Add build-time test for ansible variable conflicts by ggbecker · Pull Request #14347 · ComplianceAsCode/content
This commit adds a new CTest that checks rendered ansible files for variable naming conflicts between registered variables and rule IDs. The problem occurs when ansible remediations register a variable with the same name as a rule ID. For example, if rule 'selinux_state' uses 'register: selinux_state', this creates a conflict with the 'selinux_state' boolean control variable used in when conditions like 'when: selinux_state | bool'. This causes the task to be skipped since the variable shadows the control variable, preventing proper execution. The test checks two locations in the build directory: 1. build/<product>/fixes/ansible/ - Individual rule remediations after template expansion 2. build/ansible/<product>-playbook-*.yml - Per-profile playbooks with fully rendered content The test runs for each product during the build and will fail if any registered variable name matches any rule ID in the system, ensuring that such conflicts are caught early in development. This is integrated into the cmake build system as a new test target 'ansible-variable-conflicts-<product>' that runs automatically during ctest execution and is labeled as a 'quick' test.