yamllint: cover all changed files ending in yaml, yml or fmf by vojtapolasek · Pull Request #14601 · ComplianceAsCode/content

vojtapolasek · 2026-03-26T14:28:32Z

Description:

update the ci-lint workflow to utilize .yamllint config file present in the root of the project
update the .yamllint config file to implement some of project's style requirements
apply yamllint to all files which are being changed by a PR, let yamllint ignore files which are not matching yml, yaml or fmf extensions

Rationale:

The previous grep "controls/" pattern matched any file path containing controls/, which could include non-YAML files that yamllint cannot process. Restricting to controls/.*\.yml ensures only relevant YAML files are linted, avoiding spurious CI failures.

Review Hints:

Single-commit, single-line change in .github/workflows/ci_lint.yml (line 52).
No product builds are affected — this is a CI infrastructure change only.

jan-cerny · 2026-03-26T15:11:26Z

.github/workflows/ci_lint.yml

        if: ${{ env.CONTROLS_CHANGES == 'true' }}
        run: |
-          for control_file in $(cat filenames.txt | grep "controls/"); do
+          for control_file in $(cat filenames.txt | grep "controls/.*\.yml"); do


There is a similar regex on line 32. Should that regex be changed as well?

comps · 2026-03-27T09:14:55Z

Are you sure you don't want to configure yamllint properly instead, as I suggested in #14529 (comment) ?

Filter out files inside the .yamllint configuration

also enforce line length of 99

jan-cerny

@vojtapolasek Do I understand it well that now the .profile files won't be checked?

vojtapolasek · 2026-03-31T09:30:28Z

@jan-cerny oops, correct, I have to fix this.

jan-cerny · 2026-03-31T11:05:08Z

/retest

jan-cerny · 2026-04-01T06:59:26Z

.github/workflows/ci_lint.yml

-            yamllint "$profile_file"
+          for file in $(cat filenames.txt); do
+            echo "Running yamllint on $file..."
+            yamllint -c .yamllint "$file"


I think this will run yamllint on all files modified by the PR, think OVALs, Python files, ... It can slow the job down.

I think it will not slow things down, the .yamllint config file explicitly specifies globs which will be actually scanned.

jan-cerny · 2026-04-01T07:03:07Z

.github/workflows/ci_lint.yml

-          if grep -q "\.profile" filenames.txt; then
-            echo "PROFILES_CHANGES=true" >> $GITHUB_ENV
-          else
-            echo "PROFILES_CHANGES=false" >> $GITHUB_ENV


You have removed this insertion of PROFILES_CHANGES and CONTROL_CHANGES environment variables to GITHUB_ENV. But, the "Install yamllint" phase still uses these environment variables. I suspect it doesn't work.

I removed the leftover conditional.

jan-cerny · 2026-04-01T07:03:43Z

.github/workflows/ci_lint.yml

-            echo "Running yamllint on $profile_file..."
-            yamllint "$profile_file"
+          for file in $(cat filenames.txt); do
+            echo "Running yamllint on $file..."


Will this work on YAML files that contain Jinja macros?

In the last commit I added a script which strips Jinja and still allows us to lint files.

jan-cerny · 2026-04-01T07:04:17Z

.yamllint

    spaces: consistent
-  line-length: disable
+  line-length:
+    max: 99 # allow lines up to 99 chars


Do all our YAML files meet the line lenghth limit of 99 lines?

They probably don't, but this should run only on newly modified files. At the same time, we impose this limit on our selves... so with this approach, it will be enforced gradually. Do you think it is a problem?

Many YAML files in this project contain Jinja2 templating ({{% %}}, {{{ }}}, {{# #}}) which causes yamllint to report false syntax errors. Add a helper script (utils/strip_jinja_for_yamllint.py) that removes Jinja constructs while preserving line numbers, and update the CI workflow to use it for files that contain Jinja. Files without Jinja are linted directly as before. Warnings are reported but do not fail the job. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jan-cerny · 2026-04-07T07:47:37Z

.yamllint

 ---
 extends: default
+locale: en_US.UTF-8
+yaml-files:


It looks like the yaml-files option is somehow ignored by yamllint.

In the CI run, we can see that the job failed on utils/strip_jinja_for_yamllint.py. Unfortunately, the CI output doesn't show any details.

When I try to reproduce it locally, I run yamllint -s -c .yamllint utils/strip_jinja_for_yamllint.py and from the output it looks like it tried to evaluate the Python file as YAML file.

jcerny@fedora:~/work/git/scap-security-guide (pr/14601)$ yamllint -s -c .yamllint utils/strip_jinja_for_yamllint.py utils/strip_jinja_for_yamllint.py 2:3 error syntax error: expected '<document start>', but found '<scalar>' (syntax)

Please check if the filtering by glob really works. Also, please investigate whether we can have a detailed output in the GitHub CI output.

Ahaaa, I see what is the problem. The yaml-files block (according to man page) applies in case yamllint processes a directory. It does not apply when it is passed a particular file.
If we would like to stick with usage of this configuration option to limit set of analyzed files, we would need to somehow create directory structure containing only files changed in the analyzed PR... that seems actually quite strange to me. I think I will go back to some kind of parsing list of changed files and passing only those relevant files to yamllint. Do you agree?

Aha, thanks for discovering this. I agree with your proposal.

This needs to be done in addition to filter within the .yamllint file because CI runs yamllint on individual files and not directories. The configuration within the .yamllint works when yamllint is given a directory.

openshift-ci · 2026-04-08T19:01:02Z

@vojtapolasek: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`daa564b`	link	true	`/test e2e-aws-openshift-node-compliance`
ci/prow/e2e-aws-openshift-platform-compliance	`daa564b`	link	true	`/test e2e-aws-openshift-platform-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jan-cerny

I have reviewed the code and the previous version of the PR confirmed that the job is able to identify and report issues in YAML formatting.

vojtapolasek mentioned this pull request Mar 26, 2026

Add Claude Code skills for content development workflows #14529

Merged

jan-cerny self-assigned this Mar 26, 2026

jan-cerny added this to the 0.1.81 milestone Mar 26, 2026

jan-cerny reviewed Mar 26, 2026

View reviewed changes

vojtapolasek force-pushed the make_yamllint_filepaths_stricter branch from 8ca69d6 to d48dd28 Compare March 27, 2026 11:48

vojtapolasek added 2 commits March 27, 2026 12:54

CI yamllint: lint all changed files

37ef4fb

Filter out files inside the .yamllint configuration

yamllint config: lint only certain file extensions

975e2d6

also enforce line length of 99

vojtapolasek force-pushed the make_yamllint_filepaths_stricter branch from d48dd28 to 975e2d6 Compare March 27, 2026 11:55

vojtapolasek added 3 commits March 27, 2026 14:04

yamllint config: add comments and disable truthy rule

a4e4e59

fix lint error in the workflow file

f4ee494

fix lint errors in the yamllint configuration it self

02bffa8

vojtapolasek force-pushed the make_yamllint_filepaths_stricter branch from b803433 to 02bffa8 Compare March 27, 2026 13:55

vojtapolasek changed the title ~~yamllint: make control file path matching stricter in CI lint workflow~~ yamllint: cover all changed files ending in yaml, yml or fmf Mar 27, 2026

jan-cerny reviewed Mar 30, 2026

View reviewed changes

cover also .profile files

57094c2

jan-cerny reviewed Apr 1, 2026

View reviewed changes

vojtapolasek and others added 2 commits April 2, 2026 10:28

remove forgotten conditional from workflow

5fa35ca

jan-cerny requested changes Apr 7, 2026

View reviewed changes

Before using yamllint on newly changed files, filter by extension

5fcf646

This needs to be done in addition to filter within the .yamllint file because CI runs yamllint on individual files and not directories. The configuration within the .yamllint works when yamllint is given a directory.

vojtapolasek force-pushed the make_yamllint_filepaths_stricter branch from daa564b to 5fcf646 Compare April 9, 2026 08:08

jan-cerny approved these changes Apr 9, 2026

View reviewed changes

jan-cerny merged commit 6c90337 into ComplianceAsCode:master Apr 9, 2026
94 of 98 checks passed

Conversation

vojtapolasek commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

comps commented Mar 27, 2026

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

vojtapolasek commented Mar 31, 2026

Uh oh!

jan-cerny commented Mar 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Apr 8, 2026

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vojtapolasek commented Mar 26, 2026 •

edited

Loading