False positive: deprecated-bare-vars on relative path to with_filetree

[bluikko]

Summary

Giving a relative path that does not end with a slash to with_filetree causes false positive for deprecated-bare-vars.

deprecated-bare-vars: Found a bare variable 'templates/files.d' used in a 'with_filetree' loop. You should use the full variable syntax ('{{ templates/files.d }}')

Issue Type

• Bug Report

Ansible and Ansible Lint details

ansible --version
ansible 2.9.22
  python version = 3.6.8 (default, Nov 16 2020, 16:55:22) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
ansible-lint --version
ansible-lint 5.0.11 using ansible 2.9.22

• ansible installation method: pip
• ansible-lint installation method: pip

OS / ENVIRONMENT

EL7.9 fully updated

STEPS TO REPRODUCE

- name: Copy files
  template:
    src: '{{ item.src }}'
    dest: "/tmp/files.d/{{ item.path | regex_replace('.j2') }}"
    mode: '0644'
  with_filetree: templates/files.d
  when: item.state == 'file'

Desired Behaviour

It should not complain since this is not a variable it is a path.

Suggest that if with_filetree contains slashes (possibly without spaces around the slash? if it is being confused with number division) then it is not treated as a bare var.

Actual Behaviour

The relative path is detected as a bare variable.

A fix is to add a slash at the end of the path, for example:

- name: Copy files
  template:
    src: '{{ item.src }}'
    dest: "/tmp/files.d/{{ item.path | regex_replace('.j2') }}"
    mode: '0644'
  with_filetree: templates/files.d/
  when: item.state == 'file'

This makes ansible-lint not detect the "bare var". But usually paths do not contain the final slash at the end.

[philipsd6]

A fix is to add a slash at the end of the path

I find this is not true in my case, as when I run ansible-lint 5.3.1 I see this:

playbook.yaml:42: deprecated-bare-vars Found a bare variable 'templates/mydir/' used in a 
'with_community.general.filetree' loop. You should use the full variable syntax ('{{ templates/mydir/ }}')

The task looks like this:

    - name: Create my directories
      file:
        path: "{{ temp.path }}/{{ item.path }}"
        state: directory
        mode: "{{ item.mode }}"
      with_community.general.filetree: templates/mydir/
      when: item.state == "directory"

In my case, I resolved this error by doing this:

    - name: Create my directories
      file:
        path: "{{ temp.path }}/{{ item.path }}"
        state: directory
        mode: "{{ item.mode }}"
      loop: >-
        {{ lookup('community.general.filetree', 'templates/mydir/') |
        selectattr('state', 'equalto', 'directory') | list }}

...which has the added advantage of filtering out the files I don't need for this task instead of littering the stdout with SKIPPED lines.

[bluikko]

I find this is not true in my case, as when I run ansible-lint 5.3.1

It may be, I had already changed all with_ loops to just plain loop: before 5.3.1.

Edit: @philipsd6 I think if you are using a late Ansible version the generator object unrolling is automatic and | list is not needed any longer? One of the few great features in later Ansible versions!

[philipsd6]

generator object unrolling is automatic

Nice! I hadn't noticed that in any release notes, but I try to write code that people can run with the oldest supported releases anyway, even if I always develop right off the devel branch.

[lr1980]

with_community.general.filetree: "templates/{{ my_var }}/"
is also a false positive

[mdebord-dlr]

For anyone else hitting this, I got this error with:

  with_file: "~/key.gpg"

This did not flag the lint error:

  with_file:
    - "~/key.gpg"

[olibre]

I have the same false positive.

Versions

The commands ansible and ansible-lint have been installed using pipenv.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04 LTS
Release:        22.04
Codename:       jammy
$ ansible --version
ansible [core 2.12.6]
  config file = /home/olibre/project/ansible.cfg
  configured module search path = ['/home/olibre/project/.ansible/plugins/modules']
  ansible python module location = /home/olibre/project/.venv/lib/python3.10/site-packages/ansible
  ansible collection location = /home/olibre/project/.ansible/collections
  executable location = /home/olibre/project/.venv/bin/ansible
  python version = 3.10.4 (main, Apr  2 2022, 09:04:19) [GCC 11.2.0]
  jinja version = 3.1.2
  libyaml = True
$ ansible-lint --version
ansible-lint 6.2.2 using ansible 2.12.6

Task

- name: Create remote directories
  ansible.builtin.file:
    path: /remote/path/{{ item.path }}
    state: directory
    mode: a=,u=rX
  with_community.general.filetree: templates/
  when: item.state == "directory"

Warning message

$ export PIPENV_VENV_IN_PROJECT="1"
$ export ANSIBLE_CONFIG=ansible.cfg
$ python3 -Wi -m pipenv run ansible-lint -v containers.yml
INFO     Running ansible-galaxy role install -vr requirements.yml --roles-path /home/olibre/.cache/ansible-compat/0cb87f/roles
INFO     Set ANSIBLE_LIBRARY=/home/olibre/.cache/ansible-compat/0cb87f/modules:/home/olibre/project/.ansible/plugins/modules
INFO     Set ANSIBLE_COLLECTIONS_PATH=/home/olibre/.cache/ansible-compat/0cb87f/collections:/home/olibre/project/.ansible/collections
INFO     Set ANSIBLE_ROLES_PATH=/home/olibre/.cache/ansible-compat/0cb87f/roles:roles:/home/olibre/project/.ansible/roles
INFO     Set ANSIBLE_LIBRARY=/home/olibre/.cache/ansible-compat/0cb87f/modules:/home/olibre/project/.ansible/plugins/modules
INFO     Set ANSIBLE_COLLECTIONS_PATH=/home/olibre/.cache/ansible-compat/0cb87f/collections:/home/olibre/project/.ansible/collections
INFO     Set ANSIBLE_ROLES_PATH=/home/olibre/.cache/ansible-compat/0cb87f/roles:roles:/home/olibre/project/.ansible/roles
WARNING  Overriding detected file kind 'yaml' with 'playbook' for given positional argument: containers.yml
INFO     Executing syntax check on containers.yml (0.67s)
WARNING  Listing 1 violation(s) that are fatal
deprecated-bare-vars: Found a bare variable 'templates/' used in a 'with_community.general.filetree' loop. You should use the full variable syntax ('{{ templates/ }}')
roles/containers/tasks/main.yml:6 Task/Handler: Create remote directories

You can skip specific rules or tags by adding them to your configuration file:
# .config/ansible-lint.yml
warn_list:  # or 'skip_list' to silence them completely
  - deprecated-bare-vars  # Using bare variables is deprecated.

Finished with 1 failure(s), 0 warning(s) on 11 files.

Workaround

Use the @philipsd6's idea:

- name:Create remote directories
  ansible.builtin.file:
    path: /remote/path/{{ item.path }}
    state: directory
    mode: a=,u=rX
  loop: >-
    {{ lookup('community.general.filetree', 'templates/') |
       selectattr('state', 'equalto', 'directory') | list }}

Note: I like this workaround because it avoids printing verbose skipping:....
I can remove the following lines in my ansible.cfg:

[defaults]
# Avoid verbose "skipping:..." when creating remote directories.
display_skipped_hosts = no

[ssbarnea]

My impression is that this is not a false positive and can be avoided by converting it from a string value to a list with one string.

When it is a string, it must be a templated string, like {{ ... }}, so it avoids confusion. No need for fancy workarounds with loop, that should be enough.

If confirmed, we should update the message to make it clear.

[ssbarnea]

Should I also mention that with_flattened was removed in ansible 2.13, so it does not make sense to complain about it.

[olibre]

Yep @ssbarnea Just successfully tested with "{{ 'templates/' }}"

- name: Create remote directories
  ansible.builtin.file:
    path: /remote/path/{{ item.path }}
    state: directory
    mode: a=,u=rX
  with_community.general.filetree: "{{ 'templates/' }}"
  when: item.state == "directory"