download exec

The download exec rule checks whether a task executes downloaded file from parameterized source.

Problematic code

- name: Download sample app installation script.
  get_url:
    url: "{{ app_installation_script_url }}"  # <-- This parameter can be overwritten.
    dest: /tmp/install_script.sh

- name: Install sample app.
  command: bash /tmp/install_script.sh

Correct code

- name: Download sample app installation script.
  get_url:
    url: https://example.com/path/install_script.sh
    dest: /tmp/install_script.sh

- name: Install sample app.
  command: bash /tmp/install_script.sh