# Ansible Role: Seriatim

Installs the [Seriatim](https://gitea.maximumdirect.net/eric/seriatim)
transcript processor from source. The role supports Ubuntu 26.04 on `amd64`
and `arm64` hosts and is independently usable outside the D&D pipeline role.

The role manages its build dependencies and a root-owned source checkout,
builds a native static executable, validates it, and safely installs it.

## Requirements

Ansible Core 2.18 or newer is required. Install the pinned collection
dependency before using or validating the role:

```sh
ansible-galaxy collection install -r collections/requirements.yml
```

## Variables

| Variable | Default | Description |
| --- | --- | --- |
| `seriatim_version` | `v1.5.0` | Release identity expected from the installed binary. |
| `seriatim_repository_url` | `https://gitea.maximumdirect.net/eric/seriatim.git` | Source repository URL. |
| `seriatim_source_ref` | `{{ seriatim_version }}` | Git tag, branch, or commit to check out. |
| `seriatim_build_version` | `{{ seriatim_version }}` | Version injected into build metadata. |
| `seriatim_source_dir` | `/usr/local/src/seriatim` | Fully managed source checkout. |
| `seriatim_binary_path` | `/usr/local/bin/seriatim` | Installed executable path. |
| `seriatim_build_state_dir` | `/usr/local/src/seriatim.ansible-build-state` | Sidecar directory for build inputs and output state. |
| `seriatim_manage_build_dependencies` | `true` | Install Git and Go when enabled. |
| `seriatim_go_snap_channel` | `1.26/stable` | Go Snap channel. |
| `seriatim_go_binary` | `/snap/bin/go` | Go executable used to inspect and build. |
| `seriatim_go_build_flags` | `[-trimpath]` | Ordered Go build arguments before `-ldflags`. |
| `seriatim_go_ldflags` | `-s -w -X gitea.maximumdirect.net/eric/seriatim/internal/buildinfo.Version={{ seriatim_build_version }}` | Linker flags passed as one argument. |
| `seriatim_go_package` | `./cmd/seriatim` | Go package built from the checkout. |

For development revisions, set both `seriatim_source_ref` and an honest
`seriatim_build_version`. Released deployments should select immutable tags.

When `seriatim_manage_build_dependencies` is enabled, the role installs Git
and converges the classic Go Snap to `seriatim_go_snap_channel`. When disabled,
both Git and the configured Go executable must already be available, and Go
must be version 1.25 or newer.

The checkout is authoritative: tracked changes and all untracked or ignored
files beneath `seriatim_source_dir` are discarded during convergence. The
repository URL may point to a private remote, but authentication must be
provided independently through the managed host's Git configuration or SSH
environment; this role does not manage credentials or accept unknown host
keys.

## Build and installation behavior

Builds run from the selected checkout with `GOWORK=off`,
`GOTOOLCHAIN=local`, `CGO_ENABLED=0`, the configured ordered build flags, and
the upstream version-injection linker flags. The resulting executable is
staged and must report the exact configured version before it atomically
replaces `seriatim_binary_path`. It is installed as `root:root` mode `0755`.

The role records readable inputs, their SHA-256 fingerprint, and the installed
binary checksum beneath `seriatim_build_state_dir`. A source commit, compiler
identity, Go path, version, flags, linker flags, package, or fixed environment
change triggers a rebuild. Missing or corrupt state, a modified binary, or an
incorrect installed version also triggers rebuilding. Failed compilation or
staged validation leaves the previous installed binary and successful state
untouched.

For example, development from a branch must identify both source and output:

```yaml
seriatim_source_ref: feature/example
seriatim_build_version: v1.5.0-dev
```

## Static validation

```sh
ANSIBLE_COLLECTIONS_PATH="$PWD/.ansible/collections" \
  ../.venv/bin/ansible-playbook -i tests/inventory tests/converge.yml \
  --syntax-check
ANSIBLE_COLLECTIONS_PATH="$PWD/.ansible/collections" \
  ../.venv/bin/ansible-lint .
```

## Development and integration validation

Create the workspace virtual environment described by the control repository
and run the complete local suite from this repository with:

```sh
tests/integration
```

The driver installs the pinned collection into the ignored local `.ansible`
directory, runs static checks, and then mutates the local host using privilege
escalation. It manages `/usr/local/src/seriatim`,
`/usr/local/src/seriatim.ansible-build-state`, and
`/usr/local/bin/seriatim`; do not run it where those paths contain data that
must be preserved. It verifies convergence, idempotence, platform guards,
authoritative source cleanup, compiler-version invalidation, and preservation
of a working installation after a failed build.

The driver uses temporary Go wrappers and removes them on exit. It attempts to
restore the default role state after a failure. Recovery consists only of
rerunning `tests/integration` or the default `tests/converge.yml`; no manual
deletion of managed paths is required.

## License

BSD-3-Clause