From 782f8df6e41f29dce2db4970a3ad84aaeb7d8c5f Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Tue, 14 May 2024 22:04:50 +0200
Subject: Adding upstream version 4.3.7.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 lib/ansiblelint/rules/ShellWithoutPipefail.py | 38 +++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 lib/ansiblelint/rules/ShellWithoutPipefail.py

(limited to 'lib/ansiblelint/rules/ShellWithoutPipefail.py')

diff --git a/lib/ansiblelint/rules/ShellWithoutPipefail.py b/lib/ansiblelint/rules/ShellWithoutPipefail.py
new file mode 100644
index 0000000..678e5a2
--- /dev/null
+++ b/lib/ansiblelint/rules/ShellWithoutPipefail.py
@@ -0,0 +1,38 @@
+import re
+
+from ansiblelint.rules import AnsibleLintRule
+
+
+class ShellWithoutPipefail(AnsibleLintRule):
+    id = '306'
+    shortdesc = 'Shells that use pipes should set the pipefail option'
+    description = (
+        'Without the pipefail option set, a shell command that '
+        'implements a pipeline can fail and still return 0. If '
+        'any part of the pipeline other than the terminal command '
+        'fails, the whole pipeline will still return 0, which may '
+        'be considered a success by Ansible. '
+        'Pipefail is available in the bash shell.'
+    )
+    severity = 'MEDIUM'
+    tags = ['command-shell']
+    version_added = 'v4.1.0'
+
+    _pipefail_re = re.compile(r"^\s*set.*[+-][A-z]*o\s*pipefail")
+    _pipe_re = re.compile(r"(?<!\|)\|(?!\|)")
+
+    def matchtask(self, file, task):
+        if task["__ansible_action_type__"] != "task":
+            return False
+
+        if task["action"]["__ansible_module__"] != "shell":
+            return False
+
+        if task.get("ignore_errors"):
+            return False
+
+        unjinjad_cmd = self.unjinja(
+            ' '.join(task["action"].get("__ansible_arguments__", [])))
+
+        return (self._pipe_re.search(unjinjad_cmd) and
+                not self._pipefail_re.match(unjinjad_cmd))
-- 
cgit v1.2.3