AAP 2.6 CI/CD Pipeline Integration: GitOps Workflows with Jenkins, GitLab, and GitHub Actions

# .github/workflows/deploy.yml
name: Deploy via AAP

on:
  push:
    branches: [main]
    paths:
      - 'ansible/**'
      - 'inventory/**'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger AAP Job Template
        uses: actions/github-script@v7
        env:
          AAP_URL: ${{ secrets.AAP_URL }}
          AAP_TOKEN: ${{ secrets.AAP_TOKEN }}
        with:
          script: |
            const response = await fetch(
              `${process.env.AAP_URL}/api/controller/v2/job_templates/42/launch/`,
              {
                method: 'POST',
                headers: {
                  'Authorization': `Bearer ${process.env.AAP_TOKEN}`,
                  'Content-Type': 'application/json'
                },
                body: JSON.stringify({
                  extra_vars: {
                    git_sha: context.sha,
                    git_ref: context.ref,
                    deployer: context.actor,
                    version: `${context.runNumber}`
                  }
                })
              }
            );
            const job = await response.json();
            console.log(`AAP Job launched: ${job.id}`);
            core.setOutput('job_id', job.id);

      - name: Wait for AAP Job
        uses: actions/github-script@v7
        env:
          AAP_URL: ${{ secrets.AAP_URL }}
          AAP_TOKEN: ${{ secrets.AAP_TOKEN }}
        with:
          script: |
            const jobId = '${{ steps.trigger.outputs.job_id }}';
            let status = 'pending';
            while (['pending', 'waiting', 'running'].includes(status)) {
              await new Promise(r => setTimeout(r, 10000));
              const res = await fetch(
                `${process.env.AAP_URL}/api/controller/v2/jobs/${jobId}/`,
                { headers: { 'Authorization': `Bearer ${process.env.AAP_TOKEN}` } }
              );
              const job = await res.json();
              status = job.status;
              console.log(`Job ${jobId}: ${status}`);
            }
            if (status !== 'successful') {
              core.setFailed(`AAP job ${jobId} finished with status: ${status}`);
            }

- name: Configure webhook-triggered template
  ansible.platform.job_template:
    controller_host: "{{ gateway_url }}"
    controller_username: "{{ controller_user }}"
    controller_password: "{{ controller_pass }}"
    name: "Deploy on Push"
    project: "Infrastructure"
    playbook: "deploy.yml"
    inventory: "Production"
    webhook_service: github
    webhook_credential: "GitHub Webhook Secret"
    state: present

# .gitlab-ci.yml
stages:
  - lint
  - test
  - deploy

lint:
  stage: lint
  image: quay.io/ansible/ansible-navigator:latest
  script:
    - ansible-navigator lint playbooks/ -m stdout

test:
  stage: test
  image: quay.io/ansible/ansible-navigator:latest
  script:
    - ansible-navigator run playbooks/test.yml -m stdout --check --diff -i inventory/staging

deploy_staging:
  stage: deploy
  script:
    - |
      JOB=$(curl -s -k -X POST \
        -H "Authorization: Bearer $AAP_TOKEN" \
        -H "Content-Type: application/json" \
        -d "{\"extra_vars\": {\"env\": \"staging\", \"version\": \"$CI_COMMIT_SHORT_SHA\"}}" \
        "$AAP_URL/api/controller/v2/job_templates/42/launch/")
      JOB_ID=$(echo $JOB | jq -r '.id')
      echo "Launched AAP job $JOB_ID"
      # Poll for completion
      while true; do
        STATUS=$(curl -s -k \
          -H "Authorization: Bearer $AAP_TOKEN" \
          "$AAP_URL/api/controller/v2/jobs/$JOB_ID/" | jq -r '.status')
        echo "Job $JOB_ID: $STATUS"
        [ "$STATUS" = "successful" ] && break
        [ "$STATUS" = "failed" ] || [ "$STATUS" = "error" ] || [ "$STATUS" = "canceled" ] && exit 1
        sleep 10
      done
  environment:
    name: staging
  only:
    - main

deploy_production:
  stage: deploy
  script:
    - |
      curl -s -k -X POST \
        -H "Authorization: Bearer $AAP_TOKEN" \
        -H "Content-Type: application/json" \
        -d "{\"extra_vars\": {\"env\": \"production\", \"version\": \"$CI_COMMIT_SHORT_SHA\"}}" \
        "$AAP_URL/api/controller/v2/workflow_job_templates/10/launch/"
  environment:
    name: production
  when: manual
  only:
    - main

// Jenkinsfile
pipeline {
    agent any

    environment {
        AAP_URL = credentials('aap-url')
        AAP_TOKEN = credentials('aap-token')
    }

    stages {
        stage('Lint') {
            steps {
                sh 'ansible-navigator lint playbooks/ -m stdout --ee false'
            }
        }

        stage('Deploy to Staging') {
            steps {
                script {
                    def response = httpRequest(
                        url: "${AAP_URL}/api/controller/v2/job_templates/42/launch/",
                        httpMode: 'POST',
                        customHeaders: [[name: 'Authorization', value: "Bearer ${AAP_TOKEN}"]],
                        contentType: 'APPLICATION_JSON',
                        requestBody: """{"extra_vars": {
                            "env": "staging",
                            "version": "${env.BUILD_NUMBER}",
                            "git_sha": "${env.GIT_COMMIT}"
                        }}"""
                    )
                    def job = readJSON text: response.content
                    env.AAP_JOB_ID = job.id
                    echo "AAP Job launched: ${job.id}"
                }
            }
        }

        stage('Wait for Staging') {
            steps {
                script {
                    waitForAAPJob(env.AAP_JOB_ID)
                }
            }
        }

        stage('Approve Production') {
            steps {
                input message: 'Deploy to production?', ok: 'Deploy'
            }
        }

        stage('Deploy to Production') {
            steps {
                script {
                    def response = httpRequest(
                        url: "${AAP_URL}/api/controller/v2/workflow_job_templates/10/launch/",
                        httpMode: 'POST',
                        customHeaders: [[name: 'Authorization', value: "Bearer ${AAP_TOKEN}"]],
                        contentType: 'APPLICATION_JSON',
                        requestBody: """{"extra_vars": {"env": "production", "version": "${env.BUILD_NUMBER}"}}"""
                    )
                    def job = readJSON text: response.content
                    waitForAAPJob(job.id)
                }
            }
        }
    }
}

def waitForAAPJob(jobId) {
    timeout(time: 30, unit: 'MINUTES') {
        while (true) {
            def resp = httpRequest(
                url: "${AAP_URL}/api/controller/v2/jobs/${jobId}/",
                customHeaders: [[name: 'Authorization', value: "Bearer ${AAP_TOKEN}"]]
            )
            def job = readJSON text: resp.content
            echo "Job ${jobId}: ${job.status}"
            if (job.status == 'successful') return
            if (job.status in ['failed', 'error', 'canceled']) {
                error "AAP job ${jobId} ${job.status}"
            }
            sleep 10
        }
    }
}

[Developer pushes to Git]
        ↓
[CI Pipeline: lint + test]
        ↓ pass
[Pipeline triggers AAP webhook]
        ↓
[AAP: Project Sync (git pull)]
        ↓
[AAP: Deploy to Staging]
        ↓ success
[AAP: Run Integration Tests]
        ↓ success
[AAP: Approval Gate (workflow)]
        ↓ approved
[AAP: Deploy to Production (rolling)]
        ↓
[AAP: Post-deploy Verify + Notify]

- name: Create GitOps deployment workflow
  ansible.platform.workflow_job_template:
    controller_host: "{{ gateway_url }}"
    controller_username: "{{ controller_user }}"
    controller_password: "{{ controller_pass }}"
    name: "GitOps Deploy"
    organization: "Operations"
    webhook_service: github
    survey_enabled: true
    survey_spec:
      name: "Deploy Parameters"
      description: ""
      spec:
        - question_name: "Environment"
          variable: target_env
          type: multiplechoice
          choices: ["staging", "production"]
          required: true
        - question_name: "Version/SHA"
          variable: deploy_version
          type: text
          required: true
    state: present

# Store AAP credentials as CI/CD secrets, never in code
# GitHub: Settings → Secrets → AAP_URL, AAP_TOKEN
# GitLab: Settings → CI/CD → Variables
# Jenkins: Credentials → Secret text

# Use short-lived tokens
- name: Create CI/CD service credential
  ansible.platform.token:
    controller_host: "{{ gateway_url }}"
    controller_username: "{{ controller_user }}"
    controller_password: "{{ controller_pass }}"
    description: "GitLab CI Token"
    scope: "write"
    state: present

# Playbooks should be safe to re-run
- name: Deploy application (idempotent)
  hosts: webservers
  tasks:
    - name: Deploy version
      ansible.builtin.template:
        src: app-config.j2
        dest: /etc/myapp/config.yml
      notify: restart myapp

    - name: Ensure desired version running
      ansible.builtin.uri:
        url: "http://localhost:8080/health"
        return_content: true
      register: health
      until: health.json.version == deploy_version
      retries: 30
      delay: 10