mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
# Ansible-lint configuration
|
|
exclude_paths:
|
|
- .cache/
|
|
- .github/
|
|
- tests/
|
|
- files/cloud-init/ # Cloud-init files have special format requirements
|
|
- playbooks/ # These are task files included by other playbooks, not standalone playbooks
|
|
- roles/cloud-ec2/files/ # AWS CloudFormation templates use YAML tags ansible-lint can't parse
|
|
- roles/cloud-lightsail/files/ # AWS CloudFormation templates use YAML tags ansible-lint can't parse
|
|
|
|
skip_list:
|
|
- 'package-latest' # Package installs should not use latest - needed for updates
|
|
- 'experimental' # Experimental rules
|
|
- 'fqcn[action]' # Use FQCN for module actions - gradual migration
|
|
- 'fqcn[action-core]' # Use FQCN for builtin actions - gradual migration
|
|
- 'var-naming[no-role-prefix]' # Variable naming
|
|
- 'var-naming[pattern]' # Variable naming patterns
|
|
- 'no-free-form' # Avoid free-form syntax - some legacy usage
|
|
- 'name[casing]' # Name casing
|
|
- 'yaml[document-start]' # YAML document start
|
|
- 'role-name' # Role naming convention - too many cloud-* roles
|
|
- 'no-handler' # Handler usage - some legitimate non-handler use cases
|
|
- 'name[missing]' # All tasks should be named - 113 issues to fix (temporary)
|
|
|
|
# Enable additional rules
|
|
enable_list:
|
|
- no-log-password
|
|
- no-same-owner
|
|
- partial-become
|
|
- name[play] # All plays should be named
|
|
- yaml[new-line-at-end-of-file] # Files should end with newline
|
|
- jinja[invalid] # Invalid Jinja2 syntax (catches template errors)
|
|
- jinja[spacing] # Proper spacing in Jinja2 expressions
|
|
- no-changed-when # Commands should declare changed_when
|
|
- risky-file-permissions # File tasks must have explicit mode
|
|
|
|
verbosity: 1
|
|
|
|
# Mock custom modules in library/ that ansible-lint can't auto-discover
|
|
# These modules exist and work at runtime, but need to be declared for static analysis
|
|
mock_modules:
|
|
- gcp_compute_location_info
|
|
- lightsail_region_facts
|
|
- x25519_pubkey
|
|
- scaleway_compute
|
|
|
|
# vim: ft=yaml
|