check_ansible.yml

# For docs on this see:
# * https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
# * https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request
# * https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=synchronize#pull_request
on:
  pull_request:
    types:
      - opened
      - synchronize # when commits are pushed to the PR
      - reopened
      - edited # title or body of a pull request was edited, or the base branch of a pull request was changed
    paths:
      - "ansible/**"
      - "!ansible/README.md"

jobs:
  ansible:
    strategy:
      matrix:
        environment: ["dev"]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ansible/
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Install Ansible
        run: |
          sudo apt update
          sudo apt install software-properties-common
          sudo add-apt-repository --yes --update ppa:ansible/ansible-9
          sudo apt install -y ansible

      - name: Write devops ssh key to .ssh
        run: |
          mkdir -p ~/.ssh/
          chmod 700 ~/.ssh/
          echo "${{ secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
          chmod 600 ~/.ssh/ooni-devops-prod.pem

      - name: Run Ansible Playbook
        id: playbook
        env:
          ANSIBLE_SSH_ARGS: "-o UserKnownHostsFile=known_hosts"
          INVENTORY_FILE_PATH: "../tf/modules/ansible_inventory/inventories/inventory-${{ matrix.environment }}.ini"
        run: |
          echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
          echo "\$ ansible-playbook playbook.yml --check --diff -i $INVENTORY_FILE_PATH" >> "$GITHUB_OUTPUT"
          ansible-playbook playbook.yml --check --diff -i  $INVENTORY_FILE_PATH \
            --key-file ~/.ssh/ooni-devops-prod.pem 2>&1 | tee -a "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
        continue-on-error: true

      # This can be uncommmented to make it possible to ssh into the container to debug the run
      #- name: Setup tmate session
      #  uses: mxschmitt/action-tmate@v3

      - uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const commentTitle = "Ansible Run Output";
            const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
            const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
            const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';

            const commentBody = `
            #### Ansible Playbook Recap 🔍

            \`\`\`\n
            ${ansiblePlaybookRecap}
            \`\`\`

            #### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`

            <details><summary>Show Execution</summary>

            \`\`\`\n
            ${ansiblePlaybookOutput}
            \`\`\`

            </details>

            |                   |                                    |
            |-------------------|------------------------------------|
            | Pusher            | @${{ github.actor }}               |
            | Action            |  ${{ github.event_name }}          |
            | Working Directory |  ${{ env.tf_actions_working_dir }} |
            | Workflow          |  ${{ github.workflow }}            |
            | Last updated      |  ${(new Date()).toUTCString()}     |
            `;

            // Call the script to write the comment
            const script = require('./scripts/ghactions/comment-on-pr.js');
            await script({github, context, core, commentTitle, commentBody});