Setup GH Action to create Self Hosted GH Runners on the STFC Cloud

[Ziggiyzoo]

Closes: #1

Use Terraform & ansible to create a VMs for Self Hosted GitHub Action Runners

[Ziggiyzoo]

Documentation on the process https://github.com/isisbusapps/ISISBusApps/wiki/Deployment-of-Self-Hosted-Github-Action-Runners

[vovsike]

Looks good overall, a few comments there and there mainly to improve security around accidentally exposing secrets.

Also is it possible to make it so the number of runners made is configurable as an input param?

[vovsike]

IS the name correct? Also it can be a bit more user friednly with spaces

[vovsike]

Suggested change

	- name: Setup SSH
	env:
	VM_IPS: ${{ steps.export.outputs.check-vms.vm_ips}}
	run: |
	service ssh status
	eval `ssh-agent -s`
	mkdir -p ~/.ssh/
	touch ~/.ssh/config
	touch ~/.ssh/id_rsa
	echo -e "${{ secrets.FASE_SSH_KEY }}" > ~/.ssh/id_rsa
	chmod 400 ~/.ssh/id_rsa
	echo $VM_IPS >> ../ansible/hosts.txt
	sed -i '$!s/$/,/' ../ansible/hosts.txt
	ssh-keyscan -f ../ansible/hosts.txt >> ~/.ssh/known_hosts
	- name: Setup SSH
	env:
	VM_IPS: ${{ steps.export.outputs.check-vms.vm_ips }}
	FASE_SSH_KEY: ${{ secrets.FASE_SSH_KEY }}
	run: |
	mkdir -p ~/.ssh
	echo "$FASE_SSH_KEY" > ~/.ssh/id_rsa
	chmod 400 ~/.ssh/id_rsa
	eval $(ssh-agent -s)
	ssh-add ~/.ssh/id_rsa
	echo "$VM_IPS" >> ../ansible/hosts.txt
	sed -i '$!s/$/,/' ../ansible/hosts.txt
	ssh-keyscan -f ../ansible/hosts.txt >> ~/.ssh/known_hosts

[vovsike]

a bit cleaner version. Not sure why you needed config file as well if you never use it

[vovsike]

Suggested change

	- name: Run GitHub runner setup playbook # Include any environment variables needed
	run: |
	ansible-playbook --private-key ~/.ssh/id_rsa -u ${{ secrets.ANSIBLE_DEPLOY_USER }} -i ../ansible/hosts.ini ../ansible/create-gh-action-runners.yaml --extra-vars ACCESS_TOKEN=${{ secrets.ACCESS_TOKEN }} --extra-vars ORG=${{ github.repository_owner }}
	- name: Run GitHub runner setup playbook
	env:
	ANSIBLE_DEPLOY_USER: ${{ secrets.ANSIBLE_DEPLOY_USER }}
	ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
	run: |
	cat > /tmp/extra_vars.yml << EOF
	ACCESS_TOKEN: "${ACCESS_TOKEN}"
	ORG: "${{ github.repository_owner }}"
	EOF
	ansible-playbook \
	--private-key ~/.ssh/id_rsa \
	-u "$ANSIBLE_DEPLOY_USER" \
	-i ../ansible/hosts.ini \
	../ansible/create-gh-action-runners.yaml \
	--extra-vars "@/tmp/extra_vars.yml"
	rm -f /tmp/extra_vars.yml

[vovsike]

can update to checkout v6 I think

[vovsike]

Suggested change

	- name: Setup SSH
	env:
	VM_IPS: ${{ steps.export.outputs.check-vms.vm_ips}}
	run: |
	service ssh status
	eval `ssh-agent -s`
	mkdir -p ~/.ssh/
	touch ~/.ssh/config
	touch ~/.ssh/id_rsa
	echo -e "${{ secrets.FASE_SSH_KEY }}" > ~/.ssh/id_rsa
	chmod 400 ~/.ssh/id_rsa
	echo [servers] > ../ansible/hosts.ini
	cat hosts.txt >> ../ansible/hosts.ini
	sed -i '$!s/$/,/' ../ansible/hosts.txt
	ssh-keyscan -f ../ansible/hosts.txt >> ~/.ssh/known_hosts
	- name: Setup SSH
	env:
	VM_IPS: ${{ steps.export.outputs.check-vms.vm_ips }}
	FASE_SSH_KEY: ${{ secrets.FASE_SSH_KEY }}
	run: |
	mkdir -p ~/.ssh
	echo "$FASE_SSH_KEY" > ~/.ssh/id_rsa
	chmod 400 ~/.ssh/id_rsa
	eval $(ssh-agent -s)
	ssh-add ~/.ssh/id_rsa
	echo [servers] > ../ansible/hosts.ini
	cat hosts.txt >> ../ansible/hosts.ini
	sed -i '$!s/$/,/' ../ansible/hosts.txt
	ssh-keyscan -f ../ansible/hosts.txt >> ~/.ssh/known_hosts

[vovsike]

Same as the other one, I think they were very similar apart from the hosts file

[vovsike]

Probably just format the same way I have suggested above

[vovsike]

are these mean to be here? and if so will they stay static? It looks like new runners will just get new IPs