Summary

var-naming[no-role-prefix] rule does not apply to variables defined in roles due to an empty prefix incorrectly set.

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint 25.6.1 using ansible-core:2.18.6 ansible-compat:25.6.0 ruamel-yaml:0.18.14 ruamel-yaml-clib:0.2.12

STEPS TO REPRODUCE

Create example role structure:

❯ tree roles
roles
└── test
    └── tasks
        └── main.yaml

3 directories, 1 file

Save example task in the role:

❯ cat roles/test/tasks/main.yaml
---
- name: Set fact
  ansible.builtin.set_fact:
    fake_var: "test val"

No warnings generated as expected due to wrong prefix of variable name fake_var, but test_ should be expected by ansible-lint:

❯ uv tool run ansible-lint roles/test

Passed: 0 failure(s), 0 warning(s) on 2 files. Last profile that met the validation criteria was 'production'.

Why so?

I think the problem is in the incorrect else statement in https://github.com/ansible/ansible-lint/blob/main/src/ansiblelint/rules/var_naming.py#L262. In case task isn't typeof "include_role" or "import_role" the prefix variable set to an empty string. If i understand logic correctly, the code

        else:
            prefix = Prefix()

should be indented one step right, to work as "else" to if isinstance(action, dict): statement.

This was done while fixing #3544. But looks like this changes created much higher blast radius then it was expected.

For example, @zeten30 noted "Bare variable exported using set_fact should be reported. It's accessible later / is valid since declaration to the end of the play." and i agree with this, but this case isn't reported now.