allow additional collections in only-builtins

.github/workflows/tox.yml

@@ -163,7 +163,7 @@ jobs:
       WSLENV: FORCE_COLOR:PYTEST_REQPASS:TOXENV:TOX_PARALLEL_NO_SPINNER
       # Number of expected test passes, safety measure for accidental skip of
       # tests. Update value if you add/remove tests.
-      PYTEST_REQPASS: 713
+      PYTEST_REQPASS: 714
 
     steps:
       - name: Activate WSL1

examples/playbooks/.ansible-lint-only-builtins-allow-collections

@@ -0,0 +1,2 @@
+only_builtins_allow_collections:
+  - fake_namespace.fake_collection

src/ansiblelint/cli.py

@@ -457,6 +457,7 @@ def merge_config(file_config: dict[Any, Any], cli_config: Namespace) -> Namespac
         "mock_modules": [],
         "mock_roles": [],
         "enable_list": [],
+        "only_builtins_allow_collections": [],
         # do not include "write_list" here. See special logic below.
     }
 

src/ansiblelint/config.py

@@ -122,6 +122,7 @@
     mock_modules=[],
     mock_roles=[],
     loop_var_prefix=None,
+    only_builtins_allow_collections=[],
     var_naming_pattern=None,
     offline=False,
     project_dir=".",  # default should be valid folder (do not use None here)

src/ansiblelint/rules/only_builtins.py

@@ -4,6 +4,7 @@
 import sys
 from typing import Any
 
+from ansiblelint.config import options
 from ansiblelint.file_utils import Lintable
 from ansiblelint.rules import AnsibleLintRule
 
@@ -23,11 +24,21 @@ class OnlyBuiltinsRule(AnsibleLintRule):
     def matchtask(
         self, task: dict[str, Any], file: Lintable | None = None
     ) -> bool | str:
-        fqcn_builtin = task["action"]["__ansible_module_original__"].startswith(
-            "ansible.builtin."
-        )
-        non_fqcn_builtin = task["action"]["__ansible_module_original__"] in builtins
-        return not fqcn_builtin and not non_fqcn_builtin and not is_nested_task(task)
+        module = task["action"]["__ansible_module_original__"]
+
+        fqcn_builtin = module.startswith("ansible.builtin.")
+        non_fqcn_builtin = module in builtins
+        is_builtin = fqcn_builtin or non_fqcn_builtin
+
+        if options.only_builtins_allow_collections:
+            allow_list = options.only_builtins_allow_collections
+            manually_allowed = any(
+                [module.startswith(f"{prefix}.") for prefix in allow_list]
+            )
+        else:
+            manually_allowed = False
+
+        return not is_builtin and not manually_allowed and not is_nested_task(task)
 
 
 # testing code to be loaded only with pytest or when executed the rule file
@@ -36,7 +47,7 @@ def matchtask(
     # pylint: disable=ungrouped-imports
     import pytest
 
-    from ansiblelint.constants import VIOLATIONS_FOUND_RC
+    from ansiblelint.constants import SUCCESS_RC, VIOLATIONS_FOUND_RC
     from ansiblelint.testing import RunFromText, run_ansible_lint
 
     SUCCESS_PLAY = """
@@ -63,6 +74,20 @@ def test_only_builtin_fail() -> None:
         assert "1 failure(s)" in result.stderr
         assert "only-builtins" in result.stdout
 
+    def test_only_builtins_allow_collections() -> None:
+        """Test rule doesn't match."""
+        conf_path = "examples/playbooks/.ansible-lint-only-builtins-allow-collections"
+        result = run_ansible_lint(
+            f"--config-file={conf_path}",
+            "--strict",
+            "--warn-list=",
+            "--enable-list",
+            "only-builtins",
+            "examples/playbooks/rule-only-builtins.yml",
+        )
+        assert result.returncode == SUCCESS_RC
+        assert "only-builtins" not in result.stdout
+
     @pytest.mark.parametrize(
         "rule_runner", (OnlyBuiltinsRule,), indirect=["rule_runner"]
     )

src/ansiblelint/schemas/ansible-lint-config.json

@@ -51,6 +51,13 @@
       "title": "Loop Var Prefix",
       "type": "string"
     },
+    "only_builtins_allow_collections": {
+      "items": {
+        "type": "string"
+      },
+      "title": "Only Builtins Allow Collections",
+      "type": "array"
+    },
     "mock_modules": {
       "items": {
         "type": "string"