diff --git a/examples/playbooks/vars/not_decryptable.yml b/examples/playbooks/vars/not_decryptable.yml new file mode 100644 index 0000000000..9a19b07173 --- /dev/null +++ b/examples/playbooks/vars/not_decryptable.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.1;AES256 +35366433323361393130396530643233373262666636646439303032366431303363316232313738 +3738636130636431623936303932306430316635663136610a353737333966353462333532393631 +36613030643762636138613734313862333165346464626461313361353732336131633137653865 +3862386136386137650a303433643531613337393735633338383163353737656339653134346363 +63613436333937313738633437373566333065663662643664643261313366323236356364316663 +62336264666464323066336365616634626336616537646336656266343562336533343732613539 +61643661303566313664313164623731316236666235656337363632393665353536303730666532 +64666639306361653963363462393966623763626566613831613739333666333665343734333630 +63623730623033346163393834396639383234393637653733396466316132663131 diff --git a/src/ansiblelint/rules/__init__.py b/src/ansiblelint/rules/__init__.py index 3a9d60a7ee..22c3b22081 100644 --- a/src/ansiblelint/rules/__init__.py +++ b/src/ansiblelint/rules/__init__.py @@ -143,6 +143,8 @@ def matchyaml(self, file: Lintable) -> List[MatchError]: # file contains a single string. YAML spec allows this but we consider # this an fatal error. if isinstance(yaml, str): + if yaml.startswith('$ANSIBLE_VAULT'): + return [] return [MatchError(filename=str(file.path), rule=LoadingFailureRule())] if not yaml: return matches diff --git a/test/TestExamples.py b/test/TestExamples.py index 0961e29e1e..57891c7869 100644 --- a/test/TestExamples.py +++ b/test/TestExamples.py @@ -46,3 +46,11 @@ def test_example_custom_module(default_rules_collection): 'examples/playbooks/custom_module.yml', rules=default_rules_collection ).run() assert len(result) == 0 + + +def test_full_vault(default_rules_collection): + """custom_module.yml is expected to pass.""" + result = Runner( + 'examples/playbooks/vars/not_decryptable.yml', rules=default_rules_collection + ).run() + assert len(result) == 0