blob: 0c222a953bc661f1c6fda360afc94cf6f59c72ab (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
# risky-shell-pipe
This rule checks for the bash `pipefail` option with the Ansible `shell` module.
You should always set `pipefail` when piping output from a command to another.
The return status of a pipeline is the exit status of the command.
The `pipefail` option ensures that tasks fail as expected if the first command fails.
## Problematic Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Pipeline without pipefail
shell: false | cat
```
## Correct Code
```yaml
---
- name: Example playbook
hosts: localhost
become: no
tasks:
- name: Pipeline with pipefail
shell: set -o pipefail && false | cat
- name: Pipeline with pipefail, multi-line
shell: |
set -o pipefail # <-- adding this will prevent surprises
false | cat
```
|
