Linting incorrectly commented ansible_managed variable in templates

[spetrosi]

When a user has the ansible_managed variable set to a multi-line entry, # {{ ansible_managed }} in templates expands to the ansible_managed variable with only the first line commented out.

For example, consider ansible_managed set to the following in ansible.cfg:

user@ansiblemaster:~# cat ansible.cfg|grep -A 4 ansible_managed
ansible_managed = WARNING: This file is managed by ANSIBLE.
template: {file}
modified on: %Y-%m-%d %H:%M:%S
by user: {uid}
from ansiblemaster: {host}

In this case, # {{ ansible_managed }} expands to the following in the resulting config file:

# WARNING: This file is managed by ANSIBLE.
template: /usr/share/ansible/roles/rhel-system-roles.timesync/templates/chrony.conf.j2
modified on: 2021-09-15 13:35:58
by user: root
from ansiblemaster: ansiblemaster.mydomain.com

Because only the first line is commented, the config file reads incorrectly and services fail to start.

This must be fixed by using the comment filter, i.e. by using {{ ansible_managed | comment }}. If you need a different comment sign, you can customize it, e.g. {{ "C style" | comment('c') }}.

This is described in Adding comments to files in Ansible documentation.

I tried writing an ansible-lint rule for that and faced the issue that ansible-lint skips the commented lines, i.e. my rule would find # {{ ansible_managed }} in the middle of the line, e.g. in the following case:
- # {{ ansible_managed }}
But the rule does not work in a real-life case - when {{ ansible_managed }} is commented on the first line of the template.

Is it possible to make ansible-lint to check commented lines? I would like to see that check in ansible-lint, but I am not that good in coding to do it myself.

Here is the simple rule I used, it is not ready, just a rule I used in my testing.

from ansiblelint.rules import AnsibleLintRule

class AnsibleManagedComment(AnsibleLintRule):
    id = 'ansible-managed-comment'
    shortdesc = "Do not use '# {{ ansible_managed }}', use '{{ ansible_managed | comment }}'"
    shortdesc = "Do not comment ansible_managed with '#', use '| comment'"
    description = (
        'Do not use ``# {{ ansible_managed }}``, you must use '
        '``{{ ansible_managed | comment }}`` to ensure that Ansible renders '
        'the multi-line ansible_managed variable properly. For more '
        'information,see '
        'https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#manipulating-text.'
    )
    severity = 'MEDIUM'
    tags = ['formatting', 'experimental']
    version_added = 'v4.0.0'

    def match(self, line: str) -> bool:
        if '# {{ ansible_managed }}' in line:
            return True
        return False

[ssbarnea]

You cannot use the linter to process templated yaml files, it will open only files that are valid YAML without processing templates.

Also the support for checking comments is bit limited so I would not advise writing rules that rely on them. The only exception that we currently have is that we allow using comments for silencing some rules.