---
# ansible-lint configuration
# Copy to project root as .ansible-lint
# See: https://ansible-lint.readthedocs.io/

# ansible-lint rejects unknown top-level keys, and it has no setting for a
# minimum ansible-core version. Pin the supported range in the project's Python
# requirements instead, for example `ansible-core>=2.18,<2.22`.

# Enable all rules by default, opt-out problematic ones
skip_list:
  - yaml[line-length]  # Allow longer lines for readability
  - role-name[path]    # Allow flexible role naming

# Enable opt-in rules
enable_list:
  - args                 # Check task arguments
  - empty-string-compare # Avoid comparing to empty strings
  - no-log-password     # Ensure no_log for passwords
  - no-same-owner       # Avoid redundant owner/group
  - name[prefix]        # Require task name prefixes

# Use production profile (strictest)
profile: production

# Exclude paths
exclude_paths:
  - .github/
  - .ansible_cache/
  - molecule/
  - vault/
  - venv/
  - .venv/

# Task name prefix used by the opt-in name[prefix] rule.
# Must be a string; {stem} expands to the task file name without its extension.
task_name_prefix: "{stem} | "

# Offline mode (don't check Galaxy)
offline: false

# Write list of rules and exit
# listrules: false

# Write list of tags and exit
# listtags: false

# Mock modules or roles
mock_modules: []
mock_roles: []

# Warn instead of failing on these rules
warn_list:
  - experimental  # Warn on experimental features

# Per-rule configuration objects accept only `exclude_paths`; there is no
# `prefix` key. The name[prefix] rule is turned on in enable_list above and
# configured through task_name_prefix.