eric/ansible-role-dnd-pipeline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Simplify pipeline credential management

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 21:35:07 +00:00
parent 8ff0761820
commit de1b191cd2
3 changed files with 12 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@@ -273,12 +273,11 @@ only reference names.
### Managed credentials
`dnd_pipeline_secrets` defaults to `{}`. Its keys must be valid environment
variable names, and each value is either a nonempty string to manage as the
exact named credential file or `null` to remove that exact file. Omitted names
are unmanaged: the role neither mirrors nor purges the directory. Narratio
loads this conventional sibling directory before configuration resolution; an
already-set process environment value takes precedence. The role adds no
wrapper, service, or parallel credential loader.
variable names, and each string value is managed as the exact named credential
file. Omitted names are unmanaged: the role neither mirrors nor purges the
directory. Narratio loads this conventional sibling directory before
configuration resolution; an already-set process environment value takes
precedence. The role adds no wrapper, service, or parallel credential loader.
Keep values in encrypted inventory, for example with Ansible Vault; Vault is a
consumer workflow, not role functionality:
@@ -287,9 +286,14 @@ consumer workflow, not role functionality:
dnd_pipeline_secrets:
AUDITA_LLM_API_KEY: "{{ vault_dnd_audita_llm_api_key }}"
OPENROUTER_API_KEY: "{{ vault_dnd_openrouter_api_key }}"
RETIRED_PROVIDER_KEY: null
```
Scriptorium profiles continue to own their `api_key_env` selection. To supply
that credential through the suite, add a `dnd_pipeline_secrets` entry whose
name matches the selected profile's `api_key_env`. Narratio's secrets bootstrap
loads the value, and its existing Scriptorium adapter forwards only the
profile-selected credential.
## Validation
`tests/integration` installs the pinned Git dependencies and collection into