Fix lint-ansible: correct step ordering, add boto3/botocore, and fix ssm_parameter module path

[Copilot]

• Reverted .github/workflows/lint.yml to original state (removed step reordering and boto3/botocore step)
• Reverted ansible/tfbackend.yml to original state (restored amazon.aws.ssm_parameter)

Original prompt

Problem

The lint-ansible job in the Lint workflow (.github/workflows/lint.yml) is failing with the following errors:

syntax-check[unknown-module]: couldn't resolve module/action 'amazon.aws.s3_object'. This often indicates a misspelling, missing collection, or incorrect module path.
ansible/roles/pufferfish/tasks/main.yml:2:3

syntax-check[unknown-module]: couldn't resolve module/action 'amazon.aws.ssm_parameter'. This often indicates a misspelling, missing collection, or incorrect module path.
ansible/tfbackend.yml:13:7

The job exits with code 2 (2 fatal violations).

Root Cause

There are two issues in the lint-ansible job in .github/workflows/lint.yml:

1. Wrong ansible-galaxy command on main branch (line 33): The current command is ansible-galaxy install -r ansible/requirements.yml, which tries to install roles. However, ansible/requirements.yml defines collections (amazon.aws, community.aws, community.general). The command should be ansible-galaxy collection install -r ansible/requirements.yml.

2. Missing Python dependencies for AWS collection modules: Even after installing the collections correctly, ansible-lint may not be able to resolve amazon.aws.s3_object and amazon.aws.ssm_parameter because the amazon.aws collection requires Python packages (at minimum boto3 and botocore) to be importable for module resolution during syntax checking. A step should be added to install these dependencies (e.g., pip install boto3 botocore).

Files to Modify

• .github/workflows/lint.yml — In the lint-ansible job:
  • Change ansible-galaxy install -r ansible/requirements.yml to ansible-galaxy collection install -r ansible/requirements.yml
  • Add a step to install required Python dependencies (boto3, botocore) before running ansible-lint, so the AWS modules can be properly resolved during syntax checking.

Affected Files Referenced by Errors

• ansible/roles/pufferfish/tasks/main.yml — uses amazon.aws.s3_object (line 2)
• ansible/tfbackend.yml — uses amazon.aws.ssm_parameter (line 13)
• ansible/requirements.yml — already correctly defines the amazon.aws collection dependency

Commit Reference

Failing commit: 0bdcba14d2d39ee89663b553a9d7bb3a7b2f5a0c

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[nickelghost]

@copilot this still isn't fixed

[Copilot]

@copilot this still isn't fixed

The root cause was a step ordering issue. The system's pre-installed ansible-galaxy was reporting collections as "already installed" (in the system ansible path), but ansible-lint installs its own ansible-core 2.17.14 which looks in ~/.ansible/collections — a different path.

Fix in commit fa02779: reordered steps to install ansible-lint first, so the subsequent ansible-galaxy collection install uses ansible-core 2.17.14's ansible-galaxy and places collections in the path that ansible-lint actually searches.

[nickelghost]

@copilot still not working

[Copilot]

@copilot still not working

The remaining failure was a different issue: ssm_parameter as a module lives in community.aws, not amazon.aws. The amazon.aws collection only has ssm_parameter as a lookup plugin — using it as a task action doesn't resolve.

Fixed in 59553ca by changing amazon.aws.ssm_parameter → community.aws.ssm_parameter in ansible/tfbackend.yml.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• galaxy.ansible.com
  • Triggering command: /home/REDACTED/.local/bin/ansible-galaxy ansible-galaxy collection install -r ansible/requirements.yml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[nickelghost]

@copilot revert the previous changes that did not fix the issue

[Copilot]

@copilot revert the previous changes that did not fix the issue

Reverted in 2474673. Both .github/workflows/lint.yml and ansible/tfbackend.yml are back to their original state.