Avoid IndexError exception with jinja transform (#3747)

Author: ssbarnea

.github/workflows/tox.yml

@@ -71,7 +71,7 @@ jobs:
       WSLENV: FORCE_COLOR:PYTEST_REQPASS:TOXENV:GITHUB_STEP_SUMMARY
       # Number of expected test passes, safety measure for accidental skip of
       # tests. Update value if you add/remove tests.
-      PYTEST_REQPASS: 824
+      PYTEST_REQPASS: 825
     steps:
       - name: Activate WSL1
         if: "contains(matrix.shell, 'wsl')"

examples/playbooks/rule-jinja-before.transformed.yml

@@ -0,0 +1,9 @@
+---
+# https://github.com/ansible/ansible-lint/issues/3739
+- name: Reproducer bug 3739
+  hosts: all
+  tasks:
+    - name: Generate keypair
+      community.crypto.openssh_keypair:
+        path: "{{ env.path }}"
+      when: ( env.path is not none )

examples/playbooks/rule-jinja-before.yml

@@ -0,0 +1,9 @@
+---
+# https://github.com/ansible/ansible-lint/issues/3739
+- name: Reproducer bug 3739
+  hosts: all
+  tasks:
+    - name: Generate keypair
+      community.crypto.openssh_keypair:
+        path: "{{env.path}}"
+      when: ( env.path is not none )

src/ansiblelint/rules/jinja.py

@@ -26,6 +26,7 @@
 if TYPE_CHECKING:
     from ruamel.yaml.comments import CommentedMap, CommentedSeq
 
+    from ansiblelint.config import Options
     from ansiblelint.errors import MatchError
     from ansiblelint.utils import Task
 
@@ -450,6 +451,8 @@ def _transform_spacing(
             ignored_keys=ignored_keys,
         ):
             if key == match.transform_meta.key and value == match.transform_meta.value:
+                if not path:
+                    continue
                 for pth in path[:-1]:
                     try:
                         obj = obj[pth]
@@ -479,7 +482,13 @@ def blacken(text: str) -> str:
     import pytest
 
     from ansiblelint.rules import RulesCollection  # pylint: disable=ungrouped-imports
-    from ansiblelint.runner import Runner  # pylint: disable=ungrouped-imports
+    from ansiblelint.runner import (
+        Runner,
+        _get_matches,
+    )
+
+    # pylint: disable=ungrouped-imports
+    from ansiblelint.transformer import Transformer  # pylint: disable=ungrouped-imports
 
     @pytest.fixture(name="error_expected_lines")
     def fixture_error_expected_lines() -> list[int]:
@@ -821,6 +830,38 @@ def test_jinja_valid() -> None:
         errs = Runner(success, rules=collection).run()
         assert len(errs) == 0
 
+    def test_jinja_transform(
+        config_options: Options,
+        copy_examples_dir: tuple[Path, Path],
+        default_rules_collection: RulesCollection,
+    ) -> None:
+        """Test transform functionality for jinja rule."""
+        playbook: str = "examples/playbooks/rule-jinja-before.yml"
+        config_options.write_list = ["all"]
+
+        config_options.lintables = [playbook]
+        runner_result = _get_matches(
+            rules=default_rules_collection,
+            options=config_options,
+        )
+        transformer = Transformer(result=runner_result, options=config_options)
+        transformer.run()
+
+        matches = runner_result.matches
+        assert len(matches) == 2
+
+        orig_dir, tmp_dir = copy_examples_dir
+        orig_playbook = orig_dir / playbook
+        expected_playbook = orig_dir / playbook.replace(".yml", ".transformed.yml")
+        transformed_playbook = tmp_dir / playbook
+
+        orig_playbook_content = orig_playbook.read_text()
+        expected_playbook_content = expected_playbook.read_text()
+        transformed_playbook_content = transformed_playbook.read_text()
+
+        assert orig_playbook_content != transformed_playbook_content
+        assert transformed_playbook_content == expected_playbook_content
+
 
 def _get_error_line(task: dict[str, Any], path: list[str | int]) -> int:
     """Return error line number."""