awx/awx/playbooks/project_update.yml

---
# The following variables will be set by the runner of this playbook:
# projects_root: Global location for caching project checkouts and roles and collections
#     should not have trailing slash on end
# local_path: Path within projects_root to use for this project
# project_path: A simple join of projects_root/local_path folders
# scm_url: https://server/repo
# insights_url: Insights service URL (from configuration)
# scm_branch: branch/tag/revision (HEAD if unset)
# scm_clean: true/false
# scm_username: username (only for svn/insights)
# scm_password: password (only for svn/insights)
# scm_accept_hostkey: true/false (only for git, set automatically)
# scm_refspec: a refspec to fetch in addition to obtaining version
# scm_track_submodules: true/false
# roles_enabled: Value of the global setting to enable roles downloading
# collections_enabled: Value of the global setting to enable collections downloading
# galaxy_task_env: environment variables to use specifically for ansible-galaxy commands
# awx_version: Current running version of the awx or tower as a string
# awx_license_type: "open" for AWX; else presume Tower
# gpg_pubkey: the GPG public key to use for validation, when enabled

- hosts: localhost
  gather_facts: false
  connection: local
  name: Update source tree if necessary
  tasks:
    - name: Delete project directory before update
      ansible.builtin.shell: set -o pipefail && find . -delete -print | tail -2  # volume mounted, cannot delete folder itself
      register: reg
      changed_when: reg.stdout_lines | length > 1
      args:
        chdir: "{{ project_path }}"
      tags:
        - delete

    - name: Update project using git
      tags:
        - update_git
      block:
        - name: Update project using git
          ansible.builtin.git:
            dest: "{{ project_path | quote }}"
            repo: "{{ scm_url }}"
            version: "{{ scm_branch | quote }}"
            refspec: "{{ scm_refspec | default(omit) }}"
            force: "{{ scm_clean }}"
            track_submodules: "{{ scm_track_submodules | default(omit) }}"
            accept_hostkey: "{{ scm_accept_hostkey | default(omit) }}"
          register: git_result

        - name: Set the git repository version
          ansible.builtin.set_fact:
            scm_version: "{{ git_result['after'] }}"
          when: "'after' in git_result"

    - name: Update project using svn
      tags:
        - update_svn
      block:
        - name: Update project using svn
          ansible.builtin.subversion:
            dest: "{{ project_path | quote }}"
            repo: "{{ scm_url | quote }}"
            revision: "{{ scm_branch | quote }}"
            force: "{{ scm_clean }}"
            username: "{{ scm_username | default(omit) }}"
            password: "{{ scm_password | default(omit) }}"
            # must be in_place because folder pre-existing, because it is mounted
            in_place: true
          environment:
            LC_ALL: 'en_US.UTF-8'
          register: svn_result

        - name: Set the svn repository version
          ansible.builtin.set_fact:
            scm_version: "{{ svn_result['after'] }}"
          when: "'after' in svn_result"

        - name: Parse subversion version string properly
          ansible.builtin.set_fact:
            scm_version: "{{ scm_version | regex_replace('^.*Revision: ([0-9]+).*$', '\\1') }}"


    - name: Project update for Insights
      tags:
        - update_insights
      block:
        - name: Ensure the project directory is present
          ansible.builtin.file:
            dest: "{{ project_path | quote }}"
            state: directory
            mode: '0755'

        - name: Fetch Insights Playbook(s)
          insights:
            insights_url: "{{ insights_url }}"
            username: "{{ scm_username }}"
            password: "{{ scm_password }}"
            project_path: "{{ project_path }}"
            awx_license_type: "{{ awx_license_type }}"
            awx_version: "{{ awx_version }}"
          register: results

        - name: Save Insights Version
          ansible.builtin.set_fact:
            scm_version: "{{ results.version }}"
          when: results is defined


    - name: Update project using archive
      tags:
        - update_archive
      block:
        - name: Ensure the project archive directory is present
          ansible.builtin.file:
            dest: "{{ project_path | quote }}/.archive"
            state: directory
            mode: '0755'

        - name: Get archive from url
          ansible.builtin.get_url:
            url: "{{ scm_url | quote }}"
            dest: "{{ project_path | quote }}/.archive/"
            url_username: "{{ scm_username | default(omit) }}"
            url_password: "{{ scm_password | default(omit) }}"
            force_basic_auth: true
            mode: '0755'
          register: get_archive

        - name: Unpack archive
          project_archive:
            src: "{{ get_archive.dest }}"
            project_path: "{{ project_path | quote }}"
            force: "{{ scm_clean }}"
          when: get_archive.changed or scm_clean
          register: unarchived

        - name: Find previous archives
          ansible.builtin.find:
            paths: "{{ project_path | quote }}/.archive/"
            excludes:
              - "{{ get_archive.dest | basename }}"
          when: unarchived.changed
          register: previous_archive

        - name: Remove previous archives
          ansible.builtin.file:
            path: "{{ item.path }}"
            state: absent
          loop: "{{ previous_archive.files }}"
          when: previous_archive.files | default([])

        - name: Set scm_version to archive sha1 checksum
          ansible.builtin.set_fact:
            scm_version: "{{ get_archive.checksum_src }}"

    - name: Repository Version
      ansible.builtin.debug:
        msg: "Repository Version {{ scm_version }}"
      tags:
        - update_git
        - update_svn
        - update_insights
        - update_archive

- hosts: localhost
  gather_facts: false
  connection: local
  name: Perform project signature/checksum verification
  tasks:
    - name: Verify project content using GPG signature
      verify_project:
        project_path: "{{ project_path | quote }}"
        validation_type: gpg
        gpg_pubkey: "{{ gpg_pubkey }}"
      tags:
        - validation_gpg_public_key

    - name: Verify project content against checksum manifest
      verify_project:
        project_path: "{{ project_path | quote }}"
        validation_type: checksum_manifest
      tags:
        - validation_checksum_manifest

- hosts: localhost
  gather_facts: false
  connection: local
  name: Install content with ansible-galaxy command if necessary
  vars:
    galaxy_task_env:  # configured in settings
    # additional_galaxy_env contains environment variables are used for installing roles and collections and will take precedence over items in galaxy_task_env
    additional_galaxy_env:
      # These paths control where ansible-galaxy installs collections and roles on top the filesystem
      ANSIBLE_COLLECTIONS_PATHS: "{{ projects_root }}/.__awx_cache/{{ local_path }}/stage/requirements_collections"
      ANSIBLE_ROLES_PATH: "{{ projects_root }}/.__awx_cache/{{ local_path }}/stage/requirements_roles"
      # Put the local tmp directory in same volume as collection destination
      # otherwise, files cannot be moved accross volumes and will cause error
      ANSIBLE_LOCAL_TEMP: "{{ projects_root }}/.__awx_cache/{{ local_path }}/stage/tmp"
  tasks:
    - name: Check content sync settings
      when: not roles_enabled | bool and not collections_enabled | bool
      tags:
        - install_roles
        - install_collections
      block:
        - name: Warn about disabled content sync
          ansible.builtin.debug:
            msg: >
              Collection and role syncing disabled. Check the AWX_ROLES_ENABLED and
              AWX_COLLECTIONS_ENABLED settings and Galaxy credentials on the project's organization.
        - name: End play due to disabled content sync
          ansible.builtin.meta: end_play

    - block:
        - name: Fetch galaxy roles from roles/requirements.(yml/yaml)
          ansible.builtin.command:
            cmd: "ansible-galaxy role install -r {{ req_file }} {{ verbosity }}"
          register: galaxy_result
          vars:
            req_file: "{{ lookup('ansible.builtin.first_found', req_candidates, skip=True) }}"
            req_candidates:
              - "{{ project_path | quote }}/roles/requirements.yml"
              - "{{ project_path | quote }}/roles/requirements.yaml"
          changed_when: "'was installed successfully' in galaxy_result.stdout"
          when:
            - roles_enabled | bool
            - req_file
          tags:
            - install_roles

        - name: Fetch galaxy collections from collections/requirements.(yml/yaml)
          ansible.builtin.command:
            cmd: "ansible-galaxy collection install -r {{ req_file }} {{ verbosity }}"
          register: galaxy_collection_result
          vars:
            req_file: "{{ lookup('ansible.builtin.first_found', req_candidates, skip=True) }}"
            req_candidates:
              - "{{ project_path | quote }}/collections/requirements.yml"
              - "{{ project_path | quote }}/collections/requirements.yaml"
              - "{{ project_path | quote }}/requirements.yml"
              - "{{ project_path | quote }}/requirements.yaml"
          changed_when: "'Nothing to do.' not in galaxy_collection_result.stdout"
          when:
            - "ansible_version.full is version_compare('2.9', '>=')"
            - collections_enabled | bool
            - req_file
          tags:
            - install_collections

        - name: Fetch galaxy roles and collections from requirements.(yml/yaml)
          ansible.builtin.command:
            cmd: "ansible-galaxy install -r {{ req_file }} {{ verbosity }}"
          register: galaxy_combined_result
          vars:
            req_file: "{{ lookup('ansible.builtin.first_found', req_candidates, skip=True) }}"
            req_candidates:
              - "{{ project_path | quote }}/requirements.yaml"
              - "{{ project_path | quote }}/requirements.yml"
          changed_when: "'Nothing to do.' not in galaxy_combined_result.stdout"
          when:
            - "ansible_version.full is version_compare('2.10', '>=')"
            - collections_enabled | bool
            - roles_enabled | bool
            - req_file
          tags:
            - install_collections
            - install_roles
      module_defaults:
        ansible.builtin.command:
          chdir: "{{ project_path | quote }}"

      # We combine our additional_galaxy_env into galaxy_task_env so that our values are preferred over anything a user would set
      environment: "{{ galaxy_task_env | combine(additional_galaxy_env) }}"
      vars:
        verbosity: "{{ (ansible_verbosity) | ternary('-'+'v'*ansible_verbosity, '') }}"