_when: false

.github/ansible/staging/proxy.yaml

@@ -2,7 +2,7 @@
   hosts: staging_nest_proxy
   tasks:
     - name: Copy proxy configuration files
-      copy:
+      ansible.builtin.copy:
         src: '{{ github_workspace }}/proxy/{{ item }}'
         dest: ~/
         mode: '0644'
@@ -15,15 +15,17 @@
         - staging.conf
 
     - name: Copy docker compose file
-      copy:
+      ansible.builtin.copy:
         src: '{{ github_workspace }}/docker-compose/proxy/compose.yaml'
         dest: ~/docker-compose.yaml
         mode: '0644'
 
     - name: Restart services
-      shell:
+      ansible.builtin.shell:
         cmd: docker compose up -d --pull always && docker compose restart
+      changed_when: false
 
     - name: Prune docker images
-      shell:
+      ansible.builtin.command:
         cmd: docker image prune -f
+      changed_when: false

.github/workflows/run-ci-cd.yaml

@@ -668,6 +668,9 @@ jobs:
           NEXTAUTH_URL=$NEXTAUTH_URL
           EOF
 
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install -r requirements.yml
+
       - name: Run Nest deploy
         working-directory: .github/ansible
         run: ansible-playbook -i inventory.yaml staging/nest.yaml -e "github_workspace=$GITHUB_WORKSPACE"
@@ -704,6 +707,9 @@ jobs:
           $PROXY_SSH_PRIVATE_KEY
           EOF
 
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install -r requirements.yml
+
       - name: Run proxy deploy
         working-directory: .github/ansible
         run: ansible-playbook -i inventory.yaml staging/proxy.yaml -e "github_workspace=$GITHUB_WORKSPACE"
@@ -1038,6 +1044,9 @@ jobs:
           "$NEST_GITHUB_APP_PRIVATE_KEY"
           EOF
 
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install -r requirements.yml
+
       - name: Run Nest deploy
         working-directory: .github/ansible
         run: ansible-playbook -i inventory.yaml production/nest.yaml -e "github_workspace=$GITHUB_WORKSPACE"
@@ -1074,6 +1083,9 @@ jobs:
           $PROXY_SSH_PRIVATE_KEY
           EOF
 
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install -r requirements.yml
+
       - name: Run proxy deploy
         working-directory: .github/ansible
         run: ansible-playbook -i inventory.yaml production/proxy.yaml -e "github_workspace=$GITHUB_WORKSPACE"

.pre-commit-config.yaml

@@ -87,3 +87,13 @@ repos:
     rev: v2.12.1
     hooks:
       - id: pyproject-fmt
+
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v26.1.1
+    hooks:
+      - id: ansible-lint
+        language_version: python3
+        args:
+          - .github/ansible
+        files: ^\.github/ansible/.*\.ya?ml$
+        pass_filenames: true

Makefile

@@ -6,7 +6,7 @@ include frontend/Makefile
 .PHONY: build clean check pre-commit prune run scan-images security-scan security-scan-code \
 	security-scan-code-semgrep security-scan-code-trivy security-scan-images \
 	security-scan-backend-image security-scan-frontend-image test update \
-	clean-trivy-cache
+	clean-trivy-cache lint-ansible
 
 MAKEFLAGS += --no-print-directory
 
@@ -63,6 +63,9 @@ run:
 	docker compose -f docker-compose/local/compose.yaml --project-name nest-local build && \
 	docker compose -f docker-compose/local/compose.yaml --project-name nest-local up --remove-orphans
 
+lint-ansible:
+	pre-commit run ansible-lint --all-files
+
 security-scan: \
 	security-scan-code \
 	security-scan-images

requirements.yml

@@ -0,0 +1,2 @@
+collections:
+  - name: ansible.posix