Run ansible-lint on Ubuntu Noble

We ran into issues getting ansible-lint to run on Noble without updating
everything to current ish versions due to Python 3.12 compatibility
issues. Updating everything in this way created a bunch of new lint
errors we need to fix so we worked around the problem previously by
pinning back to Jammy.

Now we move the job back to Noble (the default Nodeset) and update the
tooling and fix the linter errors. This should allow us to move forward
in a productive manner on modern platforms.

The linter errors we fix include:

 * Naming every play
 * Ensuring every play name starts with a capital letter
 * Using fully qualified collection names for action modules
   (archive, git_config, and synchronize)
 * Quoting octal file modes

Change-Id: I96560c5ce2a5af39d39b3fc339862932a856bd13

playbooks/api-jobs/promote.yaml

@@ -1,6 +1,7 @@
 # This is a variant of https://opendev.org/opendev/base-jobs/src/branch/master/playbooks/docs/promote.yaml
 # updated to calculate the service type.
-- hosts: localhost
+- name: Promote API Documentation
+  hosts: localhost
   tasks:
     - name: Check execution context
       when: "zuul.branch is not defined"

playbooks/bindep-fallback/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run Bindep Against Fallback File
+  hosts: all
   roles:
     - role: bindep
       bindep_profile: test

playbooks/check-main-yaml/post.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Post Run For Zuul main.yaml Checks
+  hosts: all
   roles:
     - fetch-tox-output

playbooks/check-main-yaml/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Pre Run for Zuul main.yaml Checks
+  hosts: all
   roles:
     - ensure-tox
     - revoke-sudo

playbooks/check-release-approval/run.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Check Release Approvals
+  hosts: localhost
   roles:
     - role: check-release-approval
       change: "{{ zuul.change }}"

playbooks/javascript/content.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Run NPM
+  hosts: all
   roles:
     - role: npm

playbooks/javascript/post-stackviz.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Process Stackviz Artifacts
+  hosts: all
   tasks:
 
     - name: Rename tarball and move it to a subdir named dist as well
@@ -19,7 +20,7 @@
       delegate_to: localhost
 
     - name: Collect artifacts
-      synchronize:
+      ansible.posix.synchronize:
         dest: "{{ zuul.executor.work_root }}/artifacts/"
         mode: pull
         src: "{{ zuul.project.src_dir }}/dist/"

playbooks/javascript/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare a Javascript Dev Env
+  hosts: all
   roles:
     - bindep
     - test-setup

playbooks/javascript/publish.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Javascript Artifacts for Publication
+  hosts: all
   roles:
     - fetch-javascript-output
     - fetch-javascript-content-tarball

playbooks/javascript/release.yaml

@@ -1,18 +1,20 @@
-- hosts: all
+- name: Fetch Javascript Artifacts for Publication
+  hosts: all
   roles:
     - fetch-javascript-output
     - version-from-git
     - fetch-javascript-tarball
 
-- hosts: all
+- name: Publish Javascript Artifacts to NPM
+  hosts: all
   tasks:
     # project_ver is set by set_fact in version-from-git, but that runs on
     # the remote host, which puts the fact into the hostvars of that host.
     # Now that we're running on localhost, we need to reach in to the remote
     # hosts vars to get the value.
     - name: Upload to NPM
+      delegate_to: localhost
       block:
         - name: Upload to npm
           include_role:
             name: upload-npm
-      delegate_to: localhost

playbooks/javascript/tarball.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run npm pack
+  hosts: all
   roles:
     - role: npm
       npm_command: pack

playbooks/maintain-github-mirror/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run GitHub Mirror Script
+  hosts: all
   tasks:
     - name: Ensure pip
       include_role:

playbooks/openstack-fips/pre.yaml

@@ -1,7 +1,7 @@
-- name: enable ua subscription
+- name: Enable ua subscription
   hosts: all
   tasks:
-    - name: enable ua subscription for fips
+    - name: Enable ua subscription for fips
       include_role:
         name: enable-ua-subscription
       when: enable_fips | default(false)

playbooks/project-config/post-tox.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Fetch Tox Output
+  hosts: all
   roles:
     - fetch-tox-output

playbooks/project-config/pre-tox.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare a Tox Runtime Environment
+  hosts: all
   roles:
     - bindep
     - ensure-tox

playbooks/project-config/run-tox.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Run Tox
+  hosts: all
   roles:
     - tox

playbooks/proposal/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare a Code Proposal Environment
+  hosts: all
   pre_tasks:
     - name: Ensure pip
       include_role:
@@ -24,7 +25,7 @@
       copy:
         dest: '{{ ansible_user_dir }}/scripts/'
         src: '{{ item }}'
-        mode: 0755
+        mode: '0755'
       with_items:
         - generate_puppetfile.sh
         - propose_update.sh

playbooks/proposal/propose-project-config-update.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Propose Constraints Update
+  hosts: all
   tasks:
 
     - name: Propose constraints update

playbooks/proposal/propose-update-constraints.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Propose Constraints Update
+  hosts: all
   tasks:
     - name: Pause in order to allow pypi to catch up
       ansible.builtin.pause:

playbooks/proposal/propose-updates.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run propose_update.sh Script
+  hosts: all
   tasks:
 
     - name: Run propose_update.sh script

playbooks/pti-python-tarball/check.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run Twine Checks Against Sdist Tarball
+  hosts: all
   roles:
     - build-python-release
     - ensure-twine

playbooks/pti-python-tarball/post.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Collect Artifacts
+  hosts: all
 
   post_tasks:
     - name: Find tarballs and wheels in dist folder.
@@ -20,13 +21,14 @@
       delegate_to: localhost
 
     - name: Collect tarball artifacts.
-      synchronize:
+      ansible.posix.synchronize:
         dest: "{{ zuul.executor.work_root }}/artifacts/"
         mode: pull
         src: "{{ item.path }}"
         verify_host: true
       with_items: "{{ result.files }}"
 
-- hosts: localhost
+- name: Sign Artifacts
+  hosts: localhost
   roles:
     - sign-artifacts

playbooks/pti-python-tarball/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare Python Package Build Environment
+  hosts: all
   roles:
     # We use ensure-pip to make sure the wheel module is installed
     - ensure-pip

playbooks/pti-python-tarball/run.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Build Python Release
+  hosts: all
   roles:
     - build-python-release

playbooks/publications-index/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Run make-index
+  hosts: all
   tasks:
     - name: Run make-index
       command: ./make-index

playbooks/publications/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare for Publication
+  hosts: all
   roles:
     - role: write-root-marker
       root_marker_dir: "{{ zuul.project.src_dir }}/"

playbooks/publish/install-guide.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Sphinx Output
+  hosts: all
   roles:
     - role: prepare-docs-for-afs
       when: zuul_success | bool
@@ -7,7 +8,8 @@
       zuul_executor_dest: "{{ zuul.executor.work_root }}/artifacts"
       when: zuul_success | bool
 
-- hosts: localhost
+- name: Publish Sphinx Output to AFS
+  hosts: localhost
   roles:
     - role: set-service-type-data-fact
       when: zuul_success | bool

playbooks/publish/openstack-afs.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Update to AFS
+  hosts: localhost
   pre_tasks:
     # Note that "{{ afs.path }}" is a valid afs_target and thus
     # afs_subpath can be empty, we need this for openstack-manuals

playbooks/publish/openstack-artifacts.yaml

@@ -1,6 +1,8 @@
-- hosts: localhost
+- name: Publish Artifacts to AFS
+  hosts: localhost
   tasks:
     - name: Upload to AFS
+      when: zuul_success | bool
       block:
         - name: Create AFS token
           include_role:
@@ -14,4 +16,3 @@
         - name: Destroy AFS token
           include_role:
             name: destroy-afs-token
-      when: zuul_success | bool

playbooks/publish/publications-index.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Sphinx Output
+  hosts: all
   roles:
     - fetch-tox-output
     - role: write-root-marker

playbooks/publish/publications.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Sphinx Output
+  hosts: all
   roles:
     - role: fetch-sphinx-output
       sphinx_output_src: "{{ zuul.project.src_dir }}/_out/"

playbooks/publish/puppetforge.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Publish Puppet Modules to PuppetForge
+  hosts: localhost
   tasks:
     - name: Find all puppet tarballs in artifacts
       find:

playbooks/publish/pypi.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Publish Python Package to PyPI
+  hosts: localhost
   roles:
     - role: ensure-twine
       when: zuul_success | bool

playbooks/publish/releasenotes.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Release Notes
+  hosts: all
   roles:
     - role: write-root-marker
       root_marker_dir: "{{ zuul_work_dir }}/{{ sphinx_build_dir }}/html"

playbooks/publish/releases-afs.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Publish Release to AFS
+  hosts: localhost
   roles:
     - role: create-afs-token
       when: zuul_success | bool

playbooks/publish/starlingx-afs.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Publish StarlingX Web Content
+  hosts: localhost
   roles:
     - role: create-afs-token
       when: zuul_success | bool

playbooks/publish/trigger-rtd.yaml

@@ -1,3 +1,4 @@
-- hosts: localhost
+- name: Trigger Read The Docs Build
+  hosts: localhost
   roles:
     - trigger-readthedocs

playbooks/publish/wheel-mirror.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Publish Wheels to Mirror
+  hosts: all
   # We don't want the python2 & python3 hosts copying to AFS at the
   # same time.  In some cases for generic wheels they can have
   # produced a file with the same name and thus we open a window to

playbooks/puppet-tarball/post.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Puppet Module
+  hosts: all
   roles:
     - fetch-puppet-module-output
 
@@ -10,6 +11,7 @@
       args:
         chdir: "{{ zuul.project.src_dir }}/pkg"
 
-- hosts: localhost
+- name: Sign Artifacts
+  hosts: localhost
   roles:
     - sign-artifacts

playbooks/puppet-tarball/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Setup Puppet Module Build Environment
+  hosts: all
   roles:
     - ensure-pdk-dependencies
     - revoke-sudo

playbooks/puppet-tarball/run.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Build Puppet Module
+  hosts: all
   roles:
     - build-puppet-module

playbooks/python-branch-tarball/post.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Create Branch Specific Python Tarball
+  hosts: all
   roles:
     - fetch-python-sdist-output
 

playbooks/release/launchpad.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Add Launchpad Credentials
+  hosts: all
   roles:
     - add-launchpad-credentials

playbooks/release/post.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Cleanup Credentials
+  hosts: all
   roles:
     - remove-sshkey
     - remove-launchpad-credentials

playbooks/release/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare Release Environment
+  hosts: all
   pre_tasks:
     # This is tempoarary until v2 is gone and we can rework things
     - name: Update origin remote to enable notes fetching

playbooks/release/tag.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Tag and Push Release
+  hosts: all
   tasks:
     - name: Run release scripts
       shell:

playbooks/releasenotes/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare Reno Build Environment
+  hosts: all
   roles:
     - role: bindep
       bindep_profile: doc

playbooks/releasenotes/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Build Releasenotes
+  hosts: all
   roles:
     - role: ensure-if-python
       # Releasenotes do not need the package itself to be installed

playbooks/service-types/promote.yaml

@@ -2,7 +2,8 @@
 # It uses upload-afs-syncronize instead of upload-afs-roots to add content
 # but not delete. It is also simplified for repository
 # openstack/service-types-authority.
-- hosts: localhost
+- name: Upload Service Types to AFS
+  hosts: localhost
   tasks:
     - name: Check execution context
       when: "zuul.branch is not defined"

playbooks/sphinx/neutron-horizon-hack.yaml

@@ -1,4 +1,5 @@
 # TODO(mordred) ZOMG DELETE THIS
-- hosts: all
+- name: Run Neutron Horizon Hack
+  hosts: all
   roles:
     - neutron-horizon-hack

playbooks/sphinx/post-infra.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Infra Sphinx Docs
+  hosts: all
   roles:
     - role: prepare-infra-docs-for-afs
       when: zuul_success | bool

playbooks/sphinx/post.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Fetch Sphinx Docs
+  hosts: all
   roles:
     - role: prepare-docs-for-afs
       when: zuul_success | bool

playbooks/sphinx/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare Sphinx Build Environment
+  hosts: all
   roles:
     - role: bindep
       bindep_profile: compile doc

playbooks/sphinx/run.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Build Sphinx Docs
+  hosts: all
   roles:
     - ensure-if-python
     - sphinx

playbooks/translation/openstack-translation-artifacts.yaml

@@ -1,6 +1,8 @@
-- hosts: localhost
+- name: Upload to AFS
+  hosts: localhost
   tasks:
     - name: Upload to AFS
+      when: zuul_success | bool
       block:
         - name: Create AFS token
           include_role:
@@ -14,4 +16,3 @@
         - name: Destroy AFS token
           include_role:
             name: destroy-afs-token
-      when: zuul_success | bool

playbooks/translation/post.yaml

@@ -1,3 +1,4 @@
-- hosts: all
+- name: Fetch Translation Subunit Output
+  hosts: all
   roles:
     - fetch-translations-subunit-output

playbooks/translation/pre.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Prepare Translations Processing Environment
+  hosts: all
   roles:
     - role: ensure-sphinx
       doc_building_packages:

playbooks/translation/propose-translation-update.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Propose Transaltion Updates
+  hosts: all
   roles:
     - prepare-zanata-client
     - legacy-zuul-git-prep-upper-constraints

playbooks/translation/upstream-translation-update.yaml

@@ -1,4 +1,5 @@
-- hosts: all
+- name: Upstream Translation Updates
+  hosts: all
   roles:
     - prepare-zanata-client
     - legacy-zuul-git-prep-upper-constraints
@@ -9,6 +10,7 @@
       args:
         chdir: "{{ zuul.project.src_dir }}"
 
-- hosts: all
+- name: Fetch Translation Output
+  hosts: all
   roles:
     - fetch-translation-output

playbooks/wheel/release.yaml

@@ -1,4 +1,5 @@
-- hosts: localhost
+- name: Release AFS Volume
+  hosts: localhost
   roles:
     - role: create-afs-token
 

roles/configure-git/tasks/main.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Configure Git
-  git_config:
+  community.general.git_config:
     name: "{{ item.key }}"
     scope: "{{ git_config_scope }}"
     value: "{{ item.value }}"

roles/copy-proposal-common-scripts/tasks/main.yaml

@@ -3,6 +3,6 @@
     # src is relative to the dir the playbook is in on the executor
     dest: "{{ ansible_user_dir }}/scripts/"
     src: '{{ item }}'
-    mode: 0755
+    mode: '0755'
   with_items:
     - common.sh

roles/copy-release-tools-scripts/tasks/main.yaml

@@ -4,6 +4,6 @@
     state: directory
 
 - name: Copy the release-tools directory to the remote node
-  synchronize:
+  ansible.posix.synchronize:
     src: "release-tools/"
     dest: "{{ ansible_user_dir }}/scripts/release-tools"

roles/fetch-translations-subunit-output/tasks/main.yaml

@@ -4,7 +4,7 @@
   register: subunit
 
 - name: Collect test-results
-  synchronize:
+  ansible.posix.synchronize:
     dest: "{{ zuul.executor.log_root }}"
     mode: pull
     src: "{{ zuul_work_dir }}/testrepository.subunit.gz"

roles/test-upload-logs/tasks/main.yaml

@@ -13,7 +13,7 @@
         path: "{{ zuul_logserver_root }}/{{ zuul_log_path }}"
         state: directory
         recurse: yes
-        mode: 0775
+        mode: '0775'
 
     # Use chmod instead of file because ansible 2.5 file with recurse and
     # follow can't really handle symlinks to .
@@ -25,7 +25,7 @@
         - skip_ansible_lint
 
     - name: Upload logs to log server
-      synchronize:
+      ansible.posix.synchronize:
         src: "{{ zuul.executor.log_root }}/"
         dest: "{{ zuul_logserver_root }}/{{ zuul_log_path }}/"
         rsync_opts:
@@ -34,16 +34,16 @@
       no_log: "{{ not zuul_log_verbose }}"
 
     # After this point there are no more logs
-    - name: gzip console log and json output
+    - name: Gzip console log and json output
       delegate_to: localhost
-      archive:
+      community.general.archive:
         path: "{{ zuul.executor.log_root }}/{{ item }}"
       with_items:
         - job-output.txt
         - job-output.json
 
     - name: Upload console log and json output
-      synchronize:
+      ansible.posix.synchronize:
         src: "{{ zuul.executor.log_root }}/{{ item }}.gz"
         dest: "{{ zuul_logserver_root }}/{{ zuul_log_path }}/{{ item }}.gz"
         verify_host: true

tox.ini

@@ -33,10 +33,8 @@ deps =
      # keep this in sync with what Zuul uses so we don't allow though
      # things from a later ansible that would actually fail in
      # production.
-     ansible>=5,<6
-     # pin these two until someone has time to update all our skips to >=6.16
-     ansible-lint>=6.0.0,<6.5.0
-     ansible-compat<4
+     ansible>=8,<9
+     ansible-lint<25.0.0
      hacking>=7.0.0,<8.0.0
      bashate>=0.2
 commands =

zuul.d/projects.yaml

@@ -3472,8 +3472,7 @@
               - specs/.*
               - other-requirements.txt
               - tox.ini
-        - openstack-zuul-jobs-linters:
-            nodeset: ubuntu-jammy
+        - openstack-zuul-jobs-linters
         - project-config-dib
         - project-config-gerrit
         - project-config-grafana:
@@ -3496,8 +3495,7 @@
             files: *project-config-grafana-files
         - build-openstack-specs-site:
             files: *specs-site
-        - openstack-zuul-jobs-linters:
-            nodeset: ubuntu-jammy
+        - openstack-zuul-jobs-linters
         - project-config-dib
         - project-config-gerrit
         - project-config-grafana: