---
- name: "🤖 Ensure the GitLab bot, its API token and the webhook settings"
ansible.builtin.command:
argv:
- container
- exec
- -i
- -e
- "OPENPROJECT_GITLAB_BOT_LOGIN={{ OPENPROJECT_GITLAB_BOT.username }}"
- -e
- "OPENPROJECT_GITLAB_BOT_MAIL={{ OPENPROJECT_GITLAB_BOT.email }}"
- -e
- OPENPROJECT_GITLAB_BOT_PASSWORD
- -e
- "OPENPROJECT_GITLAB_TOKEN_NAME={{ openproject_addon.value.config.token_name }}"
- -e
- OPENPROJECT_GITLAB_WEBHOOK_SECRET
- -e
- OPENPROJECT_GITLAB_API_TOKEN
- "{{ OPENPROJECT_WEB_LOCAL_CID }}" # nocheck: container-exec-resolver CID resolved at delegate_to runtime; container_address targets a manager-only subshell
- bash
- -lc
- "cd /app && bundle exec rails runner -"
stdin: "{{ lookup('file', 'ruby/addons/gitlab/ensure_gitlab_webhook.rb') }}"
environment:
OPENPROJECT_GITLAB_BOT_PASSWORD: "{{ OPENPROJECT_GITLAB_BOT.password }}"
OPENPROJECT_GITLAB_WEBHOOK_SECRET: "{{ OPENPROJECT_GITLAB_WEBHOOK_SECRET }}"
OPENPROJECT_GITLAB_API_TOKEN: "{{ OPENPROJECT_GITLAB_TOKEN_HELD }}"
delegate_to: "{{ OPENPROJECT_WEB_HOST_NODE }}"
register: openproject_gitlab_provision
changed_when: "'CHANGED' in openproject_gitlab_provision.stdout"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🔎 Take the webhook key out of the runner output"
ansible.builtin.set_fact:
openproject_gitlab_key: "{{ (openproject_gitlab_provision.stdout | regex_search('\\{.*\\}') | from_json).api_token }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🛑 Refuse a run that produced no usable webhook key"
ansible.builtin.assert:
that:
- openproject_gitlab_key | length >= 20
fail_msg: >-
OpenProject issued no API token for the GitLab bot. A webhook built with an
empty key= authenticates as nobody, and every event answers 403.
- name: "💾 Publish the webhook key for the GitLab side to register with"
ansible.builtin.include_role:
name: sys-token-store
tasks_from: write.yml
vars:
sys_token_store_user_key: gitlab-web-app-openproject
sys_token_store_app: "{{ application_id }}"
sys_token_store_token: "{{ openproject_gitlab_key }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "📣 Name the half this role does not own"
ansible.builtin.debug:
msg: >-
{{ application_id }}: the OpenProject side is configured. No GitLab webhook exists -
register one against
{{ lookup('tls', application_id, 'url.origin') }}{{ openproject_addon.value.config.webhook_path }}?key=<stored token>
with the X-Gitlab-Token header set to the webhook secret, triggers
push/comments/issues/merge_request/pipeline.
