From 8fd9fd5b20dd02afee46e54efe295e0e538b9527 Mon Sep 17 00:00:00 2001 From: Hermes Agent service account Date: Fri, 29 May 2026 23:13:49 -0500 Subject: [PATCH] fix(semaphore/configure): vault key attaches via vaults[] not vault_key_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Semaphore v2.18 replaced the single vault_key_id field with a vaults[] array supporting multi-vault per template. Sending vault_key_id is silently ignored — template stores no vault association, runs fail at the playbook stage with 'Attempting to decrypt but no vault secrets found'. Wrap the single configured vault password in the required envelope: vaults: [{id: 0, vault_key_id: , name: 'default'}] Empirically verified: PUT with this shape returns 204 and the GET echoes the vault back with a server-assigned id. --- ansible/roles/semaphore/tasks/configure.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ansible/roles/semaphore/tasks/configure.yml b/ansible/roles/semaphore/tasks/configure.yml index 79dc539..713722a 100644 --- a/ansible/roles/semaphore/tasks/configure.yml +++ b/ansible/roles/semaphore/tasks/configure.yml @@ -305,7 +305,9 @@ 'survey_vars': item.survey_vars | default([]) } | combine( - {'vault_key_id': _semaphore_key_ids[item.vault_password] | int} + {'vaults': [{'id': 0, + 'vault_key_id': _semaphore_key_ids[item.vault_password] | int, + 'name': 'default'}]} if item.vault_password is defined else {} ) }}