False positive for partial-become

[zjpeterson]

Summary

When using become_user on a task, with become=true at play level, partial-become is triggered stating "become_user should have a corresponding become at the play or task level." - when that is already true. There should be no need to repeat become=true on the task.

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint 25.1.0 using ansible-core:2.18.1 ansible-compat:24.10.0 ruamel-yaml:0.18.10 ruamel-yaml-clib:None

• ansible installation method: pip
• ansible-lint installation method: pip

STEPS TO REPRODUCE

---
- name: Example
  hosts: pgsql
  gather_facts: false
  become: true

  tasks:
    - name: Initialize postgres
      ansible.builtin.command: postgresql-setup --initdb
      args:
        creates: /var/lib/pgsql/data/postgresql.conf
      become_user: postgres

Desired Behavior

Playbook passes lint

Actual Behavior

ansible-lint example.yml
WARNING  Listing 1 violation(s) that are fatal
partial-become[task]: ``become_user`` should have a corresponding ``become`` at the play or task level.
example.yml:8 Task/Handler: Initialize postgres

Read documentation for instructions on how to ignore specific rule violations.

# Rule Violation Summary

  1 partial-become profile:basic tags:unpredictability

Failed: 1 failure(s), 0 warning(s) on 1 files. Last profile that met the validation criteria was 'min'.

[cavcrosby]

I believe this is intended when looking at the partial-become rule's documentation, https://ansible.readthedocs.io/projects/lint/rules/partial-become/. In particular, from the Warning section:

While Ansible inherits have of become and become_user from upper levels, like play level or command line, we do not look at these values. This rule requires you to be explicit and always define both in the same place, mainly in order to prevent accidents when some tasks are moved from one location to another one.

To be fair, I do think the error message is ambiguous when mentioning, "...at the play or task level".

[Qalthos]

Yeah, we should update the warning to specify that the corresponding become should be at the same level, perhaps instead:

``become_user`` should have a corresponding ``become`` at the same level as itself.