ci: run drift's ansible as the bot; cd_bot pubkey by var #9

Merged

paul merged 1 commit from erwin/ci-as-bot into main

2026-07-26 06:32:01 +00:00

erwin commented

2026-07-09 15:04:22 +00:00

Collaborator

Fixes drift run 28's fetch failure (inventory pins paul + workstation key path, absent on the runner). drift-check.sh honors CD_BOT_USER for its ansible identity; cd_bot accepts the runner pubkey via -e for per-host rollouts. Prerequisite for the drift CLEAN dispatch; merge before the milton converge round.

erwin added 1 commit

2026-07-09 15:04:22 +00:00

ci: run drift's ansible as the bot; cd_bot pubkey by var 2e5be7c752

Drift run 28 failed at the fetch on both hosts and the log names the
reason exactly: the inventory pins ansible_user=paul and paul's
WORKSTATION key path (~/.ssh/gierz_ed25519), neither of which exists
on the runner host - "no such identity ... Permission denied". The
act_runner design note "reuses paul's SSH keys" was never true on the
VM; the milton branch fixes the identity, and this makes drift
actually use it:

- drift-check.sh: when CD_BOT_USER is set (the CI runner), every
  ansible call gets -e ansible_user / -e ansible_ssh_private_key_file
  for the bot. Laptop callers leave it unset and keep inventory
  connection settings. drift.yml renames CD_BOT_NAME to CD_BOT_USER
  (one knob for the notification name AND the ssh identity) and
  documents the requirement on erwin/milton-runner being converged.

- roles/cd_bot: the runner-pubkey slurp is skipped when the caller
  provides cd_bot_runner_pubkey by -e, so host-by-host rollouts work
  when the runner host is not reachable with the same connection args
  (off-LAN, tenant VM down). README shows the pattern.

Signed-off-by: erwin <erwin@gierz.eu>
Co-Authored-By: LLM <noreply@invalid>
Claude-Session: https://claude.ai/code/session_01UVBwAUedQi9YJ6S9UJomMS

paul merged commit f66df3680e into main

2026-07-26 06:32:01 +00:00

paul referenced this pull request from a commit

2026-07-26 06:32:03 +00:00

Merge pull request 'ci: run drift's ansible as the bot; cd_bot pubkey by var' (#9) from erwin/ci-as-bot into main