ansible-compat 25.1.1 causes lint to fail if venv not writable

[k-c-p]

Summary

When ansible-lint and ansible-compat 25.1.1 are present in a virtual env and this venv is not writable by the user running ansible-lint, the linter fails with a "[Errno 13] Permission denied" error it runs galaxy.

Issue Type

• Bug Report

STEPS TO REPRODUCE

# Setup venv containing current lint and compat
python3 -m venv venv25
venv25/bin/pip install ansible-lint
# Remove write permission all throughout the venv
chmod -R -w venv25

# Verify versions
$ /tmp/venv25/bin/ansible-lint --version
WARNING: PATH altered to include /tmp/venv25/bin, /tmp/venv25/bin :: This is usually a sign of broken local setup, which can cause unexpected behaviors.
ansible-lint 25.1.1 using ansible-core:2.18.2 ansible-compat:25.1.1 ruamel-yaml:0.18.10 ruamel-yaml-clib:None

# Try to lint a play that has a requirements.yml
$ /tmp/venv25/bin/ansible-lint -v
WARNING: PATH altered to include /tmp/venv25/bin, /tmp/venv25/bin :: This is usually a sign of broken local setup, which can cause unexpected behaviors.
INFO     Identified /home/charly/eclipseprojects/hilt_playground as project root due .git directory.
INFO     Collection paths was patch to include extra directories /tmp/venv25/lib/python3.13/site-packages,/tmp/venv25/local/lib/python3.13/dist-packages,/tmp/venv25/lib/python3/dist-packages,/tmp/venv25/lib/python3.13/dist-packages,/home/charly/eclipseprojects/hilt_playground/collections
INFO     Set ANSIBLE_LIBRARY=/home/charly/eclipseprojects/hilt_playground/.ansible/modules:/home/charly/.ansible/plugins/modules:/usr/share/ansible/plugins/modules
INFO     Set ANSIBLE_COLLECTIONS_PATH=/home/charly/eclipseprojects/hilt_playground/.ansible/collections:/tmp/venv25/lib/python3.13/site-packages:/tmp/venv25/local/lib/python3.13/dist-packages:/tmp/venv25/lib/python3/dist-packages:/tmp/venv25/lib/python3.13/dist-packages:/home/charly/eclipseprojects/hilt_playground/collections
INFO     Set ANSIBLE_ROLES_PATH=/home/charly/eclipseprojects/hilt_playground/.ansible/roles:roles:/home/charly/eclipseprojects/hilt_playground/external_roles
INFO     Running ansible-galaxy role install -r /home/charly/eclipseprojects/hilt_playground/requirements.yml -v --roles-path /home/charly/eclipseprojects/hilt_playground/.ansible/roles
INFO     Running ansible-galaxy collection install -v -r /home/charly/eclipseprojects/hilt_playground/requirements.yml
ERROR    Using /home/charly/eclipseprojects/hilt_playground/ansible.cfg as config file
ERROR! Unexpected Exception, this is probably a bug: [Errno 13] Permission denied: b'/tmp/venv25/lib/python3.13/site-packages/ansible_collections'

Got 250 exit code while running: ansible-galaxy collection install -v -r /home/charly/eclipseprojects/hilt_playground/requirements.yml

Desired Behavior

Lint should pass, at is does when Lint 24.12.2 / Compat 24.x are used in the same setup:

# Setup venv containing current lint 24.12.2 and compat 24.x
python3 -m venv venv24
venv24/bin/pip install ansible-lint==24.12.2 "ansible-compat<25"
# Remove write permission all throughout the venv
chmod -R -w venv24

# Verify versions
$ /tmp/venv24/bin/ansible-lint --v
WARNING: PATH altered to include /tmp/venv24/bin, /tmp/venv24/bin :: This is usually a sign of broken local setup, which can cause unexpected behaviors.
ansible-lint 24.12.2 using ansible-core:2.18.2 ansible-compat:24.10.0 ruamel-yaml:0.18.10 ruamel-yaml-clib:None
A new release of ansible-lint is available: 24.12.2 → 25.1.1[/] Upgrade by running: pip install --upgrade ansible-lint

# Lint a play
$ /tmp/venv24/bin/ansible-lint -v
WARNING: PATH altered to include /tmp/venv24/bin, /tmp/venv24/bin :: This is usually a sign of broken local setup, which can cause unexpected behaviors.
INFO     Identified /home/charly/eclipseprojects/hilt_playground as project root due .git directory.
INFO     Set ANSIBLE_LIBRARY=/home/charly/.cache/ansible-compat/0a80eb/modules:/home/charly/.ansible/plugins/modules:/usr/share/ansible/plugins/modules
INFO     Set ANSIBLE_ROLES_PATH=/home/charly/.cache/ansible-compat/0a80eb/roles:roles:/home/charly/eclipseprojects/hilt_playground/external_roles
INFO     Running ansible-galaxy role install -r /home/charly/eclipseprojects/hilt_playground/requirements.yml -v --roles-path /home/charly/.cache/ansible-compat/0a80eb/roles
INFO     Running ansible-galaxy collection install -v -r /home/charly/eclipseprojects/hilt_playground/requirements.yml
...
# Rule Violation Summary

  1 syntax-check profile:min tags:core,unskippable
  4 syntax-check profile:min tags:core,unskippable
...
Failed: 2542 failure(s), 0 warning(s) on 879 files.
A new release of ansible-lint is available: 24.12.2 → 25.1.1[/] Upgrade by running: pip install --upgrade ansible-lint

Actual Behavior

ERROR! Unexpected Exception, this is probably a bug: [Errno 13] Permission denied: b'/tmp/venv25/lib/python3.13/site-packages/ansible_collections'

Got 250 exit code while running: ansible-galaxy collection install -v -r /home/charly/eclipseprojects/hilt_playground/requirements.yml

[mtward]

+1 we are having the same issue and had to roll back to 24.12.x

[bluikko]

Finally found this one. Seems to be the source for my ansible/ansible-lint#4501

[k-c-p]

When I invoke ansible-galaxy standalone it uses collections_path and roles_path from the plays ansible.cfg to determine where to install roles/collections. Any particular reason, why these parameters are not used in the context of ansible-lint?