From c9445232b0be6f57a2f068980bdec64d6bc1f4ee Mon Sep 17 00:00:00 2001
From: n0mad1k <n0mad1k@mealeyfamily.com>
Date: Thu, 30 Apr 2026 19:08:40 -0400
Subject: [PATCH] Fix play-level when and teardown credential handling in
 webrunner.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ansible does not support 'when' at the play level — moved
teardown_after_scan condition onto each individual teardown task.
Teardown Linode task now reads token from LINODE_TOKEN env var via
lookup('env') instead of the linode_token extra-var (which is now
filtered out of extra-vars by _SECRET_KEYS). AWS teardown removes
hardcoded aws_access_key/secret_key params — those are already set
as environment vars by set_provider_environment().
---
 providers/webrunner.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/providers/webrunner.yml b/providers/webrunner.yml
index 2ec8521..5223f07 100644
--- a/providers/webrunner.yml
+++ b/providers/webrunner.yml
@@ -99,7 +99,6 @@
   hosts: localhost
   connection: local
   gather_facts: false
-  when: teardown_after_scan | default(true) | bool
 
   tasks:
     - name: Teardown Linode nodes
@@ -107,10 +106,11 @@
         url: "https://api.linode.com/v4/linode/instances/{{ hostvars[item]['linode_instance_id'] }}"
         method: DELETE
         headers:
-          Authorization: "Bearer {{ linode_token }}"
+          Authorization: "Bearer {{ lookup('env', 'LINODE_TOKEN') }}"
         status_code: [200, 204]
       loop: "{{ groups['webrunner_nodes'] | default([]) }}"
       when:
+        - teardown_after_scan | default(true) | bool
         - hostvars[item]['provider'] == 'linode'
         - hostvars[item]['linode_instance_id'] is defined
       ignore_errors: true
@@ -120,11 +120,10 @@
         instance_ids:
           - "{{ hostvars[item]['ec2_instance_id'] }}"
         region: "{{ aws_region | default('us-east-1') }}"
-        aws_access_key: "{{ aws_access_key | default('') }}"
-        aws_secret_key: "{{ aws_secret_key | default('') }}"
         state: terminated
       loop: "{{ groups['webrunner_nodes'] | default([]) }}"
       when:
+        - teardown_after_scan | default(true) | bool
         - hostvars[item]['provider'] == 'aws'
         - hostvars[item]['ec2_instance_id'] is defined
       ignore_errors: true
@@ -132,4 +131,7 @@
     - name: Teardown complete
       debug:
         msg: "All WEBRUNNER scan nodes destroyed."
-      when: groups['webrunner_nodes'] is defined and groups['webrunner_nodes'] | length > 0
+      when:
+        - teardown_after_scan | default(true) | bool
+        - groups['webrunner_nodes'] is defined
+        - groups['webrunner_nodes'] | length > 0