apme: mechanical lint sweep (L067 + L025 + L070)

anaeem commented

2026-05-22 01:41:55 +00:00

Owner

First batch of fixes against the APME analysis of main (scan 8049d507f471, 1871 violations). Hand-rolled fixers since APME's autopatcher introduced behaviour-changing bugs (capitalized Jinja filters, mangled shell heredocs).

L067 (67 findings): added verbosity: 1 to every ansible.builtin.debug: task that lacked it. 43 files.
L025 (88 of 198): capitalized the first letter of Ansible task names — discriminator avoids touching Galaxy name:, EE image names, collection list items, AAP JT lookup names. 13 files.
L070 (67 of 184): moved inline {{ Jinja }} in task names to the end of the string while preserving the Role | … prefix convention. 9 files.

YAML safe-load + ansible-playbook --syntax-check pass on all modified files.

Next PRs will cover L043 (405 bare vars), M005 (59 untrusted templates), L060 + L049 + misc lints, and the R-series audit.

First batch of fixes against the APME analysis of main (scan 8049d507f471, 1871 violations). Hand-rolled fixers since APME's autopatcher introduced behaviour-changing bugs (capitalized Jinja filters, mangled shell heredocs). - **L067** (67 findings): added `verbosity: 1` to every `ansible.builtin.debug:` task that lacked it. 43 files. - **L025** (88 of 198): capitalized the first letter of Ansible task names — discriminator avoids touching Galaxy `name:`, EE image names, collection list items, AAP JT lookup names. 13 files. - **L070** (67 of 184): moved inline `{{ Jinja }}` in task names to the end of the string while preserving the `Role | …` prefix convention. 9 files. YAML safe-load + ansible-playbook --syntax-check pass on all modified files. Next PRs will cover L043 (405 bare vars), M005 (59 untrusted templates), L060 + L049 + misc lints, and the R-series audit.

anaeem added 3 commits

2026-05-22 01:41:55 +00:00

apme L067: add verbosity:1 to debug tasks 3aec379b5e

APME flagged 67 debug tasks across 43 files for missing `verbosity:`
(rule L067 — "Set verbosity on debug tasks to avoid noisy output in
production").

Adds `verbosity: 1` to every `ansible.builtin.debug:` that didn't have
one. AAP runs JT-A/B/E at verbosity 1 by default, so these still print
in AAP. CLI runs default to verbosity 0, so the debug output is now
suppressed during plain `ansible-playbook …` runs — only visible with
`-v`. Production paths see less noise.

Generated by a text-based fixer (/tmp/fix_l067.py) rather than APME's
own autopatcher — APME's auto-fixer was found to introduce
behaviour-breaking changes elsewhere (capitalized Jinja filter names,
mangled shell heredocs). This fix is purely additive: a single
`verbosity: 1` line inside each debug block. YAML + ansible-playbook
syntax check pass on all 43 files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apme L025: capitalize first letter of Ansible task names 722eccfa62

APME flagged 198 task names that started with a lowercase letter (rule
L025 — "Task name should start with an uppercase letter"). This commit
fixes the 88 actual task names that have an Ansible task body (module
call or task keyword) following them.

Discriminator: only `- name: …` lines whose next non-empty/non-comment
line at greater indent matches a known Ansible module
(ansible.builtin.*, community.*, set_fact, debug, uri, shell, …) or
task keyword (block, when, register, loop, delegate_to, …). This avoids
touching:
 * `name: discovery` in galaxy.yml (would break ansible-galaxy install)
 * `- name: kubernetes.core` in requirements.yml (would break collection
   install)
 * `name: ghcr.io/...` in execution-environment.yml (would break EE
   build)
 * `name: "migration-discovery: JT-perapp-analyze"` in EDA rulebooks
   (would break JT lookup at runtime — the AAP JT is named with a
   lowercase prefix and that has to match exactly)

The remaining 110 L025 findings are on detector YAMLs
(roles/detect_apps/files/detectors/*.yml) where `name:` is a detector
identifier (e.g. `name: tomcat`) used as a stable key, not a task name.
Those are intentionally lowercase and stay that way.

Generated by /tmp/fix_l025.py. YAML safe-load passes on all 13 modified
files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apme L070: move Jinja in task names to end-of-string 47f4b24666

APME flagged 184 task names that had a `{{ … }}` Jinja expression in the
middle or start of the name (rule L070 — "Jinja in task names should
only appear at the end of the name string"). This commit rewrites 67 of
them where the pattern is unambiguous:

  Before: `Role | {{ x.attr }} — verb`
  After:  `Role | verb — {{ x.attr }}`

Preserves the `Role | …` prefix our codebase uses for log filtering.
Pure cosmetic — task semantics unchanged. The remaining ~117 L070
findings sit on names that don't match this fixed pattern (no role
prefix, multiple Jinja expressions, or Jinja embedded in literal text);
those need case-by-case rewrites and are left for a follow-up pass.

Generated by /tmp/fix_l070.py. YAML safe-load passes on all 9 modified
files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

anaeem added 1 commit

2026-05-22 01:46:16 +00:00

apme: review doc + stubbed CI gate

APME static analysis / apme-check (pull_request) Has been cancelled

Details

3c8c920f06

* docs/APME_REVIEW.md — summary of scan 8049d507f471 (1871 violations
  on main @ df7e5aa), what was fixed mechanically in this branch
  (222 fixes via L067/L025/L070 sweeps), what's left by category with
  pragmatic recommendations per rule, and the smoking-gun bugs in
  APME's autopatcher that justify hand-rolling our own fixers.

* .gitea/workflows/apme.yml — stubbed Forgejo Actions gate (gated
  behind `if: false`). Activation depends on (1) the apme-engine
  Primary gRPC port being reachable from a Forgejo runner — today it's
  ClusterIP-only on hammer2 — and (2) registering a self-hosted runner
  against this repo. Documented inline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>