Skip to content

Fix all ansible-lint violations; pin ansible-lint - #471

Merged
compscidr merged 7 commits into
mainfrom
jason/ansible-lint-cleanup
Aug 3, 2026
Merged

Fix all ansible-lint violations; pin ansible-lint#471
compscidr merged 7 commits into
mainfrom
jason/ansible-lint-cleanup

Conversation

@compscidr

@compscidr compscidr commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Summary

CI's Ansible Lint job has been red since ~Jul 22: the workflow installs unpinned ansible-lint, and the 26.4.0 → 26.6.0 upgrade started enforcing rules the repo violated in 170 places. This fixes every violation properly (no blanket skips) and pins the linter so future upgrades arrive as Renovate PRs instead of silent CI breakage.

Local result with CI's exact version (26.6.0): Passed: 0 failure(s) — validation profile now production (was failing at min).

By commit:

  • ansible-lint --fix pass: formatting, long-lookup wraps, FQCN (45 files, no semantic changes)
  • var-naming[no-role-prefix] (79): role vars renamed with role prefixes, every reference updated repo-wide (incl. the Renovate regex manager that tracked claude_desktop_tag). 10 vars intentionally left un-renamed with inline noqa + comments: they're the documented interface of external roles (php_* → geerlingguy.php, media_* → compscidr.media_server) and renaming them would silently break those roles
  • risky-shell-pipe (8): set -o pipefail + executable: /bin/bash
  • command-instead-of-module (5): systemctl state-checks got changed_when: false + noqa (service_facts refactor out of scope); vendor curl | sh installers (tailscale/fnm/rustup) kept intentionally with noqa
  • risky-file-permissions (7): explicit 0644 on rc-file edits; mode: preserve for the staging data copy
  • no-changed-when (5): real changed_when expressions per task
  • no-handler (1): apt-cache refresh converted to a proper dev_gui handler
  • role-name (3): sair-orchestrator/sair-portal/www-redirect dirs renamed to underscore form; runtime identities (container names, /opt paths, images, runner names) and playbook tags deliberately unchanged
  • yaml[line-length] (49): folded at safe points, zero noqa needed
  • CI: pin ansible-lint==26.6.0 + Renovate custom manager for the pin; new ansible/.ansible-lint excludes galaxy-managed content from linting

All 12 top-level playbooks pass ansible-playbook --syntax-check.

Test plan

  • ansible-lint . with 26.6.0 from ansible/: Passed, 0 failures, production profile
  • Syntax-check on all top-level playbooks
  • CI Ansible Lint job green on this PR
  • After merge: next playbook run against hosts should report no unexpected changed diffs from the var renames (all references were updated together)

🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings August 3, 2026 00:36
Copilot AI reviewed Aug 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR restores a green Ansible lint CI by pinning ansible-lint and applying repo-wide Ansible lint fixes (formatting, safer shell usage, explicit file modes, idempotency markers, and role/var naming updates), while excluding vendored Galaxy-managed roles from linting.

Changes:

  • Pin ansible-lint==26.6.0 in CI and add a Renovate regex manager to keep the pin updated via PRs.
  • Apply ansible-lint-driven refactors across playbooks/roles (variable renames with role prefixes, folded long lookups, safer shell pipes, explicit modes/changed_when).
  • Add/refresh vendored external roles under ansible/roles/ and exclude them from ansible-lint runs.

Reviewed changes

Copilot reviewed 136 out of 148 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
renovate.json Updates Renovate regex manager for renamed var; adds manager for ansible-lint pin.
ansible/vars/user.yml Adds YAML document start.
ansible/vars/deb_arch.yml Adds YAML document start; formats architecture map.
ansible/sair.yml Wraps long 1Password lookups to satisfy line-length lint.
ansible/runners.yml Wraps long 1Password lookup to satisfy line-length lint.
ansible/roles/www_redirect/tasks/main.yml Updates loops to renamed redirect var.
ansible/roles/www_redirect/defaults/main.yml Renames www_redirects → www_redirect_domains.
ansible/roles/webarchitect609.jet_brains_toolbox/vars/main.yml Adds vendored role vars.
ansible/roles/webarchitect609.jet_brains_toolbox/tasks/main.yml Adds vendored role tasks (used by dev_gui).
ansible/roles/webarchitect609.jet_brains_toolbox/README.md Adds vendored role docs.
ansible/roles/webarchitect609.jet_brains_toolbox/meta/main.yml Adds vendored role metadata.
ansible/roles/webarchitect609.jet_brains_toolbox/meta/.galaxy_install_info Adds Galaxy install info for vendored role.
ansible/roles/webarchitect609.jet_brains_toolbox/LICENSE.md Adds vendored role license.
ansible/roles/webarchitect609.jet_brains_toolbox/defaults/main.yml Adds vendored role defaults.
ansible/roles/webarchitect609.jet_brains_toolbox/CHANGELOG.md Adds vendored role changelog.
ansible/roles/stalwart/tasks/main.yml Normalizes quoting/formatting and wraps long shell pipeline.
ansible/roles/stalwart/defaults/main.yml Comment spacing tweak to satisfy lint.
ansible/roles/sair/tasks/main.yml Comment spacing tweak to satisfy lint.
ansible/roles/sair_portal/tasks/main.yml Adds new SAIR portal deployment role tasks.
ansible/roles/sair_portal/defaults/main.yml Adds defaults for SAIR portal role.
ansible/roles/sair_orchestrator/tasks/main.yml Comment spacing tweak to satisfy lint.
ansible/roles/sair_orchestrator/defaults/main.yml Adds defaults for SAIR orchestrator role.
ansible/roles/rustup/tasks/main.yml Adds pipefail/executable and explicit file modes; improves idempotency vars naming.
ansible/roles/rust_game/tasks/main.yml Adds YAML document start; wraps long 1Password lookups; normalizes modes.
ansible/roles/projects/tasks/main.yml Normalizes quoting/modes; wraps long 1Password lookups; comment spacing tweaks.
ansible/roles/projects/defaults/main.yml Comment spacing tweak to satisfy lint.
ansible/roles/opencode/tasks/main.yml Normalizes quoting/modes.
ansible/roles/openclaw/tasks/main.yml Renames registers; folds long when expressions.
ansible/roles/openclaw/defaults/main.yml Comment spacing tweaks to satisfy lint.
ansible/roles/ollama/tasks/main.yml Renames registers; adds pipefail + bash executable; normalizes modes.
ansible/roles/ollama/defaults/main.yml Comment spacing tweaks; line-length formatting.
ansible/roles/media_server/tasks/main.yml Adds interface-var comments/noqa; renames letsencrypt email var; normalizes modes/lookups.
ansible/roles/mailu/tasks/main.yml Renames registers; adds pipefail + bash executable; normalizes modes/no_log spacing.
ansible/roles/mailu/defaults/main.yml Wraps long 1Password lookups; comment spacing tweaks.
ansible/roles/luizgavalda.gnome_extensions/tasks/main.yml Adds vendored role tasks.
ansible/roles/luizgavalda.gnome_extensions/tasks/install_extension.yml Adds vendored role subtask file.
ansible/roles/luizgavalda.gnome_extensions/README.md Adds vendored role docs.
ansible/roles/luizgavalda.gnome_extensions/meta/main.yml Adds vendored role metadata.
ansible/roles/luizgavalda.gnome_extensions/meta/.galaxy_install_info Adds Galaxy install info for vendored role.
ansible/roles/luizgavalda.gnome_extensions/LICENSE Adds vendored role license.
ansible/roles/luizgavalda.gnome_extensions/defaults/main.yml Adds vendored role defaults.
ansible/roles/jasonernst_com/tasks/main.yml Normalizes quoting/modes; preserves mode on staging→prod copy.
ansible/roles/home_assistant/tasks/main.yml Normalizes mode quoting.
ansible/roles/geerlingguy.php/vars/Ubuntu-24.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/Ubuntu-22.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/Ubuntu-20.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/RedHat.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/Debian.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/Debian-12.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/vars/Debian-11.yml Adds vendored role vars.
ansible/roles/geerlingguy.php/templates/www.conf.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/templates/php.ini.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/templates/php-fpm.conf.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/templates/opcache.ini.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/templates/fpm-init.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/templates/apc.ini.j2 Adds vendored role template.
ansible/roles/geerlingguy.php/tasks/setup-RedHat.yml Adds vendored role tasks.
ansible/roles/geerlingguy.php/tasks/setup-Debian.yml Adds vendored role tasks.
ansible/roles/geerlingguy.php/tasks/main.yml Adds vendored role main task file.
ansible/roles/geerlingguy.php/tasks/install-from-source.yml Adds vendored role source-install tasks.
ansible/roles/geerlingguy.php/tasks/configure.yml Adds vendored role config tasks.
ansible/roles/geerlingguy.php/tasks/configure-opcache.yml Adds vendored role opcache tasks.
ansible/roles/geerlingguy.php/tasks/configure-fpm.yml Adds vendored role FPM tasks.
ansible/roles/geerlingguy.php/tasks/configure-apcu.yml Adds vendored role APCu tasks.
ansible/roles/geerlingguy.php/README.md Adds vendored role docs.
ansible/roles/geerlingguy.php/molecule/default/source-install.yml Adds vendored role molecule playbook.
ansible/roles/geerlingguy.php/molecule/default/requirements.yml Adds vendored role molecule requirements.
ansible/roles/geerlingguy.php/molecule/default/molecule.yml Adds vendored role molecule config.
ansible/roles/geerlingguy.php/molecule/default/converge.yml Adds vendored role molecule converge playbook.
ansible/roles/geerlingguy.php/meta/main.yml Adds vendored role meta.
ansible/roles/geerlingguy.php/meta/.galaxy_install_info Adds vendored role Galaxy install info.
ansible/roles/geerlingguy.php/LICENSE Adds vendored role license.
ansible/roles/geerlingguy.php/handlers/main.yml Adds vendored role handlers.
ansible/roles/geerlingguy.php/defaults/main.yml Adds vendored role defaults.
ansible/roles/geerlingguy.php/.yamllint Adds vendored role yamllint config.
ansible/roles/geerlingguy.php/.gitignore Adds vendored role gitignore.
ansible/roles/geerlingguy.php/.github/workflows/stale.yml Adds vendored role workflow file.
ansible/roles/geerlingguy.php/.github/workflows/release.yml Adds vendored role workflow file.
ansible/roles/geerlingguy.php/.github/workflows/ci.yml Adds vendored role workflow file.
ansible/roles/geerlingguy.php/.github/FUNDING.yml Adds vendored role funding config.
ansible/roles/geerlingguy.php/.ansible-lint Adds vendored role ansible-lint config.
ansible/roles/fnm/tasks/main.yml Adds pipefail + bash executable; explicit modes; improves changed_when/var naming.
ansible/roles/fnm/defaults/main.yml Adds YAML document start; normalizes comment spacing.
ansible/roles/fail2ban/tasks/main.yml Normalizes quoting/modes.
ansible/roles/fail2ban/defaults/main.yml Comment spacing tweaks to satisfy lint.
ansible/roles/dyndns/tasks/main.yml Adds YAML document start; qualifies set_fact; wraps long 1Password lookup.
ansible/roles/dev/vars/main.yml Adds YAML doc start; adds interface-var comments/noqa for external php role vars.
ansible/roles/dev/tasks/main.yml Normalizes quoting/modes; adjusts register variable naming and changed_when.
ansible/roles/dev_gui/tasks/main.yml Introduces handler for apt cache refresh; prefixes vars and wraps long lines.
ansible/roles/dev_gui/handlers/main.yml Adds handler to refresh apt cache.
ansible/roles/dev_gui/defaults/main.yml Renames claude_desktop_tag → dev_gui_claude_desktop_tag.
ansible/roles/cs2_game/tasks/main.yml Normalizes quoting/modes; wraps long 1Password lookup.
ansible/roles/compscidr.lapce/tasks/main.yml Adds vendored role tasks.
ansible/roles/compscidr.lapce/requirements.txt Adds vendored role Python requirements.
ansible/roles/compscidr.lapce/renovate.json Adds vendored role Renovate config.
ansible/roles/compscidr.lapce/README.md Adds vendored role docs.
ansible/roles/compscidr.lapce/playbook.yml Adds vendored role example playbook.
ansible/roles/compscidr.lapce/molecule/default/verify.yml Adds vendored role molecule verify playbook.
ansible/roles/compscidr.lapce/molecule/default/molecule.yml Adds vendored role molecule config.
ansible/roles/compscidr.lapce/molecule/default/converge.yml Adds vendored role molecule converge playbook.
ansible/roles/compscidr.lapce/meta/main.yml Adds vendored role metadata.
ansible/roles/compscidr.lapce/meta/.galaxy_install_info Adds vendored role Galaxy install info.
ansible/roles/compscidr.lapce/defaults/main.yml Adds vendored role defaults.
ansible/roles/compscidr.lapce/.gitignore Adds vendored role gitignore.
ansible/roles/compscidr.lapce/.github/workflows/molecule.yml Adds vendored role workflow.
ansible/roles/compscidr.lapce/.github/workflows/deploy.yml Adds vendored role workflow.
ansible/roles/compscidr.lapce/.github/workflows/check.yml Adds vendored role workflow.
ansible/roles/compscidr.lapce/.ansible-lint Adds vendored role ansible-lint config.
ansible/roles/compscidr.gpg/test-version-fix.py Adds vendored role helper script/docs.
ansible/roles/compscidr.gpg/tasks/main.yml Adds vendored role tasks.
ansible/roles/compscidr.gpg/TAG_VERSIONING_FIX.md Adds vendored role documentation.
ansible/roles/compscidr.gpg/requirements.txt Adds vendored role Python requirements.
ansible/roles/compscidr.gpg/renovate.json Adds vendored role Renovate config.
ansible/roles/compscidr.gpg/README.md Adds vendored role docs.
ansible/roles/compscidr.gpg/README_FIX.md Adds vendored role documentation.
ansible/roles/compscidr.gpg/molecule/default/verify.yml Adds vendored role molecule verify playbook.
ansible/roles/compscidr.gpg/molecule/default/molecule.yml Adds vendored role molecule config.
ansible/roles/compscidr.gpg/molecule/default/converge.yml Adds vendored role molecule converge playbook.
ansible/roles/compscidr.gpg/meta/main.yml Adds vendored role metadata.
ansible/roles/compscidr.gpg/meta/.galaxy_install_info Adds vendored role Galaxy install info.
ansible/roles/compscidr.gpg/LICENSE Adds vendored role license.
ansible/roles/compscidr.gpg/library/gpg.py Adds vendored custom module implementation.
ansible/roles/compscidr.gpg/fix-tag-versioning.sh Adds vendored role helper script.
ansible/roles/compscidr.gpg/.gitignore Adds vendored role gitignore.
ansible/roles/compscidr.gpg/.github/workflows/molecule.yml Adds vendored role workflow.
ansible/roles/compscidr.gpg/.github/workflows/deploy.yml Adds vendored role workflow.
ansible/roles/compscidr.gpg/.github/workflows/check.yml Adds vendored role workflow.
ansible/roles/compscidr.gpg/.ansible-lint Adds vendored role ansible-lint config.
ansible/roles/common_gui/vars/main.yml Adds YAML doc start; normalizes list formatting.
ansible/roles/common_gui/tasks/main.yml Renames registers; normalizes modes; adds changed_when for macOS installer.
ansible/roles/common_cli/vars/main.yml Adds YAML doc start; normalizes list formatting/comments.
ansible/roles/common_cli/templates/wpa_supplicant.conf.j2 Updates SSID var name used in template.
ansible/roles/common_cli/meta/main.yml Wraps long commented 1Password lookup example.
ansible/roles/common_cli/handlers/main.yml Normalizes handler syntax; prefixes register vars.
ansible/roles/common_cli/defaults/main.yml Prefixes watchtower defaults with common_cli_.
ansible/roles/bootstrap/tasks/main.yml Comment spacing tweaks to satisfy lint.
ansible/roles/bootstrap/defaults/main.yml Wraps long 1Password lookups.
ansible/requirements.yml Adds YAML document start.
ansible/projects.yml Wraps long 1Password lookups; updates role/var names; adds pre_task name.
ansible/openclaw.yml Comment spacing tweaks.
ansible/jasonernst_com.yml Adds pre_task name; updates redirect var/role names.
ansible/inventory.yml Adds YAML doc start; removes trailing blank mapping entries.
ansible/group_vars/linux.yml Adds YAML doc start.
ansible/group_vars/dev.yml Wraps long 1Password lookup.
ansible/common.yml Adds pre_task name and conditional tailscale check.
ansible/.ansible-lint Adds lint excludes for Galaxy-managed/vendored content.
.github/workflows/verify.yml Pins ansible-lint in CI install step.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread ansible/roles/webarchitect609.jet_brains_toolbox/tasks/main.yml Outdated
Comment on lines +3 to +7
ansible.builtin.find:
name: "{{ toolbox_install_dir }}"
file_type: "file"
pattern: "{{ toolbox_install_file }}"
use_regex: false

@compscidr compscidr Aug 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is no longer part of the PR — it's the vendored webarchitect609.jet_brains_toolbox galaxy role that was committed by mistake in the original first commit; the branch history has been rewritten to exclude all vendored roles. The bug you found is real but belongs upstream in that role (pinned at 3.0.0 in requirements.yml).

Comment thread ansible/roles/webarchitect609.jet_brains_toolbox/tasks/main.yml Outdated
Comment thread ansible/roles/compscidr.gpg/library/gpg.py Outdated
Comment thread .github/workflows/verify.yml Outdated
compscidr and others added 6 commits August 2, 2026 17:42
@compscidr @claude
style(ansible): ansible-lint --fix pass (formatting, wraps, fqcn)
27491ff 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr @claude
refactor(ansible): prefix role vars per var-naming[no-role-prefix]
80e2a5e 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr @claude
fix(ansible): pipefail, file modes, changed_when, task names, apt-cac…
c0acc6e 
…he handler

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr @claude
refactor(ansible): rename hyphenated role dirs to match role-name pat…
fb3eb9f 
…tern

sair-orchestrator -> sair_orchestrator, sair-portal -> sair_portal,
www-redirect -> www_redirect. Runtime identities (container names,
/opt paths, images, runner names) and playbook tags unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr @claude
style(ansible): wrap lines over 160 chars; rename www_redirects to ww…
b1c8f28 
…w_redirect_domains

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr @claude
ci: pin ansible-lint, exclude vendored paths from lint
5b38405 
Pin ansible-lint==26.6.0 so linter upgrades arrive as Renovate PRs (a
new custom manager tracks the pin) instead of breaking CI unannounced —
the 26.4->26.6 drift is what broke main. Add ansible/.ansible-lint so
galaxy-managed roles/collections are never linted, locally or in CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr
compscidr force-pushed the jason/ansible-lint-cleanup branch from 810dfa1 to 5b38405 Compare August 3, 2026 00:43
@compscidr @claude
ci: pin ansible alongside ansible-lint
645db58 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@compscidr
compscidr merged commit 810d4b0 into main Aug 3, 2026
4 checks passed
@compscidr compscidr mentioned this pull request Aug 4, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@compscidr