Ansible-lint TektonCD task

[tylerauerbeck]

Summary

I've recently been working on a pipeline in Tekton that uses ansible-lint in order to lint ansible-roles prior to applying them in our pipeline. Part of this included creating a task and a container image that would allow for this. Is this something that anyone here would be interested in being involved in?

Issue Type

• Feature Idea

Additional Information

These particular pieces are used in TektonCD pipelines in order to utilize the ansible-lint cli. This then allows ansible-lint to be passed params from a pipeline and then execute on them.

The task itself would likely be pushed to the https://github.com/tektoncd/catalog repository. One of the "suggestions" in that repo is that any images that are used are built automatically and then pushed to a repository. Right now I've just been building these myself and pushing them to a quay repo (quay.io/tauerbec/ansible-lint), but would probably be better served if they were to come from somewhere like this repository.

[ssbarnea]

If I remember well @webknjaz already had one such container in another repository, maybe he can make a PR or at least give you a link to make one.

Molecule sister project already has such a container, one that already includes ansible-lint. You can reuse that one or use it as an inspiration for adding one here too (you would only have to remove stuff from it).

This may explain why nobody bothered seriously about building a container because it is so easy to do it, and most of the time you want to build a container with multiple linters, as you are unlikely to want to run 10-15 containers to perform linting.

[webknjaz]

You must be confusing something. I don't recall having such a container and my first hunch would be to point to the Molecule's container too.
In Ansible Core we use uses containers from https://quay.io/organization/ansible for our CI but there's no lint container there.
I guess you could contribute an extra GHA workflow conditioned similar to https://github.com/ansible/ansible-lint/blob/9da220a/.github/workflows/tox.yml#L274-L296 that would build and auto-publish containers to either quay, or dockerhub (the built-in GitHub Packages registry doesn't seem to be suitable — I think it requires auth for pulling, plus there's a free quota that will get exhausted fast if everyone starts using that).

P.S. There's ansible-runner (also shipped as a container) that is supposed to be a means for running Ansible programmatically but I'm pretty sure that it doesn't have lint inside.

[ssbarnea]

The only catch here is that publishing to quay from github actions is problematic (security). On molecule I decided to make use of their own self-building method for publishing. Still, there is a tox job that tests that the container building works, just the publishing is done by quay.io itself.

Regarding if the linter should be included in other containers, that is a very good questions, one that should deserve a feature request on https://github.com/ansible/ansible-runner itself. @tylerauerbeck You should make a feature request there.

From outpoint of view, it would make sense to use ansible-runner container as a base and install the linter in it. Any PR will be considered as I will not have time to work on it myselft.

[webknjaz]

I don't think lint belongs in the runner container, it has a different purpose that is not linting.