From ansible-skills
Review Ansible code against Red Hat Communities of Practice automation good practices. Use this skill when the user asks to: "review ansible code", "check CoP compliance", "validate against Red Hat standards", "cop review", "ansible best practices review", "check ansible code quality", "review playbook", "review role", or wants to validate their Ansible automation against Red Hat CoP standards. Always invoke this skill for code review and validation tasks.
npx claudepluginhub stoleas/ansible-skillsThis skill is limited to using the following tools:
Review Ansible code against all Red Hat Communities of Practice (CoP) automation good practices, providing detailed feedback and actionable recommendations.
Creates isolated Git worktrees for feature branches with prioritized directory selection, gitignore safety checks, auto project setup for Node/Python/Rust/Go, and baseline verification.
Executes implementation plans in current session by dispatching fresh subagents per independent task, with two-stage reviews: spec compliance then code quality.
Dispatches parallel agents to independently tackle 2+ tasks like separate test failures or subsystems without shared state or dependencies.
Review Ansible code against all Red Hat Communities of Practice (CoP) automation good practices, providing detailed feedback and actionable recommendations.
This skill reviews Ansible automation against the complete Red Hat CoP framework:
Determine the scope:
Use appropriate tools to read all relevant files:
# List project structure
find . -type f -name "*.yml" -o -name "*.yaml"
# Read playbooks
cat playbooks/*.yml
# Read role files
cat roles/*/tasks/main.yml
cat roles/*/defaults/main.yml
cat roles/*/meta/main.yml
Check against all Red Hat CoP criteria (detailed below).
Provide structured feedback:
Standard:
project/
├── ansible.cfg
├── inventory/
│ ├── production/
│ │ ├── hosts
│ │ └── group_vars/
│ └── staging/
├── playbooks/
│ ├── types/ # Type playbooks
│ │ ├── web_server.yml
│ │ └── database.yml
│ └── landscapes/ # Landscape playbooks
│ └── ecommerce.yml
├── roles/ # Local roles
└── collections/
└── requirements.yml
Review Points:
Rules:
.yml extension (not .yaml)Review Points:
.yml extensionRequired Pattern:
rolename_variable_name__rolename_internal_variableReview Points:
Example Check:
# Good
apache_install_version: "2.4"
apache_install_listen_port: 80
__apache_install_package_name: "httpd"
# Bad
version: "2.4" # No role prefix
apache-port: 80 # Dash instead of underscore
apacheVersion: "2.4" # CamelCase
Required: meta/argument_specs.yml for Ansible 2.11+
Review Points:
Required: Roles must be idempotent
Review Points:
creates/removes or changed_whenCommon Violations:
# Bad - always reports changed
- ansible.builtin.command: yum install -y httpd
# Good - idempotent
- ansible.builtin.package:
name: httpd
state: present
Required: Platform-specific variables in separate files
Review Points:
Example:
# tasks/main.yml
- name: Include platform-specific variables
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
Required Files:
Optional but Recommended:
Review Points:
Required Architecture:
Review Points:
Example:
# Good - Type playbook
- name: Configure web server type
hosts: web_server
become: true
roles:
- base_linux
- apache_install
- app_deploy
Rules:
roles OR tasks, never bothReview Points:
Required Pattern:
Review Points:
Example:
roles:
- role: apache_install
tags: ['apache_install', 'web', 'install']
Standards:
>- for line foldingtrue/false booleans (not yes/no)Review Points:
Example:
# Good
- name: Task with long conditional
ansible.builtin.package:
name: httpd
when:
- ansible_os_family == "RedHat"
- ansible_distribution_major_version|int >= 8
- httpd_enabled|bool
Required: Pass ansible-lint moderate profile
Review Points:
Check:
ansible-lint --profile moderate .
Required for Roles:
Review Points:
Required for Roles:
Review Points:
Review Points:
Rules:
Review Points:
Example:
# Good
- name: Set user password
ansible.builtin.user:
name: alice
password: "{{ user_password }}"
no_log: true
Rules:
Review Points:
Problem:
# roles/apache_install/defaults/main.yml
version: "2.4"
port: 80
enabled: true
Fix:
# roles/apache_install/defaults/main.yml
apache_install_version: "2.4"
apache_install_listen_port: 80
apache_install_service_enabled: true
Problem:
- name: Install Apache
ansible.builtin.shell: yum install -y httpd
Fix:
- name: Install Apache
ansible.builtin.package:
name: httpd
state: present
Problem:
- name: Configure servers
hosts: all
roles:
- base_config
tasks:
- name: Additional task
ansible.builtin.command: something
Fix:
# Option 1: Move task to role
- name: Configure servers
hosts: all
roles:
- base_config
- additional_config
# Option 2: Use only tasks
- name: Configure servers
hosts: all
tasks:
- ansible.builtin.include_role:
name: base_config
- name: Additional task
ansible.builtin.command: something
Problem:
roles/
└── apache-install/ # Bad - dashes cause collection issues
Fix:
roles/
└── apache_install/ # Good - underscores
Problem:
# tasks/main.yml
- name: Install Apache
ansible.builtin.yum:
name: httpd
state: present
# Only works on RedHat
Fix:
# tasks/main.yml
- name: Include platform-specific variables
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
- name: Install Apache
ansible.builtin.package:
name: "{{ __apache_install_package_name }}"
state: present
# vars/RedHat.yml
__apache_install_package_name: httpd
# vars/Debian.yml
__apache_install_package_name: apache2
Use this structure for review output:
# Ansible CoP Review Report
## Summary
[Overall assessment - compliant/needs work/major issues]
## Scope Reviewed
- [x] Playbooks (3 files)
- [x] Roles (2 roles)
- [ ] Collections
- [x] Testing setup
## Critical Issues (Must Fix)
1. **Variable naming violations** (roles/apache/defaults/main.yml:5)
- Using generic variable `port` instead of `apache_port`
- Fix: Prefix all variables with role name
2. **Non-idempotent command** (roles/app/tasks/main.yml:12)
- Command always runs without changed_when
- Fix: Add `changed_when: false` or use creates parameter
## Warnings (Should Fix)
1. **Missing argument_specs.yml** (roles/apache/meta/)
- No argument validation defined
- Recommendation: Add meta/argument_specs.yml
2. **ansible-lint warnings** (multiple files)
- 3 tasks missing FQCN
- Fix: Use ansible.builtin.* for core modules
## Recommendations (Nice to Have)
1. Add Molecule tests for idempotence validation
2. Include more comprehensive README documentation
3. Add CI/CD integration for automated testing
## Strengths
- ✅ Good Type-Function pattern implementation
- ✅ Proper YAML formatting throughout
- ✅ Multi-platform support in place
- ✅ Comprehensive tagging strategy
## Next Steps
1. Fix all critical issues
2. Address warnings
3. Run ansible-lint --profile moderate
4. Test with Molecule
5. Re-review after fixes
## Resources
- Red Hat CoP: https://redhat-cop.github.io/automation-good-practices/
- ansible-lint rules: https://ansible-lint.readthedocs.io/
Run these commands for automated validation:
# Syntax check
find . -name "*.yml" -exec ansible-playbook --syntax-check {} \;
# ansible-lint
ansible-lint --profile moderate .
# Check for generic variable names
grep -r "^[^#]*: " roles/*/defaults/main.yml | grep -v "^[a-z_]*_"
# Check for dashes in role names
find roles/ -maxdepth 1 -type d -name "*-*"
# Verify .yml extension
find . -name "*.yaml"
# Check for missing argument_specs
find roles/ -maxdepth 2 -type d -name meta | while read meta; do
if [ ! -f "$meta/argument_specs.yml" ]; then
echo "Missing: $meta/argument_specs.yml"
fi
done
When asked to review Ansible code:
Remember: The goal is constructive feedback that helps improve code quality while maintaining Red Hat CoP compliance.