# Set cdh-info GitHub deploy token as default 

* Status: accepted
* Deciders: @rlskoeser, @acozine, @kayiwa, @carolyncole
* Date: 2024-06-04

## Context and Problem Statement

CDH playbooks use the GitHub deployment API to document what version of a codebase (i.e., commit hash, tag, branch) is deployed to which environment (e.g., staging or production). Using this API requires a GitHub credential, which we previously set as an environment variable or a command-line override.  To run these playbooks in Ansible Tower, we need a way to set that GitHub credential as an ansible variable. Tower supports GitHub personal access tokens, but only for webhooks triggered by Tower.

## Decision 

1. A GitHub token for the cdh-info/princetoncdh account with repository deployment permissions has been added to vaulted group variables available to all playbooks/hosts (`all/vault.yml`) and set as the default option for the `github_token` variable in `all/vars.yml`.  (This follows the same approach used by PUL for Capistrano deploys: system account token stored in vault.)
2. If the `ANSIBLE_GITHUB_TOKEN` environment variable is set, it will override the vaulted github token (previous behavior).

### Consequences 

* This setup should allow us to run playbooks locally or in Ansible Tower
* Deployment API calls will work whether or not someone has configured an environment variable with a personal access token tied to their account.
* Local deploys will show up as run by the cdh-info/princetoncdh account if a personal token is not used.