Review Ansible

Creates and removes a GitLab review environment with project-owned Ansible playbooks.

The component runs both playbooks in the CI Tools Ansible execution-environment image, initializes SSH through ci_ssh_init, and serializes start and stop operations with a resource group.

Basic review environment

Keep the inventory and playbooks in the application repository:

# playbooks/start-review.yml
---
- name: Deploy review application
  hosts: review
  become: true
  tasks:
    - name: Start the application
      ansible.builtin.service:
        name: my-application
        state: started

# playbooks/stop-review.yml
---
- name: Remove review application
  hosts: review
  become: true
  tasks:
    - name: Stop the application
      ansible.builtin.service:
        name: my-application
        state: stopped

Include the component and point it at the inventory and playbooks:

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/ansible-molecule@$CI_COMMIT_SHA
    inputs:
      name: review
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/review-ansible@$CI_COMMIT_SHA
    inputs:
      name: review
      environment: review/$CI_COMMIT_REF_SLUG
      inventory: inventories/review
      review-domain: $CI_ENVIRONMENT_SLUG.apps.example.com
      start-playbook: playbooks/start-review.yml
      stop-playbook: playbooks/stop-review.yml
      needs-start:
        - job: molecule:review
          artifacts: false

This creates molecule:review, review:start, and review:stop. The review environment starts only after the Molecule scenarios pass. The start job exposes the environment at https://$CI_ENVIRONMENT_HOST; the stop job is registered as its GitLab on_stop action. Branch and merge-request pipelines run the jobs when their corresponding playbooks exist. Tag pipelines expose the jobs as manual actions when the start playbook exists, while scheduled pipelines skip them.

CI prerequisites

The selected runner must be able to reach the inventory hosts. Configure the SSH key and host verification values expected by ci_ssh_init as protected or masked CI/CD variables, and keep secrets out of the inventory committed to the repository.

The start playbook should:

• create or update only the resources owned by the review environment;
• be idempotent so a retried job converges safely;
• fail when the environment cannot be made ready.

The stop playbook should:

• remove the same resources created by the start playbook;
• tolerate resources that have already been removed;
• avoid deleting shared infrastructure.

Environment lifecycle

environment names the GitLab environment and its resource group. review-domain sets CI_ENVIRONMENT_HOST and therefore the environment URL. timeout controls both the start-job timeout and GitLab's automatic stop interval.

Use needs-start for quality gates such as molecule:review that must pass before provisioning. Use needs-stop for the final review test that must complete before the environment stops. Set tag when the Ansible jobs require a tagged runner.

Inputs

Name	Description	Default	Type
---	---	---	---
environment	GitLab environment prefix.	int	string
inventory	Inventory file for the review environment.		string
name	Name of the review job. Used to name the start and stop jobs.	review	string
needs-start	The jobs that the start job depends on.	[]	array
needs-stop	The jobs that the stop job depends on.	[]	array
review-domain		$CI_ENVIRONMENT_SLUG.review.xrow.net	string
rules	The rules to determine when to run the review process.	[{"if":"$CI_PIPELINE_SOURCE == \"schedule\"","when":"never"},{"if":"$CI_COMMIT_TAG =~ $CI_PATTERN_SEMVER","when":"never"},{"when":"always"}]	array
stage		test	string
start-playbook	Playbook for starting the review	playbooks/start-review.yml	string
stop-playbook	Playbook for stopping the review	playbooks/stop-review.yml	string
tag			string
timeout		1h	string