Ansible

Package installs should use state: present with or without a version. Use latest ONLY if they are supported by the underlying package module(s) executed.

become_user without become: yes will not actually change user. When become is set to yes but become_user is not set, user root is set.

Without the pipefail option set, a shell command that implements a pipeline can fail and still return 0. If any part of the pipeline other than the terminal command fails, the whole pipeline will still return 0, which may be considered a success by Ansible. Pipefail is available in the bash shell.

All files referenced by by include or import_tasks must exist. The check excludes files with jinja2 templates in the filename. Example :

Tasks should tell Ansible when to return changed, unless the task only reads information. To do this, set changed_when, use the creates or removes argument, or use when to run the task only if another check has a particular result.

Command module does not accept setting environment variables inline. Use environment: to set environment variables or use shell module which accepts both.

All version control checkouts must point to an explicit commit or tag, not just latest. Relying on latest may lead to breakages in the application if the latest version is unstable or not meant for use with the current system.

The Ansible analyzer failed to process this YAML file. It is possible that the file has syntax errors, or was not intended to be an Ansible file.

Avoid multiple entries with the same key in mappings.

All version control checkouts must point to an explicit commit or tag, not just latest. Relying on latest may lead to breakages in the application if the latest version is unstable or not meant for use with the current system.