class

Krikri::Lint::CommandInsteadOfShellRule

Inherits Krikri::Lint::Rule < Reference < Object

Upstream parity: ansible-lint's command-instead-of-shell (severity HIGH, tags command-shell/idiom). Fires on shell: tasks whose command contains none of the shell-feature characters after Jinja is stripped; executable: exempts.

Constants

SHELL_CHARS = "&|<>;$\n*[]{}?`!"

Instance methods

applies_to
Source
check(file : PositionedFile, violations : Array(Violation)) : Nil
Source
fix(buffer : FixBuffer, file : PositionedFile, violation : Violation) : Bool

Upstream's transform renames the shell action key to ansible.builtin.command; the rule only fires on commands with no shell metacharacters, so the rename is safe.

Source
fixable?

Autofix support, mirroring upstream's TransformMixin: a rule opts in by overriding fixable? (and carrying the "autofix" tag like upstream does) and implementing fix. fix must only make line-local edits through the FixBuffer (replace spans within existing lines, delete whole lines, add the final newline); returning true marks the violation fixed so the CLI drops it from the report.

Source
marks_fixed?(violation : Violation) : Bool

Upstream's transform rewrites the task's module key and marks the match fixed, so no "not applied" is logged for it.

Source
overrides?(task : LintTask) : Bool

True when this rule's fix (renaming the key to ansible.builtin.command) supersedes an fqcn fix on the same key, so the fqcn rule's fix should stand down. Mirrors the composed effect of upstream applying both transforms.

Source
severity
Source
tags
Source
task_scoped?

Task-oriented: violations belong to an enclosing task, so a # noqa: anywhere in that task's body suppresses them.

Source
transformable?

Upstream's TransformMixin: the --fix transformer attempts a rule-specific transform for matches of these rules, even when krikri has no line fix of its own (upstream's yaml transform is a documented no-op, yet every yaml[*] match gets a "Rule specific fix not applied for" ERROR from it).

Source