Allow/enforce underscore prefixed internal variables

[gardar]

Summary

Followup to: #3422 (comment)

Internal variables are often prefixed with underscores to distinguish them as in python: https://peps.python.org/pep-0008/#descriptive-naming-styles

The no-role-prefix rule should allow internal variables to have a leading underscore in addition to the role name prefix.
Also perhaps there's no need for the role name prefix on internal variables if all of the internal variables are distinguished with a underscore prefix.

In the prometheus ansible collection roles we prefix the variables in vars/ with a single underscore and then variables which are registered in tasks are prefixed with double underscores.
I've seen the same style used in roles from @geerlingguy and others

[cidrblock]

I like this idea, always have.

We need to make sure AH will allow it, we can ask @thedoubl3j or @alisonlhart

A couple related things come to mind:

redhat-cop/automation-good-practices#80
ansible-community/community-topics#154

Regardless of whether or not ansible-core ever recognizes the convetion, I think it is sane.

We should (you, sorin, or I) should raise an issue in the COP repo proposing the standard. We work closely with them to make sure we never have conflicting standards and try to stay in sync.

[gardar]

While we are on the subject, I wish we could also prefix role names with underscores, to create roles in collections that are like a library, and sourced by other roles for common tasks and such and not supposed to be used directly.

[richm]

The no-role-prefix rule should allow internal variables to have a leading underscore in addition to the role name prefix.

I would prefer to allow 1 or 2 leading underscores - in system roles we use two e.g. https://github.com/linux-system-roles/logging/blob/main/roles/rsyslog/tasks/deploy_nolog.yml#L39
because of the recommended practices - https://github.com/redhat-cop/automation-good-practices/tree/main/roles

Moreover, internal variables (those that are not expected to be set by users) are to be prefixed
by two underscores: __foo_variable.

where foo is the rolename

[erikgb]

Please fix this ASAP. The latest release (6.16.1) broke the following code:

- name: Assert Secret
  ansible.builtin.assert:
    that:
      - test_tls_secret_secret.type == 'kubernetes.io/tls'
      - "'tls.crt' in test_tls_secret_secret.data"
      - "'tls.key' in test_tls_secret_secret.data"
  vars:
    test_tls_secret_secret: "{{ test_tls_secret_secret_list.resources[0] }}"

How am I supposed to fix the following new ansible-lint errors?

var-naming[no-role-prefix]: Variables names from within roles should use role_name_ as a prefix. (vars: __file__)
molecule/tls_secret/roles/test_tls_secret/tasks/main.yml:19 Task/Handler: Assert Secret

var-naming[no-role-prefix]: Variables names from within roles should use role_name_ as a prefix. (vars: __line__)
molecule/tls_secret/roles/test_tls_secret/tasks/main.yml:19 Task/Handler: Assert Secret

What kind of versioning is ansible-lint practicing? It is definitely not SemVer.....

[drybjed]

I can confirm the above case, here's a test role which triggers the warning.

[jeremyspencer39171]

I encountered the same thing just now, thought I'd lost my marbles.

[drybjed]

The issue should be fixed in the latest ansible-lint release (v6.16.2), it works correctly now with my playbooks and roles.

[alexdyukov]

@drybjed @ssbarnea There is a issue with register keyword also. Code like this:

---
- name: Add repository
  ansible.builtin.yum_repository:
    name: testrole
    description: Testrole
    baseurl: "{{ testrole_url }}"
    gpgcheck: false
    enabled: true
    state: present
  register: _repo

throws the error:

var-naming[no-role-prefix]: Variables names from within roles should use role_name_ as a prefix. (register: _repo)

As i can see the topic, it mentions the error as part of issue:
Also perhaps there's no need for the role name prefix on internal variables if all of the internal variables are distinguished with a underscore prefix.