From 6f4b3eeb392a702ae1778cf838adf224427873b5 Mon Sep 17 00:00:00 2001 From: Ant Somers Date: Tue, 1 Sep 2026 22:58:26 +0300 Subject: [PATCH] fix(baseline): make the check-mode key-install conditional boolean MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `make check` fails on any host where a sudo operator account already exists: [ERROR]: Task failed: A 'when' expression failed: Conditional result (True) was derived from value of type 'list' ... Conditionals must have a boolean result. `getent` with fail_key:false stores a hit as the passwd field LIST (["x","1000","1000","Ant Somers","/home/user","/bin/bash"]), not a boolean, and ansible-core 2.19+ rejects a non-boolean conditional outright rather than coercing it. It only bites under --check. A real run short-circuits on the left operand of the `or` and yields a clean True, so the right operand is never evaluated; in check mode `not ansible_check_mode` is False, the list is returned as the result, and the task dies. That asymmetry is also why no molecule scenario catches it — none of them run in check mode. Compare the getent hit to None explicitly, which is what the comment on the line already said the test was for. Verified against a real provisioned host (Ubuntu 26.04, two existing operator accounts): `make check` went from failed=1 to ok=206 changed=7 failed=0. `make lint` and `make lint-ansible` (production profile) both pass. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_019WB9m9pHjptvDCThR4z6Lj --- ansible/roles/baseline/tasks/sudo_account.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ansible/roles/baseline/tasks/sudo_account.yml b/ansible/roles/baseline/tasks/sudo_account.yml index 4b62215..5be8ef9 100644 --- a/ansible/roles/baseline/tasks/sudo_account.yml +++ b/ansible/roles/baseline/tasks/sudo_account.yml @@ -102,5 +102,11 @@ key: "{{ item }}" state: present loop: "{{ sudo_account['keys'] }}" - # fail_key:false stores a missing user as {user: None}, so test the value, not `in`. - when: not ansible_check_mode or (getent_passwd | default({})).get(sudo_account['name']) + # fail_key:false stores a missing user as {user: None}, so test the value, not `in` + # — and compare it explicitly: the hit is the passwd field LIST, and ansible-core + # 2.19+ rejects a non-boolean conditional outright. Only check mode reaches this + # operand (a real run short-circuits on the left), which is why it fails solely + # under --check. + when: >- + not ansible_check_mode + or (getent_passwd | default({})).get(sudo_account['name']) is not none