Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

scripts/check.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Run every check this repo has. CI and pre-commit call the same script.
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+# Ansible and uv both want a writable cache. Keep them in the checkout so the
+# script works when $HOME is read-only, which is the case in the agent sandbox.
+export ANSIBLE_CONFIG="${ANSIBLE_CONFIG:-$PWD/ansible.cfg}"
+export ANSIBLE_HOME="${ANSIBLE_HOME:-$PWD/.ansible/home}"
+export ANSIBLE_LOCAL_TEMP="${ANSIBLE_LOCAL_TEMP:-$PWD/.ansible/tmp}"
+export UV_CACHE_DIR="${UV_CACHE_DIR:-$PWD/.ansible/uv-cache}"
+export UV_TOOL_DIR="${UV_TOOL_DIR:-$PWD/.ansible/uv-tools}"
+export ANSIBLE_GALAXY_CACHE_DIR="${ANSIBLE_GALAXY_CACHE_DIR:-$PWD/.ansible/galaxy_cache}"
+mkdir -p "$ANSIBLE_LOCAL_TEMP" "$UV_CACHE_DIR" "$UV_TOOL_DIR" "$ANSIBLE_GALAXY_CACHE_DIR" "$ANSIBLE_HOME"
+
+if [ -f requirements.yml ]; then
+  echo "== ansible-galaxy collection install =="
+  ansible-galaxy collection install -r requirements.yml
+fi
+
+run() {
+  local tool="$1"
+  shift
+  if command -v "$tool" >/dev/null 2>&1; then
+    "$tool" "$@"
+  else
+    uvx "$tool" "$@"
+  fi
+}
+
+echo "== yamllint =="
+run yamllint .
+
+echo "== ansible-lint =="
+run ansible-lint
+
+echo "== ansible-playbook --syntax-check =="
+shopt -s nullglob
+for playbook in */playbook.yml; do
+  echo "-- $playbook"
+  ansible-playbook --syntax-check "$playbook"
+done