Introduction
The Ansible Code Bot is a GitHub App that automatically scans your repositories for Ansible playbooks, roles, and collections — then opens pull requests with suggested improvements based on current best practices. Think of it as an automated code reviewer that never sleeps, catching deprecated modules, outdated syntax, and missed optimization opportunities.
What Ansible Code Bot Does
The bot analyzes your Ansible code and generates PRs for:
| Category | Examples |
|---|---|
| Deprecated modules | Replace command with ansible.builtin.command (FQCN) |
| Outdated syntax | Update with_items to loop |
| Best practices | Add no_log: true to password tasks |
| Module updates | Use newer module parameters |
| Security | Flag hardcoded credentials |
| Performance | Suggest ansible.builtin.package over yum/apt for cross-platform |
Example PR from Code Bot
# Before (bot detects deprecated syntax)
- - name: Install packages
- yum:
- name: "{{ item }}"
- state: present
- with_items:
- - nginx
- - redis
# After (bot suggests modern approach)
+ - name: Install packages
+ ansible.builtin.dnf:
+ name:
+ - nginx
+ - redis
+ state: present
Prerequisites
- GitHub account (personal or organization)
- Repositories containing Ansible code
- Red Hat account (for subscription authentication)
Installation
Step 1: Install the GitHub App
- Go to the Ansible Code Bot GitHub App page
- Click Install
- Choose your organization or personal account
Step 2: Select Repositories
Choose which repositories the bot can access:
- All repositories — scan everything (recommended for organizations)
- Select repositories — pick specific repos
Step 3: Grant Permissions
The bot requires:
| Permission | Access | Purpose |
|---|---|---|
| Repository metadata | Read | Discover Ansible files |
| Repository contents | Read | Scan code |
| Pull requests | Read & Write | Create fix PRs |
| Issues | Read & Write | Report findings |
Step 4: Authenticate with Red Hat
Log in with your Red Hat account to activate the subscription. The bot validates your entitlement and links to your GitHub installation.
Step 5: Verify Installation
After installation, the bot:
- Performs an initial scan of selected repositories
- Opens PRs for any findings (within 24 hours)
- Appears in your repository's Settings → GitHub Apps
Configuration
Repository-Level Config
Add .ansible-code-bot.yml to your repository root:
# .ansible-code-bot.yml
scan:
# Directories to scan (default: entire repo)
paths:
- playbooks/
- roles/
- collections/
# Directories to exclude
exclude:
- tests/
- .github/
# Scan schedule
schedule: weekly # daily, weekly, monthly
# Severity threshold for PRs
min_severity: medium # low, medium, high
# PR behavior
pull_requests:
# Auto-assign reviewers
reviewers:
- team/ansible-devs
# Add labels
labels:
- ansible-code-bot
- automated
# Branch prefix for PRs
branch_prefix: ansible-bot/
Organization-Level Settings
Access the Ansible Code Bot dashboard to configure:
- Default scan schedule for all repos
- Notification preferences (email, Slack)
- Global exclusion patterns
- Severity thresholds
Using the Dashboard
The Ansible Code Bot dashboard shows:
- Scan History — when each repo was last scanned
- Open PRs — all pending fix suggestions
- Statistics — issues found, fixed, and trending
- Repository Health — code quality scores per repo
Manual Scan Trigger
Trigger an on-demand scan from:
- The dashboard Scan Now button
- GitHub issue comment:
/ansible-code-bot scan - Dashboard API endpoint
Handling Pull Requests
Review Workflow
- Bot opens PR with detailed description of changes
- Each change includes:
- What was changed and why
- Link to Ansible documentation
- Before/after comparison
- Review the changes
- Merge, request changes, or close
Duplicate Prevention
The bot tracks existing PRs and won't create duplicates. If you close a PR without merging, the bot won't re-open it for the same finding unless the configuration changes.
Integration with CI/CD
Combine Ansible Code Bot with your existing pipeline:
# .github/workflows/ansible-quality.yml
name: Ansible Quality
on: [push, pull_request]
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run ansible-lint
uses: ansible/ansible-lint-action@v6
# Ansible Code Bot handles proactive suggestions
# ansible-lint catches issues in real-time on PRs
Troubleshooting
Bot Not Scanning
- Verify the GitHub App is installed: Settings → Integrations → GitHub Apps
- Check repository permissions are correct
- Ensure Red Hat subscription is active
- Check
.ansible-code-bot.ymlfor syntax errors
Too Many PRs
Increase the severity threshold:
scan:
min_severity: high
PRs on Wrong Files
Add exclusion paths:
scan:
exclude:
- legacy/
- vendor/
- "*.bak"
Related Articles
- Ansible-Lint Guide
- VS Code for Ansible Development
- Ansible Best Practices Guide
- Ansible Galaxy: The Complete Guide
- Ansible Roles Explained
Conclusion
Ansible Code Bot automates code quality enforcement for Ansible projects. Install the GitHub App, configure scan settings per repository, and let it generate PRs with best-practice improvements. Pair it with ansible-lint in CI for comprehensive coverage — the bot catches strategic improvements proactively while ansible-lint enforces rules on every commit.