Ansible Role: Seriatim

Installs the Seriatim transcript processor from source. The role supports Ubuntu 26.04 on amd64 and arm64 hosts and is independently usable outside the D&D pipeline role.

The role manages its build dependencies and a root-owned source checkout, builds a native static executable, validates it, and safely installs it.

Requirements

Ansible Core 2.18 or newer is required. Install the pinned collection dependency before using or validating the role:

ansible-galaxy collection install -r collections/requirements.yml

Variables

Variable	Default	Description
seriatim_version	v1.5.0	Release identity expected from the installed binary.
seriatim_repository_url	https://gitea.maximumdirect.net/eric/seriatim.git	Source repository URL.
seriatim_source_ref	{{ seriatim_version }}	Git tag, branch, or commit to check out.
seriatim_build_version	{{ seriatim_version }}	Version injected into build metadata.
seriatim_source_dir	/usr/local/src/seriatim	Fully managed source checkout.
seriatim_binary_path	/usr/local/bin/seriatim	Installed executable path.
seriatim_build_state_dir	/usr/local/src/seriatim.ansible-build-state	Sidecar directory for build inputs and output state.
seriatim_manage_build_dependencies	true	Install Git and Go when enabled.
seriatim_go_snap_channel	1.26/stable	Go Snap channel.
seriatim_go_binary	/snap/bin/go	Go executable used to inspect and build.
seriatim_go_build_flags	[-trimpath]	Ordered Go build arguments before -ldflags.
seriatim_go_ldflags	-s -w -X gitea.maximumdirect.net/eric/seriatim/internal/buildinfo.Version={{ seriatim_build_version }}	Linker flags passed as one argument.
seriatim_go_package	./cmd/seriatim	Go package built from the checkout.

For development revisions, set both seriatim_source_ref and an honest seriatim_build_version. Released deployments should select immutable tags.

When seriatim_manage_build_dependencies is enabled, the role installs Git and converges the classic Go Snap to seriatim_go_snap_channel. When disabled, both Git and the configured Go executable must already be available, and Go must be version 1.25 or newer.

The checkout is authoritative: tracked changes and all untracked or ignored files beneath seriatim_source_dir are discarded during convergence. The repository URL may point to a private remote, but authentication must be provided independently through the managed host's Git configuration or SSH environment; this role does not manage credentials or accept unknown host keys.

Build and installation behavior

Builds run from the selected checkout with GOWORK=off, GOTOOLCHAIN=local, CGO_ENABLED=0, the configured ordered build flags, and the upstream version-injection linker flags. The resulting executable is staged and must report the exact configured version before it atomically replaces seriatim_binary_path. It is installed as root:root mode 0755.

The role records readable inputs, their SHA-256 fingerprint, and the installed binary checksum beneath seriatim_build_state_dir. A source commit, compiler identity, Go path, version, flags, linker flags, package, or fixed environment change triggers a rebuild. Missing or corrupt state, a modified binary, or an incorrect installed version also triggers rebuilding. Failed compilation or staged validation leaves the previous installed binary and successful state untouched.

For example, development from a branch must identify both source and output:

seriatim_source_ref: feature/example
seriatim_build_version: v1.5.0-dev

Static validation

ANSIBLE_COLLECTIONS_PATH="$PWD/.ansible/collections" \
  ../.venv/bin/ansible-playbook -i tests/inventory tests/converge.yml \
  --syntax-check
ANSIBLE_COLLECTIONS_PATH="$PWD/.ansible/collections" \
  ../.venv/bin/ansible-lint .

License

BSD-3-Clause