Add ansible-lint CI gate and antsibull-changelog release pipeline #1

Merged

jsanchezd merged 1 commit from feature/ci-lint-and-release-gate into main

2026-09-29 14:54:42 +00:00

jsanchezd commented

2026-09-29 14:35:09 +00:00

Owner

Rolls out the pattern proven on silvarion.repos/base/containers/databases. Depends on silvarion.databases, so the lint workflow installs it first.

Fixed real issues: missing meta/runtime.yml + misplaced requires_ansible key, a systemctl status-check switched to the idiomatic systemd module (verified live: no-op query, correct .status.ActiveState), and 7 confirmed-safe become_user/partial-become false positives (playbooks set become: true at the play level; ansible-lint can't see that when linting role task files in isolation) marked noqa with reasoning.

Verified antsibull-changelog release+generate end-to-end in a fresh container matching the CI job image.

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

Rolls out the pattern proven on silvarion.repos/base/containers/databases. Depends on silvarion.databases, so the lint workflow installs it first. Fixed real issues: missing meta/runtime.yml + misplaced requires_ansible key, a systemctl status-check switched to the idiomatic systemd module (verified live: no-op query, correct .status.ActiveState), and 7 confirmed-safe become_user/partial-become false positives (playbooks set become: true at the play level; ansible-lint can't see that when linting role task files in isolation) marked noqa with reasoning. Verified antsibull-changelog release+generate end-to-end in a fresh container matching the CI job image. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd added 1 commit

2026-09-29 14:35:09 +00:00

Add ansible-lint CI gate and antsibull-changelog release pipeline

Ansible Lint / ansible-lint (pull_request) Successful in 5m16s

Details

8320f1ebc4

Rolls out the pattern proven on silvarion.repos/base/containers/
databases. Collection depends on silvarion.databases, so the lint
workflow installs it before linting, same as silvarion.repos.

Fixed real issues ansible-lint found:
- galaxy.yml had a top-level `requires_ansible` key (not part of the
  official schema) and meta/runtime.yml didn't exist -- created it.
- roles/powerdns/tasks/dns/install.yml shelled out to `systemctl
  is-active` to check a service's state instead of using the systemd
  module -- switched to ansible.builtin.systemd (name only, no state,
  a genuine no-op query) and updated the downstream `when:` to read
  .status.ActiveState instead of .rc. Verified live: the module call
  is changed=false and correctly reports ActiveState.
- 7 tasks across roles/pdns_manager and roles/powerdns_admin use
  become_user without a local become: true (partial-become[task]).
  Confirmed via grep that these roles' own playbooks
  (playbooks/pdns_manager.yml, playbooks/powerdns_admin.yml) set
  become: true at the play level, so these tasks correctly narrow down
  to an app-specific user -- ansible-lint can't see that play-level
  context when linting a role's task file in isolation. Marked noqa
  with the reasoning inline rather than changing working code.

Verified antsibull-changelog release+generate end-to-end in a fresh
container matching the CI job image.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

jsanchezd merged commit ce6b8645ee into main

2026-09-29 14:54:42 +00:00

jsanchezd deleted branch feature/ci-lint-and-release-gate

2026-09-29 14:54:42 +00:00

jsanchezd referenced this pull request from a commit

2026-09-29 14:54:43 +00:00

Merge pull request 'Add ansible-lint CI gate and antsibull-changelog release pipeline' (#1) from feature/ci-lint-and-release-gate into main