Running --write on a project having Ansible files results in stack trace

[ganeshrn]

Summary

When ansible-lint (version 6.17.2) is executed with --write option against the repository https://github.com/geerlingguy/ansible-for-devops, it fails with:

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint --version
6.17.2

• ansible installation method: one of source, pip, OS package
• ansible-lint installation method: one of source, pip, OS package

STEPS TO REPRODUCE

$ ansible-lint --write ansible-for-devops 
Traceback (most recent call last):
  File "/home/ttakamiy/.local/bin/ansible-lint", line 8, in <module>
    sys.exit(_run_cli_entrypoint())
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ansiblelint/__main__.py", line 317, in _run_cli_entrypoint
    sys.exit(main(sys.argv))
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ansiblelint/__main__.py", line 281, in main
    _do_transform(result, options)
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ansiblelint/__main__.py", line 192, in _do_transform
    transformer.run()
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ansiblelint/transformer.py", line 98, in run
    ruamel_data = yaml.loads(data)
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ansiblelint/yaml_utils.py", line 931, in loads
    data = self.load(stream=text)
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ruamel/yaml/main.py", line 426, in load
    return constructor.get_single_data()
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ruamel/yaml/constructor.py", line 111, in get_single_data
    node = self.composer.get_single_node()
  File "/home/ttakamiy/.local/lib/python3.9/site-packages/ruamel/yaml/composer.py", line 75, in get_single_node
    raise ComposerError(
ruamel.yaml.composer.ComposerError: expected a single document in the stream
  in "<unicode string>", line 5, column 1:
    kind: ClusterRole
    ^ (line: 5)
but found another document
  in "<unicode string>", line 29, column 1:
    ---
    ^ (line: 29)

Desired Behavior

Possible security bugs should be reported via email to [email protected]

Actual Behavior

The --write option should be able to handle them w/o throwing errors.

[ganeshrn]

Additional offline comments from @TamiTakamiya

Found this issue on the ansible repository --> Multiple yaml documents in a single playbook file #42898

According to that issue, Ansible does not support multiple yaml document in a single playbook file right now. It means that we should be able to just skip those yaml files if they contain more than one documents.

Found this StackOverflow page --> Reading YAML file with Python results in yaml.composer.ComposerError: expected a single document in the stream

if any stream (e.g. a file) contains more than one document then you should use the yaml.load_all function rather than yaml.load.

So one possible fix would be like:

1. Use yaml.load_all to load any YAML files instead of yaml.load
2. If the number of returned documents is one, use it for further processing.
3. If the number of returned documents is more than one, skip processing the file.

Another (simpler) fix is to capture the ComposeError and if the message is "expected a single document in the stream", gracefully ignore the file.