Fix intermittent host key verification failures in ansible tasks

[berendt]

With high fork counts (e.g. 50), multiple SSH processes within a single ansible-playbook run read/write the shared known_hosts file simultaneously, causing race conditions that lead to "Host key verification failed" errors.

AI-assisted: Claude Code

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Disabling SSH host key checking globally via ANSIBLE_HOST_KEY_CHECKING = "False" is a significant security change; consider making this behavior opt-in (e.g., via a function parameter or config flag) rather than always-on.
• If the goal is to avoid known_hosts race conditions, it may be safer to direct Ansible to use a per-run or per-task dedicated known_hosts file instead of disabling host key verification entirely.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Disabling SSH host key checking globally via `ANSIBLE_HOST_KEY_CHECKING = "False"` is a significant security change; consider making this behavior opt-in (e.g., via a function parameter or config flag) rather than always-on.
- If the goal is to avoid known_hosts race conditions, it may be safer to direct Ansible to use a per-run or per-task dedicated `known_hosts` file instead of disabling host key verification entirely.

## Individual Comments

### Comment 1
<location path="osism/tasks/__init__.py" line_range="180-184" />
<code_context>
     # This ensures Ansible's Python process flushes stdout immediately
     env["PYTHONUNBUFFERED"] = "1"

+    # Disable SSH host key checking to prevent intermittent "Host key verification
+    # failed" errors. With high fork counts (e.g. 50), multiple SSH processes within
+    # a single ansible-playbook run read/write the shared known_hosts file
+    # simultaneously, causing race conditions and file corruption.
+    env["ANSIBLE_HOST_KEY_CHECKING"] = "False"
+
     # Use a unique SSH ControlPath directory per task to prevent race conditions
</code_context>
<issue_to_address>
**🚨 issue (security):** Disabling SSH host key checking globally has significant security implications.

Unconditionally setting `ANSIBLE_HOST_KEY_CHECKING` to `False` disables host key pinning for all Ansible SSH connections from this helper, enabling possible MITM and misbinding to the wrong host, particularly in shared environments. Please make this opt‑in (e.g., via a parameter or config flag) with a secure default, or strictly scope the override to known-safe environments where the risk is explicitly accepted.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 issue (security): Disabling SSH host key checking globally has significant security implications.

Unconditionally setting ANSIBLE_HOST_KEY_CHECKING to False disables host key pinning for all Ansible SSH connections from this helper, enabling possible MITM and misbinding to the wrong host, particularly in shared environments. Please make this opt‑in (e.g., via a parameter or config flag) with a secure default, or strictly scope the override to known-safe environments where the risk is explicitly accepted.