feat: obfuscate ansible logs

.bin/commands.sh

@@ -72,10 +72,9 @@ function seed:apply() {
 }
 
 function deploy:log:encrypt() {
-  "${SCRIPT_DIR}/deploy-log-encrypt.sh" "$@"
+  (cd "$ROOT_DIR" && "${SCRIPT_DIR}/deploy-log-encrypt.sh" "$@")
 }
 
 function deploy:log:decrypt() {
-  "${SCRIPT_DIR}/deploy-log-decrypt.sh" "$@"
+  (cd "$ROOT_DIR" && "${SCRIPT_DIR}/deploy-log-decrypt.sh" "$@")
 }
-

.bin/scripts/deploy-log-decrypt.sh

@@ -9,6 +9,13 @@ else
     shift
 fi
 
+if [ -z "${1:-}" ]; then
+  read -p "Veuillez renseigner l'ID du job: " JOB_ID
+else
+    readonly JOB_ID="$1"
+    shift
+fi
+
 if [[ -z "${ANSIBLE_VAULT_PASSWORD_FILE:-}" ]]; then
   ansible_extra_opts+=("--vault-password-file" "${SCRIPT_DIR}/get-vault-password-client.sh")
 else
@@ -24,10 +31,10 @@ delete_cleartext() {
 trap delete_cleartext EXIT
 
 
-rm -f /tmp/deploy_error.log.gpg
+rm -f /tmp/deploy.log.gpg
 
-gh run download "$RUN_ID" -n error-logs -D /tmp
+gh run download "$RUN_ID" -n "logs-$JOB_ID" -D /tmp
 
 ansible-vault view "${ansible_extra_opts[@]}" "$VAULT_FILE" | yq '.vault.SEED_GPG_PASSPHRASE' > "$PASSPHRASE"
 
-gpg -d --batch --passphrase-file "$PASSPHRASE" /tmp/deploy_error.log.gpg
+gpg -d --batch --passphrase-file "$PASSPHRASE" /tmp/deploy.log.gpg

.bin/scripts/deploy-log-encrypt.sh

@@ -19,5 +19,5 @@ trap delete_cleartext EXIT
 ansible-vault view "${ansible_extra_opts[@]}" "$VAULT_FILE" | yq '.vault.SEED_GPG_PASSPHRASE' > "$PASSPHRASE"
 
 # Make sur the file exists
-touch /tmp/deploy_error.log
-gpg  -c --cipher-algo twofish --batch --passphrase-file "$PASSPHRASE" -o /tmp/deploy_error.log.gpg /tmp/deploy_error.log
+touch /tmp/deploy.log
+gpg  -c --cipher-algo twofish --batch --passphrase-file "$PASSPHRASE" -o /tmp/deploy.log.gpg /tmp/deploy.log

.bin/scripts/run-playbook.sh

@@ -6,7 +6,6 @@ readonly PLAYBOOK_NAME=${1:?"Merci de le nom du playbook"}
 shift
 readonly ENV_FILTER=${1:?"Merci de préciser un ou plusieurs environnements (ex. recette ou production)"}
 shift
-readonly PRODUCT_NAME=bal
 
 function runPlaybook() {
   echo "Lancement du playbook ${PLAYBOOK_NAME} pour l'environnement ${ENV_FILTER}..."
@@ -62,5 +61,5 @@ function runPlaybook() {
 if [[ -z "${CI:-}" ]]; then
   runPlaybook "$@"
 else
-  runPlaybook "$@" 2> /tmp/deploy_error.log
+  runPlaybook "$@" &> /tmp/deploy.log
 fi;

.github/workflows/_deploy.yml

@@ -71,32 +71,36 @@ jobs:
         run: echo ${{ secrets.VAULT_PWD }} > .infra/.vault_pwd.txt
 
       - name: Run playbook
-        run: .bin/mna-bal deploy ${{ inputs.environment }} --extra-vars "app_version=${{ inputs.app_version }}"
+        run: .bin/mna deploy ${{ inputs.environment }} --extra-vars "app_version=${{ inputs.app_version }}"
         env:
           ANSIBLE_VAULT_PASSWORD_FILE: .infra/.vault_pwd.txt
           ANSIBLE_REMOTE_USER: deploy
           ANSIBLE_BECOME_PASS: ${{ secrets.DEPLOY_PASS }}
 
-      - name: Encrypt Error log on failure
-        run: .bin/mna-bal deploy:log:encrypt
-        if: failure()
+      - name: Encrypt logs
+        run: .bin/mna deploy:log:encrypt
+        if: always()
         env:
           ANSIBLE_VAULT_PASSWORD_FILE: .infra/.vault_pwd.txt
 
-      - name: Upload failure artifacts on failure
-        if: failure()
-        uses: actions/upload-artifact@v3
+      - name: Upload logs artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          name: error-logs
-          path: /tmp/deploy_error.log.gpg
+          name: logs-${{ inputs.environment }}
+          path: /tmp/deploy.log.gpg
+
+      - name: Add Job summary
+        if: always()
+        run: echo 'You can get logs using `.bin/mna deploy:log:decrypt ${{ github.run_id }} ${{ inputs.environment }}`' >> $GITHUB_STEP_SUMMARY
 
       - name: Notify failure on Slack
         uses: ravsamhq/notify-slack-action@v2
         if: always()
         with:
           status: ${{ job.status }}
           notification_title: "Le déploiement ${{ inputs.app_version }} en ${{ inputs.environment }} a échoué"
-          message_format: "{emoji} *[${{ inputs.environment }}]* *{workflow}* {status_message} in <{repo_url}|{branch}> on <{commit_url}|{commit_sha}>. You can get error logs using `.bin/mna-bal deploy:log:decrypt ${{ github.run_id }}`"
+          message_format: "{emoji} *[${{ inputs.environment }}]* *{workflow}* {status_message} in <{repo_url}|{branch}> on <{commit_url}|{commit_sha}>. You can get error logs using `.bin/mna-bal deploy:log:decrypt ${{ github.run_id }} ${{ inputs.environment }}`"
           notify_when: "failure"
           mention_groups: "!channel"
         env:

.github/workflows/deploy_preview.yml

@@ -89,18 +89,22 @@ jobs:
           ANSIBLE_REMOTE_USER: deploy
           ANSIBLE_BECOME_PASS: ${{ secrets.DEPLOY_PASS }}
 
-      - name: Encrypt Error log on failure
+      - name: Encrypt logs
         run: .bin/mna-bal deploy:log:encrypt
-        if: failure()
+        if: always()
         env:
           ANSIBLE_VAULT_PASSWORD_FILE: .infra/.vault_pwd.txt
 
-      - name: Upload failure artifacts on failure
-        if: failure()
+      - name: Upload log artifacts
+        if: always()
         uses: actions/upload-artifact@v3
         with:
-          name: error-logs
-          path: /tmp/deploy_error.log.gpg
+          name: logs-${{ github.event.issue.number }}
+          path: /tmp/deploy.log.gpg
+
+      - name: Add Job summary
+        if: always()
+        run: echo 'You can get logs using `.bin/mna deploy:log:decrypt ${{ github.run_id }} ${{ github.event.issue.number }}`' >> $GITHUB_STEP_SUMMARY
 
       - name: Preview Summary when failed
         if: failure()