Rule to enforce idempotency of tasks

[nre-ableton]

ansible-lint already has no-changed-when, which until #3050 could be used to enforce that tasks such as command/shell did not execute unnecessarily. The message that no-changed-when emits even says "Commands should not change things if nothing needs doing." This is correct, but unfortunately no-changed-when is only taking care of half of the job here.

Confusion over the use of no-changed-when resulted in #3050 (see also #2629), which clarified that this rule should enforce that tasks such as command/shell (and others) always report an accurate changed state. However, ansible-lint should have another rule that also enforces idempotency for such tasks.

For example, here's a problematic task that sets the system hostname on Ubuntu systems:

- name: Set hostname
  become: true
  ansible.builtin.command: "hostnamectl set-hostname {{ system_hostname }}"
  changed_when: true

By adding changed_when: true, it satisfies no-changed-when but this task on its own is not great because it always modifies the system state. The best practice should be something like this:

- name: Get hostname
  ansible.builtin.command: "hostname"
  changed_when: false
  register: hostname

- name: Set hostname
  become: true
  ansible.builtin.command: "hostnamectl set-hostname {{ system_hostname }}"
  when: hostname.stdout != system_hostname

This is a trivial example, but there are plenty of cases where one wants to avoid running a potentially large and system-changing operations if they aren't necessary. As command/shell are the primary culprits for such cases (since nearly all built-in tasks are idempotent), I would recommend calling the rule idempotent-command or something along those lines.

[ssbarnea]

To be honest this can be achieved with:

- name: Set hostname
  become: true
  ansible.builtin.command: "hostnamectl set-hostname {{ system_hostname }}"
  when: hostname.stdout != system_hostname
  changed_when: hostname.stdout != system_hostname

I am not sure if we can make a rule for it. What would be needed, to require both when and changed_when to be present? If so, we still have the problem of conditions from upper block levels, which currently are not accessible to matchtask().

[nre-ableton]

I'm not terribly fond of repeating the when and changed_when clauses, and what I really want is for ansible-lint to be aware of when a task needs to be run by evaluating other nearby tasks. However, I can understand that this might be too difficult to effectively implement, so let's just leave it at that.