Idempotence & Lint in the Pipeline

Great roles pass two more checks: they are idempotent and they lint clean. Molecule runs both for you.

Molecule runs your role a second time and watches the output. This dedicated step is called idempotence.

A second run should report no changes. If any task reports changed, the idempotence step fails the test.

Tasks built on the raw command module run every time, so they often break idempotence. Prefer a proper module instead.

The lint step runs static checks on your YAML and tasks before any host is even created.

Lint runs ansible-lint, which flags risky patterns like missing names, deprecated syntax, and unsafe shell use.

It also runs yamllint to catch formatting issues like bad indentation, trailing spaces, and overlong lines.

Because lint runs early in molecule test, a style error stops the run before wasting time creating a host.

In your pipeline, a single molecule test call runs lint, converge, verify, and idempotence as one quality gate.

Wire that command into CI so a failing test blocks the merge. Bad roles never reach your main branch.

A passing run proves the role is linted, applies correctly, verifies, and is idempotent. That is your signal it is production-ready.

Recall how Molecule proves a role is idempotent.

Molecule adds two gates: lint catches style and risky patterns early, and idempotence proves a second run changes nothing. Wire it into CI. 🚦