Ansible lintのタグ

こちらの記事は[Ansible lint Advent Calendar 2022](https://qiita.com/advent-calendar/2022/ansible-lint) 3日目の記事になります。

Ansible lintのルールには２つの大分類があります。`タグ`と`Profile`です。今回は`タグ`について説明します。

### タグ一覧

`ansible-lint --list-tags`で表示されます。

* command-shell
* core
* deprecations
* experimental
* formatting
* idempotency
* idiom
* metadata
* opt-in
* risk
* security
* syntax
* unpredictability
* unskippable
* yaml

```bash
ansible-lint --list-tags

# List of tags and rules they cover
command-shell:  # Specific to use of command and shell modules
  - command-instead-of-module
  - command-instead-of-shell
  - deprecated-command-syntax
  - inline-env-var
  - no-changed-when
  - risky-shell-pipe
core:  # Related to internal implementation of the linter
  - internal-error
  - load-failure
  - parser-error
  - syntax-check
  - warning
  - schema
deprecations:  # Indicate use of features that are removed from Ansible
  - deprecated-bare-vars
  - deprecated-command-syntax
  - deprecated-local-action
  - deprecated-module
  - no-jinja-when
  - role-name
experimental:  # Newly introduced rules, by default triggering only warnings
  - warning
  - avoid-implicit
  - galaxy
  - ignore-errors
  - key-order
  - no-free-form
  - no-log-password
  - no-prompting
  - only-builtins
  - risky-file-permissions
  - run-once
  - schema
  - var-naming
formatting:  # Related to code-style
  - yaml
  - fqcn
  - jinja
  - key-order
  - no-tabs
  - playbook-extension
  - risky-octal
idempotency:  # Possible indication that consequent runs would produce different results
  - latest
  - no-changed-when
  - package-latest
idiom:  # Anti-pattern detected, likely to cause undesired behavior
  - command-instead-of-module
  - command-instead-of-shell
  - empty-string-compare
  - inline-env-var
  - literal-compare
  - loop-var-prefix
  - name
  - no-handler
  - no-relative-paths
  - run-once
  - var-naming
metadata:  # Invalid metadata, likely related to galaxy, collections or roles
  - galaxy
  - meta-incorrect
  - meta-no-info
  - meta-no-tags
  - meta-video-links
  - role-name
opt-in:  # Rules that are not used unless manually added to `enable_list`
  - empty-string-compare
  - galaxy
  - no-log-password
  - no-prompting
  - no-same-owner
  - only-builtins
risk:
  - no-free-form
security:  # Rules related o potentially security issues, like exposing credentials
  - no-log-password
syntax:
  - no-free-form
unpredictability:  # Warn about code that might not work in a predictable way
  - avoid-implicit
  - ignore-errors
  - partial-become
  - risky-file-permissions
unskippable:  # Indicate a fatal error that cannot be ignored or disabled
  - load-failure
yaml:  # External linter which will also produce its own rule codes
  - yaml
```

#### command-shell

[ansible.builtin.shell](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/shell_module.html)モジュールおよび[ansible.builtin.command](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/command_module.html)モジュールが利用される際にベストプラクティスに準じて処理が記述されているか検査します。

* [command-instead-of-module](https://ansible-lint.readthedocs.io/rules/command-instead-of-module/)
* [command-instead-of-shell](https://ansible-lint.readthedocs.io/rules/command-instead-of-shell/)
* [deprecated-command-syntax](https://ansible-lint.readthedocs.io/rules/deprecated-command-syntax/)
* [inline-env-var](https://ansible-lint.readthedocs.io/rules/inline-env-var/)
* [no-changed-when](https://ansible-lint.readthedocs.io/rules/no-changed-when/)
* [risky-shell-pipe](https://ansible-lint.readthedocs.io/rules/risky-shell-pipe/)

#### core

Ansible lintの内部的な処理に利用されるルールです。

* [internal-error](https://ansible-lint.readthedocs.io/rules/internal-error/)
* [load-failure](https://ansible-lint.readthedocs.io/rules/load-failure/)
* [parser-error](https://ansible-lint.readthedocs.io/rules/parser-error/)
* [syntax-check](https://ansible-lint.readthedocs.io/rules/risky-shell-pipe/)
* [warning](https://ansible-lint.readthedocs.io/rules/warning/)
* [schema](https://ansible-lint.readthedocs.io/rules/schema/)

#### deprecations

PlaybookやRoleの書き方が古い形式だったりAnsible coreもしくはAnsible communityで非推奨のModuleが利用されていないか等を検査します。

* [deprecated-bare-vars](https://ansible-lint.readthedocs.io/rules/deprecated-bare-vars/)
* [deprecated-command-syntax](https://ansible-lint.readthedocs.io/rules/deprecated-command-syntax/)
* [deprecated-local-action](https://ansible-lint.readthedocs.io/rules/deprecated-local-action/)
* [deprecated-module](https://ansible-lint.readthedocs.io/rules/deprecated-module/)
* [no-jinja-when](https://ansible-lint.readthedocs.io/rules/no-jinja-when/)
* [role-name](https://ansible-lint.readthedocs.io/rules/role-name/)

#### experimental

導入時期が比較的新しいルールです。これらのルールで違反が見つかった場合は初期設定ではエラーではなくwarningを出力します。

* [warning](https://ansible-lint.readthedocs.io/rules/warning/)
* [avoid-implicit](https://ansible-lint.readthedocs.io/rules/avoid-implicit/)
* [galaxy](https://ansible-lint.readthedocs.io/rules/galaxy/)
* [ignore-errors](https://ansible-lint.readthedocs.io/rules/ignore-errors/)
* [key-order](https://ansible-lint.readthedocs.io/rules/key-order/)
* [no-free-form](https://ansible-lint.readthedocs.io/rules/no-free-form/)
* [no-log-password](https://ansible-lint.readthedocs.io/rules/no-log-password/)
* [no-prompting](https://ansible-lint.readthedocs.io/rules/no-prompting/)
* [only-builtins](https://ansible-lint.readthedocs.io/only-builtins/)
* [risky-file-permissions](https://ansible-lint.readthedocs.io/rules/risky-file-permissions/)
* [run-once](https://ansible-lint.readthedocs.io/rules/run-once/)
* [schema](https://ansible-lint.readthedocs.io/rules/schema/)
* [var-naming](https://ansible-lint.readthedocs.io/rules/var-naming/)


#### formatting

Ansible lintが基準と考えるコーディング規約に沿って記述されているか検査します。

* [yaml](https://ansible-lint.readthedocs.io/rules/yaml/)
* [fqcn](https://ansible-lint.readthedocs.io/rules/fqcn/)
* [jinja](https://ansible-lint.readthedocs.io/rules/jinja/)
* [key-order](https://ansible-lint.readthedocs.io/rules/key-order/)
* [no-tabs](https://ansible-lint.readthedocs.io/rules/no-tabs/)
* [playbook-extension](https://ansible-lint.readthedocs.io/rules/playbook-extension/)
* [risky-octal](https://ansible-lint.readthedocs.io/rules/risky-octal/)

#### idempotency

PlaybookやRoleを実行した際に冪等性が保証されないような記述があるか検査します。

* [latest](https://ansible-lint.readthedocs.io/rules/latest/)
* [no-changed-when](https://ansible-lint.readthedocs.io/rules/no-changed-when/)
* [package-latest](https://ansible-lint.readthedocs.io/rules/package-latest/)

#### idiom

意図しない動作や副作用が起こるような記述があるか検査します。

* [command-instead-of-module](https://ansible-lint.readthedocs.io/rules/command-instead-of-module/)
* [command-instead-of-shell](https://ansible-lint.readthedocs.io/rules/command-instead-of-shell/)
* [empty-string-compare](https://ansible-lint.readthedocs.io/rules/empty-string-compare/)
* [inline-env-var](https://ansible-lint.readthedocs.io/rules/inline-env-var/)
* [literal-compare](https://ansible-lint.readthedocs.io/rules/literal-compare/)
* [loop-var-prefix](https://ansible-lint.readthedocs.io/rules/loop-var-prefix/)
* [name](https://ansible-lint.readthedocs.io/rules/name/)
* [no-handler](https://ansible-lint.readthedocs.io/rules/no-handler/)
* [no-relative-paths](https://ansible-lint.readthedocs.io/rules/no-relative-paths/)
* [run-once](https://ansible-lint.readthedocs.io/rules/run-once/)
* [var-naming](https://ansible-lint.readthedocs.io/rules/var-naming/)

#### metadata

galaxy collectionとroleのメタデータファイルの記述に違反がないかチェックします。

* [galaxy](https://ansible-lint.readthedocs.io/rules/galaxy/)
* [meta-incorrect](https://ansible-lint.readthedocs.io/rules/meta-incorrect/)
* [meta-no-info](https://ansible-lint.readthedocs.io/rules/meta-no-info/)
* [meta-no-tags](https://ansible-lint.readthedocs.io/rules/meta-no-tags/)
* [meta-video-links](https://ansible-lint.readthedocs.io/rules/meta-video-links/)
* [role-name](https://ansible-lint.readthedocs.io/rules/role-name/)

#### opt-in

初期設定では無効になっているルールです。Ansible lintの設定ファイルで`enable_list`で設定すると有効になります。

* [empty-string-compare](https://ansible-lint.readthedocs.io/rules/empty-string-compare/)
* [galaxy](https://ansible-lint.readthedocs.io/rules/galaxy/)
* [no-log-password](https://ansible-lint.readthedocs.io/rules/o-log-password/)
* [no-prompting](https://ansible-lint.readthedocs.io/rules/no-prompting/)
* [no-same-owner](https://ansible-lint.readthedocs.io/rules/no-same-owner/)
* [only-builtins](https://ansible-lint.readthedocs.io/rules/only-builtins/)

#### risk

主に[ansible.builtin.command](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/command_module.html)モジュールや[ansible.builtin.raw](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/raw_module.html)モジュールで副作用が起きそうな記述がないか検査します。

* [no-free-form](https://ansible-lint.readthedocs.io/rules/no-free-form/)


#### security

Ansible実行時にパスワード等の秘匿情報がログに出力されないか検査します。Ansibleのログについては「[Ansible 出力のロギング — Ansible Documentation](https://docs.ansible.com/ansible/2.9_ja/reference_appendices/logging.html?highlight=no_log)」を参照してみてください。

* [no-log-password](https://ansible-lint.readthedocs.io/rules/no-log-password/)


#### syntax

説明なし

* [no-free-form](https://ansible-lint.readthedocs.io/rules/no-free-formd/)

#### unpredictability

記述された処理が意図した通りに実行されない可能性がある場合に警告を出します。

* [avoid-implicit](https://ansible-lint.readthedocs.io/rules/avoid-implicit/)
* [ignore-errors](https://ansible-lint.readthedocs.io/rules/ignore-errors/)
* [partial-become](https://ansible-lint.readthedocs.io/rules/partial-become/)
* [risky-file-permissions](https://ansible-lint.readthedocs.io/rules/risky-file-permissions/)


#### unskippable

Ansible lintがファイルを検査できない時に出力されれます。検査できない主な原因は

* ファイルのエンコーディングエラー（Ansible lintはUTF-8のみ扱える）
* Ansibleがサポートする形式のファイルではない
* YAMLファイルではない
* ファイルにAnsible vaultで解読できない記述が含まれている

などが考えらます。

* [load-failure](https://ansible-lint.readthedocs.io/rules/load-failure/)

#### yaml

Playbookやrole等が[yamllint](https://github.com/adrienverge/yamllint)で設定した形式で記述されているか検査します。

* [yaml](https://ansible-lint.readthedocs.io/rules/yaml/)