From 7e3645b1fe79eba9328f01852497b82db50c4b89 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 18:14:37 +0200 Subject: [PATCH 1/2] Add ansible-lint and inventory checks to CI Run ansible-lint (basic profile, includes yamllint and playbook syntax checks) and parse every inventory on pull requests and master pushes. Existing violations are baselined in .ansible-lint-ignore so only new code has to pass. --- .ansible-lint | 19 ++++++++ .ansible-lint-ignore | 73 ++++++++++++++++++++++++++++++ .github/workflows/ansible-lint.yml | 43 ++++++++++++++++++ .gitignore | 1 + .yamllint | 22 +++++++++ README.md | 11 +++++ 6 files changed, 169 insertions(+) create mode 100644 .ansible-lint create mode 100644 .ansible-lint-ignore create mode 100644 .github/workflows/ansible-lint.yml create mode 100644 .yamllint diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..e059f40 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,19 @@ +--- +# Violations that existed when linting was introduced are listed in +# .ansible-lint-ignore, new code has to pass the 'basic' profile. +# To shrink the baseline, fix the issues and remove the matching lines. +profile: basic + +exclude_paths: + - .ansible/ + - .github/ + - cron_jobs/ + - systemd_templates/ + - roles/ezamriy.fail2ban/ + - roles/geerlingguy.docker/ + - roles/geerlingguy.redis/ + - "*.tmpl" + +skip_list: + # Role variables are shared between roles and inventories by design + - var-naming[no-role-prefix] diff --git a/.ansible-lint-ignore b/.ansible-lint-ignore new file mode 100644 index 0000000..ae4e5c0 --- /dev/null +++ b/.ansible-lint-ignore @@ -0,0 +1,73 @@ +# This file contains ignores rule violations for ansible-lint +inventories/separate_build_node/group_vars/build_node_vm.yml yaml[empty-lines] +playbooks/albs_with_separate_sign_node.yml yaml[braces] +playbooks/alts_scheduler.yml yaml[braces] +playbooks/build_node_systemd_service.yml name[missing] +playbooks/prepare_alma9_one_vm.yml yaml[empty-lines] +roles/alts_base/tasks/main.yml yaml[truthy] +roles/alts_celery/defaults/main.yml yaml[new-line-at-end-of-file] +roles/alts_celery/tasks/main.yml yaml[braces] +roles/alts_celery/tasks/main.yml yaml[octal-values] +roles/alts_celery/tasks/main.yml yaml[truthy] +roles/alts_docker_customization/tasks/main.yml name[missing] +roles/alts_docker_customization/tasks/main.yml yaml[octal-values] +roles/alts_docker_customization/tasks/main.yml yaml[truthy] +roles/alts_rabbitmq_server/tasks/main.yml key-order[task] +roles/alts_rabbitmq_server/tasks/main.yml schema[tasks] +roles/alts_rabbitmq_server/tasks/main.yml yaml[braces] +roles/alts_rabbitmq_server/tasks/main.yml yaml[colons] +roles/alts_rabbitmq_server/tasks/main.yml yaml[octal-values] +roles/alts_rabbitmq_server/tasks/main.yml yaml[truthy] +roles/alts_scheduler/tasks/main.yml yaml[octal-values] +roles/alts_scheduler/tasks/main.yml yaml[truthy] +roles/alts_terraform/tasks/main.yml yaml[line-length] +roles/alts_terraform/tasks/main.yml yaml[octal-values] +roles/alts_terraform/tasks/main.yml yaml[truthy] +roles/bitwarden_cli/tasks/main.yml yaml[truthy] +roles/dev_deploy/defaults/main/common.yml jinja[spacing] +roles/dev_deploy/defaults/main/configs.yml jinja[spacing] +roles/dev_deploy/tasks/ansible_preparation.yml schema[tasks] +roles/dev_deploy/tasks/common.yml command-instead-of-module +roles/dev_deploy/tasks/common.yml jinja[spacing] +roles/dev_deploy/tasks/common.yml key-order[task] +roles/dev_deploy/tasks/common.yml name[missing] +roles/dev_deploy/tasks/common.yml no-free-form +roles/dev_deploy/tasks/common.yml schema[tasks] +roles/dev_deploy/tasks/common.yml yaml[truthy] +roles/dev_deploy/tasks/configs.yml yaml[truthy] +roles/dev_deploy/tasks/gpg.yml command-instead-of-shell +roles/dev_deploy/tasks/gpg.yml yaml[empty-lines] +roles/dev_deploy/tasks/gpg.yml yaml[truthy] +roles/dev_deploy/tasks/main.yml key-order[task] +roles/dev_deploy/tasks/main.yml name[missing] +roles/dev_deploy/tasks/misc.yml command-instead-of-shell +roles/dev_deploy/tasks/misc.yml literal-compare +roles/dev_deploy/tasks/misc.yml yaml[truthy] +roles/dev_deploy/tasks/services.yml command-instead-of-shell +roles/dev_deploy/tasks/services.yml key-order[task] +roles/dev_deploy/tasks/services.yml name[missing] +roles/dev_deploy/tasks/services.yml yaml[truthy] +roles/prepare_alma9_one_vm/defaults/main.yml yaml[new-line-at-end-of-file] +roles/pulp/vars/main.yml var-naming[pattern] +roles/separate_build_node/tasks/create_env.yml yaml[truthy] +roles/separate_build_node/tasks/dnf.yml yaml[truthy] +roles/separate_build_node/tasks/install_systemd_service.yml yaml[octal-values] +roles/separate_build_node/tasks/install_systemd_service.yml yaml[truthy] +roles/separate_build_node/tasks/main.yml name[missing] +roles/separate_build_node/tasks/pesign.yml yaml[truthy] +roles/separate_sign_file/tasks/create_env.yml yaml[truthy] +roles/separate_sign_file/tasks/install_systemd_service.yml yaml[truthy] +roles/separate_sign_file/tasks/main.yml name[missing] +roles/separate_sign_node/defaults/main/common.yml yaml[comments] +roles/separate_sign_node/tasks/create_env.yml schema[tasks] +roles/separate_sign_node/tasks/create_env.yml yaml[truthy] +roles/separate_sign_node/tasks/dnf.yml schema[tasks] +roles/separate_sign_node/tasks/dnf.yml yaml[truthy] +roles/separate_sign_node/tasks/install_systemd_service.yml schema[tasks] +roles/separate_sign_node/tasks/install_systemd_service.yml yaml[truthy] +roles/separate_sign_node/tasks/main.yml name[missing] +roles/separate_sign_node/tasks/proxy.yml schema[tasks] +roles/separate_sign_node/tasks/proxy.yml yaml[truthy] +roles/sign_common/tasks/gpg.yml yaml[truthy] +roles/sign_common/tasks/main.yml name[missing] +roles/sign_common/tasks/main.yml yaml[truthy] diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml new file mode 100644 index 0000000..2a82a3b --- /dev/null +++ b/.github/workflows/ansible-lint.yml @@ -0,0 +1,43 @@ +name: 'Ansible Checks' +on: + pull_request: + push: + branches: + - master + +jobs: + ansible-lint: + name: ansible-lint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + - name: Install ansible-lint + run: pip install ansible-lint==26.10.1 + # Also runs yamllint (.yamllint) and syntax-checks the playbooks, + # Galaxy dependencies from requirements.yml are installed on the fly + - name: Run ansible-lint + run: ansible-lint + + inventories: + name: Inventories + runs-on: ubuntu-latest + env: + # ansible-inventory only warns about unparseable sources by default + ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED: 'true' + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + - name: Install Ansible + run: pip install ansible-core + - name: Parse every inventory + run: | + for inventory in inventories/*/; do + echo "::group::${inventory}" + ansible-inventory -i "${inventory}" --graph + echo "::endgroup::" + done diff --git a/.gitignore b/.gitignore index 61af98d..0ee859c 100644 --- a/.gitignore +++ b/.gitignore @@ -21,6 +21,7 @@ roles/pulp/files/*.pem roles/pulp/files/*.crt # Caches +.ansible/ .mypy_cache/ __pycache__/ *.py[cod] diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..23fa5aa --- /dev/null +++ b/.yamllint @@ -0,0 +1,22 @@ +--- +extends: default + +ignore: | + .ansible/ + .venv/ + +rules: + braces: + max-spaces-inside: 1 + comments: + min-spaces-from-content: 1 + comments-indentation: false + document-start: disable + line-length: + max: 160 + octal-values: + forbid-implicit-octal: true + forbid-explicit-octal: true + truthy: + allowed-values: ['true', 'false'] + check-keys: false diff --git a/README.md b/README.md index 5497cf4..3eac8b8 100644 --- a/README.md +++ b/README.md @@ -199,6 +199,17 @@ Do you want to contribute with source code? 3. Write your change 4. Submit a pull request +Pull requests are checked with `ansible-lint` (which also runs `yamllint` +and syntax-checks the playbooks) and every inventory has to parse. To run +the same checks locally from the repository root: +```bash +pip install ansible-lint==26.10.1 +ansible-lint +ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED=true ansible-inventory -i inventories/alts --graph +``` +Violations that already existed are listed in `.ansible-lint-ignore`, +new code has to pass. When fixing old ones, remove their lines from that file. + ## License albs-deploy is licensed under the MIT License, see `LICENSE`. Exception: the vendored pulpcore modules `roles/pulp/files/export.py` and From 2c7f4969977b7e2e6063a1f8588eb9938c1c5007 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 18:17:53 +0200 Subject: [PATCH 2/2] Add missing community.rabbitmq collection to requirements alts_rabbitmq_server uses rabbitmq_plugin, rabbitmq_user and rabbitmq_vhost from community.rabbitmq, which was not listed, so the role failed on machines without the collection preinstalled. --- requirements.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/requirements.yml b/requirements.yml index 0dad480..1acfbb7 100644 --- a/requirements.yml +++ b/requirements.yml @@ -9,3 +9,4 @@ collections: - name: community.docker - name: ansible.posix - name: community.general + - name: community.rabbitmq