Use same dependencies for ansible-lint as actual environment (#967)

* use same deps for ansible lint as actual environment

* avoid ansible-lint install upgrading ansible-core

* workaround galaxy installs

* ignore galaxy-installed collections when ansible-linting

* fix local superlinter

* remove deprecated VALIDATE_TERRAFORM_TERRASCAN setting

* move superlinter before galaxy installs so it doens't lint them

* ensure ansible-lint always runs even if superlinter fails

* add pip caching to linting

* turn off checkov again locally, cpu usage too high

* fixup requirements

Author: sjpb

.ansible-lint.yml

@@ -13,6 +13,7 @@ skip_list:
 exclude_paths:
   - actionlint.yml
   - .ansible/
+  - ansible/collections/
   - .github/
   # Rule 'syntax-check' is unskippable, you cannot use it in 'skip_list' or 'warn_list'.
   # It breaks the parser which takes place before the linter, the only option is to exclude the file.

.github/workflows/lint.yml

@@ -26,10 +26,13 @@ jobs:
           submodules: true
           persist-credentials: false
 
-      - name: Run ansible-lint
-        uses: ansible/ansible-lint@a2bc8b8b13a80802215856c56823d85007d3baf5 # v25.12.2
-        env:
-          ANSIBLE_COLLECTIONS_PATH: .ansible/collections
+      - name: Cache pip
+        # Don't cache galaxy/requirements.yml as during dev its common for this
+        # to use branch names
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/pip
+          key: pip-${{ hashFiles('requirements.txt') }}
 
       - name: Load super-linter configuration
         # Use grep inverse matching to exclude eventual comments in the .env file
@@ -38,10 +41,23 @@ jobs:
         # yamllint disable-line rule:line-length
         # Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable
         run: grep -v '^#' super-linter.env >> "$GITHUB_ENV"
-        if: always()
 
       - name: Run super-linter
         uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
-        if: always()
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install ansible etc
+        # NB: could prepend to path using GITHUB_PATH but don't want to check
+        # if that messes with superlinter
+        run: dev/setup-env.sh
+        if: always()
+
+      - name: Run ansible-lint
+        # use offline mode galaxy roles/collections already installed
+        # but build a list so we can ignore them
+        run: |
+          . venv/bin/activate
+          mapfile -t excludes < <(git ls-files --others --ignored --exclude-standard --directory ansible/roles/)
+          ansible-lint --offline --config-file .ansible-lint.yml --exclude "${excludes[@]}"
+        if: always()

dev/run-linters

@@ -7,7 +7,7 @@
 # Disabled linters: checkov stays stuck for some reason!
 # VALIDATE_GITLEAKS=false is controversial because that's the best time to catch errors
 
-if [ "$1" = "-f" ] || [ "$1" = "--false" ]; then
+if [ "$1" = "-f" ] || [ "$1" = "--fast" ]; then
 	echo "Disabling slow linters: ansible-lint and gitleaks"
 	VALIDATE_ANSIBLE_LINT=false
 	export VALIDATE_GITLEAKS=false
@@ -16,9 +16,10 @@ fi
 if [ "${VALIDATE_ANSIBLE_LINT:-true}" = true ]; then
 	echo "Running ansible-lint $*..."
 	ansible_lint_failed=false
-	# Specifying `ANSIBLE_COLLECTIONS_PATH` ensures `ansible-lint` downloads collections and roles under the `.ansible` directory, separating them from our own roles under the `ansible` directory.
-	# We exclude these downloaded files from linting by listing `.ansible` under `exclude_paths` in `.ansible-lint.yml`.
-	if ! ANSIBLE_COLLECTIONS_PATH=.ansible/collections ansible-lint -c .ansible-lint.yml "$@"; then
+	# Create an array of uncommitted role paths:
+	mapfile -t excludes < <(git ls-files --others --ignored --exclude-standard --directory ansible/roles/)
+	# Run ansible-lint in offline mode so it doesn't download galaxy requirements itself, ignoring galaxy-installed roles:
+	if ! ansible-lint --offline --config-file .ansible-lint.yml --exclude "${excludes[@]}" "$@"; then
 		echo "ansible-lint found errors"
 		ansible_lint_failed=true
 	fi

requirements.txt

@@ -1,10 +1,14 @@
-ansible-core==2.16.0
+ansible-compat==26.3.0
+ansible-core==2.16.14
+ansible-lint==25.12.2
 arrow==1.4.0
 attrs==25.4.0
 autopage==0.5.2
 bcrypt==4.3.0
 beautifulsoup4==4.13.3
 binaryornot==0.4.4
+black==26.5.1
+bracex==2.6
 certifi==2025.11.12
 cffi==2.0.0
 chardet==5.2.0
@@ -18,7 +22,9 @@ cryptography==46.0.5
 cycler==0.12.1
 debtcollector==3.0.0
 decorator==5.2.1
+distro==1.9.0
 dogpile.cache==1.5.0
+filelock==3.29.0
 fonttools==4.60.1
 idna==3.11
 iso8601==2.1.0
@@ -35,6 +41,7 @@ MarkupSafe==3.0.3
 matplotlib==3.10.7
 mdurl==0.1.2
 msgpack==1.1.2
+mypy_extensions==1.1.0
 netaddr==1.3.0
 numpy==2.3.5
 openstacksdk==4.8.0
@@ -48,6 +55,7 @@ oslo.serialization==5.8.0
 oslo.utils==9.2.0
 packaging==23.2
 passlib==1.7.4
+pathspec==1.1.1
 pbr==7.0.3
 pillow==12.1.1
 platformdirs==4.5.0
@@ -64,6 +72,7 @@ python-keystoneclient==5.7.0
 python-manilaclient==5.7.0
 python-openstackclient==8.0.0
 python-slugify==8.0.4
+pytokens==0.4.1
 PyYAML==6.0.3
 referencing==0.37.0
 requests==2.31.0
@@ -73,15 +82,20 @@ rfc3986==2.0.0
 rich==14.2.0
 rich-argparse==1.7.2
 rpds-py==0.29.0
+ruamel.yaml==0.19.1
+ruamel.yaml.clib==0.2.15
 schema==0.7.8
 setuptools==80.9.0
 six==1.17.0
 soupsieve==2.8
 stevedore==5.6.0
+subprocess-tee==0.4.2
 text-unidecode==1.3
 toml==0.10.2
 typing_extensions==4.15.0
 tzdata==2025.2
 urllib3==2.5.0
+wcmatch==10.1
 wcwidth==0.2.14
 wrapt==2.0.1
+yamllint==1.38.0

super-linter.env

@@ -1,6 +1,9 @@
 # Detect that default branch is devel when running locally
 DEFAULT_BRANCH=main
 
+# Ignore files git ignores
+IGNORE_GITIGNORED_FILES=true
+
 # Don't add a big table with lint results as a PR comment
 ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT=false
 
@@ -23,9 +26,6 @@ VALIDATE_PYTHON_RUFF_FORMAT=false
 # Don't validate YAML prettier because yamllint is sufficient
 VALIDATE_YAML_PRETTIER=false
 
-# Getting false positives with terrascan that seemingly can't be masked
-VALIDATE_TERRAFORM_TERRASCAN=false
-
 # Doesn't seem possible to exclude files with terragrunt
 VALIDATE_TERRAGRUNT=false