timothyswan/ansible-lint repository overview

ansible-lint⁠ checks Ansible playbooks, roles, and collections for best practices and common mistakes. It applies a profile-based rule set covering YAML style, task structure, module usage, naming conventions, and security hygiene.

This image installs ansible-lint and its dependencies offline from a hash-pinned wheelhouse built against Python 3.13, using Red Hat Hardened Image Python builder and runtime layers. The built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

⁠Usage

# Lint a playbook
podman run --rm -v "$(pwd):/work:ro,Z" -w /work ansible-lint:<version>-rhhi site.yml

# Lint with offline mode (no galaxy/collection lookups)
podman run --rm -v "$(pwd):/work:ro,Z" -w /work \
  -e ANSIBLE_COLLECTIONS_PATH=/dev/null \
  ansible-lint:<version>-rhhi site.yml

⁠Supply chain

• Base images: registry.access.redhat.com/hi/python:3.13-builder (build) and hi/python:3.13 (runtime) — Red Hat Hardened
• Dependencies: 30 packages, hash-pinned via pip-compile on Python 3.13
• Tier: 3 (Python from PyPI)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation