---
- name: "🔑 Read the API token the boot hook minted for MCP clients"
ansible.builtin.shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ JENKINS_LOCAL_CID | quote }} \
cat {{ JENKINS_MCP_TOKEN_FILE | quote }}
register: jenkins_mcp_token_read
retries: 30
delay: 10
until: jenkins_mcp_token_read.rc == 0
changed_when: false
delegate_to: "{{ JENKINS_HOST_NODE }}"
run_once: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🔧 Take the minted token from the boot hook output"
ansible.builtin.set_fact:
jenkins_mcp_token: "{{ jenkins_mcp_token_read.stdout_lines | last | trim }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
run_once: true
- name: "🛑 Refuse a controller that issued no usable API token"
ansible.builtin.assert:
that:
- jenkins_mcp_token | length >= 34
fail_msg: >-
Jenkins wrote no API token to {{ JENKINS_MCP_TOKEN_FILE }}, so every MCP
client would be configured with an empty credential and fail at first use.
- name: "💾 Persist the token so MCP clients can read it"
ansible.builtin.include_role:
name: sys-token-store
tasks_from: write.yml
vars:
sys_token_store_user_key: "{{ lookup('config', application_id, 'mcp.credential.owner') }}"
sys_token_store_app: "{{ application_id }}"
sys_token_store_token: "{{ jenkins_mcp_token }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
