From cf8f2435f8bba35d65545ed417337bdfe6165590 Mon Sep 17 00:00:00 2001
From: jdelpilar <gitea@delpilar.net>
Date: Sat, 13 Jun 2026 16:43:33 -0700
Subject: [PATCH] Feat/add ci cd pipeline (#4)

This PR add the basic CI/CD workflow.

- On push to any branch ansible-lint is ran to verify syntax and formatting
- On push to main, all pushes are required to pass ansible-lint. Project is than ran against all hosts to push changes to production.

---------

Co-authored-by: Jordan Del Pilar <jordan@delpilar.net>
Reviewed-on: https://git.delpilar.net/jdelpilar/johto-infra/pulls/4
---
 .gitea/workflows/ansible-cicd.yaml | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 .gitea/workflows/ansible-cicd.yaml

diff --git a/.gitea/workflows/ansible-cicd.yaml b/.gitea/workflows/ansible-cicd.yaml
new file mode 100644
index 0000000..4086163
--- /dev/null
+++ b/.gitea/workflows/ansible-cicd.yaml
@@ -0,0 +1,55 @@
+name: Johto Infrastructure Pipeline
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  lint:
+    name: Run Ansible Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Ansible and Lint
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ansible ansible-lint
+
+      - name: Inject Vault Password
+        run: echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > .vault-pass.txt
+
+      - name: Lint Playbooks
+        run: ansible-lint site.yaml
+
+  deploy:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ansible
+
+      - name: Inject SSH Key for Ansible
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.ANSIBLE_SSH_KEY }}
+
+      - name: Add Headscale IPs to Known Hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan 100.64.0.1 100.64.0.2 >> ~/.ssh/known_hosts
+
+      - name: Inject Vault Password
+        run: echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > .vault-pass.txt
+
+      - name: Run Ansible Playbook
+        run: ansible-playbook site.yaml