[TakGN]

The run page didn't say what a run was going to do. For #12's merge it showed site-dry-run, site-apply and platform-apply as skipped with no reason, and the dry run's summary was one row, "lith-1 | Allow 8443/tcp … | 2", without saying what the two changes were.

Changes

"What this run does": the changes job writes a table at the top of the run's summary page. It has one row per playbook: the changed files that make this run touch it, and what happens:

Event	This run
pull request	Dry run only; nothing from a fork
merge to main	Dry run, then, if it would change anything, the apply, once a required reviewer approves it in production
manual	What run asked for, and the limit
file not touched	Nothing

For example, #12's merge would have shown:

Playbook	Changed files it applies	This run
site.yml	None	Nothing
platform.yml	roles/monitoring/defaults/main.yml	Dry run, then, if it would change anything, the apply, once a required reviewer approves it in production

Exactly what changes: the summary moved out of ci-playbook.sh into scripts/ci-summary.py. It lists each loop item that changes, and puts any --diff output in a collapsed block per box and task. On #12's real log it now reads:

Box	Task	What
lith-1	ufw_allowlist : Allow 8443/tcp from each source (monitoring ingest)	103.232.206.165 103.232.206.162

On 6719ee6's site.yml dry run it names net.ipv4.ip_local_reserved_ports on each box instead of a count.

The apply writes a summary too, of what it changed, so the run page shows what was done as well as what was planned.

An apply with nothing to do is skipped. Each dry run records whether any box would change (a changed= above 0 in its PLAY RECAP, as the job output changes). On a merge, site-apply and platform-apply run only if their dry run would change something, so nobody is asked to approve an apply that does nothing. The dry run's summary then says "Nothing would change on the boxes, so on a merge the apply is skipped". A manual run with run: apply still always applies, in case a dry run ever misses a change. platform-dry-run already accepts a skipped site-apply, so platform.yml still runs after a site.yml with nothing to do.

scripts/ci-summary.py joins the shared paths, so a change to it gets a dry run that exercises it.

Safety

Tasks with no_log (the Argo CD and Cloudflare secrets) print neither items nor diffs, so the summary shows nothing that isn't already in the job's log. Items are capped at 120 characters and diffs at 200 lines per box and task.

Merging

This touches .github/workflows/ci.yml and scripts/, so merging it dry-runs both playbooks. Both should change nothing, so with this change both applies are skipped and no approval is needed. That is the first real test of the skip. This PR's own run shows the new summaries.

Checked

• actionlint and shellcheck pass.
• The change detection, with GNU sed as on the runner: true for Let sf and sf2 push metrics and logs to the monitoring hub #12's and 6719ee6's dry runs, false for Let sf and sf2 push metrics and logs to the monitoring hub #12's log with every changed= set to 0.
• ci-summary.py on Let sf and sf2 push metrics and logs to the monitoring hub #12's and 6719ee6's real dry-run logs (output above).
• A local --check --diff playbook: file and line diffs, a loop item with parentheses, a task name with |, a failing task, and the apply wording.
• The changes step run locally for a merge (Let sf and sf2 push metrics and logs to the monitoring hub #12's range), this PR, a fork PR and a manual apply with a limit.

🤖 Generated with Claude Code