feat(galaxy): package public roles as the decdn.node collection - #4
Conversation
Stage baseline + decdn_node into a distributable Ansible Galaxy collection
(`decdn.node`) without disturbing the internal deploy project. The collection
overlay lives in `ansible/galaxy/` and is assembled into a clean
`ansible_collections/decdn/node/` tree by `galaxy/build.sh` — deliberately NOT a
`galaxy.yml` at the project root, so ansible-lint/molecule still treat the deploy
project as a plain project (bare role names, roles_path, production profile).
Only the two public-facing roles ship; the internal anvil tooling
(anvil/caddy/contracts) is excluded by construction. Foundations only — publishing
stays a manual `ansible-galaxy collection publish` step (no token in CI).
- add LICENSE (MIT) backing the roles' declared license
- add galaxy/{galaxy.yml,meta/runtime.yml,README.md,CHANGELOG.md,build.sh}
- enrich baseline/decdn_node meta (author, galaxy_tags); add baseline README
- add `make build` / `make galaxy-check` (root + ansible) and a CI `galaxy-build`
job that builds + validates via galaxy-importer (no publish, no secrets)
- exclude generated build/ and the pre-1.0 galaxy/ overlay from the linters
- document the collection + manual-publish flow in ansible/README.md and CLAUDE.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request packages the public-facing roles (baseline and decdn_node) into a distributable Ansible Galaxy collection named decdn.node. It introduces a staging and build script, metadata manifests, documentation, and Makefile targets for building and validating the collection using galaxy-importer. The review feedback identifies two key improvements: ensuring the galaxy-check target does not silently succeed if galaxy-importer fails to start or is missing by using set -o pipefail, and cleaning up old tarball artifacts in build.sh to prevent wildcard expansion errors when multiple versions exist.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Pull request overview
Packages the repository’s two public roles (baseline and decdn_node) into a Galaxy-distributable Ansible collection (decdn.node) while keeping the existing ansible/ tree as a plain Ansible project (collection layout is staged at build time under ansible/build/).
Changes:
- Adds a
ansible/galaxy/overlay (manifest, runtime metadata, README/CHANGELOG) plus a staging build script to produce a clean collection artifact containing only the two public roles. - Introduces
make build/make galaxy-checktargets and a new CIgalaxy-buildjob to build + validate the collection viagalaxy-importer(without publishing). - Updates role metadata and documentation, and adds a repo
LICENSEto support Galaxy metadata requirements; updates lint ignores for generated build output.
Reviewed changes
Copilot reviewed 16 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| Makefile | Adds root-level convenience targets to build/validate the staged Galaxy collection via ansible/Makefile. |
| LICENSE | Adds MIT license file for collection distribution/metadata compliance. |
| CLAUDE.md | Documents the new build/validation workflow and CI gate behavior. |
| ansible/roles/decdn_node/meta/main.yml | Adds Galaxy author/tags metadata for the public decdn_node role. |
| ansible/roles/baseline/README.md | Adds public-facing role documentation for baseline. |
| ansible/roles/baseline/meta/main.yml | Adds Galaxy author/tags metadata for the public baseline role. |
| ansible/README.md | Documents collection packaging approach and manual publish flow. |
| ansible/Makefile | Adds build and galaxy-check targets for staging/building and validating the collection artifact. |
| ansible/galaxy/README.md | Collection README intended to ship inside the built artifact. |
| ansible/galaxy/meta/runtime.yml | Declares minimum supported ansible-core for the collection. |
| ansible/galaxy/galaxy.yml | Collection manifest overlay (namespace/name/version/deps/tags/etc.). |
| ansible/galaxy/CHANGELOG.md | Introduces collection changelog for releases. |
| ansible/galaxy/build.sh | Stages only the public roles into a clean collection tree and builds the tarball. |
| ansible/.yamllint | Excludes generated build/ output from YAML linting. |
| ansible/.ansible-lint | Excludes generated build/ and the galaxy/ overlay from project ansible-lint scope. |
| .gitignore | Ignores generated collection build outputs and importer output JSON. |
| .github/workflows/ci.yml | Adds a galaxy-build job that builds + validates the collection and uploads the artifact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- add author + galaxy_tags to anvil/caddy role metas. The latest ansible-lint meta JSON-schema makes galaxy_info.author REQUIRED; adding it to baseline/ decdn_node surfaced that anvil/caddy still lacked it, failing the ansible-lint CI job. All role metas now carry it. - galaxy-check: gate on `set -o pipefail` AND the importer's "completed successfully" line. tee was swallowing the pipe exit, and the old error|traceback grep missed startup failures (e.g. "No module named galaxy_importer") while risking false positives on benign "0 errors" lines. - build.sh: rm stale build/decdn-node-*.tar.gz so the galaxy-check glob stays unambiguous as versions change. - CHANGELOG: point footnote links at pages that resolve before the first tag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What & why
Makes the repo Galaxy-ready by packaging the two public-facing roles (
baseline+decdn_node) as a distributabledecdn.nodecollection — the foundation for offering external operators a turnkey node deployment. Internal-for-now: the collection builds and validates in CI, but publishing stays a manual step (no token in CI).The roles were already in good shape (parameterized, FQCN-clean, decoupled), so this is packaging + metadata + docs, not refactoring.
Design: stage at build time (no
galaxy.ymlat the project root)Dropping a
galaxy.ymlintoansible/would make ansible-lint / molecule reinterpret the deploy project as a collection (expecting theansible_collections/decdn/node/layout and FQCN role refs in the internal playbooks), which would break themake deploydev loop. Instead,ansible/galaxy/build.shstages only the two roles into a clean collection tree and builds the artifact. The internal project stays a plain Ansible project, untouched.Scope decisions (agreed up front): public-only collection (anvil/caddy/contracts excluded by construction), name
decdn.node, foundations + manual publish.Changes
LICENSE(MIT) — backs thelicense: MITthe role metas already declaredansible/galaxy/—galaxy.yml,meta/runtime.yml, collectionREADME.md+CHANGELOG.md,build.shauthor+galaxy_tagson baseline & decdn_node; newroles/baseline/README.mdmake build/make galaxy-check(root +ansible/) and a CIgalaxy-buildjob that builds + validates viagalaxy-importer(no publish, no secrets, reuses SHA-pinned actions)build/and the pre-1.0galaxy/overlay from yamllint/ansible-lintansible/README.mdandCLAUDE.mdVerification (local, all green)
make build→decdn-node-0.1.0.tar.gz; tarball contains only baseline + decdn_node (+ manifest/LICENSE/README/CHANGELOG) — no anvil/caddy/contracts/inventory/molecule leakagemake galaxy-check(galaxy-importer 0.4.39) → processing completed successfully, 0 errors, 0 warningsdecdn.node.baseline+decdn.node.decdn_nodepasses--syntax-checkyamllintOK,ansible-lintproduction profile, 0 failures, all pre-commit hooks passDeferred (until first real publish)
Auto-publish workflow + Galaxy API token,
antsibull-changelog, anvil/caddy READMEs, and claiming thedecdnnamespace on galaxy.ansible.com.🤖 Generated with Claude Code