ansible-lint

Container image for linting Ansible repos in Forgejo Actions: UBI 10 minimal with Python 3.12, ansible-core and ansible-lint, plus Node.js and git for actions/checkout and tar for actions/cache.

forgejo.dmeg.se/nollverket/ansible-lint:<version>

Use

As the job container. ansible-lint installs the linted repo's own requirements.yml into .ansible/collections; Galaxy downloads are slow (about 1–2 minutes), so cache that directory, keyed on the file:

jobs:
  ansible-lint:
    runs-on: docker
    container:
      image: forgejo.dmeg.se/nollverket/ansible-lint:3.0.1
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: .ansible/collections
          key: collections-${{ hashFiles('requirements.yml') }}
      - run: ansible-lint

The image has no collections of its own, so the linted repo's requirements.yml is the only list. It also sets a dummy vault password (ANSIBLE_VAULT_PASSWORD_FILE): linting never needs the real one, and the encrypted vault.yml files are just skipped with a warning.

Locally: podman run --rm -v "$PWD:/work:Z" -w /work forgejo.dmeg.se/nollverket/ansible-lint:3.0.1 ansible-lint.

What's in it

	Version	Set in	For
ansible-core	2.21.4	Dockerfile (ANSIBLE_CORE_VERSION)
ansible-lint	26.9.0	Dockerfile (ANSIBLE_LINT_VERSION)
Python	3.12	UBI 10 package (python3)	ansible-core, ansible-lint
Node.js	22	UBI 10 package (nodejs)	actions/checkout, actions/cache
git	2.52	UBI 10 package (git-core)	actions/checkout
tar, gzip	1.35, 1.13	UBI 10 packages	actions/cache

The UBI packages follow Red Hat's updates on every image build (microdnf upgrade); the versions above are from v3.0.1.

Keep ansible-core and ansible-lint in step with the workstation, so CI and a local ansible-lint agree.

Build and release

.forgejo/workflows/ci.yml runs on the runner's default image (actions-base), builds the image and tests it (lints test/playbook.yml) on every pull request and push.

• Push to main: pushes :latest and :sha-<commit>.
• Tag vX.Y.Z: pushes :X.Y.Z, :X.Y and :latest.

Pushing uses the org's REGISTRY_USER / REGISTRY_TOKEN Actions secrets. To upgrade: bump the versions, merge, tag a new vX.Y.Z, then point the linted repos' workflows at the new tag.