blob: dfede8e84d9b613ff70e753db9033814a9c4a5ec (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# risky-shell-pipe
This rule checks for the bash `pipefail` option with the Ansible `shell` module.
You should always set `pipefail` when piping output from one command to another.
The return status of a pipeline is the exit status of the command. The
`pipefail` option ensures that tasks fail as expected if the first command
fails.
As this requirement does not apply to PowerShell, for shell commands that have
`pwsh` inside `executable` attribute, this rule will not trigger.
## Problematic Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Pipeline without pipefail
ansible.builtin.shell: false | cat
```
## Correct Code
```yaml
---
- name: Example playbook
hosts: localhost
become: false
tasks:
- name: Pipeline with pipefail
ansible.builtin.shell:
cmd: set -o pipefail && false | cat
executable: /bin/bash
- name: Pipeline with pipefail, multi-line
ansible.builtin.shell:
cmd: |
set -o pipefail # <-- adding this will prevent surprises
false | cat
executable: /bin/bash
```
|
