Jinja templates should only be at the end of 'name'

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 6 — [' + node_section + '] use_tls', 'expected': 'use_tls = true', 'actual': node_usetls.stdout | default('NOT FOUND'), 'status': '✅ PASS' if tls_enabled else '❌ FAIL — TLS disabled, skipping cert checks' } ] }} -> {{ check_results + [{'check': 'CHECK 6 — [' + node_section + '] use_tls', 'expected': 'use_tls = true', 'actual': node_usetls.stdout | default('NOT FOUND'), 'status': '✅ PASS' if tls_enabled else '❌ FAIL — TLS disabled, skipping cert checks'}] }}

Jinja templates should only be at the end of 'name'

Jinja templates should only be at the end of 'name'

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 5 — Last cert in CA bundle is self-signed root (subject hash == issuer hash)', 'expected': 'Both hashes match', 'actual': ca_hash_check.stdout | default('ERROR'), 'status': '✅ PASS' if (ca_hash_check.stdout_lines | default([]) | length == 2 and ca_hash_check.stdout_lines[0] == ca_hash_check.stdout_lines[1]) else '❌ FAIL' } ] }} -> {{ check_results + [{'check': 'CHECK 5 — Last cert in CA bundle is self-signed root (subject hash == issuer hash)', 'expected': 'Both hashes match', 'actual': ca_hash_check.stdout | default('ERROR'), 'status': '✅ PASS' if (ca_hash_check.stdout_lines | default([]) | length == 2 and ca_hash_check.stdout_lines[0] == ca_hash_check.stdout_lines[1]) else '❌ FAIL'}] }}

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 4 — CA cert has CA:TRUE (can sign other certs)', 'expected': 'CA:TRUE', 'actual': ca_basic_constraints.stdout | default('NOT FOUND'), 'status': '✅ PASS' if 'TRUE' in (ca_basic_constraints.stdout | default('')) else '❌ FAIL' } ] }} -> {{ check_results + [{'check': 'CHECK 4 — CA cert has CA:TRUE (can sign other certs)', 'expected': 'CA:TRUE', 'actual': ca_basic_constraints.stdout | default('NOT FOUND'), 'status': '✅ PASS' if 'TRUE' in (ca_basic_constraints.stdout | default('')) else '❌ FAIL'}] }}

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 3 — CA bundle cert count', 'expected': 'At least 1 cert (root only is valid; 2 = root + intermediate)', 'actual': ca_count.stdout | default('ERROR') + ' cert(s) found', 'status': '✅ PASS' if ca_count.stdout | int >= 2 else ('⚠️ WARN — only root CA present, no intermediate (valid but less secure)' if ca_count.stdout | int == 1 else '❌ FAIL — no certificates found in CA bundle') } ] }} -> {{ check_results + [{'check': 'CHECK 3 — CA bundle cert count', 'expected': 'At least 1 cert (root only is valid; 2 = root + intermediate)', 'actual': ca_count.stdout | default('ERROR') + ' cert(s) found', 'status': '✅ PASS' if ca_count.stdout | int >= 2 else ('⚠️ WARN — only root CA present, no intermediate (valid but less secure)' if ca_count.stdout | int == 1 else '❌ FAIL — no certificates found in CA bundle')}] }}

Use shell only when shell functionality is required.

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 2 — [application] ca_certificate_file exists on disk', 'expected': 'File exists at ' + (ca_cert_path | default('N/A')), 'actual': 'EXISTS' if (ca_file_stat.stat.exists | default(false)) else 'NOT FOUND on disk', 'status': '✅ PASS' if (ca_file_stat.stat.exists | default(false)) else '❌ FAIL' } ] }} -> {{ check_results + [{'check': 'CHECK 2 — [application] ca_certificate_file exists on disk', 'expected': 'File exists at ' + (ca_cert_path | default('N/A')), 'actual': 'EXISTS' if (ca_file_stat.stat.exists | default(false)) else 'NOT FOUND on disk', 'status': '✅ PASS' if (ca_file_stat.stat.exists | default(false)) else '❌ FAIL'}] }}

Jinja2 spacing could be improved: {{ check_results + [ { 'check': 'CHECK 1 — [application] ca_certificate_file is set', 'expected': 'ca_certificate_file = /path/to/ca-bundle.crt', 'actual': ca_conf_line.stdout | default('NOT FOUND'), 'status': '✅ PASS' if ca_conf_line.stdout != '' else '❌ FAIL' } ] }} -> {{ check_results + [{'check': 'CHECK 1 — [application] ca_certificate_file is set', 'expected': 'ca_certificate_file = /path/to/ca-bundle.crt', 'actual': ca_conf_line.stdout | default('NOT FOUND'), 'status': '✅ PASS' if ca_conf_line.stdout != '' else '❌ FAIL'}] }}

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (set_fact: check_results)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (set_fact: node_section)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (set_fact: gateway_conf)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: private_ip)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: server_port)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: service_name)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: client_gateway_conf)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: server_gateway_conf)

Variables names from within roles should use certcheck_cluster_client_to_server_ as a prefix. (vars: iag5_client_group)