242 lines
8.3 KiB
YAML
242 lines
8.3 KiB
YAML
---
|
|
- name: Construct canonical Seriatim build inputs
|
|
ansible.builtin.set_fact:
|
|
seriatim_build_inputs: >-
|
|
{{ {
|
|
'source_commit': seriatim_source_commit,
|
|
'go_version': seriatim_go_version_result.stdout,
|
|
'go_binary': seriatim_go_binary,
|
|
'build_version': seriatim_build_version,
|
|
'build_flags': seriatim_go_build_flags,
|
|
'ldflags': seriatim_go_ldflags,
|
|
'package': seriatim_go_package,
|
|
'environment': {
|
|
'GOWORK': 'off',
|
|
'GOTOOLCHAIN': 'local',
|
|
'CGO_ENABLED': '0'
|
|
}
|
|
} | to_nice_json(indent=2, sort_keys=true) }}
|
|
|
|
- name: Calculate desired Seriatim build fingerprint
|
|
ansible.builtin.set_fact:
|
|
seriatim_desired_fingerprint: "{{ seriatim_build_inputs | hash('sha256') }}"
|
|
seriatim_stored_build_inputs: ""
|
|
seriatim_stored_fingerprint: ""
|
|
seriatim_stored_checksum: ""
|
|
|
|
- name: Inspect installed Seriatim binary
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_binary_path }}"
|
|
checksum_algorithm: sha256
|
|
register: seriatim_installed_binary_stat
|
|
|
|
- name: Require a regular installed Seriatim binary path
|
|
ansible.builtin.assert:
|
|
that:
|
|
- not seriatim_installed_binary_stat.stat.exists or seriatim_installed_binary_stat.stat.isreg
|
|
fail_msg: >-
|
|
Seriatim binary path exists but is not a regular file:
|
|
{{ seriatim_binary_path }}. Move the unexpected object before rerunning the role.
|
|
|
|
- name: Inspect Seriatim build input state
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_build_state_dir }}/build-inputs.json"
|
|
register: seriatim_build_inputs_state_stat
|
|
|
|
- name: Inspect Seriatim fingerprint state
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_build_state_dir }}/fingerprint.sha256"
|
|
register: seriatim_fingerprint_state_stat
|
|
|
|
- name: Inspect Seriatim checksum state
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_build_state_dir }}/binary.sha256"
|
|
register: seriatim_checksum_state_stat
|
|
|
|
- name: Read stored Seriatim fingerprint
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_build_state_dir }}/fingerprint.sha256"
|
|
register: seriatim_stored_fingerprint_result
|
|
when: seriatim_fingerprint_state_stat.stat.exists
|
|
|
|
- name: Read stored Seriatim build inputs
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_build_state_dir }}/build-inputs.json"
|
|
register: seriatim_stored_build_inputs_result
|
|
when:
|
|
- seriatim_build_inputs_state_stat.stat.isreg | default(false)
|
|
- seriatim_build_inputs_state_stat.stat.readable | default(false)
|
|
|
|
- name: Read stored Seriatim checksum
|
|
ansible.builtin.slurp:
|
|
src: "{{ seriatim_build_state_dir }}/binary.sha256"
|
|
register: seriatim_stored_checksum_result
|
|
when: seriatim_checksum_state_stat.stat.exists
|
|
|
|
- name: Record stored Seriatim state values
|
|
ansible.builtin.set_fact:
|
|
seriatim_stored_build_inputs: >-
|
|
{{ seriatim_stored_build_inputs_result.content | b64decode | trim }}
|
|
seriatim_stored_fingerprint: >-
|
|
{{ seriatim_stored_fingerprint_result.content | b64decode | trim }}
|
|
seriatim_stored_checksum: >-
|
|
{{ seriatim_stored_checksum_result.content | b64decode | trim }}
|
|
when:
|
|
- seriatim_build_inputs_state_stat.stat.isreg | default(false)
|
|
- seriatim_build_inputs_state_stat.stat.readable | default(false)
|
|
- seriatim_fingerprint_state_stat.stat.exists
|
|
- seriatim_checksum_state_stat.stat.exists
|
|
|
|
- name: Read installed Seriatim version
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "{{ seriatim_binary_path }}"
|
|
- --version
|
|
register: seriatim_installed_version_result
|
|
changed_when: false
|
|
failed_when: false
|
|
when: seriatim_installed_binary_stat.stat.exists
|
|
|
|
- name: Decide whether Seriatim requires rebuilding
|
|
ansible.builtin.set_fact:
|
|
seriatim_build_required: >-
|
|
{{ not seriatim_installed_binary_stat.stat.exists
|
|
or not seriatim_build_inputs_state_stat.stat.exists
|
|
or not seriatim_fingerprint_state_stat.stat.exists
|
|
or not seriatim_checksum_state_stat.stat.exists
|
|
or seriatim_stored_build_inputs != seriatim_build_inputs
|
|
or (seriatim_stored_build_inputs | hash('sha256')) != seriatim_stored_fingerprint
|
|
or (seriatim_stored_build_inputs | hash('sha256')) != seriatim_desired_fingerprint
|
|
or seriatim_stored_fingerprint != seriatim_desired_fingerprint
|
|
or seriatim_stored_checksum != (seriatim_installed_binary_stat.stat.checksum | default(''))
|
|
or (seriatim_installed_version_result.rc | default(1)) != 0
|
|
or (seriatim_installed_version_result.stdout | default('')) != 'seriatim version ' ~ seriatim_build_version }}
|
|
|
|
- name: Build, validate, and install Seriatim
|
|
when: seriatim_build_required
|
|
block:
|
|
- name: Create temporary Seriatim build directory
|
|
ansible.builtin.tempfile:
|
|
state: directory
|
|
prefix: ansible-seriatim-build-
|
|
register: seriatim_build_tempdir
|
|
|
|
- name: Build staged Seriatim binary
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{ [seriatim_go_binary, 'build']
|
|
+ seriatim_go_build_flags
|
|
+ ['-ldflags', seriatim_go_ldflags,
|
|
'-o', seriatim_build_tempdir.path ~ '/seriatim',
|
|
seriatim_go_package] }}
|
|
chdir: "{{ seriatim_source_dir }}"
|
|
environment:
|
|
GOWORK: "off"
|
|
GOTOOLCHAIN: local
|
|
CGO_ENABLED: "0"
|
|
changed_when: true
|
|
|
|
- name: Validate staged Seriatim binary
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "{{ seriatim_build_tempdir.path }}/seriatim"
|
|
- --version
|
|
register: seriatim_staged_version_result
|
|
changed_when: false
|
|
failed_when: >-
|
|
seriatim_staged_version_result.rc != 0 or
|
|
seriatim_staged_version_result.stdout != 'seriatim version ' ~ seriatim_build_version
|
|
|
|
- name: Install validated Seriatim binary
|
|
ansible.builtin.copy:
|
|
src: "{{ seriatim_build_tempdir.path }}/seriatim"
|
|
dest: "{{ seriatim_binary_path }}"
|
|
remote_src: true
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Validate installed Seriatim binary
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "{{ seriatim_binary_path }}"
|
|
- --version
|
|
register: seriatim_new_installed_version_result
|
|
changed_when: false
|
|
failed_when: >-
|
|
seriatim_new_installed_version_result.rc != 0 or
|
|
seriatim_new_installed_version_result.stdout != 'seriatim version ' ~ seriatim_build_version
|
|
|
|
- name: Calculate installed Seriatim checksum
|
|
ansible.builtin.stat:
|
|
path: "{{ seriatim_binary_path }}"
|
|
checksum_algorithm: sha256
|
|
register: seriatim_new_binary_stat
|
|
|
|
- name: Create Seriatim build state directory
|
|
ansible.builtin.file:
|
|
path: "{{ seriatim_build_state_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Record Seriatim build inputs
|
|
ansible.builtin.copy:
|
|
content: "{{ seriatim_build_inputs }}\n"
|
|
dest: "{{ seriatim_build_state_dir }}/build-inputs.json"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Record Seriatim build fingerprint
|
|
ansible.builtin.copy:
|
|
content: "{{ seriatim_desired_fingerprint }}\n"
|
|
dest: "{{ seriatim_build_state_dir }}/fingerprint.sha256"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Record installed Seriatim checksum
|
|
ansible.builtin.copy:
|
|
content: "{{ seriatim_new_binary_stat.stat.checksum }}\n"
|
|
dest: "{{ seriatim_build_state_dir }}/binary.sha256"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
always:
|
|
- name: Remove temporary Seriatim build directory
|
|
ansible.builtin.file:
|
|
path: "{{ seriatim_build_tempdir.path }}"
|
|
state: absent
|
|
when: seriatim_build_tempdir.path is defined
|
|
|
|
- name: Converge installed Seriatim binary metadata
|
|
ansible.builtin.file:
|
|
path: "{{ seriatim_binary_path }}"
|
|
state: file
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Converge Seriatim build state directory metadata
|
|
ansible.builtin.file:
|
|
path: "{{ seriatim_build_state_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Converge Seriatim build state file metadata
|
|
ansible.builtin.file:
|
|
path: "{{ seriatim_build_state_dir }}/{{ item }}"
|
|
state: file
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- build-inputs.json
|
|
- fingerprint.sha256
|
|
- binary.sha256
|