mirror of
https://github.com/trailofbits/algo.git
synced 2025-10-07 11:05:16 +02:00
640249ae59
* fix: Remove POSIX-incompatible 'local' keyword from install.sh The install.sh script uses #\!/usr/bin/env sh (POSIX shell) but was using the 'local' keyword in the tryGetMetadata function, which is a bash-specific feature. This caused shellcheck to fail with SC3043 warnings in CI. Fixed by removing 'local' keywords from variable declarations in the tryGetMetadata function. The variables are still function-scoped in practice since they're assigned at the beginning of the function. This resolves the CI failure introduced in PR #14788 (run #919). * ci: Make ansible-lint stricter and fix basic issues - Remove || true from ansible-lint CI job to enforce linting - Enable name[play] rule - all plays should be named - Enable yaml[new-line-at-end-of-file] rule - Move name[missing] from skip_list to warn_list (first step) - Add names to plays in main.yml and users.yml - Document future linting improvements in comments This makes the CI stricter while fixing the easy issues first. More comprehensive fixes for the 113 name[missing] warnings can be addressed in future PRs. * fix: Add name[missing] to skip_list temporarily The ansible-lint CI is failing because name[missing] was not properly added to skip_list. This causes 113 name[missing] errors to fail the CI. Adding it to skip_list for now to fix the CI. The rule can be moved to warn_list and eventually enabled once all tasks are properly named in future PRs. * fix: Fix ansible-lint critical errors - Fix schema[tasks] error in roles/local/tasks/prompts.yml by removing with_items loop - Add missing newline at end of requirements.yml - Replace ignore_errors with failed_when in reboot task - Add pipefail to shell command with pipes in strongswan openssl task These fixes address all critical ansible-lint errors that were causing CI failures.
61 lines
2.3 KiB
YAML
61 lines
2.3 KiB
YAML
---
|
|
- name: Algo VPN Setup
|
|
hosts: localhost
|
|
become: false
|
|
tasks:
|
|
- name: Playbook dir stat
|
|
stat:
|
|
path: "{{ playbook_dir }}"
|
|
register: _playbook_dir
|
|
|
|
- name: Ensure Ansible is not being run in a world writable directory
|
|
assert:
|
|
that: _playbook_dir.stat.mode|int <= 775
|
|
msg: >
|
|
Ansible is being run in a world writable directory ({{ playbook_dir }}), ignoring it as an ansible.cfg source.
|
|
For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
|
|
|
|
- name: Ensure the requirements installed
|
|
debug:
|
|
msg: "{{ '' | ipaddr }}"
|
|
ignore_errors: true
|
|
no_log: true
|
|
register: ipaddr
|
|
|
|
- name: Set required ansible version as a fact
|
|
set_fact:
|
|
required_ansible_version: "{{ item | regex_replace('^ansible[\\s+]?(?P<op>[=,>,<]+)[\\s+]?(?P<ver>\\d.\\d+(.\\d+)?)$', '{\"op\": \"\\g<op>\",\"ver\"\
|
|
: \"\\g<ver>\" }') }}"
|
|
when: '"ansible" in item'
|
|
with_items: "{{ lookup('file', 'requirements.txt').splitlines() }}"
|
|
|
|
- name: Just get the list from default pip
|
|
community.general.pip_package_info:
|
|
register: pip_package_info
|
|
|
|
- name: Verify Python meets Algo VPN requirements
|
|
assert:
|
|
that: (ansible_python.version.major|string + '.' + ansible_python.version.minor|string) is version('3.8', '>=')
|
|
msg: >
|
|
Python version is not supported.
|
|
You must upgrade to at least Python 3.8 to use this version of Algo.
|
|
See for more details - https://trailofbits.github.io/algo/troubleshooting.html#python-version-is-not-supported
|
|
|
|
- name: Verify Ansible meets Algo VPN requirements
|
|
assert:
|
|
that:
|
|
- pip_package_info.packages.pip.ansible.0.version is version(required_ansible_version.ver, required_ansible_version.op)
|
|
- not ipaddr.failed
|
|
msg: >
|
|
Ansible version is {{ pip_package_info.packages.pip.ansible.0.version }}.
|
|
You must update the requirements to use this version of Algo.
|
|
Try to run python3 -m pip install -U -r requirements.txt
|
|
|
|
- name: Include prompts playbook
|
|
import_playbook: input.yml
|
|
|
|
- name: Include cloud provisioning playbook
|
|
import_playbook: cloud.yml
|
|
|
|
- name: Include server configuration playbook
|
|
import_playbook: server.yml
|