Question: ansible-galaxy ignore git-credentials

[SLedunois]

Question

Hello,

I just installed Semaphore and I’m using roles/collections that are hosted on a private GitLab, which therefore requires authentication.
When running a task, ansible-galaxy tries to install the dependencies, but it seems the Git credentials are not taken into account.

After some research, I have:

• Configured my .gitconfig to point to the .git-credentials:

[credential]
    helper = "store --file=<path_to_git_credentials>"

• Created a variable group with the environment variable GIT_CONFIG_GLOBAL pointing to the .gitconfig
• Added this variable group to my Ansible template
• Added this variable group to a Bash template

This works perfectly fine with the following Bash script:

# !/bin/bash

whoami
printenv | more

ansible-galaxy role install -r requirements.yml --force

However, it doesn’t work at all when running an Ansible playbook. I always end up with the following log:

4:39:59 PMStarting galaxy role install process
4:39:59 PM[WARNING]: - <role_name> was NOT installed successfully: - command
4:39:59 PM/usr/bin/git clone https://<git> drupal_install_role failed in directory
4:39:59 PM/appli/semaphore/project_1/.ansible/tmp/ansible-local-114046rvfapy4o/tmpwf2a00zk (rc=128) - Cloning into
4:39:59 PM'<role_name>'... fatal: could not read Username for 'https://<git>': No such device or address
4:39:59 PMERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.

Do you have any idea how to fix this, or is this a bug?

Thanks,

SLedunois

Related to

Ansible (task execution)

[fiftin]

Hi @SLedunois I'm sure it is problem with Semaphore behaviour - Semaphore overrides %HOME% env variable to a project directory.

[SLedunois]

Hello @fiftin ,

I did notice in the Bash template that the HOME variable is overridden by Semaphore.
That’s why I set the Git environment variable GIT_CONFIG_GLOBAL to point to the .gitconfig file, and running ansible-galaxy manually works perfectly fine in the Bash template. However, it doesn’t work in the Ansible template.

[SLedunois]

@fiftin any fix idea ?

[SLedunois]

Update:

I tested a new approach using only environment variables.
So I modified the variable group and added the following variables:

GITLAB_TOKEN=<token>
GIT_CONFIG_COUNT=1
GIT_CONFIG_KEY_0=credential.https://<repo>.username
GIT_CONFIG_VALUE_0=<user>
GIT_ASKPASS=<path to script>/git-pass.sh

with the script git-pass.sh that simply does:

#!/bin/bash

echo $GITLAB_TOKEN

It works perfectly in a bash template.
Not at all in an Ansible template.
Does the Ansible template actually use environment variables?

[SLedunois]

Ok, I found out why it’s not working. The environment variables don’t get propagated between the LocalJob preparation phase and the execution of the commands when installing the requirements.

They are present here during the run preparation:

semaphore/services/tasks/LocalJob.go

Line 559 in c47e9d1

err = t.prepareRun(db_lib.LocalAppInstallingArgs{

But the environment variables are never passed when installing the requirements:

semaphore/services/tasks/LocalJob.go

Line 665 in c47e9d1

if err := t.App.InstallRequirements(installingArgs); err != nil {

And even less when running the ansible-galaxy commands:

semaphore/db_lib/AnsiblePlaybook.go

Line 40 in c47e9d1

cmd := p.makeCmd(command, args, nil)

So by design, variable groups are excluded from the preparation steps