bug: task run --dry-run silently ignored — task executes fully

[Moep90]

Version: v0.6.0

Repro steps

semctl task run render_all_inventory -p tiki-share --dry-run --message 'semctl v0.6.0 review test'

Expected behavior

Ansible is invoked with --check (dry run); no real changes are made on target hosts.

Actual behavior

The task runs fully — actual SSH connections to fleet hosts were made and tasks executed (confirmed via Semaphore task logs). Searching the logs for --check or dry found no flag being passed to ansible-playbook. The --dry-run flag is accepted by the CLI without error but has no effect on the Semaphore task submission.

The --help text describes --dry-run as "Dry run mode" (distinct from --check which maps to Ansible check mode), but neither description is honoured: --dry-run is a silent no-op.

This is a footgun: users who believe they are doing a safe dry run are actually executing real changes on their fleet.

[Moep90]

The CLI sends --dry-run as the boolean dry_run field in the task-run body (the field documented in the Semaphore TaskRequest schema). Added a regression test in #93 (TestRunCommandDryRunSendsFlag).

Whether the server turns dry_run into an ansible --check run is a server-side contract question I can't verify from here. On newer Semaphore versions the params may need to be nested under a params object instead of sent at the top level — if a live --dry-run still executes for real, that nesting is the likely cause. Leaving open pending live verification; if confirmed, the fix is to also send dry_run under params.