fix: do not warn when Jinja block indent is only trim-marker noise by DSeaStar · Pull Request #5153 · ansible/ansible-lint

DSeaStar · 2026-08-14T19:38:09Z

jinja[spacing] currently rewrites nested {%- if -%} / {%- else -%} blocks by stripping the indent in front of the inner tags. That indent is not a real spacing problem: lex/unlex cannot restore whitespace consumed by the - trim markers, and --fix makes the template less readable.

Skip the spacing warning when the original and reformatted text differ only by indentation immediately before Jinja block tags. Internal spacing inside the tags is still checked.

Summary by CodeRabbit

Bug Fixes
- Prevented false-positive spacing fixes when Jinja block indentation is intentionally preserved.
- Ensured nested trim-marker blocks retain their existing indentation.

coderabbitai · 2026-08-14T19:38:39Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c253bffb-0f0f-4d78-92a7-c4502597ebd0

📥 Commits

Reviewing files that changed from the base of the PR and between 4971cbb and 62bc712.

📒 Files selected for processing (1)

src/ansiblelint/rules/jinja.py

🚧 Files skipped from review as they are similar to previous changes (1)

src/ansiblelint/rules/jinja.py

📝 Walkthrough

Walkthrough

The Jinja spacing rule now suppresses rewrites that only alter indentation before block tags consumed by trim markers. A regression test covers nested conditional blocks and verifies that their indentation remains unchanged.

Changes

Jinja spacing behavior

Layer / File(s)	Summary
Indentation-only rewrite detection and regression coverage `src/ansiblelint/rules/jinja.py`	The rule compares templates after removing indentation before Jinja block tags. It suppresses spacing rewrites when only trim-marker indentation changes. A regression test verifies nested `if` and `else` block indentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 62bc7

The change prevents false spacing warnings caused by Jinja trim-marker indentation while preserving checks inside the tags. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the fix for false warnings caused by Jinja block indentation and trim-marker noise.
Linked Issues check	✅ Passed	The changes address issue `#5146` by suppressing indentation-only Jinja spacing rewrites and adding a regression test for nested trim-marker blocks.
Out of Scope Changes check	✅ Passed	The changes are limited to the Jinja spacing rule and its regression coverage, which directly support issue `#5146`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Nested {%- if -%} / {%- else -%} blocks lose their indent on lex/unlex because the '-' trim eats following whitespace. That is not a spacing improvement, and --fix makes the template worse. Signed-off-by: SeaStar Deng <37767638+DSeaStar@users.noreply.github.com>

shvenkat-rh · 2026-08-18T15:55:55Z

Code Review: PR #5153 — fix: do not warn when Jinja block indent is only trim-marker noise

Verdict: READY_FOR_HUMAN_REVIEW

Scores

Lens	Score	Findings
Functionality	10/10	0 surviving
Security	10/10	0 surviving
Quality	10/10	0 surviving
Overall	10.0/10

Change Intent

Fixes #5146: jinja[spacing] falsely rewrites nested {%- if -%} / {%- else -%} blocks by stripping indent before inner tags. The lex/unlex cycle cannot restore whitespace consumed by - trim markers, so --fix makes the template less readable. The fix adds _is_block_indent_only_change() to skip the spacing warning when the only difference is indentation before Jinja block tags.

Structural Sweep

Category	Count	Files
New logic	1	`src/ansiblelint/rules/jinja.py` (regex + helper function)
Modified logic	1	`src/ansiblelint/rules/jinja.py` (new guard in `check_whitespace`)
Tests	1	`src/ansiblelint/rules/jinja.py` (test case id=48)

Findings

None. No critical, major, minor, or nit-level issues found.

Verification Results

Check	Method	Result
Regex does not match `{{` variable tags	`" {{ var }}"` unchanged after `.sub()`	PASS
Regex does not match mid-line whitespace	`"some text {% if x %}"` unchanged	PASS
Regex strips indent before `{%`	`" {%- if x -%}"` becomes `"{%- if x -%}"`	PASS
Real spacing fix not suppressed	`"{%- if x-%}"` != `"{%- if x -%}"` after strip	PASS
No ReDoS risk	100KB adversarial whitespace: ~7ms	PASS
Test id=48 passes	`pytest -k 48`	PASS
All existing tests pass	60/60 passed	PASS

Observations

Regex correctness verified. r"(?m)^[ \t]+(?=\{%)" correctly matches only leading whitespace at line boundaries before {% block tags. Does NOT match {{, mid-line whitespace, or literal text.
No over-suppression risk. Real spacing issues inside block tags (e.g., {%- if x-%} → {%- if x -%}) survive the strip comparison and are still reported.
Guard ordering correct. Placed after _is_broken_rewrite — both guards are independent and return the same early-return tuple.
Code organization follows conventions. Mirrors the existing _is_broken_rewrite pattern exactly.
ReDoS absent. Simple linear pattern, no nested quantifiers or ambiguous paths.
Security-neutral. jinja[spacing] is purely cosmetic; suppressing a spacing warning has zero security impact.

Path to 10/10

No action required. Clean change — well-targeted fix with correct regex, no over-suppression, follows existing conventions, and includes a representative test case.

Overall: 10.0/10 — READY_FOR_HUMAN_REVIEW

AI-assisted review using Claude Code

shvenkat-rh · 2026-08-18T15:56:40Z

Please rebase the branch. Once done i will approve it

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ansible-lint](https://github.com/ansible/ansible-lint) ([changelog](https://github.com/ansible/ansible-lint/releases)) | minor | `==26.6.0` → `==26.9.0` | --- ### Release Notes <details> <summary>ansible/ansible-lint (ansible-lint)</summary> ### [`v26.9.0`](https://github.com/ansible/ansible-lint/releases/tag/v26.9.0) [Compare Source](ansible/ansible-lint@v26.8.0...v26.9.0) #### Features - feat: support `example` section in file `meta/argument_specs.yml` ([#5164](ansible/ansible-lint#5164)) [@berndfinger](https://github.com/berndfinger) #### Fixes - fix: resolve short mock modules during syntax check ([#5149](ansible/ansible-lint#5149)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: propagate `extra_vars` to `import_playbook` syntax check ([#5148](ansible/ansible-lint#5148)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: resolve nested `include_tasks` relative paths ([#5159](ansible/ansible-lint#5159)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: resolve `include_tasks` paths from playbook dir ([#5184](ansible/ansible-lint#5184)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: apply profile-level skip list during linting ([#5151](ansible/ansible-lint#5151)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: honor `warn_list` after `--fix` rewrites task names ([#5085](ansible/ansible-lint#5085)) [@santosh7676](https://github.com/santosh7676) - fix: mock\_modules clobbering collections and args false positives ([#5157](ansible/ansible-lint#5157)) [@djdanielsson](https://github.com/djdanielsson) - fix: inject plain-name mock roles path regardless of `--offline` ([#5183](ansible/ansible-lint#5183)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: warn users when directory expansion discovers new files ([#5158](ansible/ansible-lint#5158)) [@rockygeekz](https://github.com/rockygeekz) - fix: skip auto-fix `no-jinja-when` on string-embedded jinja ([#5103](ansible/ansible-lint#5103)) [@f1047](https://github.com/f1047) - fix: do not warn when Jinja block indent is only trim-marker noise ([#5153](ansible/ansible-lint#5153)) [@DSeaStar](https://github.com/DSeaStar) - fix: preserve blank lines after flow collections ([#5178](ansible/ansible-lint#5178)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: add `validate_argspec` to play schema ([#5187](ansible/ansible-lint#5187)) [@sameeralam3127](https://github.com/sameeralam3127) - fix: use ThreadPoolExecutor for syntax check workers ([#5173](ansible/ansible-lint#5173)) [@rockygeekz](https://github.com/rockygeekz) - fix: drop ruamel.yaml.clib ([#5163](ansible/ansible-lint#5163)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix(deps): upgrade gitpython 3.1.57 to 3.1.59 ([#5152](ansible/ansible-lint#5152)) [@rockygeekz](https://github.com/rockygeekz) - fix: upgrade black to >=25.2.0 to address CVE-2026-32274 ([#5166](ansible/ansible-lint#5166)) [@shvenkat-rh](https://github.com/shvenkat-rh) - fix: raise cryptography floor and bump js-yaml for Guardian prod vulns ([#5174](ansible/ansible-lint#5174)) [@rockygeekz](https://github.com/rockygeekz) #### Performance - perf: cache `get_deps_versions()` result ([#5113](ansible/ansible-lint#5113)) [@BlackDark](https://github.com/BlackDark) #### Maintenance - chore: Add `.github/SECURITY.md` ([#5165](ansible/ansible-lint#5165)) [@gundalow](https://github.com/gundalow) - chore(deps): update all dependencies and pep621 ([#5138](ansible/ansible-lint#5138), [#5154](ansible/ansible-lint#5154), [#5155](ansible/ansible-lint#5155), [#5160](ansible/ansible-lint#5160), [#5161](ansible/ansible-lint#5161), [#5172](ansible/ansible-lint#5172), [#5175](ansible/ansible-lint#5175), [#5176](ansible/ansible-lint#5176)) @[renovate\[bot\]](https://github.com/apps/renovate) #### What's Changed - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5138](ansible/ansible-lint#5138) - fix: resolve short mock modules during syntax check by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5149](ansible/ansible-lint#5149) - fix(deps): upgrade gitpython 3.1.57 to 3.1.59 by [@rockygeekz](https://github.com/rockygeekz) in [#5152](ansible/ansible-lint#5152) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5155](ansible/ansible-lint#5155) - fix: propagate extra\_vars to import\_playbook syntax check by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5148](ansible/ansible-lint#5148) - fix: warn users when directory expansion discovers new files by [@rockygeekz](https://github.com/rockygeekz) in [#5158](ansible/ansible-lint#5158) - fix: resolve nested include\_tasks relative paths by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5159](ansible/ansible-lint#5159) - fix: apply profile-level skip list during linting by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5151](ansible/ansible-lint#5151) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5154](ansible/ansible-lint#5154) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5160](ansible/ansible-lint#5160) - fix: skip auto-fix no-jinja-when on string-embedded jinja by [@f1047](https://github.com/f1047) in [#5103](ansible/ansible-lint#5103) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5161](ansible/ansible-lint#5161) - fix: do not warn when Jinja block indent is only trim-marker noise by [@DSeaStar](https://github.com/DSeaStar) in [#5153](ansible/ansible-lint#5153) - chore: Add .github/SECURITY.md by [@gundalow](https://github.com/gundalow) in [#5165](ansible/ansible-lint#5165) - fix: upgrade black to >=25.2.0 to address CVE-2026-32274 by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5166](ansible/ansible-lint#5166) - Fix/drop ruamel yaml clib fresh by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5163](ansible/ansible-lint#5163) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5172](ansible/ansible-lint#5172) - fix: honor warn\_list after --fix rewrites task names by [@santosh7676](https://github.com/santosh7676) in [#5085](ansible/ansible-lint#5085) - feat: support 'example' section in file meta/argument\_specs.yml by [@berndfinger](https://github.com/berndfinger) in [#5164](ansible/ansible-lint#5164) - fix: use ThreadPoolExecutor for syntax check workers by [@rockygeekz](https://github.com/rockygeekz) in [#5173](ansible/ansible-lint#5173) - fix: mock\_modules clobbering collections and args false positives by [@djdanielsson](https://github.com/djdanielsson) in [#5157](ansible/ansible-lint#5157) - fix: raise cryptography floor and bump js-yaml for Guardian prod vulns by [@rockygeekz](https://github.com/rockygeekz) in [#5174](ansible/ansible-lint#5174) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5176](ansible/ansible-lint#5176) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5175](ansible/ansible-lint#5175) - fix: preserve blank lines after flow collections by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5178](ansible/ansible-lint#5178) - perf: cache get\_deps\_versions() result by [@BlackDark](https://github.com/BlackDark) in [#5113](ansible/ansible-lint#5113) - fix: inject plain-name mock roles path regardless of --offline by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5183](ansible/ansible-lint#5183) - fix: resolve include\_tasks paths from playbook dir by [@shvenkat-rh](https://github.com/shvenkat-rh) in [#5184](ansible/ansible-lint#5184) - fix: add validate\_argspec to play schema by [@sameeralam3127](https://github.com/sameeralam3127) in [#5187](ansible/ansible-lint#5187) #### New Contributors - [@shvenkat-rh](https://github.com/shvenkat-rh) made their first contribution in [#5149](ansible/ansible-lint#5149) - [@f1047](https://github.com/f1047) made their first contribution in [#5103](ansible/ansible-lint#5103) - [@DSeaStar](https://github.com/DSeaStar) made their first contribution in [#5153](ansible/ansible-lint#5153) - [@berndfinger](https://github.com/berndfinger) made their first contribution in [#5164](ansible/ansible-lint#5164) - [@BlackDark](https://github.com/BlackDark) made their first contribution in [#5113](ansible/ansible-lint#5113) - [@sameeralam3127](https://github.com/sameeralam3127) made their first contribution in [#5187](ansible/ansible-lint#5187) **Full Changelog**: <ansible/ansible-lint@v26.8.0...v26.9.0> ### [`v26.8.0`](https://github.com/ansible/ansible-lint/releases/tag/v26.8.0) [Compare Source](ansible/ansible-lint@v26.6.0...v26.8.0) #### What's Changed - Fix/sonarcloud unbounded recursion complexity by [@sathyapramod](https://github.com/sathyapramod) in [#5098](ansible/ansible-lint#5098) - feat: honor ANSIBLE\_VAULT\_PASSWORD\_FILE for vault decryption by [@JohnLahr](https://github.com/JohnLahr) in [#5019](ansible/ansible-lint#5019) - fix: jinja\[spacing] rule creating invalid syntax for minus modifiers by [@Dotify71](https://github.com/Dotify71) in [#5102](ansible/ansible-lint#5102) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5081](ansible/ansible-lint#5081) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5082](ansible/ansible-lint#5082) - fix: remove stale words from cspell dictionary by [@rockygeekz](https://github.com/rockygeekz) in [#5109](ansible/ansible-lint#5109) - chore(deps): bump schemas npm packages for Dependabot CVEs by [@sudhirverma](https://github.com/sudhirverma) in [#5114](ansible/ansible-lint#5114) - fix(security): update dependencies \[SECURITY] by [@renovate](https://github.com/renovate)\[bot] in [#5111](ansible/ansible-lint#5111) - fix: address SonarCloud new code violations by [@sudhirverma](https://github.com/sudhirverma) in [#5116](ansible/ansible-lint#5116) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5121](ansible/ansible-lint#5121) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5122](ansible/ansible-lint#5122) - fix(deps): exclude ansible-core 2.17.x (CVE-2026-11332) by [@rockygeekz](https://github.com/rockygeekz) in [#5123](ansible/ansible-lint#5123) - fix: expose ansible-galaxy on the uv tool-install path by [@jeffcpullen](https://github.com/jeffcpullen) in [#5124](ansible/ansible-lint#5124) - fix: var-naming for register projections by [@0xTaoZ](https://github.com/0xTaoZ) in [#5110](ansible/ansible-lint#5110) - chore: Adding OpenWrt 25.12 as platform by [@sscheib](https://github.com/sscheib) in [#5132](ansible/ansible-lint#5132) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5134](ansible/ansible-lint#5134) - chore(deps): update all dependencies by [@renovate](https://github.com/renovate)\[bot] in [#5133](ansible/ansible-lint#5133) - fix: add timeout to release-check urlopen() call by [@cooperlees](https://github.com/cooperlees) in [#5128](ansible/ansible-lint#5128) - fix: respect ANSIBLE\_HOME env var for cache dir selection ([#5806](https://github.com/ansible/ansible-lint/issues/5806)) by [@Jkhall81](https://github.com/Jkhall81) in [#5105](ansible/ansible-lint#5105) - fix: deduplicate ANSIBLE\_HOME isolation check by [@rockygeekz](https://github.com/rockygeekz) in [#5140](ansible/ansible-lint#5140) - fix(security): update dependencies \[SECURITY] by [@renovate](https://github.com/renovate)\[bot] in [#5141](ansible/ansible-lint#5141) - fix: do not require role prefix for ansible\_ connection variables by [@Sanjays2402](https://github.com/Sanjays2402) in [#5130](ansible/ansible-lint#5130) - Adding missing FreeBSD versions. by [@jmpalacios](https://github.com/jmpalacios) in [#5143](ansible/ansible-lint#5143) - chore(deps): update all dependencies pep621 by [@renovate](https://github.com/renovate)\[bot] in [#5139](ansible/ansible-lint#5139) - fix: prepend runtime cache dir to collections paths ([#5137](ansible/ansible-lint#5137)) by [@rockygeekz](https://github.com/rockygeekz) in [#5145](ansible/ansible-lint#5145) #### New Contributors - [@sathyapramod](https://github.com/sathyapramod) made their first contribution in [#5098](ansible/ansible-lint#5098) - [@JohnLahr](https://github.com/JohnLahr) made their first contribution in [#5019](ansible/ansible-lint#5019) - [@jeffcpullen](https://github.com/jeffcpullen) made their first contribution in [#5124](ansible/ansible-lint#5124) - [@0xTaoZ](https://github.com/0xTaoZ) made their first contribution in [#5110](ansible/ansible-lint#5110) - [@cooperlees](https://github.com/cooperlees) made their first contribution in [#5128](ansible/ansible-lint#5128) - [@Sanjays2402](https://github.com/Sanjays2402) made their first contribution in [#5130](ansible/ansible-lint#5130) - [@jmpalacios](https://github.com/jmpalacios) made their first contribution in [#5143](ansible/ansible-lint#5143) **Full Changelog**: <ansible/ansible-lint@v26.6.0...v26.8.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  --------- Co-authored-by: Renovate Bot <bot@renovateapp.com> Reviewed-on: https://git.ivanch.me/ivanch/haven/pulls/17

DSeaStar requested a review from a team as a code owner August 14, 2026 19:38

github-project-automation Bot added this to 🧰 devtools project board Aug 14, 2026

github-actions Bot added the fix label Aug 14, 2026

DSeaStar force-pushed the fix-jinja-block-indent-trim branch from 4971cbb to 72ca913 Compare August 15, 2026 00:46

DSeaStar force-pushed the fix-jinja-block-indent-trim branch from 72ca913 to 62bc712 Compare August 15, 2026 00:52

shvenkat-rh added 2 commits August 25, 2026 14:43

Merge branch 'main' into fix-jinja-block-indent-trim

93d6a41

Merge branch 'main' into fix-jinja-block-indent-trim

7a5bc71

shvenkat-rh approved these changes Aug 25, 2026

View reviewed changes

github-project-automation Bot moved this to Review in 🧰 devtools project board Aug 25, 2026

shvenkat-rh merged commit e6ec973 into ansible:main Aug 25, 2026
23 checks passed

github-project-automation Bot moved this from Review to Done in 🧰 devtools project board Aug 25, 2026

Navigation Menu

Repository navigation

fix: do not warn when Jinja block indent is only trim-marker noise - #5153

fix: do not warn when Jinja block indent is only trim-marker noise#5153
shvenkat-rh merged 3 commits into
ansible:mainfrom
DSeaStar:fix-jinja-block-indent-trim

DSeaStar commented Aug 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

shvenkat-rh commented Aug 18, 2026

Uh oh!

shvenkat-rh commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

DSeaStar commented Aug 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

shvenkat-rh commented Aug 18, 2026

Code Review: PR #5153 — fix: do not warn when Jinja block indent is only trim-marker noise

Verdict: READY_FOR_HUMAN_REVIEW

Scores

Change Intent

Structural Sweep

Findings

Verification Results

Observations

Path to 10/10

Uh oh!

shvenkat-rh commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

DSeaStar commented Aug 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading