Add ansible-lint to CI (#1181)

* Improve Ansible code. * Add some ansible-lint ignores. * Add ansible-lint to CI.
2025-12-15 11:32:05 +00:00 · 2025-10-25 11:07:40 +02:00 · 2025-10-25 11:07:40 +02:00 · 95bdce75e6
commit 95bdce75e6
parent b24bce77b6
35 changed files with 123 additions and 85 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -0,0 +1,30 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+skip_list:
+  # Ignore rules that make no sense:
+  - galaxy[tags]
+  - galaxy[version-incorrect]
+  - meta-runtime[unsupported-version]
+  - no-changed-when
+  - sanity[cannot-ignore]  # some of the rules you cannot ignore actually MUST be ignored, like yamllint:unparsable-with-libyaml
+  - yaml  # we're using yamllint ourselves
+  - run-once[task]  # wtf???
+
+  # To be checked and maybe fixed:
+  - ignore-errors
+  - key-order[task]
+  - name[casing]
+  - name[missing]
+  - name[play]
+  - name[template]
+  - no-free-form
+  - no-handler
+  - risky-file-permissions
+  - risky-shell-pipe
+  - var-naming[no-reserved]
+  - var-naming[no-role-prefix]
+  - var-naming[pattern]
+  - var-naming[read-only]
--- a/antsibull-nox.toml
+++ b/antsibull-nox.toml
@ -216,6 +216,12 @@ remote = [

 ##################################################################################################

+[sessions.ansible_lint]
+ansible_lint_package = [
+    "ansible-lint",
+    "ansible-compat < 25.8.2",
+]
+
 [[sessions.ee_check.execution_environments]]
 name = "devel-ubi-9"
 description = "ansible-core devel @ RHEL UBI 9"
--- a/tests/integration/targets/connection/test_connection.yml
+++ b/tests/integration/targets/connection/test_connection.yml
@ -3,7 +3,7 @@
 # GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
 # SPDX-License-Identifier: GPL-3.0-or-later

- hosts: "{{ target_hosts }}"
+- hosts: "{{ target_hosts }}"  # noqa: syntax-check[specific]
  gather_facts: false
  serial: 1
  tasks:
--- a/tests/integration/targets/connection_docker/setup.yml
+++ b/tests/integration/targets/connection_docker/setup.yml
@ -11,4 +11,4 @@
  tasks:
    - name: Setup docker
      import_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]
--- a/tests/integration/targets/connection_docker_api/setup.yml
+++ b/tests/integration/targets/connection_docker_api/setup.yml
@ -11,8 +11,8 @@
  tasks:
    - name: Setup docker
      import_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]

    - name: Setup docker Python deps
      import_role:
-        name: setup_docker_python_deps
+        name: setup_docker_python_deps  # noqa: syntax-check[specific]
--- a/tests/integration/targets/connection_nsenter/setup.yml
+++ b/tests/integration/targets/connection_nsenter/setup.yml
@ -11,4 +11,4 @@
  tasks:
    - name: Setup docker
      import_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]
--- a/tests/integration/targets/docker_config/tasks/test_docker_config.yml
+++ b/tests/integration/targets/docker_config/tasks/test_docker_config.yml
@ -20,7 +20,7 @@
        advertise_addr: "{{ ansible_default_ipv4.address | default('127.0.0.1') }}"

    - name: Parameter name should be required
-      community.docker.docker_config:
+      community.docker.docker_config:  # noqa: args[module]
        state: present
      ignore_errors: true
      register: output
@ -32,7 +32,7 @@
          - 'output.msg == "missing required arguments: name"'

    - name: Test parameters
-      community.docker.docker_config:
+      community.docker.docker_config:  # noqa: args[module]
        name: foo
        state: present
      ignore_errors: true
@ -261,7 +261,7 @@
          community.docker.docker_config:
            name: db_password
            data: opensesame!
-            template_driver: "not a template driver"
+            template_driver: "not a template driver"  # noqa: args[module]
            state: present
          ignore_errors: true
          register: output
--- a/tests/integration/targets/docker_image_export/tasks/tests/basic.yml
+++ b/tests/integration/targets/docker_image_export/tasks/tests/basic.yml
@ -46,7 +46,7 @@
      register: result

    - name: Extract manifest.json files
-      ansible.builtin.command: tar xvf "{{ remote_tmp_dir }}/{{ item.file }}" manifest.json --to-stdout
+      ansible.builtin.command: tar xvf "{{ remote_tmp_dir }}/{{ item.file }}" manifest.json --to-stdout  # noqa: command-instead-of-module
      loop: "{{ image_tasks }}"
      loop_control:
        label: "{{ item.file }}"
--- a/tests/integration/targets/docker_secret/tasks/test_secrets.yml
+++ b/tests/integration/targets/docker_secret/tasks/test_secrets.yml
@ -15,7 +15,7 @@
        advertise_addr: "{{ ansible_default_ipv4.address | default('127.0.0.1') }}"

    - name: Parameter name should be required
-      community.docker.docker_secret:
+      community.docker.docker_secret:  # noqa: args[module]
        state: present
      ignore_errors: true
      register: output
@ -27,7 +27,7 @@
          - 'output.msg == "missing required arguments: name"'

    - name: Test parameters
-      community.docker.docker_secret:
+      community.docker.docker_secret:  # noqa: args[module]
        name: foo
        state: present
      ignore_errors: true
--- a/tests/integration/targets/docker_stack/tasks/test_stack.yml
+++ b/tests/integration/targets/docker_stack/tasks/test_stack.yml
@ -20,7 +20,7 @@

    - name: Create a stack without name
      register: output
-      community.docker.docker_stack:
+      community.docker.docker_stack:  # noqa: args[module]
        state: present
      ignore_errors: true

--- a/tests/integration/targets/docker_swarm/tasks/tests/basic.yml
+++ b/tests/integration/targets/docker_swarm/tasks/tests/basic.yml
@ -10,7 +10,7 @@
 ## Errors ##########################################################
 ####################################################################
 - name: Test parameters with state=join
-  community.docker.docker_swarm:
+  community.docker.docker_swarm:  # noqa: args[module]
    state: join
  ignore_errors: true
  register: output
@ -22,7 +22,7 @@
      - 'output.msg == "state is join but all of the following are missing: remote_addrs, join_token"'

 - name: Test parameters with state=remove
-  community.docker.docker_swarm:
+  community.docker.docker_swarm:  # noqa: args[module]
    state: remove
  ignore_errors: true
  register: output
--- a/tests/integration/targets/inventory_docker_containers/playbooks/docker_setup.yml
+++ b/tests/integration/targets/inventory_docker_containers/playbooks/docker_setup.yml
@ -11,11 +11,11 @@
  tasks:
    - name: Setup docker
      ansible.builtin.import_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]

    - name: Setup Docker Python deps
      ansible.builtin.import_role:
-        name: setup_docker_python_deps
+        name: setup_docker_python_deps  # noqa: syntax-check[specific]

    - name: Start containers
      community.docker.docker_container:
--- a/tests/integration/targets/inventory_docker_machine/playbooks/pre-setup.yml
+++ b/tests/integration/targets/inventory_docker_machine/playbooks/pre-setup.yml
@ -8,11 +8,11 @@
  tasks:
    - name: Setup docker
      ansible.builtin.include_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]

    - name: Setup Docker Python deps
      ansible.builtin.import_role:
-        name: setup_docker_python_deps
+        name: setup_docker_python_deps  # noqa: syntax-check[specific]

    # There seems to be no better way to install docker-machine. At least I couldn't find any packages for RHEL7/8.
    - name: Download docker-machine binary
--- a/tests/integration/targets/inventory_docker_machine/playbooks/test_inventory_1.yml
+++ b/tests/integration/targets/inventory_docker_machine/playbooks/test_inventory_1.yml
@ -8,7 +8,7 @@
  tasks:
    - name: sanity check Docker Machine output
      vars:
-        dm_ls_format: !unsafe '{{.Name}} | {{.DriverName}} | {{.State}} | {{.URL}} | {{.Error}}'
+        dm_ls_format: !unsafe '{{.Name}} | {{.DriverName}} | {{.State}} | {{.URL}} | {{.Error}}'  # noqa: jinja[invalid]
        success_regex: "^vm | [^|]+ | Running | tcp://.+ |$"
      ansible.builtin.command: docker-machine ls --format '{{ dm_ls_format }}'
      register: result
--- a/tests/integration/targets/inventory_docker_swarm/playbooks/swarm_setup.yml
+++ b/tests/integration/targets/inventory_docker_swarm/playbooks/swarm_setup.yml
@ -11,7 +11,7 @@
  tasks:
    - name: Setup docker
      ansible.builtin.import_role:
-        name: setup_docker
+        name: setup_docker  # noqa: syntax-check[specific]

    - name: Setup Docker SDK for Python
      ansible.builtin.import_role:
--- a/tests/integration/targets/setup_docker/tasks/Debian.yml
+++ b/tests/integration/targets/setup_docker/tasks/Debian.yml
@ -4,7 +4,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later

 - name: Get OS version
-  ansible.builtin.shell: uname -r
+  ansible.builtin.command: uname -r
  register: os_version

 - name: Install pre-reqs
@ -35,7 +35,7 @@
  name: Add Docker repo on Ubuntu 20 or before, or Debian 11 or before
  block:
    - name: Add gpg key
-      ansible.builtin.shell: curl -fsSL https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg >key && apt-key add key
+      ansible.builtin.shell: curl -fsSL https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg >key && apt-key add key  # noqa: command-instead-of-module

    - name: Add Docker repo
      ansible.builtin.apt_repository:
--- a/tests/integration/targets/setup_docker/tasks/RedHat-7.yml
+++ b/tests/integration/targets/setup_docker/tasks/RedHat-7.yml
@ -30,7 +30,7 @@
    gpgkey: https://download.docker.com/linux/centos/gpg

 - name: Update cache
-  ansible.builtin.command: yum -y makecache fast
+  ansible.builtin.command: yum -y makecache fast  # noqa: command-instead-of-module

 - name: Install docker
  ansible.builtin.dnf:
--- a/tests/integration/targets/setup_docker/tasks/main.yml
+++ b/tests/integration/targets/setup_docker/tasks/main.yml
@ -25,7 +25,7 @@
          ansible.builtin.set_fact:
            needs_docker_daemon: '{{ not ansible_module_running_in_container }}'

-        - name:
+        - name: Print information
          ansible.builtin.debug:
            msg: |-
              OS family: {{ ansible_facts.os_family }}
--- a/tests/integration/targets/setup_docker_cli_buildx/tasks/main.yml
+++ b/tests/integration/targets/setup_docker_cli_buildx/tasks/main.yml
@ -11,7 +11,7 @@
 - name: Setup Docker
  when: ansible_facts.distribution ~ ansible_facts.distribution_major_version not in  ['CentOS6', 'RedHat6']
  block:
-    - name:
+    - name: Print information
      ansible.builtin.debug:
        msg: |-
          OS family: {{ ansible_facts.os_family }}
--- a/tests/integration/targets/setup_docker_cli_compose/tasks/main.yml
+++ b/tests/integration/targets/setup_docker_cli_compose/tasks/main.yml
@ -11,7 +11,7 @@
 - name: Setup Docker
  when: ansible_facts.distribution ~ ansible_facts.distribution_major_version not in  ['CentOS6', 'RedHat6']
  block:
-    - name:
+    - name: Print information
      ansible.builtin.debug:
        msg: |-
          OS family: {{ ansible_facts.os_family }}
--- a/tests/integration/targets/setup_docker_python_deps/tasks/main.yml
+++ b/tests/integration/targets/setup_docker_python_deps/tasks/main.yml
@ -28,5 +28,5 @@
      - git+https://github.com/psf/requests
      - git+https://github.com/urllib3/urllib3
    extra_args: "-c {{ remote_constraints }}"
-    state: latest
+    state: latest  # noqa: package-latest
  when: force_docker_sdk_for_python_dev | default(false)
--- a/tests/integration/targets/setup_pkg_mgr/tasks/main.yml
+++ b/tests/integration/targets/setup_pkg_mgr/tasks/main.yml
@ -21,12 +21,14 @@
  when: ansible_os_family == "Suse"

 - ansible.builtin.shell:
+    # noqa: command-instead-of-module
    cmd: |
      sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*.repo
      sed -i 's%#baseurl=http://mirror.centos.org/%baseurl=https://vault.centos.org/%g' /etc/yum.repos.d/*.repo
  when: ansible_distribution in 'CentOS' and ansible_distribution_major_version == '7'

 - ansible.builtin.shell:
+    # noqa: command-instead-of-module
    cmd: |
      sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-Linux-*.repo
      sed -i 's%#baseurl=http://mirror.centos.org/$contentdir/$releasever/%baseurl=https://vault.centos.org/8.4.2105/%g' /etc/yum.repos.d/CentOS-Linux-*.repo
--- a/tests/integration/targets/setup_podman/tasks/main.yml
+++ b/tests/integration/targets/setup_podman/tasks/main.yml
@ -25,7 +25,7 @@

    - when: not podman_setup_marker.stat.exists and not ansible_module_running_in_container
      block:
-        - name:
+        - name: Print information
          ansible.builtin.debug:
            msg: |-
              OS family: {{ ansible_facts.os_family }}