github-actions: The vault password file was not found

[ReenigneArcher]

Summary

Ansible lint gives warnings/errors that it cannot find the vault password file. I create my vault password using the following step before the ansible lint step.

run: echo ${{ secrets.MYSECRET || '1234' }} > .vault-password

I run ansible lint with this step:

uses: ansible/[email protected]
with:
  args: "playbooks/"

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint --version

6.18.0 (using ansible-lint as github action)

• ansible installation method: pypi
• ansible-lint installation method: using github action

STEPS TO REPRODUCE

Set password file location in config.

ansible.cfg

vault_password_file=.vault-password

Create vault passowrd file in workflow, as shown above.

Run ansible lint action, as shown above.

Desired Behavior

Find the file, that was created.

Possible security bugs should be reported via email to [email protected]

Actual Behavior

File was not found.

Warning: /some_playbook.yml:1 [WARNING]: Error getting vault password file (default): The vault password file /runner/_work/ansible-repo/ansible-repo/.vault-password was not found

Additional Information

I use the same method of creating the .vault-password file to actually run ansible playbooks inside of GitHub actions, and that works fine. I also did not have this problem on the now depreciated ansible-lint-action repository.

[mszumilak]

This seems to be a duplicate of #2443

[ReenigneArcher]

@mszumilak Maybe similar but I don't think it's a duplicate. They are having jinja and variable issues. I am having the issue where it cannot find the vault password file that does exist.

[ssbarnea]

@ReenigneArcher I do think that the vault password is not found because the current directory is different when running from lint. I would recommend you to ensure that you configure the path to vault file to be a full path, just in case.

Print the full of your dumped file, to check it.

[ReenigneArcher]

Why would the working directory be different? I have not specified a different working directory.

And I don't think that's the case, otherwise ansible would not be able to find my ansible.cfg file which is in the working directory, and the only place where the vault password file is specified.

---
# Lint Ansible files.

name: Ansible lint

# yamllint disable-line rule:truthy
on:
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ansible_lint:
    name: ansible lint
    # runs-on: ubuntu-latest
    runs-on: [self-hosted, linux, X64]
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Create vault_password
        run: |
          echo "1234" > .vault-password

      - name: Ansible lint
        id: ansible-lint
        uses: ansible/[email protected]
        with:
          args: "playbooks/"

      - name: Remove vault_password
        if: always()
        run: |
          rm -f .vault-password

Works fine with the old action, using.

      - name: Ansible lint
        id: ansible-lint
        uses: ansible/[email protected]
        with:
          path: "playbooks/"

Also added a statement to print the current directory and contents right before the ansible lint action.

  echo "1234" > .vault-password
  echo "Current working directory: $(pwd)"
  echo "Current directory contents:"
  ls -a .

As you can see the file does exist.

Current working directory: /runner/_work/ansible-repo/ansible-repo
Current directory contents:
.
..
.git
.github
.gitignore
.vault-password
.yamllint.yml
README.md
ansible.cfg
inventory
playbooks
requirements.txt
requirements.yml

So, yea. This is definitely a bug in this action, since it can't find a file that does exist.

Warning: /some_playbook.yml:1 [WARNING]: Error getting vault password file (default): The vault password file /runner/_work/ansible-repo/ansible-repo/.vault-password was not found

[ReenigneArcher]

Bump

[ReenigneArcher]

FYI:

Works fine if I replace the GitHub action with CLI version.

      - name: Ansible lint
        run: |
          ansible-lint ./playbooks

[ReenigneArcher]

Specifying a full path to the password file is not the most practical advice as when you deploy the playbooks, the environments/directory structure likely don't match what you get with a GitHub runner.

Anyway, the password file exists at this location, which ansible lint is saying doesn't exist.

/runner/_work/ansible-repo/ansible-repo/.vault-password

[tamiroh]

I also encountered the same problem.

I think the reason for this is that actions/checkout deletes existing files when it runs. This is a specification and maybe impossible to work around.

[ReenigneArcher]

Impossible, since I create the vault password file AFTER the checkout step.

[ssbarnea]

How about dumping the file outside the cloning area, maybe even in TMP. This should work. I will convert the issue into a discussion as it does not seem like a bug.

[akzov]

You would then have to gitignore your ansible config file or use a temp directory in production

[akzov]

Can this also be converted back into an issue, actions shouldn't be running actions that break other steps

[mszumilak]

@mszumilak Maybe similar but I don't think it's a duplicate. They are having jinja and variable issues. I am having the issue where it cannot find the vault password file that does exist.

Acutally I believe it's the same as it has the common denominator: ansible-lint does not accept vault configuration ansible does. So ansible.cfg entries and ANSIBLE_VAULT_PASSWORD_FILE should be accepted.

Additionaly: ANSIBLE_VAULT_PASSWORD_FILE env should have priority as many CI/CD systems are exposing this env variable for ansible configuration and it's harder to predict than ansible.cfg entry.

So to summarize: ansible-lint is not compliant with ansible configuration and that's the main issue here.

In addition: ansible-lint does not support supplying vault password in any way as a runtime parameter.

Considering all mentioned above THIS IS A BUG. It's ansible-lint, otherwise I'd use yaml.lint and it should be fine.

[akzov]

You can't modify the environment to add a vault password file because the ansible-lint action destroys the existing environment each run by running actions/checkout with clean:true.

I recommend using the archived ansible/anisble-lint-action with vault files until this is resolved.

[ReenigneArcher]

I think you're on to something... looking into the action.yml, there is a lot of unnecessary stuff going on there. I'm going to put up a PR to improve it.

For one... it shouldn't be doing any checkout... the user should definitely be setting up their own environment!

I put a PR to address this: #3798

Doesn't matter that much to me now, I moved to just installing ansible-lint and running it natively in my workflow.

[akzov]

If they want to continue using actions/checkout they need to specify clean:false to avoid breaking changes made in other steps, but it's better to just allow the user to run their own checkout

[ReenigneArcher]

I agree. I've used a lot of different github actions and never came across one that did a checkout of the user's repo (other than of course actions/checkout).