Ansible check mode is a dry run that predicts what a Playbook would change without making changes. Run it with ansible-playbook site.yml --check, and add --diff to see line-by-line differences in files and templates. Tasks report “changed” or “ok” as if they had run.
Check mode has limits. It still connects to every managed host, so it needs inventory, credentials and network access. Modules that don’t support check mode are skipped, and tasks that depend on earlier changes can give misleading results.
Validating a Playbook without running it takes three layers: ansible-playbook --syntax-check for YAML and structure, static checks that read the code without touching hosts, and check mode against a test environment. Steampunk Spotter adds the static governance layer. It verifies Playbooks against policies and target versions without connecting to any host, so it runs at commit and in CI/CD.
