a13labs.infra/ansible/roles/windows_gitea_runner_windows/tasks/main.yml

---
- name: Validate required runner settings
  ansible.builtin.assert:
    that:
      - windows_gitea_runner_windows_instance_url | length > 0
      - windows_gitea_runner_windows_registration_token | length > 0
      - windows_gitea_runner_windows_runners | length > 0
    fail_msg: >-
      windows_gitea_runner_windows_instance_url, windows_gitea_runner_windows_registration_token,
      and at least one windows_gitea_runner_windows_runners entry are required.
  tags:
    - always

- name: Ensure Docker service is running
  ansible.windows.win_service:
    name: docker
    start_mode: auto
    state: started
  become: true
  become_method: ansible.builtin.runas
  become_user: SYSTEM
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Resolve runtime user
  ansible.builtin.set_fact:
    __windows_gitea_runner_windows_runtime_user: >-
      {{
        windows_gitea_runner_windows_runtime_user
        | default(ansible_user | default(''), true)
      }}
    __windows_gitea_runner_windows_become_user: >-
      {{
        windows_gitea_runner_windows_become_user
        | default(__windows_gitea_runner_windows_runtime_user, true)
        | default('SYSTEM', true)
      }}
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Check docker-users local group availability
  ansible.windows.win_shell: |
    $group = Get-LocalGroup -Name 'docker-users' -ErrorAction SilentlyContinue
    if ($null -ne $group) {
      Write-Output "__EXISTS__"
      exit 0
    }
    Write-Output "__MISSING__"
    exit 0
  become: true
  become_method: ansible.builtin.runas
  become_user: SYSTEM
  register: __windows_gitea_runner_windows_docker_users_group
  changed_when: false
  when: __windows_gitea_runner_windows_runtime_user | length > 0
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Add runtime user to docker-users group
  ansible.windows.win_group_membership:
    name: docker-users
    members:
      - >-
        {{
          __windows_gitea_runner_windows_runtime_user
          if ('\\' in __windows_gitea_runner_windows_runtime_user)
          else '.\\' ~ __windows_gitea_runner_windows_runtime_user
        }}
    state: present
  become: true
  become_method: ansible.builtin.runas
  become_user: SYSTEM
  when:
    - __windows_gitea_runner_windows_runtime_user | length > 0
    - "'__EXISTS__' in (__windows_gitea_runner_windows_docker_users_group.stdout | default(''))"
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Ensure Windows base build directory exists
  ansible.windows.win_file:
    path: "{{ windows_gitea_runner_windows_base_build_dir }}"
    state: directory
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Copy Windows base Dockerfile to build context
  ansible.windows.win_copy:
    src: >-
      {{
        windows_gitea_runner_windows_dockerfile_source_root
        ~ '/'
        ~ windows_gitea_runner_windows_base_dockerfile_src
      }}
    dest: "{{ windows_gitea_runner_windows_base_build_dir }}\\Dockerfile"
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Copy Windows base entrypoint script to build context
  ansible.windows.win_copy:
    src: >-
      {{
        windows_gitea_runner_windows_dockerfile_source_root
        ~ '/'
        ~ windows_gitea_runner_windows_base_entrypoint_script_src
      }}
    dest: >-
      {{
        windows_gitea_runner_windows_base_build_dir
        ~ '\\'
        ~ windows_gitea_runner_windows_base_entrypoint_script_src
      }}
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Read current Windows base image hash label
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $docker = "{{ windows_gitea_runner_windows_runtime_bin }}"
    $image = "{{ windows_gitea_runner_windows_base_image }}"

    if (Get-Variable -Name PSNativeCommandUseErrorActionPreference -ErrorAction SilentlyContinue) {
      $PSNativeCommandUseErrorActionPreference = $false
    }
    $ErrorActionPreference = "Continue"
    $raw = & $docker image inspect $image 2>$null
    $inspectExit = $LASTEXITCODE
    $ErrorActionPreference = "Stop"

    if ($inspectExit -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) {
      Write-Output "__MISSING__"
      exit 0
    }

    $obj = $raw | ConvertFrom-Json
    if ($obj -is [System.Array]) {
      $obj = $obj[0]
    }

    $labels = $obj.Config.Labels
    if ($null -eq $labels) {
      Write-Output "__UNLABELED__"
      exit 0
    }

    $key = "{{ windows_gitea_runner_windows_base_image_hash_label }}"
    $current = $labels.$key
    if ([string]::IsNullOrWhiteSpace($current)) {
      Write-Output "__UNLABELED__"
      exit 0
    }

    Write-Output $current.Trim()
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ __windows_gitea_runner_windows_become_user }}"
  register: __windows_gitea_runner_windows_current_base_image_hash
  changed_when: false
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Read desired Windows base Dockerfile checksum
  ansible.builtin.set_fact:
    __windows_gitea_runner_windows_base_dockerfile_checksum: >-
      {{
        (
          lookup(
            'file',
            windows_gitea_runner_windows_dockerfile_source_root
            ~ '/'
            ~ windows_gitea_runner_windows_base_dockerfile_src
          )
          ~ '\n'
          ~ lookup(
            'file',
            windows_gitea_runner_windows_dockerfile_source_root
            ~ '/'
            ~ windows_gitea_runner_windows_base_entrypoint_script_src
          )
        ) | hash('sha1')
      }}
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Determine if Windows base image needs rebuild
  ansible.builtin.set_fact:
    __windows_gitea_runner_windows_needs_base_image_rebuild: >-
      {{
        (__windows_gitea_runner_windows_current_base_image_hash.stdout | trim)
        != (__windows_gitea_runner_windows_base_dockerfile_checksum | trim)
      }}
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Rebuild Windows base image when Dockerfile changed
  ansible.windows.win_shell: |
    $ErrorActionPreference = "Stop"
    $docker = "{{ windows_gitea_runner_windows_runtime_bin }}"
    $baseHash = "{{ __windows_gitea_runner_windows_base_dockerfile_checksum }}"
    $baseLabel = "{{ windows_gitea_runner_windows_base_image_hash_label }}=$baseHash"
    & $docker build `
      --label "$baseLabel" `
      --tag "{{ windows_gitea_runner_windows_base_image }}" `
      --file "{{ windows_gitea_runner_windows_base_build_dir }}\Dockerfile" `
      "{{ windows_gitea_runner_windows_base_build_dir }}"
    if ($LASTEXITCODE -ne 0) {
      exit 1
    }
    Write-Output "__BUILT__"
  become: true
  become_method: ansible.builtin.runas
  become_user: "{{ __windows_gitea_runner_windows_become_user }}"
  register: __windows_gitea_runner_windows_base_build
  changed_when: "'__BUILT__' in __windows_gitea_runner_windows_base_build.stdout"
  when: __windows_gitea_runner_windows_needs_base_image_rebuild
  tags:
    - roles::windows_gitea_runner_windows::windows

- name: Reconcile runners
  ansible.builtin.include_tasks: runner.yml
  args:
    apply:
      tags:
        - roles::windows_gitea_runner_windows::windows
  loop: "{{ windows_gitea_runner_windows_runners }}"
  loop_control:
    loop_var: windows_gitea_runner_windows_runner
    label: >-
      {{ windows_gitea_runner_windows_runner.name | default(windows_gitea_runner_windows_runner.profile) }}
  tags:
    - roles::windows_gitea_runner_windows::windows