Add ansible-lint and inventory checks to CI

.ansible-lint

@@ -0,0 +1,19 @@
+---
+# Violations that existed when linting was introduced are listed in
+# .ansible-lint-ignore, new code has to pass the 'basic' profile.
+# To shrink the baseline, fix the issues and remove the matching lines.
+profile: basic
+
+exclude_paths:
+  - .ansible/
+  - .github/
+  - cron_jobs/
+  - systemd_templates/
+  - roles/ezamriy.fail2ban/
+  - roles/geerlingguy.docker/
+  - roles/geerlingguy.redis/
+  - "*.tmpl"
+
+skip_list:
+  # Role variables are shared between roles and inventories by design
+  - var-naming[no-role-prefix]

.ansible-lint-ignore

@@ -0,0 +1,73 @@
+# This file contains ignores rule violations for ansible-lint
+inventories/separate_build_node/group_vars/build_node_vm.yml yaml[empty-lines]
+playbooks/albs_with_separate_sign_node.yml yaml[braces]
+playbooks/alts_scheduler.yml yaml[braces]
+playbooks/build_node_systemd_service.yml name[missing]
+playbooks/prepare_alma9_one_vm.yml yaml[empty-lines]
+roles/alts_base/tasks/main.yml yaml[truthy]
+roles/alts_celery/defaults/main.yml yaml[new-line-at-end-of-file]
+roles/alts_celery/tasks/main.yml yaml[braces]
+roles/alts_celery/tasks/main.yml yaml[octal-values]
+roles/alts_celery/tasks/main.yml yaml[truthy]
+roles/alts_docker_customization/tasks/main.yml name[missing]
+roles/alts_docker_customization/tasks/main.yml yaml[octal-values]
+roles/alts_docker_customization/tasks/main.yml yaml[truthy]
+roles/alts_rabbitmq_server/tasks/main.yml key-order[task]
+roles/alts_rabbitmq_server/tasks/main.yml schema[tasks]
+roles/alts_rabbitmq_server/tasks/main.yml yaml[braces]
+roles/alts_rabbitmq_server/tasks/main.yml yaml[colons]
+roles/alts_rabbitmq_server/tasks/main.yml yaml[octal-values]
+roles/alts_rabbitmq_server/tasks/main.yml yaml[truthy]
+roles/alts_scheduler/tasks/main.yml yaml[octal-values]
+roles/alts_scheduler/tasks/main.yml yaml[truthy]
+roles/alts_terraform/tasks/main.yml yaml[line-length]
+roles/alts_terraform/tasks/main.yml yaml[octal-values]
+roles/alts_terraform/tasks/main.yml yaml[truthy]
+roles/bitwarden_cli/tasks/main.yml yaml[truthy]
+roles/dev_deploy/defaults/main/common.yml jinja[spacing]
+roles/dev_deploy/defaults/main/configs.yml jinja[spacing]
+roles/dev_deploy/tasks/ansible_preparation.yml schema[tasks]
+roles/dev_deploy/tasks/common.yml command-instead-of-module
+roles/dev_deploy/tasks/common.yml jinja[spacing]
+roles/dev_deploy/tasks/common.yml key-order[task]
+roles/dev_deploy/tasks/common.yml name[missing]
+roles/dev_deploy/tasks/common.yml no-free-form
+roles/dev_deploy/tasks/common.yml schema[tasks]
+roles/dev_deploy/tasks/common.yml yaml[truthy]
+roles/dev_deploy/tasks/configs.yml yaml[truthy]
+roles/dev_deploy/tasks/gpg.yml command-instead-of-shell
+roles/dev_deploy/tasks/gpg.yml yaml[empty-lines]
+roles/dev_deploy/tasks/gpg.yml yaml[truthy]
+roles/dev_deploy/tasks/main.yml key-order[task]
+roles/dev_deploy/tasks/main.yml name[missing]
+roles/dev_deploy/tasks/misc.yml command-instead-of-shell
+roles/dev_deploy/tasks/misc.yml literal-compare
+roles/dev_deploy/tasks/misc.yml yaml[truthy]
+roles/dev_deploy/tasks/services.yml command-instead-of-shell
+roles/dev_deploy/tasks/services.yml key-order[task]
+roles/dev_deploy/tasks/services.yml name[missing]
+roles/dev_deploy/tasks/services.yml yaml[truthy]
+roles/prepare_alma9_one_vm/defaults/main.yml yaml[new-line-at-end-of-file]
+roles/pulp/vars/main.yml var-naming[pattern]
+roles/separate_build_node/tasks/create_env.yml yaml[truthy]
+roles/separate_build_node/tasks/dnf.yml yaml[truthy]
+roles/separate_build_node/tasks/install_systemd_service.yml yaml[octal-values]
+roles/separate_build_node/tasks/install_systemd_service.yml yaml[truthy]
+roles/separate_build_node/tasks/main.yml name[missing]
+roles/separate_build_node/tasks/pesign.yml yaml[truthy]
+roles/separate_sign_file/tasks/create_env.yml yaml[truthy]
+roles/separate_sign_file/tasks/install_systemd_service.yml yaml[truthy]
+roles/separate_sign_file/tasks/main.yml name[missing]
+roles/separate_sign_node/defaults/main/common.yml yaml[comments]
+roles/separate_sign_node/tasks/create_env.yml schema[tasks]
+roles/separate_sign_node/tasks/create_env.yml yaml[truthy]
+roles/separate_sign_node/tasks/dnf.yml schema[tasks]
+roles/separate_sign_node/tasks/dnf.yml yaml[truthy]
+roles/separate_sign_node/tasks/install_systemd_service.yml schema[tasks]
+roles/separate_sign_node/tasks/install_systemd_service.yml yaml[truthy]
+roles/separate_sign_node/tasks/main.yml name[missing]
+roles/separate_sign_node/tasks/proxy.yml schema[tasks]
+roles/separate_sign_node/tasks/proxy.yml yaml[truthy]
+roles/sign_common/tasks/gpg.yml yaml[truthy]
+roles/sign_common/tasks/main.yml name[missing]
+roles/sign_common/tasks/main.yml yaml[truthy]

.github/workflows/ansible-lint.yml

@@ -0,0 +1,43 @@
+name: 'Ansible Checks'
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  ansible-lint:
+    name: ansible-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install ansible-lint
+        run: pip install ansible-lint==26.10.1
+      # Also runs yamllint (.yamllint) and syntax-checks the playbooks,
+      # Galaxy dependencies from requirements.yml are installed on the fly
+      - name: Run ansible-lint
+        run: ansible-lint
+
+  inventories:
+    name: Inventories
+    runs-on: ubuntu-latest
+    env:
+      # ansible-inventory only warns about unparseable sources by default
+      ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED: 'true'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install Ansible
+        run: pip install ansible-core
+      - name: Parse every inventory
+        run: |
+          for inventory in inventories/*/; do
+            echo "::group::${inventory}"
+            ansible-inventory -i "${inventory}" --graph
+            echo "::endgroup::"
+          done

.gitignore

@@ -21,6 +21,7 @@ roles/pulp/files/*.pem
 roles/pulp/files/*.crt
 
 # Caches
+.ansible/
 .mypy_cache/
 __pycache__/
 *.py[cod]

.yamllint

@@ -0,0 +1,22 @@
+---
+extends: default
+
+ignore: |
+  .ansible/
+  .venv/
+
+rules:
+  braces:
+    max-spaces-inside: 1
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  document-start: disable
+  line-length:
+    max: 160
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: false

README.md

@@ -199,6 +199,17 @@ Do you want to contribute with source code?
 3. Write your change
 4. Submit a pull request
 
+Pull requests are checked with `ansible-lint` (which also runs `yamllint`
+and syntax-checks the playbooks) and every inventory has to parse. To run
+the same checks locally from the repository root:
+```bash
+pip install ansible-lint==26.10.1
+ansible-lint
+ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED=true ansible-inventory -i inventories/alts --graph
+```
+Violations that already existed are listed in `.ansible-lint-ignore`,
+new code has to pass. When fixing old ones, remove their lines from that file.
+
 ## License
 albs-deploy is licensed under the MIT License, see `LICENSE`. Exception: the
 vendored pulpcore modules `roles/pulp/files/export.py` and

requirements.yml

@@ -9,3 +9,4 @@ collections:
   - name: community.docker
   - name: ansible.posix
   - name: community.general
+  - name: community.rabbitmq