jmespath dependency

[AirOnSkin]

Hello ansible-lint community

I'm struggling with switching from the old linter (ansible-community/ansible-lint-action) to this one because of a missing dependency: jmespath

Linting produces the following error multiple times:

jinja[invalid]: You need to install "jmespath" prior to running json_query filter
roles/some_project/tasks/some_file.yml:16 Task/Handler: Filter some json payload

Error: You need to install "jmespath" prior to running json_query filter

I see jmespath is present in https://github.com/ansible/ansible-lint/blob/main/.config/constraints.txt#L45, but not in https://github.com/ansible/ansible-lint/blob/main/.config/requirements-lock.txt

What's the best practice to add this additional dependency to our linting workflow?

Cheers,
Stefan

[konstruktoid]

Have you tried something similiar to this?

      - name: Install system dependencies
        run: |
          sudo apt-get --assume-yes install python3-pip --no-install-recommends
          python3 -m pip install --user -U jmespath

[konstruktoid]

This is how I use it https://github.com/konstruktoid/ansible-role-hardening/blob/master/.github/workflows/molecule.yml

If jmespath isn't installed:

$ ansible-lint
WARNING  Listing 3 violation(s) that are fatal
jinja[invalid]: You need to install "jmespath" prior to running json_query filter
tests/debug_facts.yml:58 Task/Handler: Get DSA keys

jinja[invalid]: You need to install "jmespath" prior to running json_query filter
tests/debug_facts.yml:65 Task/Handler: Get short RSA keys

jinja[invalid]: You need to install "jmespath" prior to running json_query filter
tests/debug_facts.yml:72 Task/Handler: Get owner of old keys

Read documentation for instructions on how to ignore specific rule violations.

              Rule Violation Summary
 count tag            profile rule associated tags
     3 jinja[invalid] basic   formatting

Failed: 3 failure(s), 0 warning(s) on 147 files. Profile 'production' was required, but 'min' profile passed

[AirOnSkin]

I see. You're not using the ansible-lint GH action but instead just the binary from pip 🤔

[konstruktoid]

I actually do, I run multiple versions: https://github.com/konstruktoid/ansible-role-hardening/tree/master/.github/workflows

From https://github.com/konstruktoid/ansible-role-hardening/actions/runs/10782079743/job/29901378202#step:6:17
"WARNING The following filters were mocked during the run: json_query"

[AirOnSkin]

Sorry for the late reply, I was on holidays.

In the end I got it to work with setting up all the packages myself and ignoring the provided ansible-lint GH action:

---
name: Ansible Lint
on:
  # not using 'push' because of the if-condition below
  pull_request:
    types: [opened, edited, synchronize, reopened, ready_for_review]

jobs:
  ansible-lint:
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft }}

    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends python3-pip
          pip install ansible ansible-lint boto3 jmespath

      - name: Run ansible-lint
        run: |
          cd "${{ github.workspace }}/aws" || exit 1
          ansible-lint -c ../.config/ansible-lint.yml || exit 1