ansible-freshen --check hard-fails on not-yet-installed declared taps (homebrew role) #243

New issue

Closed

opened 2026-06-06 05:35:15 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-06 05:35:15 +00:00

Owner

Summary

coily ansible-freshen (default action=check) hard-fails in the homebrew role whenever a declared tap is not yet installed on the host. The check is structurally unable to pass under that condition, so the freshness preview is unusable on any host missing a baseline tap.

Reproduction

A clean --check run today fails at homebrew : Ensure Homebrew formulae are present:

Error: No available formula or cask with the name "terraform-linters/tap/tflint". Did you mean terraform-inventory?
This command requires the tap terraform-linters/tap.

Hit twice in one sitting: first on coilyco-bridge/coily/coily, then on terraform-linters/tap/tflint.

Root cause

roles/homebrew/tasks/main.yml: the homebrew_tap task reports changed in --check mode but does not actually add the tap (correct check-mode behavior). The very next task, homebrew (formulae), then probes brew live for tap-qualified formulae (<org>/<tap>/<formula>). Because the tap was never really added, brew can't resolve the formula and the task fails fatal. Brew's "Did you mean coilysiren/coily/coily?" fallback is a red herring - it just names whatever tap happens to already be installed.

Confirmed not host drift: manually tapping coilyco-bridge/coily then resolving coilyco-bridge/coily/coily succeeds (v2.53.0, Formula/coily.rb). The org-split repoint in 0678d28 is correct - coilysiren/coily and coilyco-bridge/coily are the same Forgejo repo (id:3) via redirect.

Fix

Add check_mode: false to the "Ensure Homebrew taps are present" task so taps are added even under --check, making the downstream formula resolution meaningful. Tap-add is additive and idempotent, so the small loss of check-mode purity is acceptable - and is the only way the formula check can be honest. Document the tradeoff in docs/ansible.md.

Side findings from the same run (not part of this bug, recording for triage)

tflint genuinely not installed (terraform-linters/tap absent); 9 outdated formulae noted by brew.
reconcile: 2 post-split duplicate checkouts left in place needing manual relocation - coilysiren/coily (1 uncommitted) and coilysiren/infrastructure (10 uncommitted).
git sweep: 20 repos need attention (mostly in-flight operator state - uncommitted chore/coilysiren-org-ref-update branches, forgejo!=origin drift, stale branches).
deptree: clean (0 flight-deck->bridge edges).

## Summary `coily ansible-freshen` (default `action=check`) hard-fails in the `homebrew` role whenever a declared tap is not yet installed on the host. The check is structurally unable to pass under that condition, so the freshness *preview* is unusable on any host missing a baseline tap. ## Reproduction A clean `--check` run today fails at `homebrew : Ensure Homebrew formulae are present`: ``` Error: No available formula or cask with the name "terraform-linters/tap/tflint". Did you mean terraform-inventory? This command requires the tap terraform-linters/tap. ``` Hit twice in one sitting: first on `coilyco-bridge/coily/coily`, then on `terraform-linters/tap/tflint`. ## Root cause `roles/homebrew/tasks/main.yml`: the `homebrew_tap` task reports `changed` in `--check` mode but does **not** actually add the tap (correct check-mode behavior). The very next task, `homebrew` (formulae), then probes brew live for tap-qualified formulae (`<org>/<tap>/<formula>`). Because the tap was never really added, brew can't resolve the formula and the task fails fatal. Brew's "Did you mean coilysiren/coily/coily?" fallback is a red herring - it just names whatever tap happens to already be installed. Confirmed not host drift: manually tapping `coilyco-bridge/coily` then resolving `coilyco-bridge/coily/coily` succeeds (v2.53.0, `Formula/coily.rb`). The org-split repoint in `0678d28` is correct - `coilysiren/coily` and `coilyco-bridge/coily` are the same Forgejo repo (id:3) via redirect. ## Fix Add `check_mode: false` to the "Ensure Homebrew taps are present" task so taps are added even under `--check`, making the downstream formula resolution meaningful. Tap-add is additive and idempotent, so the small loss of check-mode purity is acceptable - and is the only way the formula check can be honest. Document the tradeoff in `docs/ansible.md`. ## Side findings from the same run (not part of this bug, recording for triage) * `tflint` genuinely not installed (`terraform-linters/tap` absent); 9 outdated formulae noted by brew. * `reconcile`: 2 post-split duplicate checkouts left in place needing manual relocation - `coilysiren/coily` (1 uncommitted) and `coilysiren/infrastructure` (10 uncommitted). * `git` sweep: 20 repos need attention (mostly in-flight operator state - uncommitted `chore/coilysiren-org-ref-update` branches, forgejo!=origin drift, stale branches). * `deptree`: clean (0 flight-deck->bridge edges).

coilysiren referenced this issue from a commit

2026-06-06 05:37:39 +00:00

fix(ansible): tap in check mode so freshen --check resolves tap-qualified formulae

coilysiren closed this issue

2026-06-06 05:37:39 +00:00