# Syntax check without vault passwords

**URL:** <https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842>\
**Category:** Get Help\
**Tags:** ansible-lint\
**Created:** [December 11, 2023, 10:11am UTC](https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842 "2023-12-11T10:11:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rokcarl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rokcarl/32/1763_2.png) [@rokcarl](https://forum.ansible.com/u/rokcarl)\
**Post date:** [December 11, 2023, 10:11am UTC](https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842/1 "2023-12-11T10:11:55Z")

</div>

Hi,

I’m having a problem running `ansible-lint`, which in turn calls `ansible-playbook --syntax-check`, which then fails as it doesn’t have the Ansible vault password so any decryption fails.

The reason there’s no vault password is because this password decrypts some important secrets and this syntax check is running in CI as part of the build and I don’t want the CI to have this password.

Can I somehow get around this? There have been some open issues around this (like [this one](https://github.com/ansible/ansible/issues/13244) where bcoca says it’s fixed), but I can’t find a solution.

As a last resort, I’ll use a hotfix to Ansible like [this one](https://github.com/ansible/ansible/issues/13244#issuecomment-256444099), but would rather not.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [December 11, 2023, 8:34pm UTC](https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842/2 "2023-12-11T20:34:01Z")

</div>

I’m guessing this would generate an unskippable `load-failure` error. `ansible-lint -L -f full` has this to say about that:

> This violation is not skippable, so it cannot be added to the warn\_list or the skip\_list. If a vault decryption issue cannot be avoided, the offending file can be added to `exclude_paths` configuration.

Asking `ansible-lint` to blindly proceed in the face of missing vault passwords might cause “interesting” issues, but the suggestion — to explicitly exclude vaulted files from linting — may be the best option.

That doesn’t help if you have vaulted variable values (strings) in otherwise unvaulted vars files, which is the way I prefer my vaulted bits. But that may not be your problem. (?)

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [December 11, 2023, 8:39pm UTC](https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842/3 "2023-12-11T20:39:32Z")

</div>

Would it be possible to have your CI pipeline stub in dummy values before running `ansible-lint`?

---

<div class="post-metadata">

**Author:** ![rokcarl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rokcarl/32/1763_2.png) [@rokcarl](https://forum.ansible.com/u/rokcarl)\
**Post date:** [December 11, 2023, 9:39pm UTC](https://forum.ansible.com/t/syntax-check-without-vault-passwords/2842/4 "2023-12-11T21:39:31Z")

</div>

> That doesn’t help if you have vaulted variable values

I have both, due to legacy reasons. At the moment, I prefer vaulted variable strings inside yaml files.

> Would it be possible to have your CI pipeline stub in dummy values before running `ansible-lint`?

Yes. But first, I’m talking about `ansible-lint` only because I’m using it, but the error comes from `ansible-playbook` running the syntax check as explained above, so the linting problem is a second-order problem.

Right now, I do a super-dirty hot-patch to make `ansible-lint` work:

```auto
sed -i '751s/.*/ return (b"", vault_id_used, vault_secret_used)/' /usr/local/lib/python3.12/site-packages/ansible/parsing/vault/ __init__.py

```