[5.0] dependencies roles step not found by ansible-lint

[juju4]

Summary

Inside molecule test, dependency role is installed through dependency step.
I found that after 5.0, ansible-lint does not search the dependency step target PATH (in github action: /home/runner/.cache/molecule/juju4.falco/default/roles) vs its own list (ansible.legacy:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default/roles:/home/runner/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/home/runner/work/ansible-falco/ansible-falco:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default)

Example
https://github.com/juju4/ansible-falco/runs/1942507643?check_suite_focus=true#step:5:309

INFO     Running default > dependency
Molecule default > dependency
  Starting galaxy role install process
  - extracting juju4.redhat_epel to /home/runner/.cache/molecule/juju4.falco/default/roles/juju4.redhat_epel
  - juju4.redhat_epel (master) was installed successfully
  INFO     Dependency completed successfully.
  WARNING  Skipping, missing the requirements file.
INFO     Running default > lint
Molecule default > lint
  COMMAND: set -e
  yamllint .
  ansible-lint -x 204
  flake8
  
  Loading custom .yamllint config file, this extends our internal yamllint config.
  WARNING  Listing 2 violation(s) that are fatal
  internal-error: the role 'juju4.redhat_epel' was not found in ansible.legacy:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default/roles:/home/runner/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/home/runner/work/ansible-falco/ansible-falco:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default
  meta/main.yml:35:5 [WARNING]: provided hosts list is empty, only localhost is available. Note that
  the implicit localhost does not match 'all'
  ERROR! the role 'juju4.redhat_epel' was not found in ansible.legacy:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default/roles:/home/runner/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/home/runner/work/ansible-falco/ansible-falco:/home/runner/work/ansible-falco/ansible-falco/juju4.falco/molecule/default
  
  The error appears to be in '/home/runner/work/ansible-falco/ansible-falco/juju4.falco/meta/main.yml': line 35, column 5, but may
  be elsewhere in the file depending on the exact syntax problem.
  
  The offending line appears to be:
  
  dependencies:
    - juju4.redhat_epel
      ^ here
  
  
  syntax-check: 'src' is not a valid attribute for a Play

Issue Type

• Bug Report

Ansible and Ansible Lint details

ansible-3.0.0 
ansible-lint-5.0.1

• ansible installation method: pip
• ansible-lint installation method: pip

OS / ENVIRONMENT

Ubuntu 18.04 from github action for host

STEPS TO REPRODUCE

Example below on my falco ansible role.

1. take any roles with dependencies and molecule test suite
2. validate dependency step install in a given path
3. check lint step is validating against different path list

Desired Behaviour

roles path of molecule dependency and molecule lint should be common or at least partially shared to avoid duplicates or symlink.

Actual Behaviour

per above

[ssbarnea]

@juju4 I found two bugs inside the linter while testing you repository and I am fixing them now. Still, the error you mention is more of a misconfiguration.

In order to pass linting, you much assure that all external dependencies are either mentioned inside root level requirements.yml or to mock them inside linter configuration. The first is to be preferred, even if it slows down the linting a little bit, but it provides much better results after.

[juju4]

Thanks @ssbarnea
I'm not sure I understand.
https://github.com/juju4/ansible-falco/blob/master/molecule/default/requirements.yml is present and correct, I believe. or no?

[ssbarnea]

Fixed on master branch.

[ssbarnea]

Try v5.0.2 it should work fine.

[xshadow]

Thank you for ansible-lint! To me this bug still stands for me on ansible-lint 5.0.2:

See a running test, with latest ansible-lint(5.0.2): systemli/ansible-role-etherpad@8244088, see failing github action: https://github.com/systemli/ansible-role-etherpad/actions/runs/611440375

With ansible-lint==4.3.7 it's working fine: https://github.com/systemli/ansible-role-etherpad/actions/runs/611447370

[erikgb]

I agree with @xshadow. This bug seems still present in ansible-lint v5.0.4:

ansible@3877c65427e9:~$ ansible-lint --version
ansible-lint 5.0.4 using ansible 2.10.7

(...)

INFO     Running default > dependency
Molecule default > dependency
Starting galaxy role install process
- extracting openshift_project to /home/ansible/.cache/molecule/k8s_thanos/default/roles/openshift_project
- openshift_project (v1) was installed successfully
INFO     Dependency completed successfully.
WARNING  Skipping, missing the requirements file.
INFO     Running default > lint
Molecule default > lint
COMMAND: set -e
ansible-lint
WARNING  Listing 2 violation(s) that are fatal
internal-error: the role 'openshift_project' was not found in /builds/kafka/ansible/k8s_thanos/molecule/default/roles:/home/ansible/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/builds/kafka/ansible/k8s_thanos/roles:/builds/kafka/ansible/k8s_thanos/molecule/default

/reopen

[ssbarnea]

The bug is not really in the linter but more in molecule. I started to work on it today and I hope to have a fix ready by monday. That will assure that dependency install is consistent between both tools. If you have specific public repos which you want me to test with, post a link here.

[erikgb]

@ssbarnea That sounds good! Sadly all our code is not available to the general public. But it seems to be a quite general bug. As long as the molecule scenario has a dependency on an collection (expressed in a requirements.yml file inside the scenario), it currently fails. I think you are right about the cause of the bug: molecule and ansibile-lint should be consistent in the role/collection dependency install location.

[erikgb]

@ssbarnea Some additional info: I get the same/similar problem when running ansible-lint from within a pretty standard Ansible role directory:

openshift_project/
├── defaults
│   └── main.yml
├── meta
│   └── main.yml
├── molecule
│   ├── default
│   │   ├── converge.yml
│   │   ├── create.yml
│   │   ├── destroy.yml
│   │   └── molecule.yml
│   └── project-quota
│       └── molecule.yml
├── openshift_project.iml
├── README.md
├── tasks
│   └── main.yml
└── templates
    └── rolebinding.yml.j2

Running ansible-lint -v from within the role directory, I get the following output:

INFO     Using .cache/roles/statnett.openshift_project symlink to current repository in order to enable Ansible to find the role using its expected full name.
INFO     Added ANSIBLE_ROLES_PATH=~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:./.cache/roles
INFO     Discovering files to lint: git ls-files -z
INFO     Discovering files to lint: git ls-files -z
INFO     Executing syntax check on molecule/default/converge.yml (0.60s)
INFO     Executing syntax check on molecule/default/create.yml (0.65s)
INFO     Executing syntax check on molecule/default/destroy.yml (0.67s)
WARNING  Listing 1 violation(s) that are fatal
internal-error: the role 'openshift_project' was not found in /builds/stas/ansible-roles/openshift_project/molecule/default/roles:/home/ansible/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/builds/stas/ansible-roles/openshift_project/.cache/roles:/builds/stas/ansible-roles/openshift_project/molecule/default
molecule/default/converge.yml:11:7 [WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that
the implicit localhost does not match 'all'
ERROR! the role 'openshift_project' was not found in /builds/stas/ansible-roles/openshift_project/molecule/default/roles:/home/ansible/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/builds/stas/ansible-roles/openshift_project/.cache/roles:/builds/stas/ansible-roles/openshift_project/molecule/default
The error appears to be in '/builds/stas/ansible-roles/openshift_project/molecule/default/converge.yml': line 11, column 7, but may
be elsewhere in the file depending on the exact syntax problem.
The offending line appears to be:
  roles:
    - role: openshift_project
      ^ here
You can skip specific rules or tags by adding them to your configuration file:
# .ansible-lint
warn_list:  # or 'skip_list' to silence them completely
  - internal-error  # Unexpected internal error
Finished with 1 failure(s), 0 warning(s) on 12 files.

ansible@96e132b6a8e2:~$ ansible --version
ansible 2.10.7
  config file = None
  configured module search path = ['/home/ansible/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.9.2 (default, Mar 12 2021, 18:54:15) [GCC 8.3.0]
ansible@96e132b6a8e2:~$ ansible-lint --version
ansible-lint 5.0.4 using ansible 2.10.7

[erikgb]

@ssbarnea Any updates on this? Still failing with the latest versions of ansible-lint (5.0.6) and molecule (3.3.0). It is really a blocking issue for us! Please let me know if there is anything I can do to get this fixed as soon as possible. 😅

[ssbarnea]

There is a PR with WIP, but I am afraid i run out of time and energy to fix all bugs myself. Unless someone proposed a fix that is passing all the tests (maybe build on top of my partial work), you will have to wait until I find some free time.

Or you can stick to old linter if you want to use short role names (without namespace), or fully migrate to FQRN and use v5.

[erikgb]

@ssbarnea That is totally fair. 🙏 Is this (#1490) the WIP PR you are referring to?

[ssbarnea]

Yes

[StarlessNights]

I just had the same issue with the latest version. It was complaining about a test role dependency in molecule's prepare.yml. I had in the roles: list, but switching to ansible.builtin.include_role task silenced the complaint.

A bit inconsistent behavior, but at least there was a way around it.