fix E306 'Shells that use pipes should set the pipefail option'

playbooks/tasks/reencrypt-vault-key.yml

@@ -3,4 +3,4 @@
   hosts: 127.0.0.1
   tasks:
       - name: reencrypt vault key
-        shell: gpg --decrypt --batch --quiet "{{playbook_dir}}/../../misc/vault-password.gpg" | gpg --batch --armor --encrypt --output - {% for userid in root_gpgkeys %}--recipient {{userid}} {% endfor %} | sponge "{{playbook_dir}}/../../misc/vault-password.gpg"
+        shell: set -o pipefail && gpg --decrypt --batch --quiet "{{playbook_dir}}/../../misc/vault-password.gpg" | gpg --batch --armor --encrypt --output - {% for userid in root_gpgkeys %}--recipient {{userid}} {% endfor %} | sponge "{{playbook_dir}}/../../misc/vault-password.gpg"

playbooks/tasks/sync-ssh-hostkeys.yml

@@ -7,7 +7,7 @@
         shell: "for type in sha256 md5; do for file in /etc/ssh/ssh_host_*.pub; do ssh-keygen -l -f $file -E $type; done; echo; done"
         register: ssh_hostkeys
       - name: fetch known_hosts
-        shell: "ssh-keyscan 127.0.0.1 2>/dev/null | sed 's#^127.0.0.1#{{ inventory_hostname }}#'"
+        shell: "set -o pipefail && ssh-keyscan 127.0.0.1 2>/dev/null | sed 's#^127.0.0.1#{{ inventory_hostname }}#'"
         register: known_hosts
 
 - name: store hostkeys

roles/zabbix-server/tasks/main.yml

@@ -38,7 +38,7 @@
 
 
 - name: check if zabbix db contains tables
-  shell: psql -U {{ zabbix_db_user }} {{ zabbix_db_name }} -c '\d' | grep -P '\(\d+ rows\)'
+  shell: set -o pipefail && psql -U {{ zabbix_db_user }} {{ zabbix_db_name }} -c '\d' | grep -P '\(\d+ rows\)'
   become_user: zabbix-server
   become: yes
   register: table_is_populated