a13labs.infra/ansible/roles/windows_gitea_runner_podman/tasks/main.yml

---
- name: Validate required runner settings
  ansible.builtin.assert:
    that:
      - windows_gitea_runner_podman_instance_url | length > 0
      - windows_gitea_runner_podman_registration_token | length > 0
      - windows_gitea_runner_podman_runners | length > 0
    fail_msg: >-
      windows_gitea_runner_podman_instance_url, windows_gitea_runner_podman_registration_token,
      and at least one windows_gitea_runner_podman_runners entry are required.
  tags:
    - always

- name: Ensure Podman auto-start service is running
  ansible.windows.win_service:
    name: "{{ windows_gitea_runner_podman_service_name }}"
    start_mode: auto
    state: started
  become: true
  become_method: ansible.builtin.runas
  become_user: SYSTEM
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Wait until Podman machine is ready
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $ready = $false
    for ($i = 0; $i -lt 90; $i++) {
      $null = & "{{ windows_gitea_runner_podman_install_dir }}\podman.exe" info --format json 2>$null
      if ($LASTEXITCODE -eq 0) {
        $ready = $true
        break
      }
      Start-Sleep -Seconds 2
    }
    if (-not $ready) {
      Write-Error "Podman machine {{ windows_gitea_runner_podman_machine_name }} did not become ready"
      exit 1
    }
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ windows_gitea_runner_podman_service_user }}"
  changed_when: false
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Ensure base build directory exists
  ansible.windows.win_file:
    path: "{{ windows_gitea_runner_podman_base_build_dir }}"
    state: directory
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Copy base Dockerfile to build context
  ansible.windows.win_copy:
    src: >-
      {{ windows_gitea_runner_podman_dockerfile_source_root }}/{{
      windows_gitea_runner_podman_base_dockerfile_src }}
    dest: "{{ windows_gitea_runner_podman_base_build_dir }}\\Dockerfile"
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Grant podman service user access to base build directory
  ansible.windows.win_acl:
    path: "{{ windows_gitea_runner_podman_base_build_dir }}"
    user: ".\\{{ windows_gitea_runner_podman_service_user }}"
    rights: FullControl
    type: allow
    state: present
    inherit: ContainerInherit, ObjectInherit
    propagation: None
  become: true
  become_method: ansible.builtin.runas
  become_user: SYSTEM
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Read current base image hash label
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"
    $image = "{{ windows_gitea_runner_podman_base_image }}"

    $null = & $podman image exists $image 2>$null
    if ($LASTEXITCODE -ne 0) {
      Write-Output "__MISSING__"
      exit 0
    }

    $raw = & $podman image inspect $image --format json 2>$null
    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) {
      Write-Output "__MISSING__"
      exit 0
    }

    $obj = $raw | ConvertFrom-Json
    if ($obj -is [System.Array]) {
      $obj = $obj[0]
    }

    $labels = $obj.Config.Labels
    if ($null -eq $labels) {
      Write-Output "__UNLABELED__"
      exit 0
    }

    $key = "{{ windows_gitea_runner_podman_base_image_hash_label }}"
    $current = $labels.$key
    if ([string]::IsNullOrWhiteSpace($current)) {
      Write-Output "__UNLABELED__"
      exit 0
    }

    Write-Output $current.Trim()
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ windows_gitea_runner_podman_service_user }}"
  register: __windows_gitea_runner_podman_current_base_image_hash
  changed_when: false
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Read desired base Dockerfile checksum
  ansible.builtin.set_fact:
    __windows_gitea_runner_podman_base_dockerfile_checksum: >-
      {{
        lookup(
          'file',
          windows_gitea_runner_podman_dockerfile_source_root ~ '/' ~ windows_gitea_runner_podman_base_dockerfile_src
        ) | hash('sha1')
      }}
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Determine if base image needs rebuild
  ansible.builtin.set_fact:
    __windows_gitea_runner_podman_needs_base_image_rebuild: >-
      {{
        (__windows_gitea_runner_podman_current_base_image_hash.stdout | trim)
        != (__windows_gitea_runner_podman_base_dockerfile_checksum | trim)
      }}
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Rebuild base image when Dockerfile changed
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"
    & $podman build `
      --label "{{
      windows_gitea_runner_podman_base_image_hash_label
      }}={{ __windows_gitea_runner_podman_base_dockerfile_checksum }}" `
      --tag "{{ windows_gitea_runner_podman_base_image }}" `
      --file "{{ windows_gitea_runner_podman_base_build_dir }}\\Dockerfile" `
      "{{ windows_gitea_runner_podman_base_build_dir }}"
    if ($LASTEXITCODE -ne 0) {
      exit 1
    }
    Write-Output "__BUILT__"
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ windows_gitea_runner_podman_service_user }}"
  register: __windows_gitea_runner_podman_base_build
  changed_when: "'__BUILT__' in __windows_gitea_runner_podman_base_build.stdout"
  when: __windows_gitea_runner_podman_needs_base_image_rebuild
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Reconcile runners
  ansible.builtin.include_tasks: runner.yml
  args:
    apply:
      tags:
        - roles::windows_gitea_runner_podman::linux
  loop: "{{ windows_gitea_runner_podman_runners }}"
  loop_control:
    loop_var: windows_gitea_runner_podman_runner
    label: >-
      {{ windows_gitea_runner_podman_runner.name | default(windows_gitea_runner_podman_runner.profile) }}
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Collect running Gitea runner container names
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"

    $raw = & $podman ps -a --filter label=io.a13labs.gitea_runner.config_hash --format json 2>$null
    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) {
      Write-Output "[]"
      exit 0
    }

    $containers = ($raw | ConvertFrom-Json)
    $names = @()
    foreach ($c in $containers) {
      $names += $c.Names
    }
    ($names | ConvertTo-Json -Compress)
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ windows_gitea_runner_podman_service_user }}"
  register: __windows_gitea_runner_podman_existing_containers
  changed_when: false
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Resolve defined container names with defaults
  ansible.builtin.set_fact:
    __windows_gitea_runner_podman_defined_containers: >-
      {{
        __windows_gitea_runner_podman_defined_containers | default([]) + [
          __windows_gitea_runner_podman_item.container_name
          | default(
              'gitea-runner-' ~ (
                  __windows_gitea_runner_podman_item.profile
                  | default(__windows_gitea_runner_podman_item.name | default('runner'))
              )
            )
        ]
      }}
  loop: "{{ windows_gitea_runner_podman_runners }}"
  loop_control:
    loop_var: __windows_gitea_runner_podman_item
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Identify stale Gitea runner containers
  ansible.builtin.set_fact:
    __windows_gitea_runner_podman_stale_containers: >-
      {{
        (__windows_gitea_runner_podman_existing_containers.stdout | from_json)
        | list
        | reject('in', __windows_gitea_runner_podman_defined_containers)
        | list
      }}
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Remove stale Gitea runner containers
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $podman = "{{ windows_gitea_runner_podman_install_dir }}\podman.exe"
    $name = "{{ item }}"
    & $podman rm -f $name 2>$null
    if ($LASTEXITCODE -eq 0) {
      Write-Output "__REMOVED__:$name"
    }
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ windows_gitea_runner_podman_service_user }}"
  loop: "{{ __windows_gitea_runner_podman_stale_containers }}"
  loop_control:
    label: "{{ item }}"
  register: __windows_gitea_runner_podman_stale_removal
  changed_when: true
  failed_when: false
  when: __windows_gitea_runner_podman_stale_containers | length > 0
  tags:
    - roles::windows_gitea_runner_podman::linux

- name: Report stale container cleanup
  ansible.builtin.debug:
    msg: >-
      Stale containers removed: {{ __windows_gitea_runner_podman_stale_containers | join(', ') }}
  when: __windows_gitea_runner_podman_stale_containers | length > 0
  tags:
    - roles::windows_gitea_runner_podman::linux