review-rolelisted

# review-role Review an Ansible role and produce a structured severity report. This command never modifies files. --- ## Required Inputs 1. **role_name or FQCN** — The role to review (resolved from discovery if not provided) --- ## Behavior ### Step 1 — Discovery Run discovery per `references/discovery.md`. Locate the role: - By name in `roles_path` directories - By FQCN in `collections_path` directories ### Step 2 — Load Role Read all files in the role directory: tasks/, defaults/, vars/, handlers/, meta/, templates/. ### Step 3 — Generate Severity Report ``` ## Role Review: <role_name> Path: <role_path> Reviewed: <timestamp> Tasks found: <count> Handlers: <count> --- ### CRITICAL [Critical issues] ### WARNING [Warnings] ### INFO [Informational notes] --- Summary: <X> critical, <Y> warnings, <Z> info ``` --- ## Checks to Perform ### CRITICAL | Check | Condition | Message | |-------|-----------|---------| | Bare module names | Any task uses module without FQCN | `[tasks/main.yml:line <N>] Task "<name>" uses bare module name '<mod>' — must use FQCN` | | Missing no_log on secrets | Task has `password:`, `secret:`, `token:`, or references `vault_*` variables without `no_log: true` | `[tasks/main.yml:line <N>] Task "<name>" handles secrets without no_log: true` | | Deprecated include syntax | Use of bare `include:` | `[tasks/main.yml:line <N>] Deprecated 'include:' — use ansible.builtin.include_tasks or ansible.builtin.import_tasks` | | Missing tasks/main.yml