ERP-CORE-DEV Ansible Review
Review Ansible playbooks and roles for best practices.
Checks
- ansible-lint compliance: run ansible-lint with default rules, zero violations
- No shell/command when module exists: flag shell: apt-get install (use apt module), shell: systemctl restart (use systemd module)
- Idempotency: every task safe to re-run; flag tasks that modify state without creates/removes guards
- Vault for secrets: all passwords, keys, tokens must be vault-encrypted; flag plaintext secrets in vars
- Handlers for restarts: service restarts via notify + handler, not inline in tasks
- Fully qualified collection names: use ansible.builtin.copy not just copy
- Become usage: use become: true only on tasks that need it, not globally
- Tags for selective runs: all roles and task blocks should have tags
- Variable naming: snake_case, prefixed with role name to avoid collisions
- Template validation: Jinja2 templates use {{ variable | default('fallback') }} for optional vars
Output
Severity-sorted findings: CRITICAL, HIGH, MEDIUM, LOW, PASSED.
Arguments
<playbook-or-role-path>: Path to playbook or role directory