update-role
Update one or more files in an existing Ansible role. Always shows a diff and waits for confirmation before writing.
Required Inputs
- role_name or FQCN — The role to update (resolved from discovery)
- change_description — What to change (e.g., "add Windows support", "fix bare module names in tasks/main.yml", "add SELinux task to RedHat.yml")
Behavior
Step 1 — Discovery
Locate the role via discovery (references/discovery.md).
Step 2 — Load Target Files
Read only the files relevant to the requested change. If the change affects multiple files (e.g., "add multi-OS support"), read all affected files.
Step 2a — Secret Scan (before any output)
Before displaying any content or diff — especially for defaults/main.yml, vars/*.yml, and group_vars/ files — scan every loaded file for credential-like values:
Step 3 — Apply Change
Apply the requested change to the relevant files:
- Preserve existing structure, indentation style, and comments
- All modules use FQCN
- All new tasks have tags (role_name + action category)
no_log: true on any new task handling secrets per references/security_vault.md- Use templates from
references/role.md for any new blocks
- Keep tests and smoke-playbook updates aligned with
references/testing.md
Step 4 — Show Unified Diff (per file)
For each modified file, show the diff:
--- roles/nginx/tasks/main.yml (original)
+++ roles/nginx/tasks/main.yml (proposed)
@@ -12,6 +12,12 @@
tags:
- nginx
- configure
+
+- name: Open firewall port for nginx
+ ansible.posix.firewalld:
+ port: "{{ nginx_port }}/tcp"
+ permanent: true
+ state: enabled
+ immediate: true
+ tags:
+ - nginx
+ - security
Then ask: "Apply these changes? (yes/no)"
Step 5 — Write on Confirmation
- If yes: write all modified files.
- If no: ask what to change and loop back to Step 3.
Step 6 — Final Output
Show file tree of the updated role:
find "roles/<role_name>" -type f | sort
Suggest next step:
Next step: Run `ansible-lint roles/<role_name>/` to validate
or use /ansible-designer:review-role to re-check for remaining issues.
Change Types Supported
| Change requested |
Files to modify |
How to handle |
| Add task |
tasks/main.yml (or OS-specific task file) |
Insert task with FQCN, tags, no_log if needed |
| Remove task |
tasks/main.yml |
Remove task block; check for orphaned handlers |
| Add multi-OS support |
tasks/main.yml, tasks/RedHat.yml, tasks/Solaris.yml, tasks/Windows.yml, vars/RedHat.yml, vars/Solaris.yml, vars/Windows.yml |
Add OS detection block + generate OS task/var files |
| Fix bare module names |
tasks/main.yml, handlers/main.yml |
Replace all bare module names with FQCN |
| Add tags |
tasks/main.yml |
Add missing tags to untagged tasks |
| Add handler |
handlers/main.yml |
Append handler with FQCN, add notify to triggering task |
| Update defaults |
defaults/main.yml |
Add/modify default variable |
| Update meta |
meta/main.yml |
Modify galaxy_info fields (platforms, version, etc.) |
| Add Windows support |
tasks/Windows.yml (create), vars/Windows.yml (create), tasks/main.yml (update) |
Generate Windows task file; add OS detection to main.yml |
| Add Solaris support |
tasks/Solaris.yml (create), vars/Solaris.yml (create), tasks/main.yml (update) |
Generate Solaris SMF task file; add OS detection to main.yml |
Safety Rules
- Never remove tasks unless explicitly requested.
- Never change the role name or its meta role_name field without explicit request.
- Preserve all existing comments.
- If adding OS support to an existing role that already has tasks in main.yml: do NOT remove those tasks. Wrap existing platform-independent tasks to remain in main.yml and move platform-specific tasks to the OS files.
- If the change would break backward compatibility (e.g., removing a defaults variable), warn before asking for confirmation.
1---2name: update-role3description: Update an existing Ansible role. Triggered by /update-role. Reads specific role files, applies the requested change following all global rules (FQCN, tags, no_log), shows a unified diff per file, waits for explicit user confirmation, then writes. Never overwrites silently.4---56# update-role78Update one or more files in an existing Ansible role. Always shows a diff and waits for confirmation before writing.910---1112## Required Inputs13141. **role_name or FQCN** — The role to update (resolved from discovery)152. **change_description** — What to change (e.g., "add Windows support", "fix bare module names in tasks/main.yml", "add SELinux task to RedHat.yml")1617---1819## Behavior2021### Step 1 — Discovery22Locate the role via discovery (`references/discovery.md`).2324### Step 2 — Load Target Files25Read only the files relevant to the requested change. If the change affects multiple files (e.g., "add multi-OS support"), read all affected files.2627### Step 2a — Secret Scan (before any output)28Before displaying any content or diff — especially for `defaults/main.yml`, `vars/*.yml`, and `group_vars/` files — scan every loaded file for credential-like values:29- Match lines or YAML values where the key contains `password`, `secret`, `token`, `api_key`, `private_key`, `pass`, or `credential`30- **Skip** lines where the value is already a vault reference (`{{ vault_* }}`), a task option (`no_log`, `register`, `when`), empty, or `None`31- For any remaining matches, **redact the value** in all output: `db_password: "***REDACTED***"`32- Emit a warning at the top of each affected file's diff block:33 ```34 ⚠ Warning: N line(s) with credential-like values were redacted from this display.35 Review the file directly before applying changes.36 ```37- Never output actual credential values in diffs, summaries, or confirmations.3839### Step 3 — Apply Change40Apply the requested change to the relevant files:41- Preserve existing structure, indentation style, and comments42- All modules use FQCN43- All new tasks have tags (role_name + action category)44- `no_log: true` on any new task handling secrets per `references/security_vault.md`45- Use templates from `references/role.md` for any new blocks46- Keep tests and smoke-playbook updates aligned with `references/testing.md`4748### Step 4 — Show Unified Diff (per file)49For each modified file, show the diff:5051```52--- roles/nginx/tasks/main.yml (original)53+++ roles/nginx/tasks/main.yml (proposed)54@@ -12,6 +12,12 @@55 tags:56 - nginx57 - configure58+59+- name: Open firewall port for nginx60+ ansible.posix.firewalld:61+ port: "{{ nginx_port }}/tcp"62+ permanent: true63+ state: enabled64+ immediate: true65+ tags:66+ - nginx67+ - security68```6970Then ask: **"Apply these changes? (yes/no)"**7172### Step 5 — Write on Confirmation73- If **yes**: write all modified files.74- If **no**: ask what to change and loop back to Step 3.7576### Step 6 — Final Output77Show file tree of the updated role:78```bash79find "roles/<role_name>" -type f | sort80```8182Suggest next step:83```84Next step: Run `ansible-lint roles/<role_name>/` to validate85 or use /ansible-designer:review-role to re-check for remaining issues.86```8788---8990## Change Types Supported9192| Change requested | Files to modify | How to handle |93|-----------------|-----------------|---------------|94| Add task | tasks/main.yml (or OS-specific task file) | Insert task with FQCN, tags, no_log if needed |95| Remove task | tasks/main.yml | Remove task block; check for orphaned handlers |96| Add multi-OS support | tasks/main.yml, tasks/RedHat.yml, tasks/Solaris.yml, tasks/Windows.yml, vars/RedHat.yml, vars/Solaris.yml, vars/Windows.yml | Add OS detection block + generate OS task/var files |97| Fix bare module names | tasks/main.yml, handlers/main.yml | Replace all bare module names with FQCN |98| Add tags | tasks/main.yml | Add missing tags to untagged tasks |99| Add handler | handlers/main.yml | Append handler with FQCN, add notify to triggering task |100| Update defaults | defaults/main.yml | Add/modify default variable |101| Update meta | meta/main.yml | Modify galaxy_info fields (platforms, version, etc.) |102| Add Windows support | tasks/Windows.yml (create), vars/Windows.yml (create), tasks/main.yml (update) | Generate Windows task file; add OS detection to main.yml |103| Add Solaris support | tasks/Solaris.yml (create), vars/Solaris.yml (create), tasks/main.yml (update) | Generate Solaris SMF task file; add OS detection to main.yml |104105---106107## Safety Rules108109- Never remove tasks unless explicitly requested.110- Never change the role name or its meta role_name field without explicit request.111- Preserve all existing comments.112- If adding OS support to an existing role that already has tasks in main.yml: do NOT remove those tasks. Wrap existing platform-independent tasks to remain in main.yml and move platform-specific tasks to the OS files.113- If the change would break backward compatibility (e.g., removing a defaults variable), warn before asking for confirmation.
3A2DEV