Dev version installed by ansible-lint action

[mkravchuk-godaddy]

Is it okay that during working ansible-lint action, it is installing dev version of ansible-lint? To me, this is not obvious behavior...

- name: "Run ansible-lint"
  id: run-lint
  uses: ansible/ansible-lint@main
  with:
    args: ""
    requirements_file: ""

Successfully installed MarkupSafe-3.0.2 ansible-compat-25.1.4 ansible-core-2.18.3 ansible-lint-25.1.4.dev13 attrs-25.3.0 black-25.1.0 bracex-2.5.post1 cffi-1.17.1 click-8.1.8 cryptography-44.0.2 filelock-3.18.0 importlib-metadata-8.6.1 jinja2-3.1.6 jsonschema-4.23.0 jsonschema-specifications-2024.10.1 mypy-extensions-1.0.0 packaging-24.2 pathspec-0.12.1 platformdirs-4.3.7 pycparser-2.22 pyyaml-6.0.2 referencing-0.36.2 resolvelib-1.0.1 rpds-py-0.23.1 ruamel.yaml-0.18.10 ruamel.yaml.clib-0.2.12 subprocess-tee-0.4.2 typing-extensions-4.12.2 wcmatch-10.0 yamllint-1.37.0 zipp-3.21.0
ansible-lint 25.1.4.dev13 using ansible-core:2.18.3 ansible-compat:25.1.4 ruamel-yaml:0.18.10 ruamel-yaml-clib:0.2.12

[konstruktoid]

@main branch is the latest commits, nothing odd about that. Use a released version instead.

[konstruktoid]

Line 45 got the correct hash 2025-04-17T10:49:01.7839808Z Download action repository 'ansible/ansible-lint@v25.2.1' (SHA:c16f018b1bdfdea6717f4b5b1b141a78b86021cd) : c16f018

But then at line 492:

2025-04-17T10:49:18.3324188Z Collecting ansible-lint@ git+https://github.com/ansible/ansible-lint@main (from ansible-lint[lock]@ git+https://github.com/ansible/ansible-lint@main)
2025-04-17T10:49:18.3327555Z   Cloning https://github.com/ansible/ansible-lint (to revision main) to /tmp/pip-install-bry25rt5/ansible-lint_f044b3ee531f4d4da1a05f2a14a7135a
2025-04-17T10:49:18.3346748Z   Running command git clone --filter=blob:none --quiet https://github.com/ansible/ansible-lint /tmp/pip-install-bry25rt5/ansible-lint_f044b3ee531f4d4da1a05f2a14a7135a
2025-04-17T10:49:19.1616411Z   Resolved https://github.com/ansible/ansible-lint to commit 51cf2dd4fe7287e7d67f0c59cf1a2fbbafb86041

See https://github.com/ansible/ansible-lint/blob/main/action.yml#L48-L92, I believe GH_ACTION_REF: ${{ env.ACTION_REF }} gets set to main and goes from there.

@rachelf42, have a look at lines 419, 430 and more as well, perhaps sanitize.

[rachelf42]

sorry, im very new to CICD as a whole nevermind GHA, is there a way to have env.ACTION_REF automatically follow what renovate sets the uses: line to? workflow file

also ANSIBLE_VAULT_PASS is just for while im still setting things up, the vault it unlocks only contains placeholder values so ansible-lint doesnt freak out about undeclared vars, once its working properly ill look into setting it up in an actually secure way, thanks for the heads-up tho

as an aside, is partial-become new? it doesnt flag when i run ansible-lint locally

[konstruktoid]

don't really know how to fix this, since you trigger the workflow on main branch, and pip install "ansible-lint[lock] @ git+https://github.com/ansible/ansible-lint@$GH_ACTION_REF" will then be pip install "ansible-lint[lock] @ git+https://github.com/ansible/ansible-lint@main" if I understand it correctly.

should probably be an issue.

partial-become is at least two years old, https://github.com/ansible/ansible-lint/blob/main/src/ansiblelint/rules/partial_become.md

[rachelf42]

turns out, apt install ansible-lint on ubuntu gets you a super old version that i was lucky to even have work this long and thats why partial-become wasnt flagging 🤦‍♀️ thanks canonical

yeah setting env.ACTION_REF completely fixes my issue and it looks like that bit about composite actions is what's messing me up since i just grabbed the uses line straight from GH marketplace idk what that even is yet, ill type up an issue later, thanks for your help!

[konstruktoid]

yeah, apt isn't the way to go when installing ansible or related tools.