forbid-variables-in-copied-files: check for variables used in files copied using ansible.builtin.copy

[Lucas-C]

Hi.

I would like to suggest a new rule to be added to the list of embedded ones:

from pathlib import Path
from ansiblelint.rules import AnsibleLintRule


class ForbidVariablesInCopiedFilesRule(AnsibleLintRule):
    """
    A file copied using ansible.builtin.copy contains a least one {{ Jinja variable }}
    ansible.builtin.template should probably be used instead?
    """

    id = 'forbid-variables-in-copied-files'
    description = 'Check for variables used in files copied using ansible.builtin.copy'
    severity = 'LOW'

    def matchtask(self, task, file):
        if task.action not in ('ansible.builtin.copy', 'copy'):
            return False
        task_path = Path(task.filename)
        files_dir = task_path.parent.parent / "files"
        src = task['action']['src']
        try:
          with (files_dir / src).open(encoding="utf-8") as src_file:
              src_file_content = src_file.read()
        except UnicodeDecodeError:
            return False
        return "{{" in src_file_content or "}}" in src_file_content

I got bitten once by using ansible.builtin.copy instead of ansible.builtin.template with a file containing variables, and thought it would be handy to have a builtin check for this in ansible-lint.

What do you think about this? 🙂

[Lucas-C]

Note: I'm willing to submit a PR for this rule if it accepted.