Lint pass: 2024-08-01

.ansible-lint

@@ -0,0 +1 @@
+offline: false

.github/workflows/lint.yaml

@@ -5,11 +5,21 @@ on:
       - main
       - release/v*
 
+  workflow_dispatch:
+
 jobs:
-  build:
+  lint:
     name: Ansible Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          cache: pip
+
+      - name: Install python dependencies
+        run: pip install -r requirements.txt
+
       - name: Run ansible-lint
-        uses: ansible/ansible-lint@main
+        run: ansible-lint

requirements.txt

@@ -0,0 +1,2 @@
+ansible
+ansible-lint

requirements.yml

@@ -0,0 +1,3 @@
+collections:
+  - community.general
+  - community.crypto

roles/uki_config/meta/argument_specs.yaml

@@ -28,7 +28,7 @@ argument_specs:
             type: path
             description: The path to the MOK x509 certificate.
             default: /etc/kernel/MOK.cer
-          
+
           owner:
             type: str
             default: root

roles/uki_config/tasks/main.yaml

@@ -317,6 +317,12 @@
           ansible.builtin.copy:
             content: "{{ ukify_config_backup.content | b64decode }}"
             dest: "{{ ukify_conf_path }}"
+            owner: root
+            group: root
+            mode: "0644"
+            seuser: system_u
+            serole: object_r
+            setype: etc_t
           changed_when: false
 
         - name: Delete new ukify configuration file
@@ -335,6 +341,12 @@
           ansible.builtin.copy:
             content: "{{ dracut_config_backup.content | b64decode }}"
             dest: "{{ dracut_conf_path }}"
+            owner: root
+            group: root
+            mode: "0644"
+            seuser: system_u
+            serole: object_r
+            setype: etc_t
           changed_when: false
 
         - name: Delete new dracut configuration file
@@ -351,6 +363,12 @@
           ansible.builtin.copy:
             content: "{{ kernel_install_config_backup.content | b64decode }}"
             dest: "{{ install_conf_path }}"
+            owner: root
+            group: root
+            mode: "0644"
+            seuser: system_u
+            serole: object_r
+            setype: etc_t
           changed_when: false
 
         - name: Remove new kernel-install configuration file