Re: [PATCH RFC 0/3] Run Ansible Lint Across Playbooks

[Daniel Gomez <da.gomez@kernel.org>]

On 01/08/2025 09.23, Daniel Gomez wrote:
> In line with the motivation behind "[PATCH v2 0/9] kdevops: add support
> for A/B testing" [1], this change runs ansible-lint across all playbooks
> to enforce a more consistent and standardized formatting of Ansible
> code.
> 
> https://lore.kernel.org/kdevops/91f83d54-8375-4016-ab53-7a210437d39b@kernel.org/T/#u [1]
> 
> This helps auto-fix several issues, but some rule violations still
> require manual resolution. Below is a summary of the remaining issues:
> 
> Rule Violation Summary
> 
>   1 syntax-check profile:min tags:core,unskippable
>  16 command-instead-of-module profile:min tags:command-shell,idiom
>   2 deprecated-local-action profile:min tags:deprecations
>   2 inline-env-var profile:min tags:command-shell,idiom
>   6 jinja profile:min tags:formatting
>   8 schema profile:min tags:core
>  11 name profile:min tags:idiom
>   1 name profile:min tags:idiom
> 461 var-naming profile:min tags:idiom
>  30 yaml profile:min tags:formatting,yaml
>   1 yaml profile:min tags:formatting,yaml
>  70 name profile:min tags:idiom
>   3 latest profile:min tags:idempotency
>   1 package-latest profile:min tags:idempotency
> 119 risky-file-permissions profile:min tags:unpredictability
>  10 risky-shell-pipe profile:min tags:command-shell
>  45 ignore-errors profile:min tags:unpredictability
> 162 no-changed-when profile:min tags:command-shell,idempotency
>   2 fqcn profile:min tags:formatting
> 
> Failed: 945 failure(s), 6 warning(s) on 562 files.
> <sys>:0: DeprecationWarning: builtin type swigvarlink has no __module__ attribute
> 
> Full log:
> https://gist.github.com/dkruces/bc63122aa1145562157ced72cd3ed408
> 
> This structured output may serve as a useful input for generative AI in
> future clean-up efforts.
> 
> This has been tested in current kdevops CI (fstests) and manually with
> nfstests workflow.
> 
> An additional note is that not always ansible-lint will produce a valid
> fix. I run into the following issue that affected bringup:
> 
> - name: Check if the developer has a git config
> delegate_to: localhost
> - stat:
> - path={{ dev_gitconfig_src }}
> + ansible.builtin.stat:
> + path: "{{"
> + cmd: dev_gitconfig_src }}
> run_once: true
> register: dev_git_config_file
> 
> The same pattern repeated in different tasks for the same file. So I
> manually fix these and let Generative AI verify more files.
> 
> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
> ---


I've pushed the first 2 patches.

670303fe40e9 playbooks: ansible-lint: fix FileNotFoundError
609131cb3587 playbooks: fix include_tasks paths in kdc and krb5 role

And agreed with Chuck to split the third into smaller parts for better
bisectability, easier review, and clarity. The ansible-lint tool allows fixing
issues using individual rule IDs or rule tags [1].

Link: https://ansible.readthedocs.io/projects/lint/autofix/#autofix [1]