Provide vault password with --ask-vault-password

[chylex]

In #115 (Lint vault files) the resolution seems to be that Ansible must be configured to automatically decrypt vaults for ansible-lint to work on playbooks that have a vault.

The problem is that I don't have the password in any file that Ansible would (or should) be able to decrypt automatically. I use ansible-playbook --ask-vault-password and have a password manager provide it when asked. If I try to lint a playbook that has a vault, I get:

internal-error: Unexpected error code 1 from execution of: ansible-playbook --syntax-check -i localhost, playbook.yaml
playbook.yaml:1 ERROR! Attempting to decrypt but no vault secrets found

If I run the syntax check manually with ansible-playbook --ask-vault-password --syntax-check playbook.yaml, it asks me for the password and then checks the syntax as expected.

It looks like I cannot do the same with ansible-lint --ask-vault-password playbook.yaml. Can this feature please be added for parity?

[sidneygijzen]

I agree it would be nice if the --ask-vault-password option would be added to ansible-lint. I ran into the same issue recently. Eventually I was able to get it working by including ask_vault_pass = True in ansible.cfg. With that option set, ansible-lint asks me for the password when run on a playbook with a vault.

[lurwas]

I agree.
A work around would be to

1. Create a temporary vault with some dummy values.
2. Create a vault-password-file with an known dummy password.
3. Copy the actual vault to a backup location.
4. Temporary copy over the regular vault with the temporary vault.
5. Encrypt the vault with the dummy vault password file.
6. Modify ansible.cfg and point out the vault password file (vault_password_file = dummy-password-file)
7. Execute ansible-lint
8. Restore the back up of the actual, original vault.