Skip to content

fix(github-cli-multi): skip live SSH verification under --check#26

Open
tahirqureshi wants to merge 1 commit into
F43from
fix/github-cli-multi-check-mode-ssh-verify
Open

fix(github-cli-multi): skip live SSH verification under --check#26
tahirqureshi wants to merge 1 commit into
F43from
fix/github-cli-multi-check-mode-ssh-verify

Conversation

@tahirqureshi

Copy link
Copy Markdown
Contributor

Problem

Running the play with --check failed at Assert SSH access and identity match for all accounts with a misleading "passphrase-related" diagnosis for every account:

SSH verification FAILED for alias balli (expected user tahir-ec-ballicom).
GitHub responded: (no Hi response)
... most likely passphrase-related.

This was a check-mode false failure, not a real passphrase issue. The failed items show the smoking gun:

"skipped": true,  "rc": 0,  "stdout": "",
"msg": "Command would have run if not in check mode"

Root cause

The Verify SSH access task is a read-only SSH probe (changed_when: false), but it depends on side-effecting tasks that Ansible skips in check mode:

  • the passphrase file /tmp/.github_ssh_pp (created by a copy task)
  • key generation

In check mode the probe is skipped, so item.stdout is empty, and the downstream assert ('successfully authenticated' in item.stdout) fails — printing the misleading passphrase remediation.

Fix

  • Guard the verify / display / assert tasks with when: not ansible_check_mode — a dry run cannot perform live SSH auth anyway, so it now skips cleanly instead of failing spuriously.
  • Harden the loops with | default([]) so they no-op when the probe is skipped.

Verification

  • ./scripts/qa-all.bash → passes
  • ansible-playbook ... --syntax-check → exit 0
  • YAML parse → OK

🤖 Generated with Claude Code

The SSH-key block's live verification chain depends on side-effecting
tasks (passphrase file creation, key generation) that Ansible skips in
check mode. With those skipped, the "Verify SSH access" probe returned
empty stdout, and the downstream assert failed with a misleading
"passphrase-related" diagnosis on every --check run.

Guard the verify/display/assert tasks with `when: not ansible_check_mode`
so a dry run no longer reports spurious SSH auth failures, and harden the
loops with `| default([])` so they no-op cleanly when the probe is skipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant