From 65a72ce7fa81907fa53fd5c227ad9f1bb7733626 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 18:37:59 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E4=B8=BA=20Ansible=20lint=20?=
 =?UTF-8?q?=E6=8F=90=E4=BE=9B=E4=B8=B4=E6=97=B6=20Vault=20=E5=8D=A0?=
 =?UTF-8?q?=E4=BD=8D=E6=96=87=E4=BB=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ansible.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitea/workflows/ansible.yml b/.gitea/workflows/ansible.yml
index ca627d2..094a88d 100644
--- a/.gitea/workflows/ansible.yml
+++ b/.gitea/workflows/ansible.yml
@@ -56,6 +56,11 @@ jobs:
           rm -f \
             infrastructure/openbao/ansible/group_vars/all/vault.yml \
             infrastructure/samba-ad/ansible/group_vars/all/vault.yml
+          # ansible.cfg still declares vault_password_file. Even with encrypted
+          # vars removed, ansible-lint validates that the configured file exists
+          # before syntax-check starts. This throwaway value decrypts nothing.
+          export ANSIBLE_VAULT_PASSWORD_FILE="$RUNNER_TEMP/ansible-lint-vault-pass"
+          printf '%s\n' 'ci-placeholder-not-a-production-secret' > "$ANSIBLE_VAULT_PASSWORD_FILE"
           rc=0
           for p in infrastructure/openbao infrastructure/samba-ad infrastructure/proxmox; do
             echo "::group::$p"