---
name: ansible

on:
  push:
    branches: [main]
    paths:
      - 'infrastructure/**/ansible/**'
      - 'infrastructure/dns/**'
      - '.ansible-lint'
      - '.gitea/workflows/ansible.yml'
  pull_request:
    paths:
      - 'infrastructure/**/ansible/**'
      - 'infrastructure/dns/**'
      - '.ansible-lint'
      - '.gitea/workflows/ansible.yml'

env:
  ANSIBLE_COLLECTIONS_PATH: /root/.ansible/collections

jobs:
  lint:
    runs-on: [self-hosted, pod]
    steps:
      - uses: actions/checkout@v4

      - name: Bootstrap uv
        run: |
          python3 -m pip install --user --break-system-packages \
            --index-url https://pypi.org/simple --quiet uv==0.11.7
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Install ansible-lint and collections
        run: |
          for i in 1 2 3 4 5; do
            uv tool install ansible-core --with paramiko --with pywinrm --quiet && break
            echo "attempt $i failed"; sleep 10
          done
          for i in 1 2 3 4 5; do
            uv tool install ansible-lint --quiet && break
            echo "attempt $i failed"; sleep 10
          done
          export PATH="$HOME/.local/bin:$PATH"
          for p in infrastructure/proxmox infrastructure/samba-ad infrastructure/openbao; do
            ansible-galaxy collection install \
              -r "$p/ansible/requirements.yml" -p "$ANSIBLE_COLLECTIONS_PATH"
          done

      - name: ansible-lint
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          export ANSIBLE_COLLECTIONS_PATH="$PWD/infrastructure/samba-ad/ansible/collections:/root/.ansible/collections"
          # 静态检查不应依赖生产 vault 凭据。一次性 checkout 可以去掉加密变量文件；
          # syntax-check 只验证结构，不需要解析变量的运行时值。
          rm -f \
            infrastructure/openbao/ansible/group_vars/all/vault.yml \
            infrastructure/samba-ad/ansible/group_vars/all/vault.yml
          rc=0
          for p in infrastructure/openbao infrastructure/samba-ad infrastructure/proxmox; do
            echo "::group::$p"
            (cd "$p/ansible" && ansible-lint -c ../../../.ansible-lint --nocolor -f pep8 .) || rc=1
            echo "::endgroup::"
          done
          exit $rc

  collection-test:
    runs-on: [self-hosted, pod]
    steps:
      - uses: actions/checkout@v4

      - name: Install ansible-core
        run: |
          python3 -m pip install --user --break-system-packages \
            --index-url https://pypi.org/simple --quiet uv==0.11.7
          export PATH="$HOME/.local/bin:$PATH"
          uv tool install ansible-core --quiet

      - name: Run ansible-test
        working-directory: infrastructure/samba-ad/ansible/collections/ansible_collections/ddupan/homelab
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          ansible-test sanity --venv --requirements --python 3.12 --color no
          ansible-test units --venv --requirements --python 3.12 --color no