Question on tasks that are always triggered

[ozendorf]

Have you checked ReadtheDocs?: Yes.

Question
Hello,
First of all, thanks for the amazing job you all have done with this project!.
We are integrating this project as an ansible collection, and I was wondering wether the following change can be imaginable: some tasks (that are not read-only) are tagged as always and systematically triggered even if the ansible is ran with a -t for a specific role (different from ansible-lockdown) which may result to unintended change in the target environment.

In case this is not possible, we are considering customizing the playbook to change this behaviour but I was interested to see your opinion on this.
Thank you very much for your help.
Environment (please complete the following information):

• Ansible Version: [e.g. 2.10]
• Host Python Version: [e.g. Python 3.7.6]
• Ansible Server Python Version: [e.g. Python 3.7.6]
• Additional Details:

[uk-bolly]

hi @ozendorf

Thanks for the great question. If i do understand this correctly, so tasks are triggering as the 'always' tag is set when you are using tags to run your tasks?
I will go through all those marked as always as they should have associated conditionals that the control can be turned off. The issue we have is the tags list will get so big due to the options and so many used in multiple control IDs. With the controls also moving numbering regularly this is quite a huge maintenance overhead to ensure they match the numbers and users also have updated all to be correct as well.
Interested to hear more on the collections as we are in the process of testing and confirming this can be done, but the number of changes taking place across all the repos and aligning of the control updates and improvements. We would need to put a change freeze in place.
Maybe we could catch up on the community discord chat?

kindest regards and thank you again for your support

uk-bolly