# changed\_when and ansible.builtin.dnf linting help **URL:** \ **Category:** Get Help\ **Tags:** ansible-lint, linux\ **Created:** [February 14, 2026, 2:28am UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336 "2026-02-14T02:28:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bryonadams](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@bryonadams](https://forum.ansible.com/u/bryonadams)\ **Post date:** [February 14, 2026, 2:28am UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336/1 "2026-02-14T02:28:32Z")
I’m trying to configure an IPv6 token in my “deploy\_basevm.yaml” playbook, as well as update packages from a default install to the latest versions. The intent is that I’ll deploy a new VM, system packages are updated, and I have the IP which I expect to have. Just using “CHANGEME” as some placeholder value for now. Originally, I had this for setting the IPv6 token since I couldn’t find a module which manages it. There is no output from running this nmcli command from the CLI. ```auto - name: Set IPv6 IID token ansible.builtin.command: nmcli con mod enX0 ipv6.token ::"CHANGEME" become: true ``` Ansible-lint complains that I should only run something if it needs to be changed, and suggested using change\_me for it, but I’m unsure what it thinks is conflicting. The below receives a linting complaint, " conflicting action statements: ansible.builtin.command, change\_whenansible-lint[syntax-check[specific]](https://ansible.readthedocs.io/projects/lint/rules/syntax-check/)" ```auto - name: Set IPv6 IID token ansible.builtin.command: nmcli con mod enX0 ipv6.token ::"CHANGEME" change_when: 'nmcli -g ipv6.token con show enX0 != \:\:"CHANGEME"' become: true ``` What is the conflict here? For the ansible.builtin.dnf, the linter complains that I shouldn’t blindly update everything, which is 100% fair but given the context for this playbook it’s what I would like to do. I want to handle any specific versioning in playbooks that are meant for deploying the specific service. Eg, some sort of VM is going to be a monitoring service, so I’d run the above deplpy\_basevm.yaml, then another playbook that deploys the monitoring thing along with any versioning I need to be careful of like a library version. ```auto - name: Update all packages ansible.builtin.dnf: name: '*' state: latest become: true ``` Python is version 3.14, Ansible is 2.18 if that matters. ---
**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\ **Post date:** [February 14, 2026, 10:18am UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336/2 "2026-02-14T10:18:31Z")
There are a few issues with this: > [@bryonadams](#): > > ```auto > - name: Set IPv6 IID token > ansible.builtin.command: > nmcli con mod enX0 ipv6.token ::"CHANGEME" > change_when: 'nmcli -g ipv6.token con show enX0 != \:\:"CHANGEME"' > become: true > > ``` First I think the command can only be on a separate line from ` ansible.builtin.command` if it is followed with a `|` or `>` (or `|-` or `>-`, see [this Stackoverflow comment](https://stackoverflow.com/a/21699210/9669328) for more details), eg: ```yaml - name: Set IPv6 IID token ansible.builtin.command: > nmcli con mod enX0 ipv6.token ::"CHANGEME" ``` Or: ```yaml - name: Set IPv6 IID token ansible.builtin.command: | nmcli con mod enX0 ipv6.token ::"CHANGEME" ``` However [you are best using `cmd`](https://forum.ansible.com/t/passing-arguments-using-ansible-builtin-command/45038/3), like this: ```yaml - name: Set IPv6 IID token ansible.builtin.command: cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME" ``` The _“conflicting action statements”_ is because of `change_when`, this should be `changed_when` (see the [documentation](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_error_handling.html#defining-changed)) and it should either be a boolean, or evaluate to a boolean: ```yaml - name: Set IPv6 IID token ansible.builtin.command: cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME" changed_when: true become: true ``` If you don’t want the task to run each time and if there is a way to get the existing value then you could update the task to only run when the token needs changing? Or if it should only [run once](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_strategies.html#running-on-a-single-machine-with-run-once): ```yaml - name: Set IPv6 IID token ansible.builtin.command: cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME" run_once: true become: true ``` It sounds like you need to simply ensure that `ansible-lint` ignores the `state` being set to `latest` since that is what you want? ```yaml - name: Update all packages # noqa: package-latest ansible.builtin.dnf: name: '*' state: latest become: true ``` ---
**Author:** ![bryonadams](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@bryonadams](https://forum.ansible.com/u/bryonadams)\ **Post date:** [February 15, 2026, 10:19pm UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336/3 "2026-02-15T22:19:26Z")
Hi chris, This was perfect, the linter is no longer complaining and suggestion to put the command on a separate line is, I think, exactly what I needed for the `changed_when`. The output of the nmcli command has backslashes in it for some reason so now I don’t need to escape them. That should evaluate as true if the token isn’t what I want then run the command, which means after I test it working I can functionally remove the action right afterwards to print the token. Eg, ```auto - name: Set IPv6 IID token ansible.builtin.command: nmcli con mod enX0 ipv6.token ::"CHANGEME" changed_when: > nmcli -g ipv6.token con show enX0 != '\:\:"CHANGEME"' become: true - name: Get IPv6 token ansible.builtin.shell: set -o pipefail && nmcli con show enX0 | grep ipv6.token register: ipv6_token_output changed_when: false ``` The 0 linting complaints on the file feels really nice, I appreciate your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 17, 2026, 10:19pm UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336/4 "2026-03-17T22:19:55Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.