mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
fe2156b05e
A looped `include_tasks` or `include_role` leaves its item in scope for everything the include reaches. Left at the default name, Ansible warns as soon as any task inside loops as well, and the sharp case is quieter than the warning: the included body reads `item` expecting the value the include was called with, while an inner loop has already repointed the name. Nothing fails, so the wrong value is written and the run reports success. web-app-prometheus was carrying exactly that shape. It hands the item to an included file through `vars:`, which Ansible templates lazily, so `network_role_id` was one nested loop away from resolving to something else. The rule complements the existing loop_var shadowing lint, which checks the other direction and cannot see this one. It parses the task files rather than scanning their lines: a line window around each include also catches the next task's `loop:` and reports 55 findings where there are 22. Fourteen of those are the plain dependency include and take `dependency_role`, the name dsk-gnome already uses. The rest take a name for what the item is. The gitlab and mastodon wait includes pass nothing through `vars:` and their included file reads `item` four times, so each needed that file renamed with it; naming only the parent would have left `item` undefined. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
15 lines
277 B
YAML
15 lines
277 B
YAML
---
|
|
- name: 📂 Include dependencies
|
|
include_role:
|
|
name: "{{ dependency_role }}"
|
|
loop:
|
|
- sys-svc-webserver-core
|
|
- sys-svc-cln-domains
|
|
- sys-svc-dns
|
|
loop_control:
|
|
loop_var: dependency_role
|
|
|
|
- meta: flush_handlers
|
|
|
|
- include_tasks: utils/once/flag.yml
|