Summary

• Introduces ScmServer dataclass (id, hostname, token_env_var) for configuring private Git-hosted collection repositories, mirroring the existing galaxy_servers pattern
• Replaces hardcoded ~/.git-credentials setup and AAP_EE_BUILDER_* / SCM_TOKEN env vars with a dynamic, data-driven approach — Portal passes scm_servers via --ee-config JSON
• SCM tokens are resolved via envsubst post-processing of context/_build/requirements.yml after ansible-builder create, with multi-stage build isolation ensuring tokens never reach the final image
• Converts README.md to a Jinja2 template with dynamic secrets table and adds a new NEXT_STEPS.md.j2 template that dynamically enumerates all required secrets (Galaxy, SCM, Registry)

Changes

Core (types.py)

• ENV_VAR_RE regex for validating uppercase env var names
• ScmServer frozen dataclass with from_dict(), as_dict(), to_schema()
• EEConfig: new scm_servers field, _KNOWN_KEYS, from_dict(), to_schema()
• TemplateData: new ee_scm_servers and ee_scm_token_vars fields

Workflow template (ee-build.yml.j2)

• Dynamic SCM token validation checks (same pattern as galaxy tokens)
• Removed hardcoded Configure Git credentials step (~/.git-credentials)
• Post-create envsubst resolves tokens in context/_build/requirements.yml
• Dynamic env vars from ee_scm_token_vars in build step

Scaffolded files

• README.md → README.md.j2 with dynamic secrets table
• New NEXT_STEPS.md.j2 with required/optional secrets checklist

Documentation

• New "SCM Servers" section in docs/ee_scaffolding.md covering schema, token flow, and security

Tests

• 10 new tests: ScmServer unit tests, EEConfig integration, end-to-end scaffolding with SCM servers
• Regenerated fixtures for default scaffolding

Example CLI usage

ansible-creator init execution_env \
  --ee-config '{
    "collections": [
      {"name": "https://${GITHUB_ORG1_TOKEN}@github.com/org1/my-collection", "type": "git"},
      {"name": "cisco.ios"}
    ],
    "scm_servers": [
      {"id": "github_org1", "hostname": "github.com", "token_env_var": "GITHUB_ORG1_TOKEN"}
    ]
  }' \
  my-ee-project

Security

The multi-stage build generated by ansible-builder ensures tokens never reach the final image:

1. ansible-builder create generates build context with unresolved ${TOKEN} references
2. envsubst resolves tokens in the generated context/_build/requirements.yml
3. buildah bud builds the image — resolved URLs exist only in the intermediate galaxy stage
4. The final stage only copies installed collections (/usr/share/ansible), not source files

Depends on

• feat: replace hardcoded hub URLs with generic galaxy_servers list #556 (galaxy_servers abstraction — merged)

Test plan

• ScmServer.from_dict() validates id, hostname, token_env_var
• ScmServer.from_dict() rejects invalid env var names (lowercase, dashes, leading digits)
• EEConfig.from_dict() parses scm_servers list
• End-to-end scaffolding generates correct workflow with envsubst post-processing
• Generated workflow contains no git-credentials or hardcoded AAP_EE_BUILDER_* references
• NEXT_STEPS.md is generated with correct SCM token names
• All pre-commit hooks pass (ruff, mypy, cspell, pylint, etc.)
• tox py, py314-devel, docs environments pass

Made with Cursor