Ansible in CI/CD

Lint, check mode, and safe automation.

Running Ansible from CI turns infrastructure change into reviewed, repeatable automation, and the pipeline mirrors other IaC: lint and syntax-check on a pull request, run in check mode to preview changes, and apply on merge to the target environment. ansible-lint enforces best practices and catches the shell-instead-of-module and missing-name smells before they reach a host.

lint:
  script:
    - ansible-lint site.yml
    - ansible-playbook --syntax-check site.yml
check:
  script:
    - ansible-playbook -i inventory site.yml --check --diff   # dry run + show diffs
apply:
  script: [ansible-playbook -i inventory site.yml]
  rules: [{ if: '$CI_COMMIT_BRANCH == "main"' }]
  when: manual                                                 # approval for prod
  environment: production

Check mode and diff

--check runs the play without making changes and reports what would change; --diff shows the actual before/after of files it would modify. Together they are your safe preview — the closest Ansible has to a plan — and running them on every PR gives reviewers a concrete picture of the change. Not every module supports check mode perfectly, so treat it as a strong signal, not an absolute guarantee.