I'm trying to use Githubactions secrets in my ansible playbooks that will then be passed to templates, but there is no lookup plugin for GHA. This does not work:
- hosts: the-host
vars:
influxdb_pass: "{{ lookup('env', 'secret.INFLUXDB_PASS' }}"
My workaround is to expose the secrets through GHA environment variables and just use the ansible env lookup plugin:
name: Pull Request - Ansible
on:
pull_request:
branches:
- master
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v1
- name: Config updates
env:
INFLUXDB_PASS: ${{ secrets.INFLUXDB_PASS }}
- hosts: the-host
vars:
influxdb_pass: "{{ lookup('env', 'INFLUXDB_PASS' }}"
The problem is I manage plenty of secrets and it is annoying having to:
- Add the secret in the repo settings
- Define the variable in ansible-playbook
- Explicitly expose the secrets through environment variables in the GHA workflow.
When in other CI tools such as Gitlab you don't need to do the explicit secret expose, you can consume secrets directly as env vars.
Does anyone have advice on a better approach for GHA?