ansible: refactor known_hosts tasks for github.com

Refactor the Ansible tasks for updating the `known_hosts` file for
github.com into its own role. Call that role from both the docker-host
and jenkins-worker/create playbooks.

ansible/roles/docker/tasks/main.yml

@@ -89,6 +89,16 @@
     - "{{ containers }}"
   when: containers is defined
 
+- name: enable fetching from github.com
+  include_role:
+    name: github
+  vars:
+    user_home_dir: "/{{ home }}/{{ server_user }}/{{ container.name }}/"
+  loop: "{{ containers|flatten(levels=1) }}"
+  loop_control:
+    loop_var: container
+  when: containers is defined
+
 - name: set up for release builders
   include_role:
     name: release-builder

ansible/roles/github/meta/argument_specs.yml

@@ -0,0 +1,10 @@
+---
+
+argument_specs:
+  main:
+    short_description: Set up specific to hosts that need to interact with github.com.
+    options:
+      user_home_dir:
+        description: The user's HOME directory.
+        required: yes
+        type: str

ansible/roles/github/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+
+# Set up hosts to be able to checkout/fetch from github.com.
+
+- name: create .ssh directory
+  ansible.builtin.file:
+    dest: "{{ user_home_dir }}/.ssh"
+    mode: "0700"
+    owner: "{{ server_user }}"
+    group: "{{ server_user }}"
+    state: directory
+
+- name: write github.com entry in known_hosts
+  ansible.builtin.known_hosts:
+    name: github.com
+    key: "{{ item }}"
+    path: "{{ user_home_dir }}/.ssh/known_hosts"
+    state: present
+  become: yes
+  become_user: "{{ server_user }}"
+  loop: "{{ lookup('file', 'files/github_known_hosts').splitlines() }}"
+
+- name: remove old github.com ssh keys
+  ansible.builtin.lineinfile:
+    path: "{{ user_home_dir }}/.ssh/known_hosts"
+    search_string: "{{ item }}"
+    state: absent
+  become: yes
+  become_user: "{{ server_user }}"
+  loop: "{{ lookup('file', 'files/github_bad_hosts').splitlines() }}"

ansible/roles/jenkins-worker/meta/main.yml

@@ -5,6 +5,9 @@
 
 dependencies:
   - role: user-create
+  - role: github
+    vars:
+      user_home_dir: "/home/{{ server_user }}"
   - role: java-base
   - role: build-test-v8
     when: build_test_v8|default(False)

ansible/roles/jenkins-worker/tasks/main.yml

@@ -31,33 +31,6 @@
     state: present
     line: ::1 localhost.localdomain localhost
 
-- name: create .ssh directory
-  ansible.builtin.file:
-    dest: "{{ home }}/{{ server_user }}/.ssh"
-    mode: "0700"
-    owner: "{{ server_user }}"
-    group: "{{ server_user }}"
-    state: directory
-
-- name: write github.com entry in known_hosts
-  ansible.builtin.known_hosts:
-    name: github.com
-    key: "{{ item }}"
-    path: "{{ home }}/{{ server_user }}/.ssh/known_hosts"
-    state: present
-  become: yes
-  become_user: "{{ server_user }}"
-  loop: "{{ lookup('file', 'files/github_known_hosts').splitlines() }}"
-
-- name: remove old github.com ssh keys
-  ansible.builtin.lineinfile:
-    path: "{{ home }}/{{ server_user }}/.ssh/known_hosts"
-    search_string: "{{ item }}"
-    state: absent
-  become: yes
-  become_user: "{{ server_user }}"
-  loop: "{{ lookup('file', 'files/github_bad_hosts').splitlines() }}"
-
 - name: run raspberry pi jenkins-worker setup
   when: "inventory_hostname|regex_search('-arm(v6l|v7l|64)_pi')"
   include: "{{ role_path }}/tasks/partials/raspberry-pi.yml"