# changed\_when and ansible.builtin.dnf linting help

**URL:** <https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336>\
**Category:** Get Help\
**Tags:** ansible-lint, linux\
**Created:** [February 14, 2026, 2:28am UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336 "2026-02-14T02:28:32Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [February 14, 2026, 10:18am UTC](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336/2 "2026-02-14T10:18:31Z")

</div>

There are a few issues with this:

> [@bryonadams](#):
>
> ```auto
> - name: Set IPv6 IID token
> ansible.builtin.command:
> nmcli con mod enX0 ipv6.token ::"CHANGEME"
> change_when: 'nmcli -g ipv6.token con show enX0 != \:\:"CHANGEME"'
> become: true
> 
> ```

First I think the command can only be on a separate line from ` ansible.builtin.command` if it is followed with a `|` or `>` (or `|-` or `>-`, see [this Stackoverflow comment](https://stackoverflow.com/a/21699210/9669328) for more details), eg:

```yaml
    - name: Set IPv6 IID token
      ansible.builtin.command: >
        nmcli con mod enX0 ipv6.token ::"CHANGEME"

```

Or:

```yaml
    - name: Set IPv6 IID token
      ansible.builtin.command: |
        nmcli con mod enX0 ipv6.token ::"CHANGEME"

```

However [you are best using `cmd`](https://forum.ansible.com/t/passing-arguments-using-ansible-builtin-command/45038/3), like this:

```yaml
    - name: Set IPv6 IID token
      ansible.builtin.command:
        cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME"

```

The _“conflicting action statements”_ is because of `change_when`, this should be `changed_when` (see the [documentation](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_error_handling.html#defining-changed)) and it should either be a boolean, or evaluate to a boolean:

```yaml
    - name: Set IPv6 IID token
      ansible.builtin.command:
        cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME"
      changed_when: true
      become: true

```

If you don’t want the task to run each time and if there is a way to get the existing value then you could update the task to only run when the token needs changing? Or if it should only [run once](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_strategies.html#running-on-a-single-machine-with-run-once):

```yaml
    - name: Set IPv6 IID token
      ansible.builtin.command:
        cmd: nmcli con mod enX0 ipv6.token ::"CHANGEME"
      run_once: true
      become: true

```

It sounds like you need to simply ensure that `ansible-lint` ignores the `state` being set to `latest` since that is what you want?

```yaml
    - name: Update all packages # noqa: package-latest
      ansible.builtin.dnf:
        name: '*'
        state: latest
      become: true

```

---

_[View the full topic](https://forum.ansible.com/t/changed-when-and-ansible-builtin-dnf-linting-help/45336)._