ansible-lint & yamllint

Lesson 4 handed you “use the FQCN or lint will fail the PR” on faith. Time to cash it out. The lint is ansible-lint. It runs in CI on every pull request. In most shops it is the first reviewer your code meets, and it never tires.

Two tools share the job. yamllint polices YAML itself — indentation, line length, trailing whitespace, lesson 13’s truthy traps — so no human ever comments on them. ansible-lint reads your playbooks and roles as Ansible, flagging patterns that parse fine but teams agree are trouble. It runs yamllint-style checks too, so one command covers both layers.

The promoted install is one bundle:

pip install ansible-dev-tools # lint + molecule + navigator, one install
ansible-lint site.yml # or run it bare to lint the whole repo

The bundle also delivers molecule and ansible-navigator, tools you meet in lessons 38 and 40 — which is why teams standardise on it.

The production profile

ansible-lint groups its rules into profiles of increasing strictness. profile: production is the strictest preset, and the one real repos run. It catches modules invoked without FQCN (lesson 4’s rule, enforced at last), unnamed tasks, role-name violations, missing handlers, and dozens of other issues. A first run:

$ ansible-lint site.yml
fqcn[action-core]: Use FQCN for builtin module actions (copy).
site.yml:8

name[missing]: All tasks should be named.
site.yml:12

Failed: 2 failure(s), 1 warning(s) on 1 files.

Note the split: failures block, warnings don’t. A with_items: surfaces as a warning, not an error — lesson 19 told you why: legacy, not deprecated.

The config file is a contract

Configuration lives in .ansible-lint at the repo root, checked in so every laptop and CI runner enforces the same bar:

# .ansible-lint — repo root, version-controlled
profile: production
skip_list:
  # OPS-1123: inherited role names predate our convention;
  # renaming breaks live playbooks, tracked for Q4 cleanup.
  - role-name

Look at that skip. The reason sits next to it, with a ticket. That’s the norm. Skips are legitimate — repos carry history you can’t fix in one PR — but every skip must be documented in the config. An undocumented skip is one of the most common PR review flags. It reads as “I made the error go away”, not “we decided this rule doesn’t apply.”

Run it twice: locally before you push (seconds spent, a failed pipeline saved) and in CI on every PR. When you wire Ansible into Jenkins in lesson 41, a lint stage is the first thing the pipeline runs. But lint reads code without executing it, so it proves style, never behaviour. Proving a role actually converges takes a harness that runs it for real — that’s lesson 38.