Repository: ansible/ansible

Issue:
Add an option to treat warnings like fatal errors
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
<!--- Explain the problem briefly -->
It would be nice to have a configuration flag that would allow all warnings to be treated like fatal errors, so user can opt into getting an feedback if something is wrong in the playbook as early as possible, before any changes are actually made and (if possible) without any connections being open.

I can see this being used, for instance, to test via CI changes to playbooks submitted in PRs. 

While this does not provide full guarantee that playbook will succeed (because it's not such comprehensive test like, for instance, running it with `--check` is), it can help to catch simple mistakes that ansible already clearly detects (because it issues warnings about them).

I have tried `any_errors_fatal: true` and `ANSIBLE_INVENTORY_UNPARSED_FAILED=true` but they are not really about warnings in playbooks so, not surprisingly, they did not help.

**Workaround:**

It is a bit hackish, but it is possible to do similar thing by running  `--syntax-check` and check output for any warnings (since, surprisingly, it reports that everything is OK with playbook, and exits with `0`):
```
$ ansible-playbook -f 2 --syntax-check -- ./playbook.yml && echo 0 || echo 1
 [WARNING]: Ignoring invalid attribute: username

 [WARNING]: Ignoring invalid attribute: password

 [WARNING]: Ignoring invalid attribute: email


playbook: ./playbook.yml
0
```

##### ISSUE TYPE
 - Feature Idea

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
ansible-playbook

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.5.5
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.4 (default, May  1 2018, 11:38:09) [GCC 6.4.0]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
```
$ ansible-config dump --only-changed
DEFAULT_HOST_LIST(env: ANSIBLE_INVENTORY) = ['/app/hosts']
DEFAULT_REMOTE_USER(env: ANSIBLE_REMOTE_USER) = root
```

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->

Ansible in Docker (based on Alpine 3.8) @ current Arch Linux x86_64
```
FROM alpine:3.8

RUN apk add --no-cache ansible bash openssh-client

ARG APP_USER_ID=1000
ARG APP_HOME="/app"

RUN mkdir -p $APP_HOME
WORKDIR $APP_HOME

# Delete ping group, it occupies pretty popular uid, 999.
RUN delgroup ping

# Get some non-root user to run from
RUN adduser -D -u "${APP_USER_ID}" -s '/bin/bash' user

# Set up empty known_hosts for them
RUN mkdir -p /home/user/.ssh
RUN touch /home/user/.ssh/known_hosts

ARG PS1="[ansible] \w $ "
ENV PS1="${PS1}"

USER user

CMD /bin/bash
```


##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
---
- name: Test warnings handling (minimal example with mistake)
  hosts: test
  any_errors_fatal: true
  tasks:
    - name: 'Log into the Docker account'
      docker_login:
      username: "{{ lookup('env', 'DOCKER_USERNAME') }}"
      password: "{{ lookup('env', 'DOCKER_PASSWORD') }}"
      email: "{{ lookup('env', 'DOCKER_EMAIL') }}"
```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->

With new flag I would expect ansible-playbook to fail with same message/messages that were warnings before, with non-zero exit code (for automation purposes), and, if possible, without SSHing to target hosts.

Flag can be a playbook-level settings (`any_warnings_fatal: true`), CLI argument (`--any-warnings-fatal`)environment var (`ANSIBLE_MAKE_WARNINGS_FATAL`?) or any combination of these, I am not sure what is the best option.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->
Command runs as usual but fails later, after already doing changes on host (or not doing changes, if `--check` was provided).

<!--- Paste verbatim command output between quotes below -->
```
$ ansible-playbook -f 2 --check -- ./playbook.yml   
 [WARNING]: Ignoring invalid attribute: username                                                                       
                                                                                                                       
 [WARNING]: Ignoring invalid attribute: password                                                                       
                   
 [WARNING]: Ignoring invalid attribute: email                                                                          
                                                             
... # goes on as usual

TASK [Log into the Docker account] ************************************************************************************
fatal: [(redacted)]: FAILED! => {"changed": false, "msg": "state is present but all of the following are missing: u
sername, password"}
fatal: [(redacted)]: FAILED! => {"changed": false, "msg": "state is present but all of the following are missing: u
sername, password"}  
  
... # fails as usual
```



Discussion:
Files identified in the description:
* [lib/ansible/playbook](https://github.com/ansible/ansible/blob/devel/lib/ansible/playbook)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->

Resolving patch:
diff --git a/lib/ansible/playbook/task.py b/lib/ansible/playbook/task.py
--- a/lib/ansible/playbook/task.py
+++ b/lib/ansible/playbook/task.py
@@ -231,7 +231,7 @@ def preprocess_data(self, ds):
                                        " Please see:\nhttps://docs.ansible.com/ansible/playbooks_roles.html#task-include-files-and-encouraging-reuse\n\n"
                                        " for currently supported syntax regarding included files and variables", version="2.7")
                     new_ds['vars'][k] = v
-                elif k in self._valid_attrs:
+                elif C.INVALID_TASK_ATTRIBUTE_FAILED or k in self._valid_attrs:
                     new_ds[k] = v
                 else:
                     display.warning("Ignoring invalid attribute: %s" % k)


Test patch: