Files
kevinveenbirkenbachandClaude Opus 5.5 6e776a5780 refactor(python): clear the open CodeQL code-quality alerts
- Declare `__all__` in every package `__init__.py` whose `PROJECT_ROOT`
  is imported by its modules (163 packages), so the constant counts as
  exported; list every public name where the package defines more.
- Empty the 15 package `__init__.py` files whose `PROJECT_ROOT` no module
  imports.
- Declare the public API of `utils.github.variant.axes` in `__all__`,
  re-exports included, instead of silencing them with `noqa: F401`; the
  list matches the one `feature/store-i18n` already carries.
- Use `import unittest.mock as mock` in `test_applications.py`, as the
  rest of the suite does.
- Spell `_NON_PRINTABLE` in `utils/yaml_bootstrap.py` as the equivalent
  BMP-only positive class; it matches exactly the same 2111 code points
  as the old negated class across U+0000..U+10FFFF.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-20 21:40:58 +02:00
..
…

Ansible Variable Lints 🪪

Lint tests that enforce variable-lifecycle invariants across the Ansible tree: every name a role declares MUST be consumed somewhere, and every name a role passes MUST be referenced by the play / template stack that receives it.

Tests in this directory MUST only cover variable definition / consumption checks. Four orthogonal scopes live here:

  • test_role_and_group_vars_used.py scans top-level keys of roles/<role>/{vars,defaults}/main.yml and group_vars/**/*.yml against every project .yml / .yaml / .j2 file. The suppression rule key is unused-var (see suppression.md).
  • test_vars_usage_in_yaml.py scans task-level vars: blocks against the same consumer set. The two scanners never overlap because their declaration shapes differ.
  • test_no_jinja_default_on_spot_path.py forbids | default(...) on Jinja expressions whose path resolves via group_vars/all/*.yml. Those keys are loaded unconditionally, so the default is dead code at best and silent SPOT decoupling at worst. Per-line suppression: # nocheck: spot-default.
  • test_dotted_path_keys_exist.py validates that every Jinja dotted path (FOO.BAR.BAZ) whose head is in group_vars/all/ or the consuming role's own vars/defaults resolves to an existing key in that dict tree, catching typos / renamed / removed sub-keys. Per-line suppression: # nocheck: dotted-path.

Both tests route every read through the project caches (utils.cache.files, utils.cache.yaml); contributors adding a new variable scanner MUST do the same instead of calling yaml.safe_load* or open() directly.

For framework, directory layout, and make test-lint usage see lint.md.