Playbook: Generate Self-Signed Certificate

Auto-generated by scripts/generate_docs.py — edit the workflow YAML, not this file.

File: .github/workflows/play-certificate.yml

Triggers

Trigger types: workflow_dispatch

Manual Dispatch Inputs (`workflow_dispatch`)

Input	Type	Required	Default	Description
`TENANT_NAME`	`string`	yes	`raas`	The top-level Cosmos DB document ID for the tenant (e.g., 'raas', 'm42').
`CUSTOMER_CODE`	`string`	yes	`rhapsody`	The specific customer code, used to select the correct runner and for the cert CN.
`MANAGEMENT_REGION`	`choice`	yes	`—`	The Azure region. Options: `westus2`, `eastus2`, `uksouth`, `australiaeast`, `uaenorth`, `westus`, `westus3`
`DEVOPS_ENV`	`choice`	yes	`—`	The target deployment environment. Options: `sandbox`, `sandbox1`, `sandbox2`, `prod`
`TARGET_HOST`	`string`	yes	`dev`	The Host Prefix only (e.g., 'dev', 'prod', 'test'). Full DNS is auto-generated.
`RHAPSODY_DEPLOYMENT_ENVIRONMENT`	`string`	yes	`nonprod`	The Rhapsody deployment environment name (e.g., 'prod', 'nonprod', 'staging') for the cert CN.
`RESTART_ENGINE`	`boolean`	no	`True`	Whether to restart the Rhapsody engine after applying the certificate.
`RUN_PLAYBOOK`	`boolean`	yes	`True`	Set to 'true' to bypass the 'run_playbook: false' guard rail in the playbook.

Permissions

id-token: write
contents: read

Jobs

`execute-playbook` — Generate Self-Signed Certificate

Property	Value
Runs on	`self-hosted`, `tooling`, `${{ inputs.DEVOPS_ENV }}`, `${{ inputs.MANAGEMENT_REGION }}`, `${{ inputs.CUSTOMER_CODE }}`
Environment	`{'name': '${{ inputs.TENANT_NAME }}'}`

Steps:

| Step | Action / Detail

---|---|---
1 | Checkout Code | actions/checkout@v4
2 | Resolve Target Hostname | Inline script: HOST_PREFIX="${{ inputs.TARGET_HOST }}"
3 | Fetch Deployment Configuration | ./.github/actions/fetch-azure-credentials
4 | Install SSH key for Ansible | Inline script: mkdir -p ~/.ssh
5 | Create Dynamic SSH Inventory | Inline script: {
6 | Install Ansible for ping | Inline script: python3 -V \ | \ | true
7 | Ping Target Host | Inline script: export PATH=$HOME/.local/bin:$PATH
8 | Execute Certificate Generation Playbook | ./.github/actions/run-ansible-playbook

Secrets Referenced

COPILOT_PAT_KEY
COSMOSDB_CREDS_KEY_SECRET
GEMINI_API_KEY
OPENAI_API_KEY
RAAS_SSH_KEY

Composite Actions Used

_📋Auto-Generated Documentation | Team: Azure Tooling | Generated by: AI Documentation Engine | Date: 2026-02-27 19:32 UTC _