Skip to content

Commit d7eb00f

Browse files
authored
Merge pull request #475 from dev-sec/ansible_lint
use Ansible lint in separate task
2 parents e20dd07 + 7b37e98 commit d7eb00f

File tree

8 files changed

+59
-19
lines changed

8 files changed

+59
-19
lines changed

.github/workflows/ansible-lint.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Ansible Lint # feel free to pick your own name
2+
3+
on: [push, pull_request]
4+
5+
jobs:
6+
ansible-lint:
7+
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
# Important: This sets up your GITHUB_WORKSPACE environment variable
12+
- uses: actions/checkout@v2
13+
14+
- name: Lint Ansible Playbook
15+
# replace "master" with any valid ref
16+
uses: ansible/ansible-lint-action@master
17+
with:
18+
# [required]
19+
# Paths to ansible files (i.e., playbooks, tasks, handlers etc..)
20+
# or valid Ansible directories according to the Ansible role
21+
# directory structure.
22+
# If you want to lint multiple ansible files, use the following syntax
23+
# targets: |
24+
# playbook_1.yml
25+
# playbook_2.yml
26+
targets: "roles/"
27+
# [optional]
28+
# Arguments to override a package and its version to be set explicitly.
29+
# Must follow the example syntax.
30+
# override-deps: |
31+
# ansible==2.9
32+
# ansible-lint==4.2.0
33+
# [optional]
34+
# Arguments to be passed to the ansible-lint
35+
36+
# Options:
37+
# -q quieter, although not silent output
38+
# -p parseable output in the format of pep8
39+
# --parseable-severity parseable output including severity of rule
40+
# -r RULESDIR specify one or more rules directories using one or
41+
# more -r arguments. Any -r flags override the default
42+
# rules in ansiblelint/rules, unless -R is also used.
43+
# -R Use default rules in ansiblelint/rules in addition to
44+
# any extra
45+
# rules directories specified with -r. There is no need
46+
# to specify this if no -r flags are used
47+
# -t TAGS only check rules whose id/tags match these values
48+
# -x SKIP_LIST only check rules whose id/tags do not match these
49+
# values
50+
# --nocolor disable colored output
51+
# --exclude=EXCLUDE_PATHS
52+
# path to directories or files to skip. This option is
53+
# repeatable.
54+
# -c C Specify configuration file to use. Defaults to ".ansible-lint"
55+
args: ""
56+

molecule/mysql_hardening/molecule.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@ dependency:
66
requirements-file: molecule/mysql_hardening/requirements.yml
77
driver:
88
name: docker
9-
lint: |
10-
yamllint roles/mysql_hardening/ molecule/mysql_hardening/ .github/workflows/mysql_hardening.yml
11-
ansible-lint roles/mysql_hardening/
129
platforms:
1310
- name: instance
1411
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
5754
- destroy
5855
test_sequence:
5956
- dependency
60-
- lint
6157
- destroy
6258
- syntax
6359
- create

molecule/nginx_hardening/molecule.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ dependency:
55
role-file: molecule/nginx_hardening/requirements.yml
66
driver:
77
name: docker
8-
lint: |
9-
yamllint roles/nginx_hardening/ molecule/nginx_hardening/ .github/workflows/nginx_hardening.yml
10-
ansible-lint roles/nginx_hardening/
118
platforms:
129
- name: instance
1310
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
5754
- destroy
5855
test_sequence:
5956
- dependency
60-
- lint
6157
- destroy
6258
- syntax
6359
- create

molecule/os_hardening/molecule.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ dependency:
55
role-file: molecule/os_hardening/requirements.yml
66
driver:
77
name: docker
8-
lint: |
9-
yamllint roles/os_hardening/ molecule/os_hardening/ .github/workflows/os_hardening.yml
10-
ansible-lint roles/os_hardening/
118
platforms:
129
- name: instance
1310
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
5754
- destroy
5855
test_sequence:
5956
- dependency
60-
- lint
6157
- destroy
6258
- syntax
6359
- create

molecule/ssh_hardening/molecule.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ dependency:
55
role-file: molecule/ssh_hardening/requirements.yml
66
driver:
77
name: docker
8-
lint: |
9-
yamllint roles/ssh_hardening/ molecule/ssh_hardening/ .github/workflows/ssh_hardening.yml
10-
ansible-lint roles/ssh_hardening/
118
platforms:
129
- name: instance
1310
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
@@ -57,7 +54,6 @@ scenario:
5754
- destroy
5855
test_sequence:
5956
- dependency
60-
- lint
6157
- destroy
6258
- syntax
6359
- create

roles/mysql_hardening/tasks/main.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
# we only override variables with our default if they have not been specified already.
1616
# by default the lookup functions finds all varnames containing the string, therefore
1717
# we add ^ and $ to denote start and end of string, so this returns only exact maches.
18-
- name: Set OS dependent variables, if not already defined by user
18+
- name: Set OS dependent variables, if not already defined by user # noqa var-naming
1919
set_fact:
2020
'{{ item.key }}': '{{ item.value }}'
2121
when: "not lookup('varnames', '^' + item.key + '$')"

roles/os_hardening/tasks/hardening.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
# we only override variables with our default, if they have not been specified already
1616
# by default the lookup functions finds all varnames containing the string, therefore
1717
# we add ^ and $ to denote start and end of string, so this returns only exact matches
18-
- name: Set OS dependent variables, if not already defined by user
18+
- name: Set OS dependent variables, if not already defined by user # noqa var-naming
1919
set_fact:
2020
'{{ item.key }}': '{{ item.value }}'
2121
when: "not lookup('varnames', '^' + item.key + '$')"

roles/ssh_hardening/tasks/hardening.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
# we only override variables with our default, if they have not been specified already
1616
# by default the lookup functions finds all varnames containing the string, therefore
1717
# we add ^ and $ to denote start and end of string, so this returns only exact matches
18-
- name: Set OS dependent variables, if not already defined by user
18+
- name: Set OS dependent variables, if not already defined by user # noqa var-naming
1919
set_fact:
2020
'{{ item.key }}': '{{ item.value }}'
2121
when: "not lookup('varnames', '^' + item.key + '$')"

0 commit comments

Comments
 (0)