ci: extract ansible and terraform setup into composite actions

[open-dave]

What changed

Extracts the copy-pasted setup sequences into two local composite actions and updates the workflows to call them:

• .github/actions/ansible-setup — setup-python 3.13, pip install -r requirements.txt, galaxy collection install, optional vault-password file, optional SSH key (inputs: vault-password, ssh-private-key, both optional so bootstrap/lint can reuse it with no secrets).
• .github/actions/terraform-setup — Tailscale connect, MinIO health check, hashicorp/setup-terraform (inputs: ts-oauth-client-id, ts-oauth-secret).

Workflows refactored to single uses: steps: ansible-base, ansible-update-proxmox, ansible-proxmox, ansible-proxmox-bootstrap, cluster-rebuild, terraform, terraform-plan, plus ansible-adguard, ansible-claude, ansible-monitoring, and ansible-lint.

Why

Removes ~30 lines of duplicated Ansible setup and ~20 lines of Terraform setup per workflow, so version bumps (e.g. Python) are a single change.

Review findings addressed

• The original implementation missed ansible-adguard, ansible-claude, ansible-monitoring, and ansible-lint, which were added after the issue was filed and carried the identical boilerplate — extended the composite to them so the duplication is fully removed.
• Confirmed the dropped inline eval ssh-agent was a no-op (its env never reached later steps; Ansible reads ~/.ssh/id_ed25519 directly).
• Verified with actionlint (validates local composite refs and inputs) and yamllint; no new lint violations.

Closes #215

🤖 Generated with Claude Code

[github-actions]

🏗️ Terraform Plan Results

⚠️ hawkfield

module.dns-hawk-1.proxmox_lxc.container: Refreshing state... [id=hawk01/lxc/131]
module.claude-hawk-1.proxmox_vm_qemu.ubuntu_server: Refreshing state... [id=hawk02/qemu/122]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.claude-hawk-1.proxmox_vm_qemu.ubuntu_server will be updated in-place
  ~ resource "proxmox_vm_qemu" "ubuntu_server" {
        id                        = "hawk02/qemu/122"
        name                      = "claude-hawk-1"
        tags                      = "base;claude"
        # (51 unchanged attributes hidden)

      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }
      ~ disk {
          - format               = "raw" -> null
            id                   = 1
            # (28 unchanged attributes hidden)
        }

      - startup_shutdown {
          - order            = -1 -> null
          - shutdown_timeout = -1 -> null
          - startup_delay    = -1 -> null
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

⚠️ hawkfield-kubernetes

module.k8s-hawk-2.proxmox_vm_qemu.ubuntu_server: Refreshing state... [id=hawk02/qemu/112]
module.k8s-hawk-3.proxmox_vm_qemu.ubuntu_server: Refreshing state... [id=hawk03/qemu/113]
module.k8s-hawk-1.proxmox_vm_qemu.ubuntu_server: Refreshing state... [id=hawk01/qemu/111]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.k8s-hawk-1.proxmox_vm_qemu.ubuntu_server will be updated in-place
  ~ resource "proxmox_vm_qemu" "ubuntu_server" {
        id                        = "hawk01/qemu/111"
        name                      = "k8s-hawk-1"
        tags                      = "base;kubernetes;kubernetes_master;kubernetes_worker"
        # (51 unchanged attributes hidden)

      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }
      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }

      - startup_shutdown {
          - order            = -1 -> null
          - shutdown_timeout = -1 -> null
          - startup_delay    = -1 -> null
        }

        # (4 unchanged blocks hidden)
    }

  # module.k8s-hawk-2.proxmox_vm_qemu.ubuntu_server will be updated in-place
  ~ resource "proxmox_vm_qemu" "ubuntu_server" {
        id                        = "hawk02/qemu/112"
        name                      = "k8s-hawk-2"
        tags                      = "base;kubernetes;kubernetes_master;kubernetes_worker"
        # (51 unchanged attributes hidden)

      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }
      ~ disk {
          - format               = "raw" -> null
            id                   = 1
            # (28 unchanged attributes hidden)
        }

      - startup_shutdown {
          - order            = -1 -> null
          - shutdown_timeout = -1 -> null
          - startup_delay    = -1 -> null
        }

        # (4 unchanged blocks hidden)
    }

  # module.k8s-hawk-3.proxmox_vm_qemu.ubuntu_server will be updated in-place
  ~ resource "proxmox_vm_qemu" "ubuntu_server" {
        id                        = "hawk03/qemu/113"
        name                      = "k8s-hawk-3"
        tags                      = "base;kubernetes;kubernetes_master;kubernetes_worker"
        # (51 unchanged attributes hidden)

      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }
      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }

      - startup_shutdown {
          - order            = -1 -> null
          - shutdown_timeout = -1 -> null
          - startup_delay    = -1 -> null
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

⚠️ london

module.dns-lon-1.proxmox_lxc.container: Refreshing state... [id=lon01/lxc/131]
module.k8s-lon-1.proxmox_vm_qemu.ubuntu_server: Refreshing state... [id=lon01/qemu/111]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.k8s-lon-1.proxmox_vm_qemu.ubuntu_server will be updated in-place
  ~ resource "proxmox_vm_qemu" "ubuntu_server" {
        id                        = "lon01/qemu/111"
        name                      = "k8s-lon-1"
        tags                      = "base;kubernetes_master;kubernetes_worker"
        # (51 unchanged attributes hidden)

      ~ disk {
          - format               = "raw" -> null
            id                   = 0
            # (28 unchanged attributes hidden)
        }
      ~ disk {
          - format               = "raw" -> null
            id                   = 1
            # (28 unchanged attributes hidden)
        }

      - startup_shutdown {
          - order            = -1 -> null
          - shutdown_timeout = -1 -> null
          - startup_delay    = -1 -> null
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

Last updated: 2026-07-06T22:33:55.695Z