GitHub Actions #

# .github/workflows/validate.yml
name: Validate Ansible

on:
  pull_request:
    paths:
      - '**.yml'
      - '**.yaml'
      - '**.j2'
      - 'roles/**'
      - 'playbooks/**'
      - 'inventory/**'

jobs:
  lint:
    name: Ansible Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Cache pip packages
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: pip-${{ hashFiles('requirements.txt', 'requirements-dev.txt') }}
          restore-keys: pip-

      - name: Install Ansible dan lint
        run: |
          pip install ansible ansible-lint
          ansible-galaxy install -r requirements.yml          

      - name: Syntax check semua playbook
        run: |
          for playbook in playbooks/*.yml; do
            echo "Checking: $playbook"
            ansible-playbook "$playbook" --syntax-check \
              -i inventory/staging/ \
              -e @tests/test-vars.yml
          done          

      - name: Jalankan ansible-lint
        run: ansible-lint --profile production

# .github/workflows/molecule.yml
name: Molecule Test

on:
  pull_request:
    paths:
      - 'roles/**'

jobs:
  molecule:
    name: Test Role — ${{ matrix.role }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        role:
          - common
          - nginx
          - postgresql
          - docker
      fail-fast: false    # Lanjutkan test role lain meski satu gagal

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Cache pip
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: molecule-${{ matrix.role }}-${{ hashFiles('**/requirements*.txt') }}

      - name: Install test dependencies
        run: |
          pip install ansible molecule molecule-plugins[docker] pytest-testinfra
          ansible-galaxy install -r requirements.yml          

      - name: Jalankan Molecule test
        run: |
          cd roles/${{ matrix.role }}
          molecule test          
        env:
          PY_COLORS: '1'
          ANSIBLE_FORCE_COLOR: '1'
          MOLECULE_DISTRO: ubuntu2204

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: molecule-logs-${{ matrix.role }}
          path: roles/${{ matrix.role }}/molecule/default/*.log

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]
    tags: ['v*.*.*']

jobs:
  build:
    name: Build dan Push Image
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.tag.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Generate tag
        id: tag
        run: echo "tag=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT

      - name: Login ke registry
        uses: docker/login-action@v3
        with:
          registry: registry.company.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build dan push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: |
            registry.company.com/myapp:${{ steps.tag.outputs.tag }}
            registry.company.com/myapp:latest            

  deploy-staging:
    name: Deploy ke Staging
    needs: build
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - name: Setup Ansible
        run: pip install ansible && ansible-galaxy install -r requirements.yml

      - name: Setup credentials
        run: |
          install -d -m 700 ~/.ssh
          echo "${{ secrets.STAGING_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          echo "${{ secrets.VAULT_PASS_STAGING }}" > /tmp/.vault_pass
          chmod 600 /tmp/.vault_pass          

      - name: Deploy ke staging
        run: |
          ansible-playbook -i inventory/staging/ playbooks/deploy.yml \
            -e "app_version=${{ needs.build.outputs.image_tag }}" \
            --vault-password-file /tmp/.vault_pass \
            --private-key ~/.ssh/deploy_key          

      - name: Smoke test staging
        run: |
          sleep 15
          curl -f https://staging.company.com/health
          curl -f https://staging.company.com/api/version          

      - name: Cleanup credentials
        if: always()
        run: rm -f ~/.ssh/deploy_key /tmp/.vault_pass

  deploy-production:
    name: Deploy ke Production
    needs: [build, deploy-staging]
    runs-on: ubuntu-latest
    environment:
      name: production       # Set required reviewers di GitHub Settings → Environments
      url: https://app.company.com
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v4

      - name: Setup Ansible
        run: pip install ansible && ansible-galaxy install -r requirements.yml

      - name: Setup credentials
        run: |
          install -d -m 700 ~/.ssh
          echo "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          echo "${{ secrets.VAULT_PASS_PROD }}" > /tmp/.vault_pass
          chmod 600 /tmp/.vault_pass          

      - name: Deploy ke production
        run: |
          ansible-playbook -i inventory/production/ playbooks/deploy.yml \
            -e "app_version=${{ needs.build.outputs.image_tag }}" \
            --vault-password-file /tmp/.vault_pass \
            --private-key ~/.ssh/deploy_key          

      - name: Verifikasi production
        run: |
          sleep 30
          curl -f https://app.company.com/health          

      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key /tmp/.vault_pass

# .github/workflows/reusable-deploy.yml (di shared repository)
name: Reusable Deploy

on:
  workflow_call:           # Bisa dipanggil dari workflow lain
    inputs:
      environment:
        required: true
        type: string
      image_tag:
        required: true
        type: string
      playbook:
        required: false
        type: string
        default: playbooks/deploy.yml
    secrets:
      ssh_key:
        required: true
      vault_password:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        run: |
          pip install ansible && ansible-galaxy install -r requirements.yml
          echo "${{ secrets.ssh_key }}" > /tmp/deploy_key
          echo "${{ secrets.vault_password }}" > /tmp/.vault_pass
          chmod 600 /tmp/deploy_key /tmp/.vault_pass
          ansible-playbook -i inventory/${{ inputs.environment }}/ \
            ${{ inputs.playbook }} \
            -e "app_version=${{ inputs.image_tag }}" \
            --vault-password-file /tmp/.vault_pass \
            --private-key /tmp/deploy_key
          rm -f /tmp/deploy_key /tmp/.vault_pass          

# Di repository aplikasi — panggil reusable workflow
jobs:
  deploy-staging:
    uses: company/shared-workflows/.github/workflows/reusable-deploy.yml@main
    with:
      environment: staging
      image_tag: ${{ needs.build.outputs.tag }}
    secrets:
      ssh_key: ${{ secrets.STAGING_SSH_KEY }}
      vault_password: ${{ secrets.VAULT_PASS_STAGING }}

# roles/github-runner/tasks/main.yml
---
- name: Download GitHub Actions runner
  get_url:
    url: "https://github.com/actions/runner/releases/download/v{{ runner_version }}/actions-runner-linux-x64-{{ runner_version }}.tar.gz"
    dest: /home/github-runner/actions-runner.tar.gz

- name: Extract runner
  unarchive:
    src: /home/github-runner/actions-runner.tar.gz
    dest: /home/github-runner/
    remote_src: true

- name: Konfigurasi runner
  command: >
    /home/github-runner/config.sh
    --url https://github.com/{{ github_org }}
    --token {{ vault_runner_token }}
    --name {{ inventory_hostname }}
    --labels self-hosted,production-network
    --unattended    
  become_user: github-runner

- name: Install dan jalankan runner sebagai service
  command: /home/github-runner/svc.sh install
  become: true

# ANTI-PATTERN: secret di-spread ke environment tanpa filter
jobs:
  deploy:
    steps:
      - name: Setup credentials
        run: |
          echo "VAULT_PASS=${{ secrets.VAULT_PASS_PROD }}" >> $GITHUB_ENV
          echo "SSH_KEY=${{ secrets.PROD_SSH_KEY }}" >> $GITHUB_ENV
          ansible-playbook -i inventory/prod/ deploy.yml          

      # ANTI-PATTERN: secret disimpan di GITHUB_ENV dan otomatis
      # di-mask di log... jika ditulis dengan benar.
      # Tapi kalau ada step berikutnya yang echo "koneksi ke $SSH_KEY"
      # atau print env, GitHub mungkin tidak bisa mask semuanya.

# BENAR: secret langsung ditulis ke file, tidak pernah di-echo
jobs:
  deploy:
    steps:
      - name: Setup credentials
        run: |
          mkdir -p ~/.ssh
          printf '%s' "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          printf '%s' "${{ secrets.VAULT_PASS_PROD }}" > /tmp/.vault_pass
          chmod 600 /tmp/.vault_pass          

      - name: Deploy
        run: |
          ansible-playbook -i inventory/prod/ deploy.yml \
            --vault-password-file /tmp/.vault_pass \
            --private-key ~/.ssh/deploy_key          

      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key /tmp/.vault_pass

# BENAR: secret hanya ditulis sebagai file dengan permission 600.
# Tidak pernah di-print, tidak pernah di-set sebagai env var
# yang bisa bocor lewat step lain. Cleanup dengan if: always()
# memastikan file dihapus meski job gagal.

# ANTI-PATTERN: pakai action langsung dari branch main
jobs:
  build:
    steps:
      - uses: actions/checkout@main         # Bisa berubah sewaktu-waktu
      - uses: actions/setup-python@main     # Breaking change bisa muncul besok
      - uses: docker/build-push-action@main # Supply chain attack bisa undetected

# BENAR: pin action ke tag atau SHA immutable
jobs:
  build:
    steps:
      - uses: actions/checkout@v4                       # Tag stabil
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # SHA
      - uses: actions/setup-python@v5
      - uses: docker/build-push-action@v5

# BENAR: SHA adalah gold standard untuk security-sensitive
# workflow. Tag bisa di-force-push atau di-override oleh
# maintainer; SHA adalah cryptographic commitment ke kode
# tertentu dan tidak bisa diubah tanpa GitHub noticing.

# ANTI-PATTERN: copy-paste workflow di setiap repository
# File yang sama ada di 8 repository dengan perbedaan kecil
# di environment name, secret name, dan playbook path

# repo-a/.github/workflows/deploy.yml
on:
  push:
    branches: [main]
jobs:
  deploy-prod:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: |
          echo "${{ secrets.PROD_SSH_KEY_A }}" > /tmp/key
          ansible-playbook -i inventory/prod/ deploy.yml \
            -e "app_version=$GITHUB_SHA" --private-key /tmp/key
          rm -f /tmp/key          

# BENAR: reusable workflow + caller per repo
# shared-workflows/.github/workflows/deploy-ansible.yml
on:
  workflow_call:
    inputs:
      environment: {required: true, type: string}
      image_tag: {required: true, type: string}
    secrets:
      ssh_key: {required: true}
      vault_password: {required: true}
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4
      - run: |
          echo "${{ secrets.ssh_key }}" > /tmp/key
          echo "${{ secrets.vault_password }}" > /tmp/.vault_pass
          chmod 600 /tmp/key /tmp/.vault_pass
          ansible-playbook -i inventory/${{ inputs.environment }}/ \
            deploy.yml -e "app_version=${{ inputs.image_tag }}" \
            --vault-password-file /tmp/.vault_pass \
            --private-key /tmp/key
          rm -f /tmp/key /tmp/.vault_pass          

# repo-a/.github/workflows/deploy.yml — cuma 6 baris!
jobs:
  deploy:
    uses: org/shared-workflows/.github/workflows/deploy-ansible.yml@v1
    with:
      environment: production
      image_tag: ${{ needs.build.outputs.tag }}
    secrets:
      ssh_key: ${{ secrets.PROD_SSH_KEY_A }}
      vault_password: ${{ secrets.VAULT_PASS_A }}

# BENAR: satu tempat untuk update deployment logic. Bug fix di
# shared workflow langsung bisa di-roll out ke semua caller dengan
# update tag version. Tidak perlu sinkronisasi manual 8 repository.