Merge c4ff0545f1 into 6da1331018

.ansible-lint

@@ -4,12 +4,7 @@
 # SPDX-FileCopyrightText: 2024, Ansible Project
 
 skip_list:
-  - meta-runtime[unsupported-version]  # This rule doesn't make any sense
+  - meta-runtime[unsupported-version]  # Tis rule doesn't make any sense
   - fqcn[deep]  # This rule produces false positives for files in tests/unit/plugins/action/fixtures/
-  - sanity[cannot-ignore]  # This rule is skipped to keep backward compatibility with Python 2
-
 exclude_paths:
   - changelogs/
-  - .github/
-  - tests/
-  - meta/

.azure-pipelines/azure-pipelines.yml

@@ -43,7 +43,7 @@ pool: Standard
 
 stages:
   - stage: Sanity_devel
-    displayName: Ansible devel Sanity & Units & Lint
+    displayName: Ansible devel sanity
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
@@ -57,25 +57,8 @@ stages:
               test: units
             - name: Lint
               test: lint
-
-  - stage: Sanity_2_20
-    displayName: Ansible 2.20 Sanity & Units & Lint
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: "{0}"
-          testFormat: 2.20/{0}
-          targets:
-            - name: Sanity
-              test: sanity
-            - name: Units
-              test: units
-            - name: Lint
-              test: lint
-
   - stage: Sanity_2_19
-    displayName: Ansible 2.19 Sanity & Units & Lint
+    displayName: Ansible 2.19 sanitay & Units & Lint
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
@@ -89,9 +72,8 @@ stages:
               test: units
             - name: Lint
               test: lint
-
   - stage: Sanity_2_18
-    displayName: Ansible 2.18 Sanity & Units & Lint
+    displayName: Ansible 2.18 sanity & Units & Lint
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
@@ -105,9 +87,8 @@ stages:
               test: units
             - name: Lint
               test: lint
-
   - stage: Sanity_2_17
-    displayName: Ansible 2.17 Sanity & Units & Lint
+    displayName: Ansible 2.17 sanity & Units & Lint
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
@@ -121,7 +102,19 @@ stages:
               test: units
             - name: Lint
               test: lint
-
+  - stage: Sanity_2_16
+    displayName: Ansible 2.16 sanity & Units & Lint
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          nameFormat: "{0}"
+          testFormat: 2.16/{0}
+          targets:
+            - name: Sanity
+              test: sanity
+            - name: Units
+              test: units
   ## Docker
   - stage: Docker_devel
     displayName: Docker devel
@@ -130,21 +123,6 @@ stages:
       - template: templates/matrix.yml
         parameters:
           testFormat: devel/linux/{0}/1
-          targets:
-            - name: Fedora 43
-              test: fedora43
-            - name: Ubuntu 22.04
-              test: ubuntu2204
-            - name: Ubuntu 24.04
-              test: ubuntu2404
-
-  - stage: Docker_2_20
-    displayName: Docker 2.20
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.20/linux/{0}/1
           targets:
             - name: Fedora 42
               test: fedora42
@@ -152,7 +130,6 @@ stages:
               test: ubuntu2204
             - name: Ubuntu 24.04
               test: ubuntu2404
-
   - stage: Docker_2_19
     displayName: Docker 2.19
     dependsOn: []
@@ -167,7 +144,6 @@ stages:
               test: ubuntu2204
             - name: Ubuntu 24.04
               test: ubuntu2404
-
   - stage: Docker_2_18
     displayName: Docker 2.18
     dependsOn: []
@@ -182,7 +158,6 @@ stages:
               test: ubuntu2204
             - name: Ubuntu 24.04
               test: ubuntu2404
-
   - stage: Docker_2_17
     displayName: Docker 2.17
     dependsOn: []
@@ -195,6 +170,20 @@ stages:
               test: fedora39
             - name: Ubuntu 22.04
               test: ubuntu2204
+  - stage: Docker_2_16
+    displayName: Docker 2.16
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.16/linux/{0}/1
+          targets:
+            - name: CentOS 7
+              test: centos7
+            - name: Fedora 38
+              test: fedora38
+            - name: Ubuntu 22.04
+              test: ubuntu2204
 
   ## Remote
   - stage: Remote_devel
@@ -205,32 +194,14 @@ stages:
         parameters:
           testFormat: devel/{0}/1
           targets:
-            - name: RHEL 10.1
-              test: rhel/10.1
-            - name: RHEL 9.7
-              test: rhel/9.7
-            - name: FreeBSD 14.3
-              test: freebsd/14.3
-            - name: FreeBSD 15.0
-              test: freebsd/15.0
-
-  - stage: Remote_2_20
-    displayName: Remote 2.20
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.20/{0}/1
-          targets:
-            - name: RHEL 10.1
-              test: rhel/10.1
-            - name: RHEL 9.7
-              test: rhel/9.7
+            - name: RHEL 10.0
+              test: rhel/10.0
+            - name: RHEL 9.6
+              test: rhel/9.6
             - name: FreeBSD 14.3
               test: freebsd/14.3
             - name: FreeBSD 13.5
               test: freebsd/13.5
-
   - stage: Remote_2_19
     displayName: Remote 2.19
     dependsOn: []
@@ -239,15 +210,14 @@ stages:
         parameters:
           testFormat: 2.19/{0}/1
           targets:
-            - name: RHEL 10.1
-              test: rhel/10.1
-            - name: RHEL 9.7
-              test: rhel/9.7
+            - name: RHEL 10.0
+              test: rhel/10.0
+            - name: RHEL 9.5
+              test: rhel/9.5
             - name: FreeBSD 14.2
               test: freebsd/14.2
             - name: FreeBSD 13.5
               test: freebsd/13.5
-
   - stage: Remote_2_18
     displayName: Remote 2.18
     dependsOn: []
@@ -256,13 +226,10 @@ stages:
         parameters:
           testFormat: 2.18/{0}/1
           targets:
-            - name: RHEL 10.1
-              test: rhel/10.1
-            - name: RHEL 9.7
-              test: rhel/9.7
+            - name: RHEL 9.4
+              test: rhel/9.4
             - name: FreeBSD 13.5
               test: freebsd/13.5
-
   - stage: Remote_2_17
     displayName: Remote 2.17
     dependsOn: []
@@ -271,17 +238,31 @@ stages:
         parameters:
           testFormat: 2.17/{0}/1
           targets:
-            # 2.17 remote target doesn't have RHEL 9 image
-            - name: RHEL 10.0
-              test: rhel/10.0
+            - name: RHEL 9.3
+              test: rhel/9.3
             - name: FreeBSD 13.5
               test: freebsd/13.5
+  - stage: Remote_2_16
+    displayName: Remote 2.16
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.16/{0}/1
+          targets:
+            - name: RHEL 8.8
+              test: rhel/8.8
+            - name: RHEL 9.2
+              test: rhel/9.2
 
   ## Finally
 
   - stage: Summary
     condition: succeededOrFailed()
     dependsOn:
+      - Sanity_2_16
+      - Remote_2_16
+      - Docker_2_16
       - Sanity_2_17
       - Remote_2_17
       - Docker_2_17
@@ -291,9 +272,6 @@ stages:
       - Sanity_2_19
       - Remote_2_19
       - Docker_2_19
-      - Sanity_2_20
-      - Remote_2_20
-      - Docker_2_20
       - Sanity_devel
       - Remote_devel
       - Docker_devel

.github/BOTMETA.yml

@@ -0,0 +1,52 @@
+---
+automerge: false
+files:
+  $module_utils/mount.py:
+    labels: mount
+  $modules/acl.py:
+    authors: astorije bcoca
+    labels: acl
+    ignore: astorije
+  $modules/at.py:
+    authors: risaacson
+    labels: at
+  $modules/authorized_key.py:
+    authors: ansible
+    labels: authorized_key
+  $modules/mount.py:
+    authors: ansible skvidal
+    maintainers: jtyr
+    labels: mount
+    ignore: skvidal
+  $modules/patch.py:
+    authors: jirutka luisperlaz
+  $modules/seboolean.py:
+    authors: sfromm
+    labels: seboolean
+  $modules/selinux.py:
+    authors: goozbach
+    maintainers: samdoran
+    labels: selinux
+  $modules/synchronize.py:
+    authors: tima
+    labels: synchronize
+  $modules/sysctl.py:
+    authors: davixx
+    maintainers: Akasurde
+    labels: sysctl
+  $plugins/:
+    labels: profile
+  $plugins/debug.py:
+    labels: debug
+  $plugins/patch.py:
+    labels: patch
+  $plugins/synchronize.py:
+    labels: synchronize
+  $plugins/timer.py:
+macros:
+  actions: plugins/action
+  callbacks: plugins/callback
+  module_utils: plugins/module_utils
+  modules: plugins/modules
+  plugins: plugins/plugins
+  shells: plugins/shell

.github/workflows/certification.yml

@@ -1,35 +0,0 @@
----
-# This workflow calls the latest version of the
-# reusable workflow.
-# You can copy this file into your respository if
-# you want to check against pinned versions of
-# Automation Hub tests.
-name: Run collection certification checks
-
-on:
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * *'
-
-concurrency:
-  group: cert-ver-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-
-# Files that are not related to the core functionality
-# of your collection can cause Ansible Lint to fail.
-# If this happens, add an .ansible-lint file that includes
-# those files and directories to the root of your
-# repository; for example:
-# https://github.com/ansible-collections/partner-certification-checker/blob/main/.ansible-lint
-# https://github.com/ansible-collections/partner-certification-checker/blob/main/.ansible-lint
-
-# If there are sanity test failures that cannot be fixed and are allowed to ignore
-# https://docs.ansible.com/projects/lint/rules/sanity/, create a sanity ignore file
-# https://docs.ansible.com/projects/ansible/devel/dev_guide/testing/sanity/ignores.html#ignore-file-location
-# for each affected version of ansible-core (for example, `tests/sanity/ignore-2.18.txt`) and add corresponding entries.
-jobs:
-  call:
-    uses: ansible-collections/partner-certification-checker/.github/workflows/certification-reusable.yml@v0.1

README.md

@@ -2,7 +2,7 @@
 <!-- Add CI and code coverage badges here. Samples included below. -->
 [![Build Status](
 https://dev.azure.com/ansible/ansible.posix/_apis/build/status/CI?branchName=main)](https://dev.azure.com/ansible/ansible.posix/_build?definitionId=26)
-[![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/ansible.posix)](https://codecov.io/gh/ansible-collections/ansible.posix)
+[![Run Status](https://api.shippable.com/projects/5e669aaf8b17a60007e4d18d/badge?branch=main)]() <!--[![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/ansible.posix)](https://codecov.io/gh/ansible-collections/ansible.posix)-->
 
 ## Communication
 

changelogs/fragments/639_fix_authorized_key.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - ansible.posix.authorized_key - fixes error on permission denied in authorized_key module (https://github.com/ansible-collections/ansible.posix/issues/462).

changelogs/fragments/682_update_ci_20250929.yml

@@ -1,4 +0,0 @@
-trivial:
-  - Updatng AZP CI matrix to ignore ansible-bad-import-from on six(https://github.com/ansible-collections/ansible.posix/pull/682).
-  - Skipped sanity[cannot-ignore] to keep backward compatibility with Python2.
-  - Consolidate all ansible-lint option locations into .ansible-lint file.

changelogs/fragments/693_azp_update_20251205.yml

@@ -1,5 +0,0 @@
----
-trivial:
-  - AZP - Update AZP matrix to follow ansible-test changes.
-  - Add ignore file for Ansible Core 2.21.
-  - Remove ignore lines for ansible-bad-import-from in 2.20 sanity tests.

plugins/modules/authorized_key.py

@@ -225,8 +225,6 @@ import os.path
 import tempfile
 import re
 import shlex
-import errno
-import traceback
 from operator import itemgetter
 
 from ansible.module_utils._text import to_native
@@ -477,18 +475,16 @@ def parsekey(module, raw_key, rank=None):
     return (key, key_type, options, comment, rank)
 
 
-def readfile(module, filename):
+def readfile(filename):
+
+    if not os.path.isfile(filename):
+        return ''
+
+    f = open(filename)
     try:
-        with open(filename, 'r') as f:
-            return f.read()
-    except IOError as e:
-        if e.errno == errno.EACCES:
-            module.fail_json(msg="Permission denied on file or path for authorized keys file: %s" % filename,
-                             exception=traceback.format_exc())
-        elif e.errno == errno.ENOENT:
-            return ''
-        else:
-            raise
+        return f.read()
+    finally:
+        f.close()
 
 
 def parsekeys(module, lines):
@@ -601,7 +597,7 @@ def enforce_state(module, params):
     # check current state -- just get the filename, don't create file
     do_write = False
     params["keyfile"] = keyfile(module, user, do_write, path, manage_dir)
-    existing_content = readfile(module, params["keyfile"])
+    existing_content = readfile(params["keyfile"])
     existing_keys = parsekeys(module, existing_content)
 
     # Add a place holder for keys that should exist in the state=present and

plugins/modules/firewalld.py

@@ -28,6 +28,11 @@ options:
       - Name of a port or port range to add/remove to/from firewalld.
       - Must be in the form PORT/PROTOCOL or PORT-PORT/PROTOCOL for port ranges.
     type: str
+  source_port:
+    description:
+      - Name of a source port or port range to add/remove to/from firewalld.
+      - Must be in the form PORT/PROTOCOL or PORT-PORT/PROTOCOL for port ranges.
+    type: str
   port_forward:
     description:
       - Port and protocol to forward using firewalld.
@@ -185,6 +190,13 @@ EXAMPLES = r'''
     permanent: true
     state: enabled
 
+- name: Permit traffic in home zone from port 20561/udp
+  ansible.posix.firewalld:
+    source_port: 20561/udp
+    zone: home
+    permanent: true
+    state: enabled
+
 - name: Permit traffic in dmz zone on http service
   ansible.posix.firewalld:
     zone: dmz
@@ -552,6 +564,43 @@ class PortTransaction(FirewallTransaction):
         self.update_fw_settings(fw_zone, fw_settings)
 
 
+class SourcePortTransaction(FirewallTransaction):
+    """
+    SourcePortTransaction
+    """
+
+    def __init__(self, module, action_args=None, zone=None, desired_state=None, permanent=False, immediate=False):
+        super(SourcePortTransaction, self).__init__(
+            module, action_args=action_args, desired_state=desired_state, zone=zone, permanent=permanent, immediate=immediate
+        )
+
+    def get_enabled_immediate(self, port, protocol, timeout):
+        if self.fw_offline:
+            dummy, fw_settings = self.get_fw_zone_settings()
+            return fw_settings.querySourcePort(port=port, protocol=protocol)
+        return self.fw.querySourcePort(zone=self.zone, port=port, protocol=protocol)
+
+    def get_enabled_permanent(self, port, protocol, timeout):
+        dummy, fw_settings = self.get_fw_zone_settings()
+        return fw_settings.querySourcePort(port=port, protocol=protocol)
+
+    def set_enabled_immediate(self, port, protocol, timeout):
+        self.fw.addSourcePort(zone=self.zone, port=port, protocol=protocol, timeout=timeout)
+
+    def set_enabled_permanent(self, port, protocol, timeout):
+        fw_zone, fw_settings = self.get_fw_zone_settings()
+        fw_settings.addSourcePort(port=port, protocol=protocol)
+        self.update_fw_settings(fw_zone, fw_settings)
+
+    def set_disabled_immediate(self, port, protocol, timeout):
+        self.fw.removeSourcePort(zone=self.zone, port=port, protocol=protocol)
+
+    def set_disabled_permanent(self, port, protocol, timeout):
+        fw_zone, fw_settings = self.get_fw_zone_settings()
+        fw_settings.removeSourcePort(port=port, protocol=protocol)
+        self.update_fw_settings(fw_zone, fw_settings)
+
+
 class InterfaceTransaction(FirewallTransaction):
     """
     InterfaceTransaction
@@ -879,6 +928,7 @@ def main():
             service=dict(type='str'),
             protocol=dict(type='str'),
             port=dict(type='str'),
+            source_port=dict(type='str'),
             port_forward=dict(type='list', elements='dict'),
             rich_rule=dict(type='str'),
             zone=dict(type='str'),
@@ -900,8 +950,8 @@ def main():
             source=('permanent',),
         ),
         mutually_exclusive=[
-            ['icmp_block', 'icmp_block_inversion', 'service', 'protocol', 'port', 'port_forward', 'rich_rule',
-             'interface', 'forward', 'masquerade', 'source', 'target']
+            ['icmp_block', 'icmp_block_inversion', 'service', 'protocol', 'port', 'source_port', 'port_forward',
+             'rich_rule', 'interface', 'forward', 'masquerade', 'source', 'target']
         ],
     )
 
@@ -957,6 +1007,17 @@ def main():
     else:
         port_protocol = None
 
+    source_port = None
+    if module.params['source_port'] is not None:
+        if '/' in module.params['source_port']:
+            source_port, source_port_protocol = module.params['source_port'].strip().split('/')
+        else:
+            source_port_protocol = None
+        if not source_port_protocol:
+            module.fail_json(msg='improper source_port format (missing protocol?)')
+    else:
+        source_port_protocol = None
+
     port_forward_toaddr = ''
     port_forward = None
     if module.params['port_forward'] is not None:
@@ -973,7 +1034,7 @@ def main():
             port_forward_toaddr = port_forward['toaddr']
 
     modification = False
-    if any([icmp_block, icmp_block_inversion, service, protocol, port, port_forward, rich_rule,
+    if any([icmp_block, icmp_block_inversion, service, protocol, port, source_port, port_forward, rich_rule,
             interface, forward, masquerade, source, target]):
         modification = True
     if modification and desired_state in ['absent', 'present'] and target is None:
@@ -1079,6 +1140,26 @@ def main():
                 )
             )
 
+    if source_port is not None:
+
+        transaction = SourcePortTransaction(
+            module,
+            action_args=(source_port, source_port_protocol, timeout),
+            zone=zone,
+            desired_state=desired_state,
+            permanent=permanent,
+            immediate=immediate,
+        )
+
+        changed, transaction_msgs = transaction.run()
+        msgs = msgs + transaction_msgs
+        if changed is True:
+            msgs.append(
+                "Changed source_port %s to %s" % (
+                    "%s/%s" % (source_port, source_port_protocol), desired_state
+                )
+            )
+
     if port_forward is not None:
         transaction = ForwardPortTransaction(
             module,

tests/integration/targets/authorized_key/tasks/check_permissions.yml

@@ -1,41 +0,0 @@
----
-# -------------------------------------------------------------
-# check permissions
-
-- name: Create a file that is not accessible
-  ansible.builtin.file:
-    state: touch
-    path: "{{ output_dir | expanduser }}/file_permissions"
-    owner: root
-    mode: '0000'
-
-- name: Create unprivileged user
-  ansible.builtin.user:
-    name: nopriv
-    create_home: true
-
-- name: Try to delete a key from an unreadable file
-  become: true
-  become_user: nopriv
-  ansible.posix.authorized_key:
-    user: root
-    key: "{{ dss_key_basic }}"
-    state: absent
-    path: "{{ output_dir | expanduser }}/file_permissions"
-  register: result
-  ignore_errors: true
-
-- name: Assert that the key deletion has failed
-  ansible.builtin.assert:
-    that:
-      - result is failed
-
-- name: Remove the file
-  ansible.builtin.file:
-    state: absent
-    path: "{{ output_dir | expanduser }}/file_permissions"
-
-- name: Remove the user
-  ansible.builtin.user:
-    name: nopriv
-    state: absent

tests/integration/targets/authorized_key/tasks/main.yml

@@ -34,6 +34,3 @@
 
 - name: Test for specifying key as a path
   ansible.builtin.import_tasks: check_path.yml
-
-- name: Test for permission denied files
-  ansible.builtin.import_tasks: check_permissions.yml

tests/integration/targets/firewalld/tasks/run_all_tests.yml

@@ -21,6 +21,10 @@
 - name: Include port test cases for firewalld module
   ansible.builtin.include_tasks: port_test_cases.yml
 
+# firewalld source_port operation test cases
+- name: Include source_port test cases for firewalld module
+  ansible.builtin.include_tasks: source_port_test_cases.yml
+
 # firewalld source operation test cases
 - name: Include source test cases for firewalld module
   ansible.builtin.include_tasks: source_test_cases.yml

tests/integration/targets/firewalld/tasks/source_port_test_cases.yml

@@ -0,0 +1,107 @@
+---
+# Test playbook for the firewalld module - source_port operations
+
+- name: Firewalld source_port range test permanent enabled
+  ansible.posix.firewalld:
+    source_port: 5500-6850/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port range test permanent enabled worked
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Firewalld source_port range test permanent enabled rerun (verify not changed)
+  ansible.posix.firewalld:
+    source_port: 5500-6850/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port range test permanent enabled rerun worked (verify not changed)
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Firewalld source_port test permanent enabled
+  ansible.posix.firewalld:
+    source_port: 6900/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port test permanent enabled worked
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Firewalld source_port test permanent enabled
+  ansible.posix.firewalld:
+    source_port: 6900/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port test permanent enabled worked
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Firewalld source_port test disabled
+  ansible.posix.firewalld:
+    source_port: "{{ item }}"
+    permanent: true
+    state: disabled
+  loop:
+    - 6900/tcp
+    - 5500-6850/tcp
+
+- name: Firewalld source_port test permanent enabled
+  ansible.posix.firewalld:
+    source_port: 8081/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port test permanent enabled worked
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Firewalld source_port test permanent enabled rerun (verify not changed)
+  ansible.posix.firewalld:
+    source_port: 8081/tcp
+    permanent: true
+    state: enabled
+  register: result
+
+- name: Assert firewalld source_port test permanent enabled rerun worked (verify not changed)
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Firewalld source_port test permanent disabled
+  ansible.posix.firewalld:
+    source_port: 8081/tcp
+    permanent: true
+    state: disabled
+  register: result
+
+- name: Assert firewalld source_port test permanent disabled worked
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Firewalld source_port test permanent disabled rerun (verify not changed)
+  ansible.posix.firewalld:
+    source_port: 8081/tcp
+    permanent: true
+    state: disabled
+  register: result
+
+- name: Assert firewalld source_port test permanent disabled rerun worked (verify not changed)
+  ansible.builtin.assert:
+    that:
+      - result is not changed

tests/integration/targets/firewalld/tasks/source_test_cases.yml

@@ -85,4 +85,4 @@
       - result is not changed
       - >
         result.msg == 'parameters are mutually exclusive:
-        icmp_block|icmp_block_inversion|service|protocol|port|port_forward|rich_rule|interface|forward|masquerade|source|target'
+        icmp_block|icmp_block_inversion|service|protocol|port|source_port|port_forward|rich_rule|interface|forward|masquerade|source|target'

tests/sanity/ignore-2.21.txt

@@ -1,10 +0,0 @@
-tests/utils/shippable/timing.py shebang
-plugins/action/synchronize.py pylint:ansible-bad-import-from
-plugins/callback/cgroup_perf_recap.py pylint:ansible-bad-import-from
-plugins/modules/mount.py pylint:ansible-bad-import-from
-plugins/modules/sysctl.py pylint:ansible-bad-import-from
-plugins/shell/csh.py pylint:ansible-bad-import-from
-plugins/shell/fish.py pylint:ansible-bad-import-from
-tests/unit/mock/procenv.py pylint:ansible-bad-import-from
-tests/unit/mock/yaml_helper.py pylint:ansible-bad-import-from
-tests/unit/modules/conftest.py pylint:ansible-bad-import-from

tests/utils/shippable/lint.sh

@@ -9,5 +9,6 @@ command -v ansible
 pip install --upgrade --user pip
 pip install --upgrade --user ansible-lint
 
-# To specify additional options, you can specify them into .ansible-lint file.
-PATH="${PATH/\~/${HOME}}" ansible-lint
+PATH="${PATH/\~/${HOME}}" ansible-lint \
+                                    --exclude changelogs/ \
+                                    --profile=production