Files
kevinveenbirkenbachandClaude Opus 5.5 6e776a5780 refactor(python): clear the open CodeQL code-quality alerts
- Declare `__all__` in every package `__init__.py` whose `PROJECT_ROOT`
  is imported by its modules (163 packages), so the constant counts as
  exported; list every public name where the package defines more.
- Empty the 15 package `__init__.py` files whose `PROJECT_ROOT` no module
  imports.
- Declare the public API of `utils.github.variant.axes` in `__all__`,
  re-exports included, instead of silencing them with `noqa: F401`; the
  list matches the one `feature/store-i18n` already carries.
- Use `import unittest.mock as mock` in `test_applications.py`, as the
  rest of the suite does.
- Spell `_NON_PRINTABLE` in `utils/yaml_bootstrap.py` as the equivalent
  BMP-only positive class; it matches exactly the same 2111 code points
  as the old negated class across U+0000..U+10FFFF.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-20 21:40:58 +02:00
..

Ansible Module Lints 🔧

Lint tests that enforce correct Ansible module usage and task-level invariants. Each test catches a class of silent or confusing failure that the runtime would otherwise tolerate or surface far from its cause.

Tests in this directory MUST only cover Ansible module / task usage rules.

  • test_network_create_via_util.py requires that role tasks creating Docker networks route through the shared utility, never inline community.docker.docker_network calls.
  • test_no_legacy_get_url_module_usage.py forbids the unqualified get_url: module name; tasks MUST use ansible.builtin.get_url.
  • test_no_legacy_uri_module_usage.py forbids the unqualified uri: module name; tasks MUST use ansible.builtin.uri.
  • test_no_literal_no_log.py forbids literal no_log: true / no_log: false; every gate MUST flow through the MASK_CREDENTIALS_IN_LOGS variable.
  • test_no_redundant_default_on_module_io.py forbids | default(...) on a task's own register: output or input arguments inside its own conditionals, where the value is provably set.
  • test_run_once_tags.py requires that every set_fact marked run_once: true carries the canonical run-once tags so re-runs and --tags filters keep the fact populated.

Shell-pipeline rules and SQL formatting rules live in sibling directories; see ../shell/ and ../sql/.

For framework, directory layout, and make test-lint usage see lint.md.