AnsibleをGitHub Actionsに組み込む設計入門｜SSH SecretsとWorkflowでPush→自動デプロイを実現する方法

この記事のポイント

・GitHubリポジトリへのPushを契機にAnsibleを自動実行できる
・SSHキーはBase64エンコードしてGitHub Secretsで安全に管理する
・GitHub-hostedとself-hostedランナーの選定が設計の核心
・GitHub Environmentsでstaging→production承認フローを実現できる

GitHub Push
    │
    ▼
GitHub-hostedランナー（ubuntu-24.04）
    │  pip install ansible-core
    │  SSH鍵をSecretsから展開
    ▼
SSH（port 22）
    │
    ▼
管理対象ノード（Rocky Linux 9.4）
    Playbookによる構成変更

GitHub Push
    │
    ▼
自社コントロールノード（GitHub Actionsランナー兼Ansibleコントロール）
    │  既存のAnsible環境をそのまま使用
    ▼
SSH（内部ネットワーク）
    │
    ▼
管理対象ノード（Rocky Linux 9.4）

# Ansible GitHub Actions用のSSHキーペアを生成（パスフレーズなし・ed25519推奨）
$ ssh-keygen -t ed25519 -C "ansible-github-actions" -f ~/.ssh/id_ansible_gha -N ""
Generating public/private ed25519 key pair.
Your identification has been saved in /home/ops/.ssh/id_ansible_gha
Your public key has been saved in /home/ops/.ssh/id_ansible_gha.pub
The key fingerprint is:
SHA256:xE7T9mKrD2qNpLb3cFvH8sWo6iYjAeZu1XnR4gTd0kM ansible-github-actions

# 管理対象ノードへ公開鍵を配布
$ ssh-copy-id -i ~/.ssh/id_ansible_gha.pub ansible-user@192.0.2.10
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/ops/.ssh/id_ansible_gha.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s)
Number of key(s) added: 1

# 秘密鍵をBase64エンコード（改行なしで出力）
$ base64 -w 0 ~/.ssh/id_ansible_gha
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQ...（省略）

name: Ansible Deploy

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Ansible
        run: |
          pip install --quiet "ansible-core==2.16.*"

      - name: Setup SSH key
        env:
          SSH_PRIVATE_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

      - name: Setup known_hosts
        run: |
          ssh-keyscan -H "${{ secrets.TARGET_HOST }}" >> ~/.ssh/known_hosts

      - name: Run Ansible Playbook
        run: |
          ansible-playbook \
            -i inventory/production.ini \
            -u ansible-user \
            --private-key ~/.ssh/id_ed25519 \
            site.yml

PLAY [webservers] **************************************************************

TASK [Gathering Facts] *********************************************************
ok: [192.0.2.10]

TASK [nginx : Install nginx] ***************************************************
ok: [192.0.2.10]

TASK [nginx : Deploy nginx config] *********************************************
changed: [192.0.2.10]

RUNNING HANDLER [nginx : restart nginx] ****************************************
changed: [192.0.2.10]

PLAY RECAP *********************************************************************
192.0.2.10  : ok=4  changed=2  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0

# Rocky Linux 9.4 上でのself-hostedランナーセットアップ例
$ mkdir actions-runner && cd actions-runner
$ curl -o actions-runner-linux-x64-2.319.1.tar.gz -L \
    https://github.com/actions/runner/releases/download/v2.319.1/actions-runner-linux-x64-2.319.1.tar.gz
$ tar xzf ./actions-runner-linux-x64-2.319.1.tar.gz
$ ./config.sh --url https://github.com/ORG/REPO --token AXXXXXXX
$ sudo ./svc.sh install
$ sudo ./svc.sh start

# サービス状態を確認
$ sudo ./svc.sh status
* actions.runner.ORG-REPO.hostname.service - GitHub Actions Runner (ORG-REPO.hostname)
   Loaded: loaded (/etc/systemd/system/actions.runner.ORG-REPO.hostname.service; enabled)
   Active: active (running)

jobs:
  deploy:
    runs-on: self-hosted

name: Ansible Deploy

on:
  push:
    branches:
      - main      # ステージングへ自動デプロイ
    tags:
      - 'v*'      # 本番へのデプロイ（タグ付きリリース）

jobs:
  deploy-staging:
    if: github.ref_type == 'branch'
    runs-on: ubuntu-24.04
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Setup SSH key
        env:
          SSH_PRIVATE_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${{ secrets.STAGING_HOST }}" >> ~/.ssh/known_hosts
      - name: Install Ansible
        run: pip install --quiet "ansible-core==2.16.*"
      - name: Deploy to staging
        run: |
          ansible-playbook -i inventory/staging.ini -u ansible-user \
            --private-key ~/.ssh/id_ed25519 site.yml

  deploy-production:
    if: github.ref_type == 'tag'
    runs-on: ubuntu-24.04
    environment: production    # GitHub Environmentsで手動承認を設定
    steps:
      - uses: actions/checkout@v4
      - name: Setup SSH key
        env:
          SSH_PRIVATE_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${{ secrets.PRODUCTION_HOST }}" >> ~/.ssh/known_hosts
      - name: Install Ansible
        run: pip install --quiet "ansible-core==2.16.*"
      - name: Deploy to production
        run: |
          ansible-playbook -i inventory/production.ini -u ansible-user \
            --private-key ~/.ssh/id_ed25519 site.yml

UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh:
  Host key verification failed.", "unreachable": true}

# ローカルでBase64デコードを検証（先頭行の確認）
$ cat ~/.ssh/id_ansible_gha | base64 -w 0 | base64 -d | head -1
-----BEGIN OPENSSH PRIVATE KEY-----