mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 12:17:13 +00:00
kevinveenbirkenbachandClaude Opus 5
c5e0d99ddc
Ansible renders a mapping's values and leaves its keys alone, so a key written
as "/{{ RBAC.GROUP.NAME }}/{{ application_id }}/administrator" reaches the
target as literal source text and matches nothing. web-app-zammad shipped that
shape and its OIDC group-to-role map silently resolved to nothing, which is
what left the platform administrator a Customer under SSO.
web-app-erpnext carries the identical shape at three keys, so its map cannot
resolve either. Rewrite it the same way: the grants are plain data, and the
keys are computed in one expression through rbac_group_path. Nothing reads
erpnext's map today, as its own TODO records, but the keys are now right
regardless.
The lint that exists for exactly this class scanned roles/*/meta/ only, which
is how both roles slipped through in vars/. Widen it to meta and vars, and move
it out of the meta/ subdirectory now that its scope is not meta-specific.
Widening needed the extractor rewritten first. The line scanner reported
roles/web-app-xwiki/vars/main.yml:159 as a key, where the Jinja is a {% for %}
inside a block scalar, i.e. part of a value. Walking the YAML node graph and
treating only real mapping key scalars as keys makes that structurally
invisible, which is better than a nocheck that would have to be justified per
occurrence. All 2105 files under roles/*/{meta,vars} compose cleanly, so the
walk never silently skips one; a file that does not compose is reported as its
own finding.
The walk carries a cycle guard. Without it a self-referencing YAML anchor
recurses into RecursionError, which is not a yaml.YAMLError, so the lint would
crash rather than report - a regression against the scanner it replaces.
Counter-examples run: recursive anchor, an alias used three times, flow
mapping, merge key, multi-document, key nested in a sequence, quoted key
containing a colon. The flow mapping is a case the old scanner missed.
Putting the old key shape back into web-app-zammad makes the widened lint fail
naming the file and line; removing it makes it pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Test guidance 🧪
This directory contains contributor guidance for automated tests. Its scope is how lint, unit, integration, regression, and Playwright coverage should be structured, selected, and validated.