All Spotter Commands
Using Spotter is simple. You just need to know a few simple commands to make your Ansible Playbooks spotless. And don’t worry, you can look them up anytime by running s --help in Spotter CLI. Dive in!
To scan
$ spotter scan playbook.ymlCopied! | Perform a simple default scan. |
$ spotter scan path/to/playbookCopied! | Scan a playbook. |
$ spotter scan path/to/taskfile1.yamlCopied! | Scan a taskfile. |
$ spotter scan path/to/roleCopied! | Scan a role. |
$ spotter scan path/to/collectionCopied! | Scan an Ansible Collection. |
$ spotter scan path/to/folderCopied! | Scan any folder that contains Ansible content. |
$ spotter scan path/to/playbook1.yaml path/to/playbook2.yamlCopied! | Scan two playbooks. |
$ spotter scan path/to/role1 path/to/role2Copied! | Scan two roles. |
$ spotter scan path/to/playbook1.yaml path/to/playbook2.yamlCopied! | Scan multiple playbooks at once. |
$ spotter scan path/to/taskfile.yaml path/to/playbook.yaml path/to/role path/to/collectionCopied! | Scan multiple files at once. |
$ spotter scan path/to/playbook/folder/play_*.yamlCopied! | Scan multiple playbooks using glob. |
$
spotter scan playbook.yml
Copied!Perform a simple default scan.
$
spotter scan path/to/playbook
Copied!Scan a playbook.
$
spotter scan path/to/taskfile1.yaml st
Copied!Scan a taskfile.
$
spotter scan path/to/role
Copied!Scan a role.
$
spotter scan path/to/collection
Copied!Scan an Ansible Collection.
$
spotter scan path/to/folder
Copied!Scan any folder that contains Ansible content.
$
spotter scan path/to/playbook1.yaml path/to/playbook2.yaml
Copied!Scan two playbooks.
$
spotter scan path/to/role1 path/to/role2
Copied!Scan two roles.
$
spotter scan path/to/playbook1.yaml path/to/playbook2.yaml
Copied!Scan multiple playbooks at once.
$
spotter scan path/to/taskfile.yaml path/to/playbook.yaml path/to/role path/to/collection
Copied!Scan multiple files at once.
$
spotter scan path/to/playbook/folder/play_*.yaml
Copied!Scan multiple playbooks using glob.
To set scanning profile
$ spotter scan --profile full playbook.ymlCopied! | Set scanning profile to Full to get the full range of check results Spotter offers. |
$ spotter scan --profile security playbook.ymlCopied! | Set scanning profile to Security to execute only security checks. |
$
spotter scan --profile full playbook.yml
Copied!Set scanning profile to Full to get the full range of check results Spotter offers.
$
spotter scan --profile security playbook.yml
Copied!Set scanning profile to Security to execute only security checks.
To set target project
$ spotter scan --project-id <project-id>Copied! | Set project you wish to see your scan results in. |
$
spotter scan --project-id <project-id>
Copied!Set project you wish to see your scan results in.
To skip or enforce checks
$ spotter config set org-config.jsonCopied! | Set basic rules and apply checks across the whole organization by uploading config file including which checks to always enforce and which to skip. |
$ spotter config clearCopied! | Clear current configuration at organization level. |
$ spotter config getCopied! | See the current configuration settings for a specific organization. |
$ spotter scan --skip-checks E1300,E1301,H1302 playbook.ymlCopied! | Skip specific checks at scan level. |
$ spotter scan --enforce-checks W1100,E1101 playbook.ymlCopied! | Enforce specific checks at scan level. |
$ spotter scan --skip-checks H1900[fqcn=sensu.sensu_go.user],W003 playbook.ymlCopied! | Skip or enforce checks for specific Fully Qualified Class Names (FQCNs) or individual check subcodes. |
$
spotter config set org-config.json
Copied!Set basic rules and apply checks across the whole organization by uploading config file including which checks to always enforce and which to skip.
$
spotter config clear
Copied!Clear current configuration at organization level.
$
spotter config get
Copied!See the current configuration settings for a specific organization.
$
spotter scan --skip-checks E1300,E1301,H1302 playbook.yml
Copied!Skip specific checks at scan level.
$
spotter scan --enforce-checks W1100,E1101 playbook.yml
Copied!Enforce specific checks at scan level.
$
spotter scan --skip-checks H1900[fqcn=sensu.sensu_go.user],W003 playbook.yml
Copied!Skip or enforce checks for specific Fully Qualified Class Names (FQCNs) or individual check subcodes.
To automatically fix issues
$ spotter scan --rewrite playbook.ymlCopied! | Automatically fix the issues that Spotter has found. |
$
spotter scan --rewrite playbook.yml
Copied!Automatically fix the issues that Spotter has found.
To include custom policies
$ spotter policies set policy.regoCopied! | Include a single custom policy (check). |
$ spotter policies set PoliciesCopied! | Include a directory of custom policies (checks). |
$ spotter policies set --project-id <project-id> policy.regoCopied! | Set policy for the whole organization. |
$ spotter policies clearCopied! | Clear policies. |
$
spotter policies set policy.rego
Copied!Include a single custom policy (check).
$
spotter policies set Policies
Copied!Include a directory of custom policies (checks).
$
spotter policies set --project-id policy.rego
Copied!Set policy for the whole organization.
$
spotter policies clear
Copied!Clear policies.
To upgrade playbooks
$ spotter scan --profile full --ansible-version 2.15 playbook.ymlCopied! | Check if your playbook is compatible with a specific Ansible version. |
$
spotter scan --profile full --ansible-version 2.15 playbook.yml
Copied!Check if your playbook is compatible with a specific Ansible version.
To customize scanning
$ spotter scan --display-level error playbook.ymlCopied! | Show only ERRORS without hints and warnings in your scan result. |
$ spotter scan --display-level hint playbook.ymlCopied! | Show only HINTS in your scan result. |
$ spotter scan --display-level warning playbook.ymlCopied! | Show only WARRNINGS in your scan result. |
$ spotter scan --format json playbook.yamlCopied! | Change the format of scan results. |
$ spotter scan --no-docs-url playbook.ymlCopied! | Omit links to documentation in scan results. |
$ spotter --no-color scan playbook.ymlCopied! | Disable colorized output. |
$ spotter --storage-path /my/project/.storage scan playbook.ymlCopied! | Set storage folder. |
$ spotter --endpoint “<spotter-api-url>” scan playbook.ymlCopied! | Specify the API endpoint. |
$ spotter scan --sarif report.sarif playbook.yml Copied! | This command facilitates integration with platforms supporting the SARIF format. |
$
spotter scan --display-level error playbook.yml
Copied!Show only ERRORS without hints and warnings in your scan result.
$
spotter scan --display-level hint playbook.yml
Copied!Show only HINTS in your scan result.
$
spotter scan --display-level warning playbook.yml
Copied!Show only WARRNINGS in your scan result.
$
spotter scan --format json playbook.yaml
Copied!Change the format of scan results.
$
spotter scan --no-docs-url playbook.yml
Copied!Omit links to documentation in scan results.
$
spotter --no-color scan playbook.yml
Copied!Disable colorized output.
$
spotter --storage-path /my/project/.storage scan playbook.yml
Copied!Set storage folder.
$
spotter --endpoint "<spotter-api-url>" scan playbook.yml
Copied!Specify the API endpoint.
To control data being shared
$ spotter scan --exclude-values playbook.ymlCopied! | Exclude values (task names, parameter values, and filenames) from your scan. |
$ spotter scan --exclude-metadata playbook.ymlCopied! | Exclude metadata (file names, line numbers, and column numbers) from your scan. |
$ spotter scan --export-payload payload.json playbook.ymlCopied! | See which data is collected from your Ansible content without actually running a scan. |
$ spotter scan --import-payload payload.jsonCopied! | Import the list of data being shared with Spotter. |
$
spotter scan --exclude-values playbook.yml
Copied!Exclude values (task names, parameter values, and filenames) from your scan.
$
spotter scan --exclude-metadata playbook.yml
Copied!Exclude metadata (file names, line numbers, and column numbers) from your scan.
$
spotter scan --export-payload payload.json playbook.yml
Copied!See which data is collected from your Ansible content without actually running a scan.
$
spotter scan --import-payload payload.json
Copied!Import the list of data being shared with Spotter.
Still need help? Contact [email protected]
