如何用Ansible安装Brewfile内软件包？执行brew bundle遇root权限报错

问题详情 #

执行ansible-playbook --ask-become-pass bootstrap.yml时出现以下错误：

fatal: [localhost]: FAILED! => {"changed": true, "cmd": "brew bundle", "delta": "0:00:00.163639", "end": "2024-04-02 21:03:51.639762", "msg": "non-zero return code", "rc": 1, "start": "2024-04-02 21:03:51.476123", "stderr": "Error: Running Homebrew as root is extremely dangerous and no longer supported.\nAs Homebrew does not drop privileges on installation you would be giving all\nbuild scripts full access to your system.", "stderr_lines": ["Error: Running Homebrew as root is extremely dangerous and no longer supported.", "As Homebrew does not drop privileges on installation you would be giving all", "build scripts full access to your system."], "stdout": "", "stdout_lines": []}

当前使用的配置文件：

# bootstrap.yaml
- name: Bootstrap development environment
  hosts: localhost
  tasks:

- name: Install packages from Brewfile
    become: yes
    ansible.builtin.shell: brew bundle
    when: ansible_distribution == "MacOSX"

# Brewfile
brew "autoconf"
brew "docker", link: false

错误原因 #

错误核心是任务中添加了become: yes，导致brew bundle以root身份执行。Homebrew的设计原则明确禁止root用户运行——因为安装过程不会自动降权，会给所有构建脚本系统级的完全访问权限，带来极高的安全风险，因此直接抛出了禁用提示。

另外，你的YAML配置存在缩进错误：Install packages from Brewfile任务的参数（become: yes等）需要和name字段对齐，否则会触发Ansible语法解析错误。

解决方法 #

方法一：修正shell任务（直接支持brew bundle） #

1. 移除become: yes：Homebrew本身安装在当前用户目录下，执行brew bundle不需要root权限
2. 修正YAML缩进错误
3. 可选添加chdir参数，确保在Brewfile所在目录执行命令

修正后的bootstrap.yaml：

# bootstrap.yaml
- name: Bootstrap development environment
  hosts: localhost
  tasks:
    - name: Install packages from Brewfile
      ansible.builtin.shell: brew bundle
      args:
        chdir: "{{ playbook_dir }}"
      when: ansible_distribution == "MacOSX"

方法二：使用community.general.brew模块批量安装 #

如果你希望用Ansible原生模块管理（而非shell命令），可以利用已安装的community.general集合，通过解析Brewfile提取包名后批量安装，还能单独处理包的额外参数：

# bootstrap.yaml
- name: Bootstrap development environment
  hosts: localhost
  tasks:
    - name: Read Brewfile content
      ansible.builtin.slurp:
        src: "{{ playbook_dir }}/Brewfile"
      register: brewfile_content
      when: ansible_distribution == "MacOSX"

    - name: Extract brew packages from Brewfile
      ansible.builtin.set_fact:
        brew_packages: "{{ brewfile_content.content | b64decode | regex_findall('brew \"([^\"]+)\"') }}"
      when: ansible_distribution == "MacOSX"

    - name: Install brew packages
      community.general.brew:
        name: "{{ item }}"
        state: present
        link: "{{ 'no' if item == 'docker' else 'yes' }}"
      loop: "{{ brew_packages }}"
      when: ansible_distribution == "MacOSX"

内容的提问来源于stack exchange，提问作者ℂybernetician