From 5b618dfabf69c329cbe2354aabfbd3cb0f32f0f0 Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 12:05:39 +0100
Subject: [PATCH 1/6] sap_netweaver_preconfigure: ansible-lint 6.22.0 cleanup

Relates to #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 roles/sap_netweaver_preconfigure/.ansible-lint   |  3 +++
 .../tasks/SLES/configuration.yml                 | 16 +++++++++-------
 .../tasks/sapnote/2526952.yml                    |  2 +-
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/roles/sap_netweaver_preconfigure/.ansible-lint b/roles/sap_netweaver_preconfigure/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_netweaver_preconfigure/.ansible-lint
+++ b/roles/sap_netweaver_preconfigure/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_netweaver_preconfigure/tasks/SLES/configuration.yml b/roles/sap_netweaver_preconfigure/tasks/SLES/configuration.yml
index b5a608c4e..41065f9a1 100644
--- a/roles/sap_netweaver_preconfigure/tasks/SLES/configuration.yml
+++ b/roles/sap_netweaver_preconfigure/tasks/SLES/configuration.yml
@@ -3,16 +3,16 @@
   ansible.builtin.systemd:
     name: saptune
     state: started
-    enabled: yes
+    enabled: true
 
 - name: Ensure saptune_check executes correctly
   ansible.builtin.command: saptune_check
-  changed_when: no
+  changed_when: false
 
 - name: Discover active solution
   ansible.builtin.command: saptune solution enabled
   register: __sap_netweaver_preconfigure_register_saptune_status
-  changed_when: no
+  changed_when: false
 
 - name: Make sure that sapconf and tuned are stopped and disabled
   ansible.builtin.command: "saptune service takeover"
@@ -26,28 +26,30 @@
 - name: Check if saptune solution needs to be applied
   ansible.builtin.command: "saptune solution verify {{ sap_netweaver_preconfigure_saptune_solution }}"
   register: __sap_netweaver_preconfigure_register_saptune_verify
-  changed_when: no # We're only checking, not changing!
-  failed_when: no # We expect this to fail if it has not previously been applied
+  changed_when: false # We're only checking, not changing!
+  failed_when: false # We expect this to fail if it has not previously been applied
 
 - name: Ensure no solution is currently applied
   ansible.builtin.command: "saptune solution revert {{ __sap_netweaver_preconfigure_fact_solution_configured }}"
+  changed_when: true
   when:
     - __sap_netweaver_preconfigure_fact_solution_configured != 'NONE'
     - __sap_netweaver_preconfigure_register_saptune_verify.rc != 0
 
 - name: Ensure saptune solution is applied
   ansible.builtin.command: "saptune solution apply {{ sap_netweaver_preconfigure_saptune_solution }}"
+  changed_when: true
   when: __sap_netweaver_preconfigure_register_saptune_verify.rc != 0
 
 - name: Ensure solution was successful
   ansible.builtin.command: "saptune solution verify {{ sap_netweaver_preconfigure_saptune_solution }}"
-  changed_when: no # We're only checking, not changing!
+  changed_when: false # We're only checking, not changing!
 
 - name: Warn if not enough swap space is configured
   ansible.builtin.fail:
     msg: "The system has only {{ ansible_swaptotal_mb }} MB of swap space configured,
       which is less than the minimum required amount of {{ sap_netweaver_preconfigure_min_swap_space_mb }} MB for SAP NetWeaver!"
-  ignore_errors: yes
+  ignore_errors: true
   when:
     - ansible_swaptotal_mb < sap_netweaver_preconfigure_min_swap_space_mb|int
     - not sap_netweaver_preconfigure_fail_if_not_enough_swap_space_configured|d(true)
diff --git a/roles/sap_netweaver_preconfigure/tasks/sapnote/2526952.yml b/roles/sap_netweaver_preconfigure/tasks/sapnote/2526952.yml
index 73efdb98c..e0a6bf9fd 100644
--- a/roles/sap_netweaver_preconfigure/tasks/sapnote/2526952.yml
+++ b/roles/sap_netweaver_preconfigure/tasks/sapnote/2526952.yml
@@ -39,7 +39,7 @@
       changed_when: true
 
     - name: Show new active tuned profile
-      ansible.builtin.shell: /usr/sbin/tuned-adm active | awk '{print $NF}'
+      ansible.builtin.shell: set -o pipefail && /usr/sbin/tuned-adm active | awk '{print $NF}'
       check_mode: no
       register: __sap_netweaver_preconfigure_register_new_tuned_profile
       changed_when: false

From a59fde5c3eee64b48b9e87c47f4fa32fc84e4194 Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 12:27:53 +0100
Subject: [PATCH 2/6] sap_hana_preconfigure: ansible-lint 6.22.0 cleanup

Fixes issue #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 .../tasks/RedHat/installation.yml              |  2 +-
 roles/sap_hana_preconfigure/.ansible-lint      |  3 +++
 roles/sap_hana_preconfigure/handlers/main.yml  |  5 ++++-
 .../tasks/RedHat/assert-installation.yml       |  3 ++-
 .../tasks/RedHat/generic/assert-tsx.yml        |  2 +-
 .../tasks/RedHat/generic/configure-tuned.yml   | 12 ++++++------
 .../tasks/RedHat/generic/disable-ksm.yml       |  3 ++-
 .../tasks/RedHat/generic/enable-tsx.yml        |  1 +
 .../tasks/RedHat/installation.yml              |  7 ++++++-
 .../tasks/SLES/configuration.yml               | 18 ++++++++++--------
 .../tasks/sapnote/2055470.yml                  |  3 ++-
 11 files changed, 38 insertions(+), 21 deletions(-)

diff --git a/roles/sap_general_preconfigure/tasks/RedHat/installation.yml b/roles/sap_general_preconfigure/tasks/RedHat/installation.yml
index caa66f47f..b86af1c69 100644
--- a/roles/sap_general_preconfigure/tasks/RedHat/installation.yml
+++ b/roles/sap_general_preconfigure/tasks/RedHat/installation.yml
@@ -168,7 +168,7 @@
   block:
 
 # Reason for noqa: We can safely fail at the last command in the pipeline.
-    - name: Create a list of minimum required package versions to be installed  # noqa risky-shell-pipe
+    - name: Create a list of minimum required package versions to be installed # noqa risky-shell-pipe
 # How does it work?
 # 1 - Print the required package name and version with a prefix "1" followed by a space.
 # 2 - In the same output sequence, list all installed versions of this package with a prefix "2" followed by a space.
diff --git a/roles/sap_hana_preconfigure/.ansible-lint b/roles/sap_hana_preconfigure/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_hana_preconfigure/.ansible-lint
+++ b/roles/sap_hana_preconfigure/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_hana_preconfigure/handlers/main.yml b/roles/sap_hana_preconfigure/handlers/main.yml
index 49e5191c7..ee7eb5c9d 100644
--- a/roles/sap_hana_preconfigure/handlers/main.yml
+++ b/roles/sap_hana_preconfigure/handlers/main.yml
@@ -3,7 +3,7 @@
 - name: "Check if server is booted in BIOS or UEFI mode"
   ansible.builtin.stat:
     path: /sys/firmware/efi
-    get_checksum: no
+    get_checksum: false
   register: __sap_hana_preconfigure_register_stat_sys_firmware_efi
   listen: __sap_hana_preconfigure_regenerate_grub2_conf_handler
   when:
@@ -19,6 +19,7 @@
 - name: "Run grub-mkconfig (BIOS mode)"
   ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
   register: __sap_hana_preconfigure_register_grub2_mkconfig_bios_mode
+  changed_when: true
   listen: __sap_hana_preconfigure_regenerate_grub2_conf_handler
   notify: __sap_hana_preconfigure_reboot_handler
   when:
@@ -51,6 +52,7 @@
 - name: "Run grub-mkconfig (UEFI mode)"
   ansible.builtin.command: "grub2-mkconfig -o {{ __sap_hana_preconfigure_uefi_boot_dir }}"
   register: __sap_hana_preconfigure_register_grub2_mkconfig_uefi_mode
+  changed_when: true
   listen: __sap_hana_preconfigure_regenerate_grub2_conf_handler
   notify: __sap_hana_preconfigure_reboot_handler
   when:
@@ -69,6 +71,7 @@
 - name: "Run grubby for enabling TSX"
   ansible.builtin.command: grubby --args="tsx=on" --update-kernel=ALL
   register: __sap_hana_preconfigure_register_grubby_update
+  changed_when: true
   listen: __sap_hana_preconfigure_grubby_update_handler
   notify: __sap_hana_preconfigure_reboot_handler
 
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/assert-installation.yml b/roles/sap_hana_preconfigure/tasks/RedHat/assert-installation.yml
index 2df389cd4..02e6bd3e7 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/assert-installation.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/assert-installation.yml
@@ -112,7 +112,8 @@
     - sap_hana_preconfigure_assert_ignore_errors | d(false)
   block:
 
-    - name: Assert - Create a list of minimum required package versions to be installed
+# Reason for noqa: We can safely fail at the last command in the pipeline.
+    - name: Assert - Create a list of minimum required package versions to be installed # noqa risky-shell-pipe
 # How does it work?
 # 1 - Print the required package name and version with a prefix "1" followed by a space.
 # 2 - In the same output sequence, list all installed versions of this package with a prefix "2" followed by a space.
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/generic/assert-tsx.yml b/roles/sap_hana_preconfigure/tasks/RedHat/generic/assert-tsx.yml
index 591f1f93f..3a64d2d3c 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/generic/assert-tsx.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/generic/assert-tsx.yml
@@ -10,7 +10,7 @@
 
 # There are CPUs which are not capable of enabling the rtm flag, so we just report the status:
     - name: Get all CPU flags
-      ansible.builtin.shell: lscpu | grep "^Flags:"
+      ansible.builtin.shell: set -o pipefail && lscpu | grep "^Flags:"
       register: __sap_hana_preconfigure_register_lscpu_flags
       changed_when: no
 
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/generic/configure-tuned.yml b/roles/sap_hana_preconfigure/tasks/RedHat/generic/configure-tuned.yml
index a5de66bfa..152d6d0ee 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/generic/configure-tuned.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/generic/configure-tuned.yml
@@ -22,7 +22,7 @@
         owner: root
         group: root
         mode: '0644'
-        backup: yes
+        backup: true
 
 - name: Perform steps for setting tuned profile
   when: sap_hana_preconfigure_use_tuned
@@ -32,11 +32,11 @@
       ansible.builtin.service:
         name: tuned
         state: started
-        enabled: yes
+        enabled: true
 
     - name: Get currently active tuned profile
-      ansible.builtin.shell: /usr/sbin/tuned-adm active | grep ":" | cut -d ":" -f 2 | awk '{$1=$1;print}'
-      check_mode: no
+      ansible.builtin.shell: set -o pipefail && /usr/sbin/tuned-adm active | awk '/:/{print $NF}'
+      check_mode: false
       register: __sap_hana_preconfigure_register_current_tuned_profile
       changed_when: false
 
@@ -53,8 +53,8 @@
           changed_when: true
 
         - name: Show new active tuned profile
-          ansible.builtin.shell: /usr/sbin/tuned-adm active | grep ":" | cut -d ":" -f 2 | awk '{$1=$1;print}'
-          check_mode: no
+          ansible.builtin.shell: set -o pipefail && /usr/sbin/tuned-adm active | awk '/:/{print $NF}'
+          check_mode: false
           register: __sap_hana_preconfigure_register_new_tuned_profile
           changed_when: false
 
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/generic/disable-ksm.yml b/roles/sap_hana_preconfigure/tasks/RedHat/generic/disable-ksm.yml
index 6a644d3a2..2e9f64c2f 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/generic/disable-ksm.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/generic/disable-ksm.yml
@@ -19,7 +19,7 @@
 
 - name: Configure - Get initial status of KSM
   ansible.builtin.command: cat /sys/kernel/mm/ksm/run
-  check_mode: no
+  check_mode: false
   register: __sap_hana_preconfigure_register_ksm_status_before
   ignore_errors: true
   changed_when: false
@@ -27,6 +27,7 @@
 - name: Disable KSM on the running system
   ansible.builtin.shell: echo 0 > /sys/kernel/mm/ksm/run
   register: __sap_hana_preconfigure_register_disable_ksm
+  changed_when: true
   when: __sap_hana_preconfigure_register_ksm_status_before.stdout != '0'
 
 - name: Configure - Get status of KSM
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/generic/enable-tsx.yml b/roles/sap_hana_preconfigure/tasks/RedHat/generic/enable-tsx.yml
index 9176357d6..4566cd726 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/generic/enable-tsx.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/generic/enable-tsx.yml
@@ -8,6 +8,7 @@
 - name: Enable TSX at boot time
   ansible.builtin.command: /bin/true
   notify: __sap_hana_preconfigure_grubby_update_handler
+  changed_when: true
   when:
     - ansible_architecture == 'x86_64'
     - ansible_distribution == 'RedHat'
diff --git a/roles/sap_hana_preconfigure/tasks/RedHat/installation.yml b/roles/sap_hana_preconfigure/tasks/RedHat/installation.yml
index 0fe0670d9..c3b68c0e6 100644
--- a/roles/sap_hana_preconfigure/tasks/RedHat/installation.yml
+++ b/roles/sap_hana_preconfigure/tasks/RedHat/installation.yml
@@ -55,6 +55,7 @@
 
 - name: Set the minor RHEL release
   ansible.builtin.command: subscription-manager release --set="{{ ansible_distribution_version }}"
+  changed_when: true
   when:
     - sap_hana_preconfigure_set_minor_release
     - __sap_hana_preconfigure_register_subscription_manager_release.stdout != ansible_distribution_version
@@ -94,6 +95,7 @@
 
 - name: Accept the license for the IBM Service and Productivity Tools
   ansible.builtin.shell: LESS=+q /opt/ibm/lop/configure <<<'y'
+  changed_when: true
   when:
     - ansible_architecture == "ppc64le"
     - sap_hana_preconfigure_install_ibm_power_tools | d(true)
@@ -131,7 +133,8 @@
     - __sap_hana_preconfigure_min_pkgs | d([])
   block:
 
-    - name: Create a list of minimum required package versions to be installed
+# Reason for noqa: We can safely fail at the last command in the pipeline.
+    - name: Create a list of minimum required package versions to be installed # noqa risky-shell-pipe
 # How does it work?
 # 1 - Print the required package name and version with a prefix "1" followed by a space.
 # 2 - In the same output sequence, list all installed versions of this package with a prefix "2" followed by a space.
@@ -237,9 +240,11 @@
 - name: Call reboot handler if necessary as per role sap_general_preconfigure
   ansible.builtin.command: /bin/true
   notify: __sap_hana_preconfigure_reboot_handler
+  changed_when: true
   when: sap_general_preconfigure_fact_reboot_required | d(false)
 
 - name: Call reboot handler if necessary as per this role
   ansible.builtin.command: /bin/true
   notify: __sap_hana_preconfigure_reboot_handler
+  changed_when: true
   when: __sap_hana_preconfigure_register_needs_restarting is failed
diff --git a/roles/sap_hana_preconfigure/tasks/SLES/configuration.yml b/roles/sap_hana_preconfigure/tasks/SLES/configuration.yml
index 0e084615e..b62711e8e 100644
--- a/roles/sap_hana_preconfigure/tasks/SLES/configuration.yml
+++ b/roles/sap_hana_preconfigure/tasks/SLES/configuration.yml
@@ -8,16 +8,16 @@
   ansible.builtin.systemd:
     name: saptune
     state: started
-    enabled: yes
+    enabled: true
 
 - name: Ensure saptune_check executes correctly
   ansible.builtin.command: saptune_check
-  changed_when: no
+  changed_when: false
 
 - name: Discover active solution
   ansible.builtin.command: saptune solution enabled
   register: __sap_hana_preconfigure_register_saptune_status
-  changed_when: no
+  changed_when: false
 
 - name: Set fact for active solution
   ansible.builtin.set_fact:
@@ -34,8 +34,8 @@
 - name: Disable TCP timestamps, recycle & reuse
   ansible.builtin.blockinfile:
     path: /etc/saptune/override/2382421
-    create: yes
-    backup: yes
+    create: true
+    backup: true
     owner: root
     group: root
     mode: '0640'
@@ -51,22 +51,24 @@
 - name: Check if saptune solution needs to be applied
   ansible.builtin.command: "saptune solution verify {{ sap_hana_preconfigure_saptune_solution }}"
   register: __sap_hana_preconfigure_register_saptune_verify
-  changed_when: no # We're only checking, not changing!
-  failed_when: no # We expect this to fail if it has not previously been applied
+  changed_when: false # We're only checking, not changing!
+  failed_when: false # We expect this to fail if it has not previously been applied
 
 - name: Ensure no solution is currently applied
   ansible.builtin.command: "saptune solution revert {{ __sap_hana_preconfigure_fact_solution_configured }}"
+  changed_when: true
   when:
     - __sap_hana_preconfigure_fact_solution_configured != 'NONE'
     - __sap_hana_preconfigure_register_saptune_verify.rc != 0
 
 - name: Ensure saptune solution is applied
   ansible.builtin.command: "saptune solution apply {{ sap_hana_preconfigure_saptune_solution }}"
+  changed_when: true
   when: __sap_hana_preconfigure_register_saptune_verify.rc != 0
 
 - name: Ensure solution was successful
   ansible.builtin.command: "saptune solution verify {{ sap_hana_preconfigure_saptune_solution }}"
-  changed_when: no # We're only checking, not changing!
+  changed_when: false # We're only checking, not changing!
 
 - name: Make sure that sapconf and tuned are stopped and disabled
   ansible.builtin.command: "saptune service takeover"
diff --git a/roles/sap_hana_preconfigure/tasks/sapnote/2055470.yml b/roles/sap_hana_preconfigure/tasks/sapnote/2055470.yml
index aeee28a8b..21a0a7512 100644
--- a/roles/sap_hana_preconfigure/tasks/sapnote/2055470.yml
+++ b/roles/sap_hana_preconfigure/tasks/sapnote/2055470.yml
@@ -19,7 +19,8 @@
         msg: "SAP note {{ (__sap_hana_preconfigure_sapnotes_versions | selectattr('number', 'match', '^2055470$') | first).number }}
               (version {{ (__sap_hana_preconfigure_sapnotes_versions | selectattr('number', 'match', '^2055470$') | first).version }}): SAP HANA on POWER settings"
 
-    - name: Ensure MTU size is 9000 on all interfaces
+# Reason for noqa: Failing early can cause unpredictable outputs.
+    - name: Ensure MTU size is 9000 on all interfaces # noqa risky-shell-pipe
       ansible.builtin.shell: |
         mtu=$(nmcli conn show {{ line_item }} | grep 802-3-ethernet.mtu | awk -F: '{printf("%d", $2)}')
         if [ "$mtu" != "9000" ]; then

From 9556077fded3320515bb0fc5704cb342fa8ea4b1 Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 12:36:42 +0100
Subject: [PATCH 3/6] sap_hana_install: ansible-lint 6.22.0 cleanup

Relates to #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 roles/sap_hana_install/.ansible-lint          |  3 +++
 .../sap_hana_install/tasks/hana_addhosts.yml  |  7 ++---
 roles/sap_hana_install/tasks/hana_exists.yml  | 26 +++++++++----------
 roles/sap_hana_install/tasks/post_install.yml |  2 ++
 .../tasks/pre_install/extract_sarfile.yml     |  2 ++
 5 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/roles/sap_hana_install/.ansible-lint b/roles/sap_hana_install/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_hana_install/.ansible-lint
+++ b/roles/sap_hana_install/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_hana_install/tasks/hana_addhosts.yml b/roles/sap_hana_install/tasks/hana_addhosts.yml
index c641c8c6d..024aa2c71 100644
--- a/roles/sap_hana_install/tasks/hana_addhosts.yml
+++ b/roles/sap_hana_install/tasks/hana_addhosts.yml
@@ -23,7 +23,8 @@
   when: not ansible_check_mode
   block:
 
-    - name: SAP HANA Add Hosts - Run 'hdblcm --list_systems'
+# Reason for noqa: We can safely fail at the last command in the pipeline.
+    - name: SAP HANA Add Hosts - Run 'hdblcm --list_systems' # noqa risky-shell-pipe
       ansible.builtin.shell: |
         ./hdblcm --list_systems | awk '/\/hana\/shared\/{{ sap_hana_install_sid }}/{a=1}
           /hosts:/{if (a==1){
@@ -32,7 +33,7 @@
       args:
         chdir: "{{ sap_hana_install_install_path }}/{{ sap_hana_install_sid }}/hdblcm"
       register: __sap_hana_install_register_hdblcm_list_systems
-      changed_when: no
+      changed_when: false
 
     - name: SAP HANA Add Hosts - Show the output of hdblcm --list_systems
       ansible.builtin.debug:
@@ -88,7 +89,7 @@
   args:
     chdir: "{{ sap_hana_install_install_path }}/{{ sap_hana_install_sid }}/hdblcm"
   register: __sap_hana_install_register_addhosts_result
-  changed_when: no
+  changed_when: false
   when: not ansible_check_mode
 
 - name: SAP HANA Add Hosts - Show the HANA version and hosts
diff --git a/roles/sap_hana_install/tasks/hana_exists.yml b/roles/sap_hana_install/tasks/hana_exists.yml
index 3a450cfc0..9634ce387 100644
--- a/roles/sap_hana_install/tasks/hana_exists.yml
+++ b/roles/sap_hana_install/tasks/hana_exists.yml
@@ -4,16 +4,16 @@
 - name: SAP HANA Checks - Check if saphostctrl is installed
   ansible.builtin.stat:
     path: /usr/sap/hostctrl/exe/saphostctrl
-  check_mode: no
+  check_mode: false
   register: __sap_hana_install_register_stat_saphostctrl
-  failed_when: no
+  failed_when: false
 
 - name: SAP HANA Checks - Check if SAP instances are installed with saphostctrl
   when: __sap_hana_install_register_stat_saphostctrl.stat.exists
   block:
 
     - name: SAP HANA Checks - Get list of installed SAP instances
-      ansible.builtin.shell: /usr/sap/hostctrl/exe/saphostctrl -function ListInstances | cut -d":" -f2-
+      ansible.builtin.shell: set -o pipefail && /usr/sap/hostctrl/exe/saphostctrl -function ListInstances | cut -d":" -f2-
       register: __sap_hana_install_register_instancelist
       changed_when: false
 
@@ -66,9 +66,9 @@
     - name: SAP HANA Checks - Get status of '/hana/shared/{{ sap_hana_install_sid }}'
       ansible.builtin.stat:
         path: "/hana/shared/{{ sap_hana_install_sid }}"
-      check_mode: no
+      check_mode: false
       register: __sap_hana_install_register_stat_hana_shared_sid_assert
-      failed_when: no
+      failed_when: false
 
     - name: SAP HANA Checks - Get contents of '/hana/shared/{{ sap_hana_install_sid }}'
       ansible.builtin.find:
@@ -87,9 +87,9 @@
     - name: SAP HANA Checks - Get status of '/usr/sap/{{ sap_hana_install_sid }}'
       ansible.builtin.stat:
         path: "/usr/sap/{{ sap_hana_install_sid }}"
-      check_mode: no
+      check_mode: false
       register: __sap_hana_install_register_stat_usr_sap_sid_assert
-      failed_when: no
+      failed_when: false
 
     - name: SAP HANA Checks - Get contents of '/usr/sap/{{ sap_hana_install_sid }}'
       ansible.builtin.find:
@@ -113,10 +113,10 @@
 
     - name: SAP HANA Checks - Get info about '{{ sap_hana_install_sid | lower }}adm' user
       ansible.builtin.command: getent passwd {{ sap_hana_install_sid | lower }}adm
-      check_mode: no
+      check_mode: false
       register: __sap_hana_install_register_getent_passwd_sidadm
-      changed_when: no
-      failed_when: no
+      changed_when: false
+      failed_when: false
 
     - name: SAP HANA Checks - Fail if the user '{{ sap_hana_install_sid | lower }}adm' exists
       ansible.builtin.fail:
@@ -135,10 +135,10 @@
 
     - name: SAP HANA Checks - Get info about the ID of the 'sapsys' group
       ansible.builtin.command: getent group sapsys
-      check_mode: no
+      check_mode: false
       register: __sap_hana_install_register_getent_group_sapsys
-      changed_when: no
-      failed_when: no
+      changed_when: false
+      failed_when: false
 
     - name: SAP HANA Checks - In case there is a group 'sapsys', assert that its group ID is identical to 'sap_hana_install_groupid'
       ansible.builtin.assert:
diff --git a/roles/sap_hana_install/tasks/post_install.yml b/roles/sap_hana_install/tasks/post_install.yml
index 927442f29..697615cca 100644
--- a/roles/sap_hana_install/tasks/post_install.yml
+++ b/roles/sap_hana_install/tasks/post_install.yml
@@ -120,6 +120,7 @@
       args:
         chdir: "{{ sap_hana_install_install_path }}/{{ sap_hana_install_sid }}/global/hdb/install/bin"
       register: __sap_hana_install_register_installation_check
+      changed_when: false
       when: sap_hana_install_use_hdbcheck | d(true)
 
     - name: SAP HANA hdblcm installation check with hdbcheck - Display the result
@@ -133,6 +134,7 @@
       args:
         chdir: "{{ sap_hana_install_install_path }}/{{ sap_hana_install_sid }}/hdblcm"
       register: __sap_hana_install_register_installation_check
+      changed_when: false
       when: not sap_hana_install_use_hdbcheck | d(true)
 
     - name: SAP HANA hdblcm installation check with hdblcm - Display the result
diff --git a/roles/sap_hana_install/tasks/pre_install/extract_sarfile.yml b/roles/sap_hana_install/tasks/pre_install/extract_sarfile.yml
index 98570de34..7cfed7751 100644
--- a/roles/sap_hana_install/tasks/pre_install/extract_sarfile.yml
+++ b/roles/sap_hana_install/tasks/pre_install/extract_sarfile.yml
@@ -36,12 +36,14 @@
     mv ${extracted_dir} ..
   args:
     chdir: "{{ __sap_hana_install_tmp_software_extract_directory }}"
+  changed_when: true
   when: "'SAPHOST' not in __sap_hana_install_passed_sarfile"
 
 - name: SAP HANA hdblcm prepare - Move files into the correct place, SAP Host Agent
   ansible.builtin.command: mv ./tmp/SAP_HOST_AGENT .
   args:
     chdir: "{{ sap_hana_install_software_extract_directory }}"
+  changed_when: true
   when: "'SAPHOST' in __sap_hana_install_passed_sarfile"
 
 - name: SAP HANA hdblcm prepare - Remove temporary extraction directory '{{ sap_hana_install_software_extract_directory }}/tmp'

From 39246412af3eb30f5156a7f192100c3dd806b380 Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 12:43:49 +0100
Subject: [PATCH 4/6] sap_swpm: ansible-lint 6.22.0 cleanup

Relates to #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 roles/sap_swpm/.ansible-lint                                   | 3 +++
 .../pre_install/install_type/ha_maint_plan_stack_install.yml   | 1 +
 .../pre_install/install_type/maint_plan_stack_install.yml      | 1 +
 .../tasks/swpm/swpm_inifile_generate_default_templates.yml     | 3 ++-
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/roles/sap_swpm/.ansible-lint b/roles/sap_swpm/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_swpm/.ansible-lint
+++ b/roles/sap_swpm/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_swpm/tasks/pre_install/install_type/ha_maint_plan_stack_install.yml b/roles/sap_swpm/tasks/pre_install/install_type/ha_maint_plan_stack_install.yml
index 9995effc0..a1f7cbb6d 100644
--- a/roles/sap_swpm/tasks/pre_install/install_type/ha_maint_plan_stack_install.yml
+++ b/roles/sap_swpm/tasks/pre_install/install_type/ha_maint_plan_stack_install.yml
@@ -24,6 +24,7 @@
   args:
     chdir: "{{ sap_swpm_mp_stack_path }}"
   register: sap_swpm_mp_stack_file_get
+  changed_when: false
   # Test if variable string is not defined or None / blank
   when:
     (sap_swpm_mp_stack_file_name is not defined) or
diff --git a/roles/sap_swpm/tasks/pre_install/install_type/maint_plan_stack_install.yml b/roles/sap_swpm/tasks/pre_install/install_type/maint_plan_stack_install.yml
index 3c33b3265..9bf39bded 100644
--- a/roles/sap_swpm/tasks/pre_install/install_type/maint_plan_stack_install.yml
+++ b/roles/sap_swpm/tasks/pre_install/install_type/maint_plan_stack_install.yml
@@ -9,6 +9,7 @@
   args:
     chdir: "{{ sap_swpm_mp_stack_path }}"
   register: sap_swpm_mp_stack_file_get
+  changed_when: false
   # Test if variable string is not defined or None / blank
   when:
     (sap_swpm_mp_stack_file_name is not defined) or
diff --git a/roles/sap_swpm/tasks/swpm/swpm_inifile_generate_default_templates.yml b/roles/sap_swpm/tasks/swpm/swpm_inifile_generate_default_templates.yml
index e5dadf8ad..68abe9de2 100644
--- a/roles/sap_swpm/tasks/swpm/swpm_inifile_generate_default_templates.yml
+++ b/roles/sap_swpm/tasks/swpm/swpm_inifile_generate_default_templates.yml
@@ -13,7 +13,8 @@
   when: "'java' in sap_swpm_templates_install_dictionary[sap_swpm_templates_product_input]['sap_swpm_product_catalog_id'] | lower"
   tags: sap_swpm_generate_inifile
 
-- name: SAP SWPM default_templates mode - If not already defined, use the default variable for the template
+# Reason for noqa: We want to define variable names based on what is in the dictionary.
+- name: SAP SWPM default_templates mode - If not already defined, use the default variable for the template # noqa var-naming[no-jinja]
   ansible.builtin.set_fact:
     "{{ item.key }}": "{{ item.value }}"
   with_dict: "{{ sap_swpm_templates_install_dictionary[sap_swpm_templates_product_input]['sap_swpm_inifile_dictionary'] }}"

From a605485335e32699ef19fe1838e20f9498a7ab8f Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 12:49:36 +0100
Subject: [PATCH 5/6] sap_install_media_detect: ansible-lint 6.22.0 cleanup

Relates to #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 roles/sap_install_media_detect/.ansible-lint               | 3 +++
 .../tasks/cleanup/disable-epel-repo.yml                    | 2 ++
 roles/sap_install_media_detect/tasks/organize_files.yml    | 7 +++++++
 .../tasks/prepare/create_file_list_phase_2.yml             | 4 ++--
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/roles/sap_install_media_detect/.ansible-lint b/roles/sap_install_media_detect/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_install_media_detect/.ansible-lint
+++ b/roles/sap_install_media_detect/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_install_media_detect/tasks/cleanup/disable-epel-repo.yml b/roles/sap_install_media_detect/tasks/cleanup/disable-epel-repo.yml
index 606ef0609..c6668e1bd 100644
--- a/roles/sap_install_media_detect/tasks/cleanup/disable-epel-repo.yml
+++ b/roles/sap_install_media_detect/tasks/cleanup/disable-epel-repo.yml
@@ -21,6 +21,7 @@
 - name: SAP Install Media Detect - Cleanup - Remove the EPEL GPG key for this OS version, using the rpm -e command # noqa command-instead-of-module
   ansible.builtin.command: rpm -e "{{ __sap_install_media_detect_register_rpm_q_gpg_pubkeys.stdout.strip().split()[0] }}"
   register: __sap_install_media_detect_register_rpm_e_epel_gpg_pubkey
+  changed_when: true
   when:
     - not sap_install_media_detect_use_rpm_key_module_for_removing_the_key
     - __sap_install_media_detect_register_rpm_q_gpg_pubkeys.stdout | length != 0
@@ -29,6 +30,7 @@
 - name: SAP Install Media Detect - Cleanup - Get the GPG keys for this OS version after removal, rpm -e
   ansible.builtin.shell: set -o pipefail && rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n' | grep 'EPEL ({{ ansible_distribution_major_version }})'
   register: __sap_install_media_detect_register_rpm_q_gpg_pubkeys_after_removal
+  changed_when: false
   failed_when: false
   when:
     - not sap_install_media_detect_use_rpm_key_module_for_removing_the_key
diff --git a/roles/sap_install_media_detect/tasks/organize_files.yml b/roles/sap_install_media_detect/tasks/organize_files.yml
index edd932a6c..afa6c496f 100644
--- a/roles/sap_install_media_detect/tasks/organize_files.yml
+++ b/roles/sap_install_media_detect/tasks/organize_files.yml
@@ -85,6 +85,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_extract_archives
     - line_item.sap_file_type is search("export")
@@ -97,6 +98,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_extract_archives
     - not line_item.sap_file_type is search("export")
@@ -109,6 +111,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_extract_archives
     - line_item.archive_type == 'rarexe'
@@ -141,6 +144,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_extract_archives
 
@@ -164,6 +168,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_extract_archives
 
@@ -211,6 +216,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_move_or_copy_archives
     - line_item.copy_archive == 'y'
@@ -224,6 +230,7 @@
   loop_control:
     loop_var: line_item
     label: "{{ line_item.file }}"
+  changed_when: true
   when:
     - sap_install_media_detect_move_or_copy_archives
     - line_item.copy_archive == 'n'
diff --git a/roles/sap_install_media_detect/tasks/prepare/create_file_list_phase_2.yml b/roles/sap_install_media_detect/tasks/prepare/create_file_list_phase_2.yml
index fa5089b58..264e17ece 100644
--- a/roles/sap_install_media_detect/tasks/prepare/create_file_list_phase_2.yml
+++ b/roles/sap_install_media_detect/tasks/prepare/create_file_list_phase_2.yml
@@ -91,8 +91,8 @@
 
 - name: SAP Install Media Detect - Prepare - Set fact for subsets of the sapfile results
   ansible.builtin.set_fact:
-    __sap_install_media_detect_fact_target_directories: "{{ __sap_install_media_detect_fact_files_sapfile_results | map(attribute='target_dir') | unique | reject('equalto', 'auto')}}"
-    __sap_install_media_detect_fact_extraction_directories: "{{ __sap_install_media_detect_fact_files_sapfile_results | map(attribute='extraction_dir') | unique | reject('equalto', 'none')}}"
+    __sap_install_media_detect_fact_target_directories: "{{ __sap_install_media_detect_fact_files_sapfile_results | map(attribute='target_dir') | unique | reject('equalto', 'auto') }}"
+    __sap_install_media_detect_fact_extraction_directories: "{{ __sap_install_media_detect_fact_files_sapfile_results | map(attribute='extraction_dir') | unique | reject('equalto', 'none') }}"
     __sap_install_media_detect_fact_files_sapfile_results_extract_zip: "{{ __sap_install_media_detect_fact_files_sapfile_results | selectattr('archive_type', 'search', 'zip') | selectattr('extract_archive', 'search', 'y') }}"
     __sap_install_media_detect_fact_files_sapfile_results_extract_rarexe: "{{ __sap_install_media_detect_fact_files_sapfile_results | selectattr('archive_type', 'search', 'rarexe') | selectattr('extract_archive', 'search', 'y') }}"
     __sap_install_media_detect_fact_files_sapfile_results_extract_sapcar_hana: "{{ __sap_install_media_detect_fact_files_sapfile_results | selectattr('archive_type', 'search', 'sapcar') | selectattr('extract_archive', 'search', 'y') | selectattr('sap_file_type', 'search', 'saphana') }}"

From da862bddb1e68b21e578843b0368ff3f0a51a272 Mon Sep 17 00:00:00 2001
From: Bernd Finger <bfinger@redhat.com>
Date: Fri, 15 Dec 2023 16:55:42 +0100
Subject: [PATCH 6/6] sap_hostagent: ansible-lint 6.22.0 cleanup

Relates to #535.

Signed-off-by: Bernd Finger <bfinger@redhat.com>
---
 roles/sap_hostagent/.ansible-lint             |  3 ++
 roles/sap_hostagent/tasks/common_post.yml     |  3 +-
 roles/sap_hostagent/tasks/common_pre.yml      |  4 +--
 roles/sap_hostagent/tasks/config_ssl.yml      | 18 ++++++------
 roles/sap_hostagent/tasks/deploy_bundle.yml   |  6 ++--
 roles/sap_hostagent/tasks/deploy_rpm.yml      |  8 +++---
 roles/sap_hostagent/tasks/deploy_sar.yml      | 10 +++----
 .../sap_hostagent/tasks/deploy_sar_remote.yml |  4 +--
 roles/sap_hostagent/tasks/main.yml            | 28 +++++++++----------
 roles/sap_maintain_etc_hosts/.ansible-lint    |  3 ++
 10 files changed, 47 insertions(+), 40 deletions(-)

diff --git a/roles/sap_hostagent/.ansible-lint b/roles/sap_hostagent/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_hostagent/.ansible-lint
+++ b/roles/sap_hostagent/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work
diff --git a/roles/sap_hostagent/tasks/common_post.yml b/roles/sap_hostagent/tasks/common_post.yml
index 009f93fb0..2d877f8f6 100644
--- a/roles/sap_hostagent/tasks/common_post.yml
+++ b/roles/sap_hostagent/tasks/common_post.yml
@@ -1,7 +1,8 @@
 ---
+
 # Ensure {{ sap_hostagent_agent_tmp_directory }} directory is removed from the target host
 - name: Ensure {{ sap_hostagent_agent_tmp_directory }} directory does not exist
-  file:
+  ansible.builtin.file:
     path: "{{ sap_hostagent_agent_tmp_directory }}"
     state: absent
     mode: '0755'
diff --git a/roles/sap_hostagent/tasks/common_pre.yml b/roles/sap_hostagent/tasks/common_pre.yml
index 7f752cf0f..4c2e5acc2 100644
--- a/roles/sap_hostagent/tasks/common_pre.yml
+++ b/roles/sap_hostagent/tasks/common_pre.yml
@@ -2,7 +2,7 @@
 
 # Ensure {{ sap_hostagent_agent_tmp_directory }} directory exists on the target host
 - name: Ensure {{ sap_hostagent_agent_tmp_directory }} directory exists
-  file:
+  ansible.builtin.file:
     path: "{{ sap_hostagent_agent_tmp_directory }}"
     state: directory
-    mode: '0755'
\ No newline at end of file
+    mode: '0755'
diff --git a/roles/sap_hostagent/tasks/config_ssl.yml b/roles/sap_hostagent/tasks/config_ssl.yml
index e0a32b7c8..0e6bcbb1f 100644
--- a/roles/sap_hostagent/tasks/config_ssl.yml
+++ b/roles/sap_hostagent/tasks/config_ssl.yml
@@ -2,7 +2,7 @@
 
 # Ensure 'sapadm' user home directory exists
 - name: Ensure 'sapadm' user home directory exists
-  file:
+  ansible.builtin.file:
     path: "/home/sapadm"
     state: directory
     mode: '0755'
@@ -12,7 +12,7 @@
 # Ensure SSL is configured for agent communication
 # https://help.sap.com/viewer/6e1636d91ccc458c987094ee1fb864ae/HAG_CURRENT_VERSION/en-US/6aac42c2e742413da050eaecd57f785d.html
 - name: Prepare the Personal Security Environment (PSE) for the server
-  file:
+  ansible.builtin.file:
     path: "/usr/sap/hostctrl/exe/sec"
     state: directory
     mode: '0755'
@@ -20,12 +20,12 @@
     group: sapsys
 
 - name: Ensure any previous PSE generated by this role does not exists
-  file:
+  ansible.builtin.file:
     path: /usr/sap/hostctrl/exe/sec/SAPSSLS.pse
     state: absent
 
 - name: Create the server PSE, the server certificate therein, and the Certificate Signing Request (CSR)
-  command: >
+  ansible.builtin.command: >
     /usr/sap/hostctrl/exe/sapgenpse gen_pse
     -p SAPSSLS.pse
     -x "{{ sap_hostagent_ssl_passwd }}"
@@ -42,7 +42,7 @@
   changed_when: "'Certificate Request:' in ssl_config_output.stdout"
 
 - name: Grant SAP Host Agent access to the server PSE
-  command: >
+  ansible.builtin.command: >
     /usr/sap/hostctrl/exe/sapgenpse seclogin
     -p SAPSSLS.pse
     -x "{{ sap_hostagent_ssl_passwd }}"
@@ -59,9 +59,9 @@
 
 # Right now there is no option to import teh signed certificate. The CSR must be signed
 # by a valid CA in order to import it
-# 
+#
 # - name: Import the signed certificate into the server PSE
-#   command: >
+#   ansible.builtin.command: >
 #     /usr/sap/hostctrl/exe/sapgenpse import_own_cert
 #     -p SAPSSLS.pse
 #     -x "{{ sap_hostagent_ssl_passwd }}"
@@ -74,7 +74,7 @@
 #     SECUDIR: /usr/sap/hostctrl/exe/sec
 
 - name: Verify the server certificate chain
-  command: >
+  ansible.builtin.command: >
     /usr/sap/hostctrl/exe/sapgenpse get_my_name
     -x "{{ sap_hostagent_ssl_passwd }}"
     -v
@@ -89,6 +89,6 @@
   changed_when: "'Opening PSE' in ssl_config_output.stdout"
 
 - name: Restart SAPHOSTAGENT
-  command: /usr/sap/hostctrl/exe/saphostexec -restart
+  ansible.builtin.command: /usr/sap/hostctrl/exe/saphostexec -restart
   register: ssl_config_output
   changed_when: "'start hostcontrol using profile' in ssl_config_output.stdout"
diff --git a/roles/sap_hostagent/tasks/deploy_bundle.yml b/roles/sap_hostagent/tasks/deploy_bundle.yml
index 01621c356..0e859ae4f 100644
--- a/roles/sap_hostagent/tasks/deploy_bundle.yml
+++ b/roles/sap_hostagent/tasks/deploy_bundle.yml
@@ -1,15 +1,15 @@
 ---
 
 - name: Extract the SAPHOSTAGENT TGZ file from the Bundle
-  unarchive:
+  ansible.builtin.unarchive:
     src: "{{ sap_hostagent_bundle_path }}/HOSTAGENT.TGZ"
     dest: "{{ sap_hostagent_agent_tmp_directory }}"
     remote_src: yes
     mode: '0755'
 
 - name: Install SAPHOSTAGENT
-  command: "{{ sap_hostagent_agent_tmp_directory }}/global/hdb/saphostagent_setup/saphostexec -install"
+  ansible.builtin.command: "{{ sap_hostagent_agent_tmp_directory }}/global/hdb/saphostagent_setup/saphostexec -install"
   register: installagent
   args:
     chdir: "{{ sap_hostagent_agent_tmp_directory }}/global/hdb/saphostagent_setup/"
-  changed_when: "'Install service' in installagent.stdout"
\ No newline at end of file
+  changed_when: "'Install service' in installagent.stdout"
diff --git a/roles/sap_hostagent/tasks/deploy_rpm.yml b/roles/sap_hostagent/tasks/deploy_rpm.yml
index b311f7c38..8b53a8496 100644
--- a/roles/sap_hostagent/tasks/deploy_rpm.yml
+++ b/roles/sap_hostagent/tasks/deploy_rpm.yml
@@ -1,22 +1,22 @@
 ---
 
 - name: Copy RPM based SAPHOSTAGENT to the target host
-  copy:
+  ansible.builtin.copy:
     src: "{{ sap_hostagent_rpm_local_path }}/{{ sap_hostagent_rpm_file_name }}"
     dest: "{{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_rpm_file_name }}"
     mode: '0755'
   when: sap_hostagent_rpm_local_path is defined
 
 - name: Ensure RPM file is installed
-  yum:
+  ansible.builtin.yum:
     name: "{{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_rpm_file_name }}"
     state: present
     disable_gpg_check: yes
   when: sap_hostagent_rpm_local_path is defined
 
 - name: Ensure RPM file is installed
-  yum:
+  ansible.builtin.yum:
     name: "{{ sap_hostagent_rpm_remote_path }}/{{ sap_hostagent_rpm_file_name }}"
     state: present
     disable_gpg_check: yes
-  when: sap_hostagent_rpm_remote_path is defined
\ No newline at end of file
+  when: sap_hostagent_rpm_remote_path is defined
diff --git a/roles/sap_hostagent/tasks/deploy_sar.yml b/roles/sap_hostagent/tasks/deploy_sar.yml
index bb388071b..121da7254 100644
--- a/roles/sap_hostagent/tasks/deploy_sar.yml
+++ b/roles/sap_hostagent/tasks/deploy_sar.yml
@@ -1,19 +1,19 @@
 ---
 
 - name: Copy SAR based SAPHOSTAGENT to the target host
-  copy:
+  ansible.builtin.copy:
     src: "{{ sap_hostagent_sar_local_path }}/{{ sap_hostagent_sar_file_name }}"
     dest: "{{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_sar_file_name }}"
     mode: '0755'
 
 - name: Copy SAPCAR tool to the target host
-  copy:
+  ansible.builtin.copy:
     src: "{{ sap_hostagent_sapcar_local_path }}/{{ sap_hostagent_sapcar_file_name }}"
     dest: "{{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_sapcar_file_name }}"
     mode: '0755'
 
 - name: Extract the SAPHOSTAGENT archive using SAPCAR
-  command: >-
+  ansible.builtin.command: >-
     {{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_sapcar_file_name }} \
     -xvf {{ sap_hostagent_agent_tmp_directory }}/{{ sap_hostagent_sar_file_name }} -manifest SIGNATURE.SMF
   register: extractagent
@@ -22,8 +22,8 @@
   changed_when: "'SAPCAR: processing archive' in extractagent.stdout"
 
 - name: Install SAPHOSTAGENT
-  command: "{{ sap_hostagent_agent_tmp_directory }}/saphostexec -install"
+  ansible.builtin.command: "{{ sap_hostagent_agent_tmp_directory }}/saphostexec -install"
   register: installagent
   args:
     chdir: "{{ sap_hostagent_agent_tmp_directory }}"
-  changed_when: "'Install service' in installagent.stdout"
\ No newline at end of file
+  changed_when: "'Install service' in installagent.stdout"
diff --git a/roles/sap_hostagent/tasks/deploy_sar_remote.yml b/roles/sap_hostagent/tasks/deploy_sar_remote.yml
index b4936a193..f99763ed8 100644
--- a/roles/sap_hostagent/tasks/deploy_sar_remote.yml
+++ b/roles/sap_hostagent/tasks/deploy_sar_remote.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: Extract the SAPHOSTAGENT archive using SAPCAR
-  command: >-
+  ansible.builtin.command: >-
     {{ sap_hostagent_sapcar_remote_path }}/{{ sap_hostagent_sapcar_file_name }} \
     -xvf {{ sap_hostagent_sar_remote_path }}/{{ sap_hostagent_sar_file_name }} -manifest SIGNATURE.SMF
   register: extractagent
@@ -10,7 +10,7 @@
   changed_when: "'SAPCAR: processing archive' in extractagent.stdout"
 
 - name: Install SAPHOSTAGENT
-  command: "{{ sap_hostagent_agent_tmp_directory }}/saphostexec -install"
+  ansible.builtin.command: "{{ sap_hostagent_agent_tmp_directory }}/saphostexec -install"
   register: installagent
   args:
     chdir: "{{ sap_hostagent_agent_tmp_directory }}"
diff --git a/roles/sap_hostagent/tasks/main.yml b/roles/sap_hostagent/tasks/main.yml
index c6cc9ad1a..17d29203a 100644
--- a/roles/sap_hostagent/tasks/main.yml
+++ b/roles/sap_hostagent/tasks/main.yml
@@ -1,27 +1,27 @@
 ---
 
-# Execute common pre installation tasks
-- import_tasks: common_pre.yml
+- name: Execute common pre installation tasks
+  ansible.builtin.import_tasks: common_pre.yml
 
-# Deploy SAPHOSTAGENT using RPM file
-- import_tasks: deploy_rpm.yml
+- name: Deploy SAPHOSTAGENT using RPM file
+  ansible.builtin.import_tasks: deploy_rpm.yml
   when: sap_hostagent_installation_type == "rpm"
 
-# Deploy SAPHOSTAGENT using SAR file
-- import_tasks: deploy_sar.yml
+- name: Deploy SAPHOSTAGENT using SAR file
+  ansible.builtin.import_tasks: deploy_sar.yml
   when: sap_hostagent_installation_type == "sar"
 
- # Deploy SAPHOSTAGENT using SAR file existing on system
-- import_tasks: deploy_sar_remote.yml
+- name: Deploy SAPHOSTAGENT using SAR file existing on system
+  ansible.builtin.import_tasks: deploy_sar_remote.yml
   when: sap_hostagent_installation_type == "sar-remote"
 
-# Deploy SAPHOSTAGENT using SAP Installation Bundle
-- import_tasks: deploy_bundle.yml
+- name: Deploy SAPHOSTAGENT using SAP Installation Bundle
+  ansible.builtin.import_tasks: deploy_bundle.yml
   when: sap_hostagent_installation_type == "bundle"
 
-# Configuring SSL for SAP Host Agent
-- import_tasks: config_ssl.yml
+- name: Configure SSL for SAP Host Agent
+  ansible.builtin.import_tasks: config_ssl.yml
   when: sap_hostagent_config_ssl
 
-# Execute common post installation tasks
-- import_tasks: common_post.yml
+- name: Execute common post installation tasks
+  ansible.builtin.import_tasks: common_post.yml
diff --git a/roles/sap_maintain_etc_hosts/.ansible-lint b/roles/sap_maintain_etc_hosts/.ansible-lint
index 63122b8f9..1405704bf 100644
--- a/roles/sap_maintain_etc_hosts/.ansible-lint
+++ b/roles/sap_maintain_etc_hosts/.ansible-lint
@@ -1,7 +1,10 @@
 ---
+exclude_paths:
+  - tests/
 enable_list:
   - yaml
 skip_list:
+  - meta-runtime[unsupported-version] # We don't want to enforce new Ansible versions for Galaxy
   - ignore-errors # We use ignore_errors for all the assert tasks, which should be acceptable
   - schema # We want to allow single digit version numbers in a role's meta/main.yml file. This is allowed as per https://galaxy.ansible.com/docs/contributing/creating_role.html and https://galaxy.ansible.com/api/v1/platforms/?page=6.
   - name[template] # Allow templating inside name. During dev and qa, it should be possible to identify cases where it doesn't work