matchplay false postivies cannot be disabled with # noqa

[cdesouza71]

Summary

False positives reported by matchplay cannot be disabled with # noqa rule-name.

Issue Type

• Bug Report

Ansible and Ansible Lint details

qc@qc-pde:$ ansible --version
ansible [core 2.11.5] 
  config file = None
  configured module search path = ['/home/qc/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.8/dist-packages/ansible
  ansible collection location = /home/qc/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.8.10 (default, Nov 26 2021, 20:14:08) [GCC 9.3.0]
  jinja version = 3.0.1
  libyaml = True

qc@qc-pde:$ ansible-lint --version
WARNING: PATH altered to include /usr/bin
ansible-lint 5.4.0 using ansible 2.11.5

• ansible installation method: pip
• ansible-lint installation method: pip

OS / ENVIRONMENT

Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.3 LTS
Release:	20.04
Codename:	focal

STEPS TO REPRODUCE

qc@qc-pde:$ ansible-lint -vvv -p -r rules/  data/task-in-playbook.yml

rules/TaskInPlaybookRule.py

from ansiblelint.rules import AnsibleLintRule

class TaskInPlaybookRule(AnsibleLintRule):
    id = "task-in-playbook"
    shortdesc = "Tasks should go in roles not the main playbook"
    description = (
        "Tasks should normally go into roles rather than our top level "
        + "playbooks. This is to keep the playbooks simple and make the code reusable. "
    )

    def matchplay(self, playbookfile, play):
        if "tasks" in play:
            matches = []
            for t in play["tasks"]:
                match = "Task '{}' in playbook".format(t.get("name", ""))
                matches.append(
                    self.create_matcherror(
                        message=match, filename=playbookfile, linenumber=t["__line__"]
                    )
                )
            return matches
        return []

data/task-in-playbook.yml

---
- name: Playbooks contains task not masked
  hosts: localhost
  tasks:
    - name: Check if directory exists
      stat:
        path: "/tmp"

- name: Playbooks contains task masked
  hosts: localhost
  tasks:
    - name: Check if directory exists  # noqa task-in-playbook
      stat:
        path: "/tmp"

Desired Behavior

The first task in the playbook should fail linting whereas the second task should pass linting as it is masked with # noqa.

Actual Behavior

Both tasks in the playbook fail linting.

WARNING: PATH altered to include /usr/bin
DEBUG    Logging initialized to level 10
DEBUG    Options: Namespace(cache_dir='/home/qc/.cache/ansible-lint/dc1163', colored=True, config_file='/home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/.ansible-lint', configured=True, cwd=PosixPath('/home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/bug'), display_relative_path=True, enable_list=[], exclude_paths=['/home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/dummy'], extra_vars=None, format='rich', kinds=[{'jinja2': '**/*.j2'}, {'jinja2': '**/*.j2.*'}, {'inventory': '**/inventory/**.yml'}, {'requirements': '**/meta/requirements.yml'}, {'galaxy': '**/galaxy.yml'}, {'reno': '**/releasenotes/*/*.{yaml,yml}'}, {'playbook': '**/playbooks/*.{yml,yaml}'}, {'playbook': '**/*playbook*.{yml,yaml}'}, {'role': '**/roles/*/'}, {'tasks': '**/tasks/**/*.{yaml,yml}'}, {'handlers': '**/handlers/*.{yaml,yml}'}, {'vars': '**/{host_vars,group_vars,vars,defaults}/**/*.{yaml,yml}'}, {'meta': '**/meta/main.{yaml,yml}'}, {'yaml': '.config/molecule/config.{yaml,yml}'}, {'requirements': '**/molecule/*/{collections,requirements}.{yaml,yml}'}, {'yaml': '**/molecule/*/{base,molecule}.{yaml,yml}'}, {'requirements': '**/requirements.yml'}, {'playbook': '**/molecule/*/*.{yaml,yml}'}, {'yaml': '**/{.ansible-lint,.yamllint}'}, {'yaml': '**/*.{yaml,yml}'}, {'yaml': '**/.*.{yaml,yml}'}], lintables=['data/task-in-playbook.yml'], listrules=False, listtags=False, loop_var_prefix=None, mock_modules=[], mock_roles=[], offline=False, parseable=True, parseable_severity=False, progressive=False, project_dir='..', quiet=False, rules={}, rulesdir=[PosixPath('/home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/bug/rules')], rulesdirs=[PosixPath('/home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/bug/rules')], skip_action_validation=True, skip_list=[], tags=[], use_default_rules=False, var_naming_pattern=None, verbosity=3, version=False, warn_list=['experimental', 'role-name'])
DEBUG    /home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/bug
DEBUG    Loading rules from /home/qc/projects/linter-bug/dev/docker/ansible-linter/custom-rules/bug/rules
INFO     Executing syntax check on data/task-in-playbook.yml (4.22s)
DEBUG    Examining data/task-in-playbook.yml of type playbook
WARNING  Listing 2 violation(s) that are fatal
data/task-in-playbook.yml:5: task-in-playbook Task 'Check if directory exists' in playbook
data/task-in-playbook.yml:12: task-in-playbook Task 'Check if directory exists' in playbook
You can skip specific rules or tags by adding them to your configuration file:
# .ansible-lint
warn_list:  # or 'skip_list' to silence them completely
  - task-in-playbook  # Tasks should go in roles not the main playbook

Finished with 2 failure(s), 0 warning(s) on 1 files.

[ssbarnea]

That is a custom rule, so really a product bug.

[cognifloyd]

matchplay matches a much larger part of the file than a single task. So comments on a task within the play would never skip the role for that play. I don't know of your can put a comment somewhere to skip the rule for the entire play; I suspect that is not implemented.

In any case, I think you'll have better luck writing your rule with matchtask. You can inspect the lintable. Of the lintable. Kind is playbook instead of tasks or handlers, then you've got your match. Doing this let's you piggy back on all the infrastructure in ansible-lint like noqa comments or skip tags.

[cdesouza71]

I already try to use matchtask where possible but sometimes it just does not provide the information required for the rule.

Strangely matchplay does sometimes set the property skipped_rules but does not evaluate the property, see example below which does not throw any linting errors.

class TaskInPlaybookRule(AnsibleLintRule):
    id = "task-in-playbook"
    shortdesc = "Tasks should go in roles not the main playbook"
    description = (
        "Tasks should normally go into roles rather than our top level "
        + "playbooks. This is to keep the playbooks simple and make the code reusable. "
    )
    severity = "MEDIUM"
    tags = ["playbook"]

    def matchplay(self, playbookfile, play):
        # Note we need to check for yaml because ansible-lint on the main
        # directory tree tags the files are yaml and not playbook
        # In the test env they are flagged as playbook
        if (
            playbookfile["type"] == "playbook" or playbookfile["type"] == "yaml"
        ) and "tasks" in play:
            # Only check top level .yml files
            if not re.search("^[^/]+\.yml$", playbookfile.filename):
                return []

            matches = []
            for t in play["tasks"]:
                #
                # Handle bug in ansible-lint that ignores skipped rules
                # in matchplay
                #
                if 'adas-task-in-playbook' in t['skipped_rules']:
                    continue

                match = "Task '{}' in playbook".format(t.get("name", ""))
                matches.append(
                    self.create_matcherror(
                        message=match, filename=playbookfile, linenumber=t["__line__"]
                    )
                )
            return matches
        return []

---
- name: Playbook contains tasks
  hosts: localhost
  tasks:
    - name: task # noqa task-in-playbook
      stat:
        path: "/home/{{ ansible_access_user }}/.ssh"
    - name: include tasks # noqa task-in-playbook
      include_tasks: roles/test/tasks/main.yml
    - include_tasks: roles/test/tasks/main.yml # noqa task-in-playbook
    - import_tasks: roles/test/tasks/main.yml # noqa task-in-playbook
    - name: include vars # noqa task-in-playbook
      include_vars: roles/test/vars/main.yml
    - name: include role # noqa task-in-playbook
      include_role:
        name: test
        tasks_from: main

[gtirloni]

Why does a rule needs special treatment to work with noqa?