Summary

Replace the hardcoded automation_hub_url / private_hub_url fields in EEConfig with a generic galaxy_servers list, decoupling ansible.cfg generation and workflow token plumbing from is_official_ee status.

• New GalaxyServer dataclass with id, url, auth_url, token_required — includes from_dict(), to_schema(), as_dict() with derived token_env_var
• EEConfig.galaxy_servers replaces automation_hub_url / private_hub_url
• Dynamic ansible.cfg generation from the server list, with token comments for each token_required server
• Dynamic workflow token plumbing — token checks, env vars, and --build-arg flags are all generated from the galaxy_servers configuration
• Behavioral change: ansible.cfg is only generated when galaxy_servers is explicitly provided (or raw ansible_cfg is supplied), even for official EE images
• New docs/ee_scaffolding.md comprehensive guide covering all EEConfig options

Example CLI

ansible-creator init execution_env \
  --ee-config '{
    "name": "ee-network",
    "base_image": "registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8:latest",
    "collections": [{"name": "cisco.ios"}, {"name": "ansible.netcommon"}],
    "galaxy_servers": [
      {
        "id": "automation_hub",
        "url": "https://console.redhat.com/api/automation-hub/content/published/",
        "auth_url": "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token",
        "token_required": true
      },
      {"id": "galaxy", "url": "https://galaxy.ansible.com/"}
    ]
  }' my-ee-project

Resulting ansible.cfg

[galaxy]
server_list = automation_hub, galaxy

[galaxy_server.automation_hub]
url = https://console.redhat.com/api/automation-hub/content/published/
auth_url = https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
# Token: set ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN as a repository secret

[galaxy_server.galaxy]
url = https://galaxy.ansible.com/

Resulting execution-environment.yml (relevant section)

additional_build_steps:
  prepend_galaxy:
    - ARG ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN

Resulting ee-build.yml (relevant sections)

Token check step:

      - name: Check if galaxy server tokens are configured
        id: check-galaxy
        env:
          ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN }}
        run: |
          CONFIGURED=false
          if [[ -n "$ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN" ]]; then
            echo "::notice::ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN is configured"
            CONFIGURED=true
          else
            echo "::notice::No ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN secret configured"
          fi
          echo "configured=$CONFIGURED" >> "$GITHUB_OUTPUT"

Build step token injection:

          if [[ -n "$ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN" ]]; then
            EXTRA_ARGS+=(--build-arg ANSIBLE_GALAXY_SERVER_AUTOMATION_HUB_TOKEN)
          fi

Behavioral change

ansible.cfg is no longer auto-generated for official EE images when no galaxy_servers are provided. Previously, using an official Red Hat EE base image would always produce a default ansible.cfg with hardcoded Automation Hub / Galaxy entries. Now, the ansible.cfg is only created when:

1. galaxy_servers is explicitly provided, OR
2. Raw ansible_cfg content is supplied

This makes the behavior explicit and consistent — Portal will pass the full galaxy_servers list via --ee-config JSON. A future --default-galaxy-servers CLI flag can restore the convenience for standalone CLI users.

Test plan

• All 204 existing tests pass (52 EE-specific)
• New tests for GalaxyServer dataclass (from_dict, as_dict, to_schema, validation)
• End-to-end test: scaffolding with galaxy_servers verifies ansible.cfg, execution-environment.yml, and ee-build.yml
• End-to-end test: no galaxy_servers produces no ansible.cfg even with official EE image
• --no-overwrite test with galaxy_servers
• Pre-commit (ruff, pylint, cspell, mypy, ansible-lint, pydoclint) all pass

Made with Cursor